CVE-2025-39825

CVE-2025-39825 affects the Linux kernel SMB client. The vulnerability is a race with concurrent opens during rename(2): in addition to sending the rename to the server, the operation also closes deferred closes, waits for outstanding I/O, and marks existing open handles as deleted, which enlarges...

CVE-2026-46311

CVE-2026-46311 (Linux kernel) involves the drm/amdgpu/userq path where access to a stale wptr mapping could occur during queue creation. The root cause is improper locking when accessing the mapping data, risking unmapping of wptr_obj while a queue is in progress and another BO is at the same add...

CVE-2026-52933

CVE-2026-52933 affects the Linux kernel’s io_uring/poll component. The root cause is a signed comparison in io_poll_get_ownership() where atomic_read(&req->poll_refs) is compared to IO_POLL_REF_BIAS; when IO_POLL_CANCEL_FLAG (BIT(31)) is set, the value becomes negative, causing the slowpath to...

CVE-2026-52958

CVE-2026-52958 affects the Linux kernel libceph subsystem. The vulnerability arises in osdmap_decode() when decoding osd_state and osd_weight for each osd; the ceph_decode_need() check did not account for map->max_osd*sizeof(*map->osd_weight), enabling a potential out-of-bounds memory acces...

CVE-2026-53043

CVE-2026-53043 affects the OCFS2 DLM in the Linux kernel. A crafted DLM_QUERY_REGION message can set qr_numregions beyond the buffer size (qr_regions) and trigger out-of-bounds reads due to insufficient validation in dlm_match_regions(). The issue is fixed by a patch series that adds a bounds che...

CVE-2026-53205

The CVE-2026-53205 issue is in the Linux kernel Intel Versatile Processing Unit (IVPU) accelerator driver (accel/ivpu). It stems from insufficient validation of read/write indices in the firmware log buffer, allowing potential out-of-bounds access if firmware supplies invalid indices. Affected sy...

CVE-2026-53274

CVE-2026-53274 affects the Linux kernel net/smc code. A logic flaw in __smc_setsockopt() allowed a local unprivileged user to cause a Denial of Service by keeping the socket lock held during a copy_from_sockptr() operation. The vulnerability occurs because the copy is performed while holding lock...

CVE-2026-53281

The CVE-2026-53281 entries describe a Linux kernel IOMMU VT-d issue where NULL pointer dereference or refcount corruption could occur during teardown if dev_pasid was not found in the dev_pasids list or if domain was never attached. The root cause was improper teardown execution after potential N...

CVE-2014-9903

CVE-2014-9903 (Linux kernel) : Affects Linux kernel 3.14-rc1 to 3.14-rc3 (and earlier rc builds) where sched_read_attr in kernel/sched/core.c uses an incorrect size. This enables a local attacker to obtain sensitive information from kernel stack memory via a crafted sched_getattr system call. The...

CVE-2016-8408

CVE-2016-8408 describes a local information-disclosure vulnerability in the NVIDIA video driver on Android (Kernel-3.10). The issue could allow a local malicious application to access data outside its permission levels, and is rated Moderate because exploitation requires compromising a privileged...

CVE-2022-49967

CVE-2022-49967 is a Linux kernel data-race vulnerability in the bpf_jit_limit variable. The issue arises when bpf_jit_limit is read while it can be concurrently updated via sysctl, risking load-tearing due to the long size of the value. The fix adds a paired READ_ONCE() alongside WRITE_ONCE() in ...

CVE-2022-50071

The CVE-2022-50071 issue affects the Linux kernel’s MPTCP implementation. The vulnerability arises when socket creation fails due to a CGROUP_INET_SOCK_CREATE eBPF program, causing leakage of subflows because cleanup was not invoked in that code path. The fix moves subflow cleanup into the mptcp_...

CVE-2023-53152

CVE-2023-53152 concerns the Linux kernel AMDGPU driver. The issue arises during removal of the amdgpu driver where BOs allocated for PSP are not freed, triggering a calltrace warning in amddrm_buddy_fini and related shutdown paths (amdgpu_exit, amdgpu_driver_release_kms). The provided trace shows...

CVE-2023-53185

CVE-2023-53185 exists in the Linux kernel: wifi/ath9k allows overwriting ENDPOINT0 attributes, enabling a bad USB device to craft a service-connection response where the target is ENDPOINT0 (reserved for HTC_CTRL_RSVD_SVC). The vulnerability is fixed in the kernel by rejecting such responses; imp...

CVE-2023-53186

CVE-2023-53186 refers to a Linux kernel race in skbuff coalescing with page_pool fragments. The provided sources describe a race where cloning and in-flight coalescing can lead to inaccurate SKB frag reference counting, potentially causing use-after-free or double-free of page data when SKBs are ...

CVE-2023-53188

CVE-2023-53188: In the Linux kernel, net: openvswitch: fix race on port output. The vulnerability arises when an Open vSwitch vport is racing with netns/namespace deletion, potentially triggering an infinite loop in skb_tx_hash in dev_queue_xmit if dev->real_num_tx_queues becomes 0 during unre...

