CVE-2016-8435

CVE-2016-8435 is an elevation of privilege in the NVIDIA GPU driver that could allow a local attacker to execute arbitrary code in the kernel context on Android devices (Kernel-3.18). The issue is addressed in Android security updates released around the 2017-01-01/2017-01-05 patch levels; Pixel ...

CVE-2016-8444

CVE-2016-8444 is an elevation of privilege vulnerability in the Qualcomm camera that could allow a local malicious app to execute arbitrary code in the kernel context on Android (Kernel-3.10). The flaw requires compromising a privileged process, and the description identifies Android as the produ...

CVE-2016-8464

CVE-2016-8464 is a Broadcom Wi‑Fi driver elevation-of-privilege vulnerability on Android. The issue allows a local malicious application to execute arbitrary code in the kernel context by exploiting the Broadcom Wi‑Fi driver after compromising a privileged process. Affected products are Android d...

CVE-2016-8478

CVE-2016-8478 describes an information-disclosure vulnerability in the Qualcomm video driver on Android (Kernel 3.18). The issue allows a local malicious application to access data outside its permission levels, but only after compromising a privileged process. The root cause is information expos...

CVE-2016-8483

CVE-2016-8483 describes an information-disclosure vulnerability in the Qualcomm power driver used by Android on Kernel-3.10. A locally installed, malicious app could access data outside its permission levels due to a flaw in the Qualcomm power driver component. The issue is categorized as High ri...

CVE-2017-0609

CVE-2017-0609 is an elevation-of-privilege vulnerability in the Qualcomm sound driver on Android, enabling a local malicious app to execute code in the kernel context. Affected: Android devices with Kernel-3.10/3.18 (Qualcomm sound subsystem). Root cause: not explicitly detailed in the provided d...

CVE-2017-0624

CVE-2017-0624 describes an information-disclosure vulnerability in the Qualcomm Wi‑Fi driver on Android, enabling a local malicious app to access data outside its permissions. Affected: Android devices (notably Nexus 5X, Pixel, Pixel XL) with Kernel 3.10/3.18; root cause: Qualcomm Wi‑Fi driver in...

CVE-2022-49967

CVE-2022-49967 is a Linux kernel data-race vulnerability in the bpf_jit_limit variable. The issue arises when bpf_jit_limit is read while it can be concurrently updated via sysctl, risking load-tearing due to the long size of the value. The fix adds a paired READ_ONCE() alongside WRITE_ONCE() in ...

CVE-2022-50042

CVE-2022-50042 refers to a Linux kernel vulnerability in the net: genl code for policy dumping. The issue is a memory leak in error paths when constructing the array of policies if recording non-first policies fails, and in netlink_policy_dump_add_policy which currently may not record the allocat...

CVE-2022-50167

Technical details for CVE-2022-50167 are not publicly available in the provided documents. The advisories list the CVE but do not specify affected products, root cause, or fixes. Monitor for official disclosures and updates.

CVE-2023-53249

CVE-2023-53249 affects Linux kernel clk-imx8mn clock driver. The vulnerability arises from a memory-leak in imx8mn_clocks_probe caused by using of_iomap() for an ioremap region and kzalloc() for allocations that aren’t automatically freed if error paths occur. The fix switches to devm_of_iomap() ...

CVE-2023-53439

CVE-2023-53439 concerns the Linux kernel fix for skb_partial_csum_set() where skb->transport_header used the sentinel value 0xFFFF to indicate the transport header status. The description indicates the vulnerability arose from callers potentially setting skb->transport_header to 0xFFFF, and...

CVE-2023-53441

CVE-2023-53441: Linux kernel bpf cpumap memory leak fix. The vulnerability concerns cpu_map_update_elem leaking memory in the BPF map update path (cpu_map_entry_alloc path) as observed by Syzkaller. The fix is in the kernel, referenced by commits such as a957ac8e0b5ffb5797382a6adbafd005a5f72851 a...

