CVE-2016-8475

CVE-2016-8475 describes an information-disclosure vulnerability in the HTC input driver on Android platforms running kernel 3.18. A local malicious application could access data outside its normal permission set after compromising a privileged process. The issue is documented as affecting Android...

CVE-2016-8481

CVE-2016-8481 describes an elevation of privilege vulnerability in the Qualcomm sound driver on Android. A local malicious application could potentially execute arbitrary code in the kernel context if it first compromises a privileged process. The issue affects Android devices with affected kerne...

CVE-2017-0306

CVE-2017-0306 affects the NVIDIA Tegra GPU driver (NVHOST) within the Android kernel (Kernel-3.10). A vulnerability in the NVHOST driver copies an input buffer to an output buffer without validating size, which can lead to denial of service and may enable local privilege escalation by a malicious...

CVE-2017-0338

CVE-2017-0338 describes an elevation-of-privilege vulnerability in the NVIDIA GPU driver affecting Android devices with Kernel-3.18. A local malicious application could run code in the kernel context, leading to a potentially permanent device compromise that may require reflashing the OS. Exploit...

CVE-2017-0435

CVE-2017-0435 is an elevation-of-privilege in the Qualcomm sound driver affecting Android kernels (Kernel-3.10 and Kernel-3.18). The vulnerability could let a local malicious app execute arbitrary code in the kernel context after compromising a privileged process. The CVE is documented with Qualc...

CVE-2017-0447

CVE-2017-0447 describes an elevation-of-privilege flaw in the HTC touchscreen driver that could allow a local malicious application to execute arbitrary code in the kernel context on Android devices. The vulnerability is tied to the Android kernel (Kernel-3.18) and affects Android devices leverag...

CVE-2017-0519

CVE-2017-0519 describes an elevation-of-privilege vulnerability in the Qualcomm fingerprint sensor driver for Android (kernel 3.18). A local attacker could exploit this to execute arbitrary code in the kernel context by compromising a privileged process. The entry remains focused on Android and k...

CVE-2017-0564

CVE-2017-0564 relates to an Elevation of Privilege in the Android kernel ION subsystem. The issue could allow a local malicious app to execute code with kernel privileges (local EoP). Affected are Android kernels 3.10 and 3.18. Public documents identify the kernel ION subsystem as the vulnerable ...

CVE-2017-0581

CVE-2017-0581 is an elevation-of-privilege flaw in the Synaptics Touchscreen driver for Android. The issue could let a local malicious app execute arbitrary code in the kernel context after compromising a privileged process. The vulnerability affects the Android stack (kernel-3.18) and is describ...

CVE-2017-0610

CVE-2017-0610 is a local privilege-escalation in the Qualcomm sound driver on Android, enabling a malicious local app to run arbitrary code in the kernel context. Affected software:Android kernel versions 3.10 and 3.18 with the Qualcomm sound subsystem. Root cause centers on elevation of privileg...

CVE-2017-8065

CVE-2017-8065 affects the Linux kernel (4.9.x and 4.10.x up to 4.10.12). The issue arises from how crypto/ccm.c interacts with CONFIG_VMAP_STACK, enabling a local attacker to cause a denial of service (system crash or memory corruption) by leveraging use of more than one virtual page for a DMA sc...

CVE-2022-49805

CVE-2022-49805 – Linux kernel (lan966x): The issue occurs in lan966x_stats_init(), which calls create_singlethread_workqueue() without validating the return value. If it returns NULL, a later queue_delayed_work path dereferences a null workqueue pointer, causing a null-pointer dereference. The re...

CVE-2022-49849

CVE-2022-49849 fixes a Linux kernel flaw in the Btrfs dev_args_match_device path. When devid is set to (u64)-1 via ioctl, the match of devid may be skipped and device matching may succeed incorrectly. The issue was introduced by a patch that added the function used to match devices; the two match...

