CVE-2025-71200

The CVE-2025-71200 entry describes a Linux kernel vulnerability in mmc: sdhci-of-dwcmshc where in HS200/HS400 timing modes lowering the clock below 52MHz could break the link due to the Rockchip DWC MSHC controller requiring a 52MHz minimum. The fix adds a check to prevent illegal clock reduction...

CVE-2026-43020

CVE-2026-43020 concerns the Linux kernel Bluetooth MGMT path: load-time Long Term Keys can overflow a fixed-size stack buffer if enc_size exceeds the 16-byte key buffer. The root cause is validation of enc_size not rejecting oversized values during management LTK record validation, allowing inval...

CVE-2016-10284

CVE-2016-10284 is a vulnerability in the Qualcomm video driver that enables an elevated-privilege path: a local, privileged process could be exploited by a malicious local app to run arbitrary code in the kernel context on Android devices. The issue affects Android kernel versions 3.10 and 3.18, ...

CVE-2016-10290

CVE-2016-10290 is an elevation-of-privilege issue in the Qualcomm Shared Memory Driver used on Android. The vulnerability could allow a local malicious application to execute arbitrary code in the kernel context by exploiting the shared memory driver. The entry specifies that exploitation is loca...

CVE-2016-10296

CVE-2016-10296 is an information-disclosure vulnerability in the Qualcomm shared memory driver affecting Android kernels those listed (Kernel-3.10, Kernel-3.18). The issue could allow a local malicious application to access data beyond its permissions, and is categorized as Moderate because explo...

CVE-2016-6162

CVE-2016-6162 affects the Linux kernel file net/core/skbuff.c (kernel 4.7-rc6). The issue allows local users to trigger a denial of service (kernel panic) or potentially other unspecified impact through certain IPv6 socket operations. Multiple advisories (SUse, Red Hat, Debian, Ubuntu OSV, CNVD, ...

CVE-2016-8407

CVE-2016-8407 is an information disclosure vulnerability in Android’s kernel components (ION subsystem, Binder, USB driver, and networking). The issue could allow a local malicious app to access data outside its permission levels after compromising a privileged process. Affected products/versions...

CVE-2016-8416

The CVE-2016-8416 entry concerns an information-disclosure vulnerability in the Qualcomm video driver on Android (kernel 3.18). A local malicious application could access data outside its permissions due to the driver’s handling, with impact described as data disclosure and requiring a privileged...

CVE-2022-50400

The CVE-2022-50400 issue concerns the Linux kernel greybus: audio_helper code, where debugfs usage was removed due to incorrect handling that could leak memory and even erase all debugfs entries. The fix is to remove all debugfs logic from the audio_helper code; if needed later, a fix for the inc...

CVE-2023-53185

CVE-2023-53185 exists in the Linux kernel: wifi/ath9k allows overwriting ENDPOINT0 attributes, enabling a bad USB device to craft a service-connection response where the target is ENDPOINT0 (reserved for HTC_CTRL_RSVD_SVC). The vulnerability is fixed in the kernel by rejecting such responses; imp...

CVE-2023-53245

CVE-2023-53245 refers to the Linux kernel Hyper-V StorVSC integration for virtual Fibre Channel timeouts. The issue arises from a faulty integration where the FC transport timeout handler (fc_eh_timed_out()) could dereference a NULL rport, causing a kernel panic. The published fix removes the cal...

CVE-2023-53249

CVE-2023-53249 affects Linux kernel clk-imx8mn clock driver. The vulnerability arises from a memory-leak in imx8mn_clocks_probe caused by using of_iomap() for an ioremap region and kzalloc() for allocations that aren’t automatically freed if error paths occur. The fix switches to devm_of_iomap() ...

CVE-2023-53275

CVE-2023-53275: In Linux kernel ALSA HDA code, a data race around snd_hdac_regmap_sync() can lead to a null-pointer dereference of codec->regmap if it is NULL after an if check. The root cause is accessing codec->regmap without holding the regmap_lock, which could race with regcache_sync() ...

CVE-2023-53354

The CVE-2023-53354 issue affects the Linux kernel, specifically skb_segment() in net/core/skbuff.c. A bug caused by calling skb_orphan_frags() before zero-copy handling can update nrfrags and leave frag pointing to stale values, leading to a NULL pointer dereference and kernel panic in the GSO pa...

CVE-2023-53513

The CVE-2023-53513 issue is a Linux kernel vulnerability where incomplete validation of the nbd ioctl arg can trigger an i_size overflow when the arg is coerced to int (arg cast in nbd_ioctl /nbd_add_socket). The root cause is insufficient validation of large ioctl arguments, allowing an overflow...

CVE-2025-38367

CVE-2025-38367 concerns the Linux kernel LoongArch KVM subsystem. The issue arises from a logic error where a modified index is reused as an array index when updating the EIOINTC_ENABLE register, creating an array index overflow condition. The vulnerability affects the kernel, with the descriptio...

CVE-2025-38434

Technical details for CVE-2025-38434 are not provided in the connected documents. Public information about affected products/versions, root cause, impact, or fixes is not available here. Monitor for updates in the sources referenced by the Initial document.