CVE-2025-38243

The CVE-2025-38243 issue affects the Linux kernel’s Btrfs log replay path. In several locations that call read_one_inode(), a NULL inode pointer could be dereferenced (e.g., iput(&inode->vfs_inode) in __add_inode_ref()), causing an invalid memory access and a crash. The available connected doc...

CVE-2025-38627

CVE-2025-38627 affects the f2fs component of the Linux kernel. The root cause is a use-after-free of f2fs_inode_info in f2fs_free_dic when decompress_io_ctx is released asynchronously after I/O completion, potentially evicting the inode before dic is used. The exploit scenario involves concurrent...

CVE-2025-38632

CVE-2025-38632 affects the Linux kernel pinctrl/pinmux logic. The issue is a race where updates to mux_usecount and mux_owner were not performed atomically under the same lock, allowing a state where mux_usecount > 0 but mux_owner is NULL, potentially causing a NULL pointer on subsequent pin r...

CVE-2025-38642

CVE-2025-38642 affects the Linux kernel’s wifi/mac80211 monitor mode handling. The issue arises on devices without WANT_MONITOR_VIF (and likely without channel context support), triggering a WARN_ON when modifying the per-link settings of a MONITOR interface. The fix moves this validation from a ...

CVE-2025-39723

CVE-2025-39723 affects the Linux kernel netfs unbuffered write path. When all subrequests in an unbuffered write stream fail, stream->transferred could remain LONG_MAX, and wreq->transferred could be updated to that value, causing write_iter() to report an erroneous non‑zero transfer and tr...

CVE-2025-39770

CVE-2025-39770 affects the Linux kernel net/ GSO for IPv6 with extension headers. The issue arises when GSO on an IPv6 packet with extension headers prompts checksum offload on devices that only advertise NETIF_F_IPV6_CSUM, which is meant to support offload only for plain TCP/UDP over IPv6 and no...

CVE-2025-39826

CVE-2025-39826 : In the Linux kernel, the net/rose_neigh struct’s use field was a non-atomic reference counter, risking use-after-free if the rose_neigh is freed while still referenced. The fix converts the field from unsigned short to refcount_t and switches code paths to rose_neigh_hold() and r...

CVE-2025-39852

CVE-2025-39852: Linux kernel TCP stack IPv6 TCP-AO path leaks memory when tcp_v6_syn_recv_sock() exits on error due to missing error-handling cleanup. The linked Astra/OpenSUSE advisories confirm the fix adds inet_csk_prepare_forced_close() and tcp_done() (as in the IPv4 path) to ensure the new s...

CVE-2025-39861

CVE-2025-39861 (Linux kernel) : A Bluetooth vulnerability in vhci can cause use-after-free when accessing debugfs files. The fix moves debugfs file creation into a dedicated function and ensures all debugfs files (e.g., force_suspend, force_wakeup) are removed during vhci_release() before freeing...

CVE-2025-39917

Summary (CVE-2025-39917) : Linux kernel bug in bpf_crypto_crypt allowed an out-of-bounds write when the destination dynptr size was smaller than the source, due to missing validation before crypto backend calls with len = src_len. The issue arises in the bpf_dynptr_data usage for src and the writ...

CVE-2025-39950

CVE-2025-39950 pertains to the Linux kernel: a NULL pointer dereference can occur in net/tcp when TCP-AO is used with TCP_REPAIR during connect(), due to dereferencing skb without null-check in tcp_ao_finish_connect(). The vulnerability affects code paths where a TCP-AO key is present and TCP_REP...

CVE-2025-39963

CVE-2025-39963 is a Linux kernel vulnerability related to io_uring: in io_link_skb, prev_notif could be computed using the wrong value (nd instead of prev_nd), causing a context validation check to compare the current notification with itself. The issue is fixed by using the correct prev_nd when ...