CVE-2022-50367

CVE-2022-50367 affects the Linux kernel’s nilfs filesystem code. The vulnerability arises when in alloc_inode, inode_init_always() may return -ENOMEM if security_inode_alloc() fails, leaving inode->i_private uninitialized. nilfs_is_metadata_file_inode() can then return true and nilfs_free_inod...

CVE-2023-20662

The CVE-2023-20662 entry describes a vulnerability in the wlan component where an integer overflow causes an out-of-bounds write. This could enable local escalation of privilege with SYSTEM-level execution privileges and requires no user interaction. A patch is identified as ALPS07560765 (Issue A...

CVE-2023-20675

CVE-2023-20675 concerns MediaTek platforms where the kernel/wlan component is vulnerable to an out-of-bounds read caused by a missing bounds check. The issue can lead to local information disclosure, with potentially full System privileges if exploited, and does not require user interaction. Conn...

CVE-2023-53354

The CVE-2023-53354 issue affects the Linux kernel, specifically skb_segment() in net/core/skbuff.c. A bug caused by calling skb_orphan_frags() before zero-copy handling can update nrfrags and leave frag pointing to stale values, leading to a NULL pointer dereference and kernel panic in the GSO pa...

CVE-2025-38055

CVE-2025-38055 affects the Linux kernel (perf/x86/intel) where PEBS-via-PT with a sample_freq could trigger a NULL pointer dereference due to intel_pmu_pebs_event_update_no_drain() misinterpreting pebs_enabled bits as counter indexes. The issue arises when bits 60/61 are set for PEBS-via-PT, and ...

CVE-2025-38452

CVE-2025-38452 affects the Linux kernel’s net/ethernet RTSN driver. The vulnerability was in a null pointer dereference in rtsn_probe(), addressed by adding a check for the return value of rcar_gen4_ptp_alloc(). This mitigates potential null pointer dereference and reduces the risk of a local imp...

CVE-2025-38542

CVE-2025-38542 affects the Linux kernel net:appletalk code. The vulnerability is a device refcount leak in atrtr_create(): during route entry updates, the old device reference was not released before assigning the new one, leading to a leak. The fix releases the old reference with dev_put() befor...

CVE-2025-39701

Technical details for CVE-2025-39701 are not provided in the supplied documents. Monitor official kernel advisories for affected versions, impact, and remediation, as available information in connected sources is not detailed for this CVE.

CVE-2025-39767

CVE-2025-39767 describes a Linux kernel issue on LoongArch where enabling CONFIG_KASAN, CONFIG_PREEMPT_VOLUNTARY_BUILD, and CONFIG_PREEMPT_VOLUNTARY together can trigger a soft deadlock due to slow module load times. The root cause involves module_frob_arch_sections() evaluating PLT/GOT counts; a...

CVE-2025-39800

CVE-2025-39800 affects the Linux kernel’s btrfs subsystem, specifically the btrfs_copy_root() path. The issue occurs when cloning an extent buffer with an unexpected eb generation: instead of aborting the transaction, the code would WARN_ON() and allow metadata to persist with the unexpected gene...

CVE-2025-39808

CVE-2025-39808 – Linux kernel HID-ntrig null-deref fix . Affects HID-ntrig in the Linux kernel. In ntrig_report_version(), a hdev structure copied from hid_probe() could lead to a page fault when a descriptor was sent to /dev/uhid if hdev->dev.parent->parent was NULL. The fix adds a null-ch...

CVE-2025-39815

The CVE-2025-39815 entry corresponds to a Linux kernel vulnerability in the RISC-V KVM area, where a stack overrun could occur while loading vlenb. The issue arises because user-space can place up to 2048 bits into an xlen-sized stack buffer, exceeding the intended xlen capacity. The advisory not...

