CVE-2025-71068

CVE-2025-71068 affects the Linux kernel RPC/RDMA path (svcrdma) and specifically the file net/sunrpc/xprtrdma/svc_rdma_rw.c. The issue is a bounds-check failure in the inline path where svc_rdma_copy_inline_range indexes rqstp->rq_pages[rc_curpage] without ensuring rc_curpage stays within the ...

CVE-2026-53339

CVE-2026-53339 is a Linux kernel vulnerability in the i2c-qcom-cci driver. On Qualcomm CCI controllers with two I2C masters, unbinding or removing the driver may trigger a NULL pointer dereference because cci_halt() runs for both masters while completion is only initialized for the enabled one. T...

CVE-2026-53343

CVE-2026-53343 affects the Linux kernel on ARM when CONFIG_KASAN_VMALLOC and CONFIG_VMAP_STACK are enabled. The vulnerability arises from an unaligned access in the KASAN VMAP stack shadow in __switch_to(), where a prior dummy read used a word load (ldr) against a byte-granular shadow memory. The...

CVE-2026-64118

The CVE-2026-64118 issue is a Linux kernel memory-management bug in qed_cxt_tables_alloc(): if a later PF/VF CID bitmap allocation fails, qed_cid_map_alloc() jumps to cid_map_fail and frees previously allocated CID bitmaps; then qed_cxt_tables_alloc() calls qed_cxt_mngr_free(), which invokes qed_...

CVE-2026-64237

Summary: CVE-2026-64237 affects the Linux kernel’s elan_i2c firmware handling. The issue arises from insufficient size validation of the firmware blob before use. Vulnerability details (as stated in connected docs): The firmware file must be large enough to contain the expected number of pages an...

CVE-2026-64276

CVE-2026-64276 affects the Linux kernel synaptics-rmi4 input driver. The F30/GP I/O mapping code incorrectly allocated gpioled_key_map for at most 6 entries but later iterated up to gpioled_count (0..31) and advanced input->keycodemax to the full count, risking out-of-bounds reads in the atten...

CVE-2026-64304

In the Linux kernel, CVE-2026-64304 affects the crypto qat driver: the RSA CRT component handling in qat_rsa_setkey_crt() can write out of bounds when a CRT component exceeds the allocated half-key buffer, causing memory corruption. The root cause is that the generic RSA key parser bounds compone...

CVE-2026-64334

CVE-2026-64334 affects the digi_acceleport USB serial driver in the Linux kernel. When submitting an OOB write URB fails persistently—such as during a physical device disconnect—the driver enters an indefinite loop with interrupts disabled , causing a hard lockup. This can be triggered when open(...

CVE-2026-64357

CVE-2026-64357 affects the Linux kernel's XFS filesystem . The bug is in xfs_exchmaps_estimate_overhead(), which adds bmbt and rmapbt overhead to a local resblks variable, but the final UINT_MAX limit check still tests req->resblks—the pre-overhead value. The computed (post-overhead) value is ...

CVE-2026-64385

The CVE-2026-64385 entry relates to a Linux kernel SMB client double-free in SMB2_ioctl() replay. The underlying issue is a stale buffer being freed twice when an SMB2_ioctl_init() path fails before the next send; the fix resets response bookkeeping before each attempt to prevent the stale free. ...

CVE-2026-64398

CVE-2026-64398 affects the Linux kernel ksmbd component. A permission check bypass in FSCTL_SET_ZERO_DATA allows an authenticated SMB client with only FILE_WRITE_ATTRIBUTES to zero out file data via fsctl path, bypassing per-handle checks. The operation uses vfs_fallocate(PUNCH_HOLE/ZERO_RANGE) a...

CVE-2026-64436

The CVE-2026-64436 issue in the Linux kernel affects IPComp state handling in PF_KEY paths. In pfkey_msg2xfrm_state, x->calg is allocated and the algorithm name is copied, but calg->alg_key_len is never initialized, even though calg is 68 bytes and alg_key_len is used later during xfrm_algo...