CVE-2025-68351

The CVE-2025-68351 issue is in the Linux kernel exfat code, specifically a refcount leak in exfat_find. The root cause is that exfat_get_dentry_set increments es->bh on success but the corresponding exfat_put_dentry_set may not be consistently invoked, leading to leaks. The patch relocates two...

CVE-2025-71095

CVE-2025-71095 affects the Linux kernel’s net: stmmac driver, causing a crash during zero-copy XDP_TX due to improper handling of xdp_buff memory types. The bug occurs when an xdp_buff is converted to an xdp_frame and the code in stmmac_xdp_xmit_back() always assumes MEM_TYPE_PAGE_POOL, regardles...

CVE-2025-71189

Technical details for CVE-2025-71189 are not provided in the connected documents; the available sources only reference the vulnerability and fix at a high level. Monitor for updates.

CVE-2025-71190

CVE-2025-71190 refers to a Linux kernel vulnerability in the DMA Engine, specifically the bcm-sba-raid driver. The issue is a device reference leak that can occur during probe, leading to leaked mailbox device references if probe fails or driver is unbound. The fixed code drops the reference to t...

CVE-2026-23026

The CVE-2026-23026 entry concerns the Linux kernel DMA engine Qualcomm gpi driver. It fixes a memory leak in gpi_peripheral_config(): if krealloc() fails and returns NULL, the code directly assigns NULL to gchan->config, discarding the original memory. The patch uses a temporary variable to ho...

CVE-2026-23080

Technical details for CVE-2026-23080 are not provided in the connected documents. The sources reference the CVE in advisories (e.g., USN entries) but do not include product/vendor/component/version, root cause, impact, or fix specifics. Monitor for updates.

CVE-2026-23101

The CVE-2026-23101 issue affects the Linux kernel LED subsystem. The root cause is a race where an LED was added to leds_list before led_init_core() and before led_classdev.set_brightness_work is initialized. This could allow a default-trigger LED to call led_trigger_set() and queue an uninitiali...

CVE-2026-23162

CVE-2026-23162 relates to the Intel Xe GPU driver in the Linux kernel (drm/xe/nvm). A double-free vulnerability occurs during initialization: after auxiliary_device_init() succeeds, if auxiliary_device_add() then fails, the memory may be freed twice (via the device release path and a premature fr...

CVE-2026-23203

CVE-2026-23203 relates to the Linux kernel cpsw driver. The fix changes the processing of the ndo_set_rx_mode callback to run in a work queue (net: cpsw_new: Execute ndo_set_rx_mode callback in a work queue) rather than holding the RTNL lock during certain paths. Root cause involved a lock- and c...

CVE-2026-23245

CVE-2026-23245 (Linux kernel, net/sched) is resolved. The vulnerability allowed replacing a gate action’s parameters while the hrtimer callback or a dump path walked the schedule list. The fix converts gate parameter updates from plain pointers to an RCU-protected snapshot , swapping updates unde...

CVE-2026-23260

CVE-2026-23260 involves the Linux kernel memory-leak in regmap maple: when mas_store_gfp() fails, the newly allocated 'entry' is not freed, leaking memory. The fix frees 'entry' on the failure path and frees the replaced neighbor blocks ('lower','upper') on success. Connected advisories show patc...

CVE-2026-23371

CVE-2026-23371 (Linux kernel SCHED_DEADLINE) details (from provided docs): The vulnerability arose when a SCHED_DEADLINE task (often a lock holder) moved to a lower class via sched_setscheduler() and failed to inherit the donor DEADLINE parameters, risking bandwidth accounting corruption because ...

CVE-2026-23440

CVE-2026-23440 is a Linux kernel vulnerability in the net/mlx5e IPSec ESN update path. A race condition could cause the ESN wrap event to be processed twice: after validating the event, the driver updates the kernel xfrm state and the lock is temporarily released, risking incorrect ESN high-order...