CVE-2025-38076

CVE-2025-38076 concerns the Linux kernel vulnerability related to module unloading and allocation tags. The issue arises from a use-after-free risk when memory containing a module’s allocation tags remains alive after unloading, because percpu counters referenced by those tags could be freed by f...

CVE-2025-38276

In CVE-2025-38276, the issue comes from fs/dax after the commit 6be3e21d25ca, which introduced wait_entry_unlocked_exclusive() that waits for an entry to unlock without advancing the XArray iterator state. Dropping the XArray lock requires xas_pause(), which advances the iterator state to the nex...

CVE-2025-38379

The CVE-2025-38379 entry corresponds to a Linux kernel SMB/CIFS issue where, during smb2_reconnect_server() channel reestablishment, a dummy tcon with an uninitialized ->query_interface is passed to smb2_reconnect(), making queue_delayed_work() unsafe to call on that tcon. The result is a warn...

CVE-2025-38545

CVE-2025-38545 : In the Linux kernel, the am65 CPSW network driver (ti am65-cpsw-nuss) had an issue where skb_shared_info memory was not allocated during transition from netdev_alloc_ip_align() to build_skb(). The fix allocates PAGE_SIZE as the skb length (accounting for packet length, headroom, ...

CVE-2025-38589

The Connected documents confirm CVE-2025-38589 relates to a null-ptr-deref in neigh_flush_dev() within the Linux kernel, fixed by reverting to hash-table iteration in neigh_table_clear() after introducing per-netdev neighbour lists. The issue was triggered by neigh_table_clear() calling neigh_ifd...

CVE-2025-38605

CVE-2025-38605 affects the Linux kernel’s wifi/ath12k driver. In ath12k_dp_tx_get_encap_type(), arvif may be NULL during vdev delete, risking a kernel panic. The fix passes the valid ab pointer directly from the caller to avoid dereferencing arvif. Affected reference points to ath12k_dp_tx and re...

CVE-2025-38619

Technical details for CVE-2025-38619 are not publicly available in the provided documents. Monitor for updates or additional sources.

CVE-2025-38645

CVE-2025-38645 affects the Linux kernel (net/mlx5). Root cause: a NULL device memory pointer (dev->dm) can be dereferenced in mlx5_init_once() if allocation fails. Fix: add a NULL check before accessing device memory to prevent a crash. Impact in docs: LOCAL attacker could crash the system; re...

CVE-2025-38708

CVE-2025-38708 is a Linux kernel/DRBD issue where, with two-primaries enabled, concurrent writes could trigger a use-after-free due to a missing kref_get in handle_write_conflicts. The root cause is not in regular operation but in the code path for detecting concurrent writes on the DRBD layer, l...

CVE-2025-38709

CVE-2025-38709 affects the Linux kernel loop device where changing the loop block size while a filesystem is mounted can cause a block-size mismatch between the loop device and the superblock, triggering warnings such as in __getblk_slow(). The issue is remedied by obtaining an exclusive hold on ...

CVE-2025-38717

The CVE-2025-38717 entry describes a race condition in the Linux kernel’s net: kcm subsystem, specifically between kcm_unattach(psock) and kcm_release(kcm). The bug occurred because kcm_unattach() did not check the kcm->tx_stopped flag before queue_work(), which could allow kcm->tx_work to ...

CVE-2025-39684

CVE-2025-39684 affects the Linux kernel Comedi subsystem. The vulnerability arises in do_insn_ioctl() and do_insnlist_ioctl() where a buffer of insn->n samples (unsigned int per sample) could copy back more data to userspace than was initialized, leaking kernel memory. Root cause: not all inst...

CVE-2025-39685

Summary (CVE-2025-39685) : In the Linux kernel, the comedi pcl726 driver could trigger an out-of-bounds when an excessively large IRQ number was passed (example 0x80008000). The fix adds an interrupt number check to prevent passing an IRQ number that is too large. It notes that if it->options[...

CVE-2025-39706

Summary: CVE-2025-39706 affects the Linux kernel's DRM/AMDKFD path. The issue arises when destroying KFD debugfs before kfd_process_destroy_wq, causing a NULL pointer hang due to an attempted remove of /sys/kernel/debug/kfd/proc/ after /sys/kernel/debug/kfd was destroyed. Root cause: proc content...

CVE-2025-39719

CVE-2025-39719 reports a Linux kernel vulnerability in iio: imu: bno055 where an out-of-bounds access could occur due to iterating the hw_xlate array with the length of vals instead of hw_xlate. The fix adds a hw_xlate_len field to the bno055_sysfs_attr to ensure correct bounds during bno055_get_...

CVE-2025-39739

The CVE-2025-39739 issue is a Linux kernel iommu/arm-smmu-qcom vulnerability that was resolved by adding SM6115 MDSS compatibility to the MDSS clients list to apply the needed workaround. The described impact includes unhandled SMMU context faults during boot on QRB4210 RB2 (SM4250/SM6115) and re...