CVE-1999-0781

The CVE-1999-0781 entry concerns KDE: local users can run arbitrary commands by setting the KDEDIR environment variable to alter KDE’s executable search path. This documents the affected component as KDE and the root cause as the KDEDIR env var influencing how KDE locates executables, enabling lo...

CVE-2006-3634

The CVE-2006-3634 entry describes a vulnerability in Linux kernel 2.6.17-rc4 through 2.6.18-rc2 where two futex helper functions, __futex_atomic_op and futex_atomic_cmpxchg_inatomic, perform the atomic futex operation in kernel address space instead of user space. This misplacement can allow a lo...

CVE-2006-6333

The CVE-2006-6333 issue affects Linux kernel 2.6.19: the tr_rx function in ibmtr.c can assign the wrong flag to ip_summed, enabling remote attackers to trigger a memory-corruption DoS by crafting packets that mislead the kernel to treat a field as an offset. The vulnerability is supported by mult...

CVE-2016-6778

CVE-2016-6778 is an Elevation of Privilege affecting the Android kernel path via the HTC sound codec driver. The vulnerability could let a local malicious application execute arbitrary kernel code, requiring initial compromise of a privileged process before exploitation. Affected stack: Android o...

CVE-2016-6791

CVE-2016-6791 is an elevation-of-privilege vulnerability in the Qualcomm sound driver affecting Android devices. The issue allows a local malicious application to execute arbitrary code in the kernel context, requiring initial compromise of a privileged process. Affected components/versions inclu...

CVE-2016-8403

CVE-2016-8403 describes an information-disclosure vulnerability in Android’s kernel components, including the ION subsystem, Binder, USB driver, and networking subsystem. The issue could allow a local malicious application to access data outside its permission levels, with confidentiality impact ...

CVE-2016-8415

CVE-2016-8415 describes an elevation-of-privilege flaw in the Qualcomm Wi‑Fi driver that lets a local malicious app execute code in the kernel context. Affected software is Android with kernel versions 3.10 and 3.18; exploitation requires compromising a privileged process. The issue is categorize...

CVE-2022-50361

Summary: CVE-2022-50361 concerns the Linux kernel wilc1000 module. In wilc_netdev_ifc_init(), an unregister_netdev() path is missing in the error handling path. The fault report shows a kernel BUG at net/core/dev.c with an invalid opcode when alloc_ordered_workqueue() fails. The root issue is tha...

CVE-2022-50411

CVE-2022-50411 concerns the Linux kernel. A use-after-free vulnerability occurs in the ACPI sub-system: after a failed invocation of acpi_ds_call_control_method(), the thread’s next_walk_state is freed but not popped, causing acpi_ps_parse_aml() to obtain an invalid current walk state. The fix ma...

CVE-2023-53555

CVE-2023-53555 relates to the Linux kernel (Damon/DAMON subsystem). The issue: in damos_new_filter(), the newly allocated filter object’s list field was not initialized, and the sysfs DAMON interface and DAMON_RECLAIM path did not reinitialize it after calling damos_new_filter(). This allowed acc...

CVE-2025-38150

The CVE-2025-38150 entry concerns the Linux kernel af_packet path, where the notifier call for packet_dev_mc was moved outside the RCU critical section. Technical details in the provided documents show that mclist modifications (add/del/flush/unregister) are now protected by RTNL, while the sklis...

CVE-2025-38394

The CVE-2025-38394 issue is in the Linux kernel HID path (appletkd/b appletb-kbd) where an input handler is registered to input core and then, if probe fails, freed memory remains in input_handler_list. This creates a use‑after‑free condition (UAF) in input_attach_handler during subsequent device...

CVE-2025-38519

The CVE-2025-38519 entry pertains to the Linux kernel (mm/damon) and is supported by multiple sources in the connected documents. The root cause is a divide-by-zero crash in damon_get_intervals_score() when region size is zero. The current patch fixes the bug without disallowing zero-size regions...

CVE-2025-38534

CVE-2025-38534 affects the Linux kernel netfs copy-to-cache path used by Ceph with local caching. The issue: a write-to-cache request could hang after the backing filesystem completes the async DIO write because NETFS_RREQ_OFFLOAD_COLLECTION wasn’t set, causing an app to miss the collection notif...