CVE-2026-43250

CVE-2026-43250 affects the Linux kernel ChipIdea USB Device Controller (UDC) driver. The vulnerability arises when a USB device is reconnected during an active transfer, because _ep_nuke() returns requests without unmapping DMA buffers or cleaning bounce buffers, leaving stale DMA state (num_mapp...

CVE-2026-43324

The CVE-2026-43324 entry covers a Linux kernel USB dummy-hcd synchronization bug. The issue stems from an emulated synchronize_irq() that ran before emulated interrupt-disable, allowing potential callback races when a gadget driver is unbound. The fix moved synchronization to the dummy_udc_async_...

CVE-2026-43497

The CVE-2026-43497 issue affects the Linux kernel fbdev path (udlfb/dlfb) where dlfb_ops_mmap maps vmalloc framebuffer pages without vm_ops, preventing mmap tracking. This allowed stale user PTEs to coexist with freed kernel pages after dlfb_realloc_framebuffer() via FBIOPUT_VSCREENINFO, causing ...

CVE-2026-45856

The CVE-2026-45856 issue affects the Linux kernel's RDMA/uverbs subsystem, specifically ib_uverbs_post_send. The vulnerability arises when cmd.wqe_size from userspace is not validated before kmalloc and using the allocated memory as struct ib_uverbs_send_wr, allowing an out-of-bounds read of kern...

CVE-2026-45882

The CVE-2026-45882 issue affects the Linux kernel power supply subsystem, specifically the pm8916_bms_vm driver. A race condition arises from using devm_ variants for IRQ requests before the power_supply handle is registered, causing the handle to be deallocated/unregistered before the IRQ handle...

CVE-2026-46004

CVE-2026-46004 concerns the Linux kernel ALSA caiaq driver. The issue stems from the probe path in setup_card(), where error handling was insufficient: on certain errors the code could drop into non-fatal paths, risking a use-after-free (UAF) on subsequent caiaq-initiated calls. The patch introdu...

CVE-2026-46024

CVE-2026-46024 targets the Linux kernel libceph component, where a CEPH_MSG_AUTH_REPLY containing zero values for both protocol and result could lead to a null pointer dereference due to ac->ops being NULL after faulty auth handling. The root cause is that a too-permissive check allowed ac-&gt...

CVE-2026-46035

CVE-2026-46035 affects the Linux kernel on UP (non-SMP) configurations and describes a vulnerability in mm/page_alloc. The issue arises because on UP, spin_trylock() is a no-op and may always succeed even if the lock is held, allowing alloc_frozen_pages_nolock() invoked from NMI to re-enter rmque...

CVE-2026-46038

CVE-2026-46038 relates to the Linux kernel net: qrtr: ns path where a node’s memory is leaked after processing BYE, because the node is not freed in ctrl_cmd_bye() failure or success. The fix removes the node from the Xarray and frees memory in both outcomes. Reported CVSS 3.1/3.1_VECTORS via NVD...

CVE-2026-46050

CVE-2026-46050 : In the Linux kernel, the md/raid10 deadlock arises when an array check runs concurrently with NOWAIT IO. The check path raises a barrier and increments nr_pending, while NOWAIT requests return immediately and do not increment nr_pending, leading to a mismatch. Upstream changes (r...

CVE-2026-46058

CVE-2026-46058 affects the Linux kernel’s amphion VPU driver, where a race in the Video4Linux m2m framework could lead to a use-after-free and kernel panic. The issue arises when v4l2_m2m_ctx_release() frees the m2m_ctx while v4l2_m2m_try_run() is about to call device_run, potentially crashing vi...

CVE-2026-46095

CVE-2026-46095 is a Linux kernel vulnerability resolved by moving the barrier raise before the llbitmap state machine transitions. The fix updates two functions, llbitmap_start_write() and llbitmap_start_discard(), to ensure the barrier is raised prior to any state changes, preventing a race wher...