CVE-2025-39746

CVE-2025-39746 affects the Linux kernel device driver stack for wifi/ath10k on PCIe. When the hardware becomes unreliable, ath10k can lose PCIe connectivity, causing WMI command timeouts and a restart loop that may trigger a watchdog timeout and a system crash on suspend. The advisory describes a...

CVE-2025-39776

CVE-2025-39776 is reported by CBLMARINER as affecting the Linux kernel package in Mariner, specifically versions less than 6.6.104.2-1. The advisory states that an upgraded kernel version 6.6.104.2-1 or newer resolves this issue. The provided connected document does not include additional technic...

CVE-2025-39788

CVE-2025-39788 affects the Linux kernel SCSI/ufs Exynos driver (gs101). The issue is in the USB/UFS host path where the left shift to set UTRL_NEXUS_TYPE is performed on an int, causing an out-of-bounds shift and writing an incorrect value (0xffffffff on gs101). The fix switches to the BIT() macr...

CVE-2025-39850

CVE-2025-39850 affects the Linux kernel vxlan implementation. When the VXLAN device runs with the proxy option enabled, ARP/IPv6 Neighbor Solicitation can be spuriously suppressed if the remote host’s MAC is not behind the any remote. The root cause is dereferencing an FDB nexthop entry that may ...

CVE-2025-39853

CVE-2025-39853 affects the Linux kernel i40e driver. The issue arises when the MAC list is empty, as list_first_entry() can return a pointer to an invalid object, risking invalid memory access upon use. The advisory notes the fix is to replace list_first_entry() with list_first_entry_or_null(), p...

CVE-2025-39881

CVE-2025-39881 involves a use-after-free in the Linux kernel PSI/PCI monitoring path within kernfs polling. The issue occurs when an open PSI-related file is released while an epoll poll still holds references, leading to use-after-free during re-enabling the monitoring. The fix introduces kernfs...

CVE-2025-39950

CVE-2025-39950 pertains to the Linux kernel: a NULL pointer dereference can occur in net/tcp when TCP-AO is used with TCP_REPAIR during connect(), due to dereferencing skb without null-check in tcp_ao_finish_connect(). The vulnerability affects code paths where a TCP-AO key is present and TCP_REP...

CVE-2025-68351

The CVE-2025-68351 issue is in the Linux kernel exfat code, specifically a refcount leak in exfat_find. The root cause is that exfat_get_dentry_set increments es->bh on success but the corresponding exfat_put_dentry_set may not be consistently invoked, leading to leaks. The patch relocates two...

CVE-2025-68365

CVE-2025-68365 : Linux kernel (fs/ntfs3) fixed by zero-initializing allocated memory. Memory allocated via __getname() (kmem_cache_alloc()) was used before being cleared, triggering KMSAN reports (ntfs_read_hdr, bcmp). The patch replaces kmem_cache_alloc() with kmem_cache_zalloc() to allocate and...

CVE-2025-71085

CVE-2025-71085: In the Linux kernel, a BUG() in pskb_expand_head() occurs via calipso_skbuff_setattr() due to an implicit integer cast in __skb_cow(). The root cause is headroom > INT_MAX combined with delta

CVE-2025-71189

Technical details for CVE-2025-71189 are not provided in the connected documents; the available sources only reference the vulnerability and fix at a high level. Monitor for updates.

CVE-2026-23100

The CVE-2026-23100 entry concerns the Linux kernel mm/hugetlb code and a fix for hugetlb_pmd_shared(). The vulnerability stemmed from how shared PMD tables were detected; the patch set switches to using an independent shared count and the ptdesc_pmd_is_shared() check, so that shared PMD tables ar...

CVE-2026-23123

The CVE-2026-23123 issue affects the Linux kernel (interconnect: debugfs) where the src_node and dst_node pointers could be read or written unsafely due to not being initialized. The fix initializes src_node and dst_node to empty strings before creating debugfs entries to ensure reads/writes are ...

CVE-2026-23172

Technical details for CVE-2026-23172 are not publicly available in the provided documents; monitor for updates.

CVE-2026-23195

The CVE-2026-23195 entry pertains to the Linux kernel, specifically the cgroup/dmem subsystem. The issue is a pool use-after-free (UAF) where a pool could still be held after its memory region is unregistered, leading to a local, kernel-space bug. The provided connected documents describe the roo...

CVE-2026-23203

CVE-2026-23203 relates to the Linux kernel cpsw driver. The fix changes the processing of the ndo_set_rx_mode callback to run in a work queue (net: cpsw_new: Execute ndo_set_rx_mode callback in a work queue) rather than holding the RTNL lock during certain paths. Root cause involved a lock- and c...

CVE-2026-23205

The CVE-2026-23205 entry describes a memory leak in the Linux kernel SMB/CIFS client (smb2_open_file()). The provided reproducer shows a scenario with a read-only CIFS export, client mount, and module removal that triggers a leak during cleanup of SMB request buffers, leading to a kmem_cache leak...

CVE-2026-23211

CVE-2026-23211 concerns the Linux kernel memory management swap subsystem. The issue arises from a change that marked the swap address space as read-only, which could trigger a kernel panic if arch_prepare_to_swap() fails during heavy memory pressure. The documented root cause path includes pages...