CVE-2025-38505

The CVE-2025-38505 issue in the Linux kernel affects the wifi MWIFIEX path when operating in concurrent STA/AP mode with host MLME enabled. The firmware could send disassociation frames to the STA interface when clients disconnect from the AP, causing spurious disconnect events at the STA and ker...

CVE-2025-38593

CVE-2025-38593: Linux kernel Bluetooth HCI double-free in hci_discovery_filter_clear() due to a race with start_service_discovery(); fix adds locking around kfree() and the NULL assignment of uuids. This mitigates a potential use-after-free / slab error and is reflected in multiple vendor advisor...

CVE-2025-38605

CVE-2025-38605 affects the Linux kernel’s wifi/ath12k driver. In ath12k_dp_tx_get_encap_type(), arvif may be NULL during vdev delete, risking a kernel panic. The fix passes the valid ab pointer directly from the caller to avoid dereferencing arvif. Affected reference points to ath12k_dp_tx and re...

CVE-2025-38631

CVE-2025-38631 affects the Linux kernel clock framework (clk/imx95-blk-ctl). When enabling runtime PM for clock suppliers that share a power domain, a crash can occur (synchronous external abort) during clock provider registration. The root cause is improper runtime PM handling that can cut power...

CVE-2025-38662

CVE-2025-38662 in the Linux kernel affects the ASoC Mediatek mt8365 PCM/DAI code. The issue arises in mt8365_dai_set_priv where priv_size is allocated for the destination, but the code passes afe_priv (the size of struct mt8365_afe_private) instead of the correct priv structure (mt8365_i2s_priv[i...

CVE-2025-38688

CVE-2025-38688: In the Linux kernel’s iommufd code, ALIGN() overflow could occur while allocating IOVA ranges near ULONG_MAX, risking overlapping mappings or mapping against reserved ranges. The fix uses get_add_overflow() to guard ALIGN() and consolidates the checks under a single helper. Public...

CVE-2025-39679

CVE-2025-39679: In the Linux kernel driver drm/nouveau/nvif, fixing a memory leak in nvif_vmm_ctor() when nvif_vmm_type is invalid. The patch returns -EINVAL and frees resources; connected advisories reference this CVE but provide no additional exploit details.

CVE-2025-39783

CVE-2025-39783: Linux kernel PCI endpoint. The configfs group handling in pci_epf_remove_cfs() incorrectly called list_del() on epf_group, which is a list head, causing a slab-use-after-free (KASAN) when tearing down endpoint function drivers with a configfs attribute group. The connected Astra L...

CVE-2025-39848

CVE-2025-39848 affects the Linux kernel’s ax25_kiss_rcv() path. The root cause is queuing or mangling input skbs without verifying whether the skb is shared, which could trigger a crash in __netif_receive_skb_core() after a regression linked to per-netns packet chains. The description and connect...

CVE-2025-39864

CVE-2025-39864 affects the Linux kernel wifi subsystem (cfg80211) and specifically the cmp_bss() path after a use-after-free in bss_free(). The fix, applied via commits addressing the hidden_beacon_bss handling, ensures the last beacon frame elements are freed only when not shared by the hidden_b...

CVE-2025-71083

CVE-2025-71083 affects the Linux kernel’s graphics subsystem (drm/ttm). A evicted BOs object can exist not currently tied to a resource; when devcoredump attempts to read all BOs, the code may dereference a NULL pointer. The result is an ENODATA outcome instead of buffer contents. The CVE is addr...

CVE-2025-71090

The CVE-2025-71090 entry concerns a Linux kernel vulnerability in the NFS server (nfsd). The issue is a reference-leak in nfsd4_add_rdaccess_to_wrdeleg(): fp->fi_fds[O_RDONLY] is overwritten with a newly acquired nfsd_file without releasing the prior reference if SHARE_ACCESS_READ exists, and ...

CVE-2025-71091

The CVE-2025-71091 issue is in the Linux kernel: when a port is disabled but queue priority changes are processed, team_queue_override_port_prio_changed() could run a del on an already-removed list node, triggering a kernel bug. The fix adds an early return when the port is not enabled to avoid t...

CVE-2025-71189

Technical details for CVE-2025-71189 are not provided in the connected documents; the available sources only reference the vulnerability and fix at a high level. Monitor for updates.

CVE-2026-23011

CVE-2026-23011: In the Linux kernel, ip_gre: make ipgre_header() robust to prevent skb under_panic when a device (e.g., bonding/team) changes dev->needed_headroom or dev->hard_header_len. The crash described involves mld_newpack/mld_sendpack path with an skb that had insufficient headroom, ...

CVE-2026-23146

Technical details for CVE-2026-23146 are not provided in the supplied connected documents; the materials only reference the vulnerability as part of Ubuntu/Mageia/Oracle advisories. Monitor for updates.

CVE-2026-23168

CVE-2026-23168 affects the Linux kernel (example: kernel6.12 lineage and Oracle/Amazon Linux advisories) where a race in the flexible proportions code (fprop_new_period) can cause a sequence counter write under softirq/hardirq interaction, potentially enabling a deadlock in certain writeout paths...