CVE-2025-39864

CVE-2025-39864 affects the Linux kernel wifi subsystem (cfg80211) and specifically the cmp_bss() path after a use-after-free in bss_free(). The fix, applied via commits addressing the hidden_beacon_bss handling, ensures the last beacon frame elements are freed only when not shared by the hidden_b...

CVE-2025-68214

Summary (CVE-2025-68214): The Linux kernel timer subsystem had a race between timer_shutdown_sync() and timer_expire() that could trigger a WARN_ON_ONCE when a timer’s function pointer was cleared to NULL while the timer was still running. The root cause: timer_shutdown_sync() could detach the ti...

CVE-2025-71094

CVE-2025-71094: In the Linux kernel, the ASIX USB Ethernet driver (net: usb: asix) could read an invalid PHY address from a USB device (address >= PHY_MAX_ADDR), triggering a warning in mdiobus_get_phy. The fix validates the PHY address in asix_read_phy_addr() and removes the now-redundant che...

CVE-2025-71306

CVE-2025-71306 is a Linux kernel vulnerability affecting the Integrity Measurement Architecture (IMA). The issue is a stack-out-of-bounds access in the function ima_appraise_measurement when processing bprm_creds for exec, traced to an incorrect offset calculation caused by using container_of on ...

CVE-2026-22987

CVE-2026-22987 concerns the Linux kernel net/sched subsystem. The issue arises when tcf_idrinfo_destroy() can pass an ERR_PTR(-EBUSY) as a tc_action pointer during netns teardown, leading to a dereference of an error pointer in tc_act_in_hw(). The fix adds a guard to skip ERR_PTR entries while it...

CVE-2026-23010

CVE-2026-23010 is a Linux kernel use-after-free affecting inet6_addr_del() in IPv6 address deletion. The issue arises from the commit that moved ipv6_del_addr() for temporary addresses before reading the ifp->flags, causing a UAF in inet6_addr_del() when handling inet6_ifaddr during address de...

CVE-2026-23146

Technical details for CVE-2026-23146 are not provided in the supplied connected documents; the materials only reference the vulnerability as part of Ubuntu/Mageia/Oracle advisories. Monitor for updates.

CVE-2026-23264

The CVE-2026-23264 issue was resolved in the Linux kernel by reverting the change that checked ASPM status from the PCIe subsystem for AMD GPUs. This reversal addressed crashes that occurred when two AMD GPUs were present but only one supported ASPM. The fix is tied to a specific revert of a prev...

CVE-2026-31677

The CVE-2026-31677 issue affects the Linux kernel af_alg path. The root cause is that af_alg_get_rsgl() could extract RX scatterlist data beyond the remaining receive budget, allowing a local attacker to trigger a DoS via recvmsg when there isn’t enough RX space for a chunk. The fix tightens budg...

CVE-2026-31719

CVE-2026-31719 concerns the Linux kernel crypto/krb5enc async decrypt path where the skcipher completion could bypass the hash verification, bypassing integrity checks. The root cause is krb5enc_dispatch_decrypt() signaling completion without invoking krb5enc_dispatch_decrypt_hash(). The fix adds...

CVE-2026-43027

The CVE-2026-43027 vulnerability in the Linux kernel arises from nf_conntrack_helper_unregister() freeing a helper while expectations still reference it due to NULL data in nf_ct_expect_iterate_destroy(), leading to use-after-free when later access occurs. The fix is to pass the actual helper poi...

CVE-2026-43109

The CVE-2026-43109 issue concerns Linux kernel x86 shadow stacks where shstk_pop_sigframe() did not check errors from mmap_read_lock_killable(), and related __must_check annotations were missing. The connected OSV entries confirm patches in rootio-linux for Ubuntu/Debian releases (e.g., Ubuntu 22...

CVE-2026-43190

The CVE-2026-43190 issue affects the Linux kernel netfilter xt_tcpmss TCP option parser. The root cause is reading op[i+1] without validating the remaining option length, which can cause an out-of-bounds read when i+1 == optlen. This could access memory past the option boundary (stack buffer _opt...