CVE-2026-23203

CVE-2026-23203 relates to the Linux kernel cpsw driver. The fix changes the processing of the ndo_set_rx_mode callback to run in a work queue (net: cpsw_new: Execute ndo_set_rx_mode callback in a work queue) rather than holding the RTNL lock during certain paths. Root cause involved a lock- and c...

CVE-2026-23206

Summary: CVE-2026-23206 affects the Linux kernel dpaa2-switch driver where zero interfaces (num_ifs == 0) caused a NULL-like ZERO_SIZE_PTR allocation and a kernel panic during probe. The issue stems from allocating arrays with kcalloc() using ethsw->sw_attr.num_ifs and dereferencing ports[0] i...

CVE-2026-23288

The CVE-2026-23288 issue is in the Linux kernel’s accel/amdxdna component. It describes an out-of-bounds write caused by clearing the command header with memset() before validating the remaining space in a command slot, when the slot space is smaller than the header. The root cause is performing ...

CVE-2026-23292

CVE-2026-23292 : Linux kernel scsi: target: Fix recursive locking in __configfs_open_file(). The root cause was target_core_item_dbroot_store() attempting to open the file path (which is the same configfs file already held) using filp_open(), leading to potential nested frag_sem locking. The fix ...

CVE-2026-23303

The CVE-2026-23303 vulnerability affects the Linux kernel SMB client: when logging is enabled, cifs_set_cifscreds can emit plaintext credentials (username/password) to logs. The issue is fixed by removing the debug log, preventing credential exposure. The connected advisories confirm the flaw exi...

CVE-2026-31504

The CVE-2026-31504 entry describes a race in the Linux kernel’s networking stack: during a NETDEV_UP event, a socket re-registration into a fanout group’s arr[] can leave a dangling pointer if packet_release() doesn’t clear po->num while bind_lock is held. This Use-After-Free risk stems from a...

CVE-2026-31555

CVE-2026-31555 relates to a Linux kernel futex race in futex_lock_pi() retry path where a stale pointer to an exiting task is not cleared on retry. The issue can lead to a WARN_ON_ONCE when an old exiting pointer is used after a failed retry, potentially contributing to a DoS via kernel instabili...

CVE-2026-31570

CVE-2026-31570 relates to the Linux kernel CAN gateway module. The vulnerability is an OOB heap access in cgw_csum_crc8_rel(), caused by looping and writing using raw s8 indices (from_idx/to_idx/result_idx) instead of the precomputed bounds-safe values (from/to/res). calc_idx() yields bounds-safe...

CVE-2026-31573

The vulnerability CVE-2026-31573 affects the Linux kernel media: verisilicon hantro_vpu driver. When built as a module, incorrect use of the __initconst annotation frees data prematurely, and non-init probe code later accesses this freed data, causing a kernel panic (page fault) during hantro_pro...

CVE-2026-31592

CVE-2026-31592 affects the Linux kernel KVM subsystem. The vulnerability arises when sev_mem_enc_register_region() is not protected by kvm->lock before sev_guest() is checked, risking state corruption if KVM_INIT{2} fails and an uninitialized sev->regions_list is touched, potentially causin...

CVE-2026-45844

Summary: CVE-2026-45844 affects the Linux kernel netfilter arp_tables on IEEE1394 (FireWire) interfaces. The vulnerability arises because arp_packet_match() unconditionally parses the ARP payload assuming both source and target hardware addresses exist, while IPv4-over-IEEE1394 ARP omits the targ...

CVE-2026-46028

CVE-2026-46028 — Linux kernel crypto/AF_ALG: per‑request IV storage for async AEAD . The vulnerability occurs in AF_ALG AEAD async requests that previously reused a socket‑wide IV buffer during processing, allowing later socket activity to modify the shared IV before the original request finished...

CVE-2026-46053

CVE-2026-46053 affects the Linux kernel RDS memory-registration cleanup. In net/rds, __rds_rdma_map() transfers ownership of sg/pages after get_mr(); if copying the cookie back to user space fails, resources could be freed more than once. The fix removes a duplicate unpin/free in the put_user() f...

CVE-2026-46083

CVE-2026-46083 concerns the Linux kernel SPI subsystem. The description indicates a fix for resource leaks that occur when a device is being set up and spi_setup() fails during registration, requiring a call to controller cleanup() to avoid leaking resources allocated by setup(). OpenSUSE/SUSE ad...

CVE-2026-46091

CVE-2026-46091 : Linux kernel vulnerability in the igorplugusb driver where a USB control request may be subject to DMA, violating DMA coherency rules. The resolution requires allocating the affected structure separately to enforce coherency. Public records identify the issue across multiple dist...

CVE-2026-46114

CVE-2026-46114 affects the Linux kernel RDMA/rxe driver. A remote attacker could exploit zero- or non-8-byte ATOMIC_WRITE payloads by triggering atomic_write_reply() to dereference 8 bytes past the packet boundary, leaking up to 4 bytes of kernel tailroom per probe (plus trailing ICRC). The issue...