CVE-2026-43205

CVE-2026-43205 affects the Linux kernel's dpaa2-switch handling. The defect arises from the driver obtaining sw_attr.num_ifs from firmware without validating it against DPSW_MAX_IF (64). This allows an out-of-bounds write in dpaa2_switch_fdb_get_flood_cfg() when num_ifs can reach 64, as it writes...

CVE-2026-43416

CVE-2026-43416 affects the Linux kernel: a NULL pointer dereference in perf stack tracing when current->mm is released, risking kernel panic during profiling with BPF. The root cause is a missing alive check before retrieving the user callchain for perf_callchain_user (and similar to a prior x...

CVE-2026-45959

The CVE-2026-45959 issue affects the Linux kernel crypto: CCP driver. A local pointer annotated with __cleanup(kfree) could cause kfree to receive the local stack address instead of the allocated memory, leading to a crash. The underlying cause is incorrect cleanup usage; the repository indicates...

CVE-2026-46196

CVE-2026-46196 describes a Linux kernel tracepoint regression: during a 0→1 transition, tracepoint_add_func() calls ext->regfunc() before installing a probe, and if func_add() fails (e.g., -ENOMEM), it previously did not call ext->unregfunc(), leaving behind side effects. The fix mirrors th...

CVE-2026-46207

The CVE-2026-46207 issue affects the Linux kernel’s vsock/virtio path, where non-linear skbs could fail to copy payloads to the vsockmon tap device due to iov_iter not being properly initialized. The fix standardizes handling for both linear and non-linear skbs by removing the linear/non-linear s...

CVE-2026-46295

CVE-2026-46295 involves the Linux kernel KVM/x86 interrupt handling fix. The patch ensures IRR is scanned via __kvm_apic_update_irr even when PIR is empty, falling back to apic_find_highest_vector() when PID.ON is set but PIR is empty, so the highest pending interrupt is reported from the existin...

CVE-2026-46311

CVE-2026-46311 (Linux kernel) involves the drm/amdgpu/userq path where access to a stale wptr mapping could occur during queue creation. The root cause is improper locking when accessing the mapping data, risking unmapping of wptr_obj while a queue is in progress and another BO is at the same add...

CVE-2026-52989

CVE-2026-52989 affects the Linux kernel nvmet-tcp component. The root cause is that nvmet_tcp_build_pdu_iovec() detects out-of-bounds PDU length/offset but does not propagate the error to callers; it returns void and triggers nvmet_tcp_fatal_error(cmd->queue) without alerting the caller, leavi...

CVE-2026-53106

CVE-2026-53106 is described as a Linux kernel issue related to bpf storage deletion in NMIs. Connected OSV entries show that Root has patched CVE-2026-53106 in the rootio-linux package for Root:Debian:12 and Root:Debian:13, with multiple fixed versions available, and UBUNTU-2204 patches also noti...

CVE-2026-53332

CVE-2026-53332 affects the Linux kernel’s Qualcomm NGD (qcom-ngd-ctrl) component. The issue is a race where callbacks can run before the NGD device is fully initialized, leading to operations on uninitialized data and boot issues on affected boards. The vulnerability stems from registering callba...

CVE-2026-53345

CVE-2026-53345 affects the Linux kernel KVM implementation. The issue arises when marking a guest page dirty: a warning is emitted about not having a running vCPU unless the VM’s refcount is non-zero, which could leak memory for SEV-ES guests. Connected advisories show Debian/Ubuntu/RootOS patche...

CVE-2026-64045

CVE-2026-64045 (Linux kernel, ovpn tcp close race) : The vulnerability stems from ovpn_tcp_close() loading the ovpn_socket pointer under RCU read-lock, then using sock->peer after releasing the lock, while ovpn_socket_release() may detach the socket concurrently. The fix tightens the pattern b...