CVE-2025-38557

CVE-2025-38557 : In the Linux kernel HID subsystem, a vulnerability affects the apple_backlight feature. A malicious HID device with quirk APPLE_MAGIC_BACKLIGHT can trigger a NULL pointer dereference when toggling the power feature-report if the HID descriptor declares only one field for the powe...

CVE-2025-38580

The CVE-2025-38580 entry concerns a Linux kernel ext4 use-after-free in ext4_end_io_rsv_work(). The fix adds a check in ext4_io_end_defer_completion() to ensure io_end->list_vec is empty before adding to i_rsv_conversion_list, preventing starting an unnecessary worker. It also adds ext4_emerge...

CVE-2025-38589

The Connected documents confirm CVE-2025-38589 relates to a null-ptr-deref in neigh_flush_dev() within the Linux kernel, fixed by reverting to hash-table iteration in neigh_table_clear() after introducing per-netdev neighbour lists. The issue was triggered by neigh_table_clear() calling neigh_ifd...

CVE-2025-38705

CVE-2025-38705: In the Linux kernel, writing a string without delimiters to gpu_od/fan_ctrl or pp_power_profile_mode for the CUSTOM profile can cause a NULL pointer dereference in drm/amd/pm. SUSE/OpenSUSE advisories (e.g., SUSE-SU-2025:03600-1) list this alongside many other kernel fixes and ind...

CVE-2025-38708

CVE-2025-38708 is a Linux kernel/DRBD issue where, with two-primaries enabled, concurrent writes could trigger a use-after-free due to a missing kref_get in handle_write_conflicts. The root cause is not in regular operation but in the code path for detecting concurrent writes on the DRBD layer, l...

CVE-2025-39673

CVE-2025-39673 affects the Linux kernel PPP code, specifically the function ppp_fill_forward_path, which had two race conditions. First, the ppp->channels list could be reconfigured between list_empty() and list_first_entry() because ppp_lock() was not held, risking access to an empty head or ...

CVE-2025-39678

CVE-2025-39678 affects the Linux kernel, specifically the x86/amd/hsmp code path. The vulnerability arises when sock->metric_tbl_addr is NULL, which can cause a NULL pointer dereference when accessing metrics_bin. The provided connected SUSE advisory confirms the fix: a NULL check was added to...

CVE-2025-39685

Summary (CVE-2025-39685) : In the Linux kernel, the comedi pcl726 driver could trigger an out-of-bounds when an excessively large IRQ number was passed (example 0x80008000). The fix adds an interrupt number check to prevent passing an IRQ number that is too large. It notes that if it->options[...

CVE-2025-39706

Summary: CVE-2025-39706 affects the Linux kernel's DRM/AMDKFD path. The issue arises when destroying KFD debugfs before kfd_process_destroy_wq, causing a NULL pointer hang due to an attempted remove of /sys/kernel/debug/kfd/proc/ after /sys/kernel/debug/kfd was destroyed. Root cause: proc content...

CVE-2025-39743

CVE-2025-39743 refers to a Linux kernel vulnerability in the JFS file system where inode pages were not truncated during eviction when the inode’s hard link count was 0. The reproducer observed AGGR_RESERVED_I on the inode copy and eviction with hard link 0, causing clear_inode() to trigger becau...

CVE-2025-39746

CVE-2025-39746 affects the Linux kernel device driver stack for wifi/ath10k on PCIe. When the hardware becomes unreliable, ath10k can lose PCIe connectivity, causing WMI command timeouts and a restart loop that may trigger a watchdog timeout and a system crash on suspend. The advisory describes a...

CVE-2025-39786

The CVE-2025-39786 issue affects the Linux kernel IIO ADC driver for ad7173. The root cause is an index mismatch when accessing the syscalib_mode channel: the address field is 0-based (same as scan_index) used to locate entries in ad7173_channels, while the channels field may not match the addres...

CVE-2025-39787

CVE-2025-39787 concerns the Linux kernel component soc/qcom/mdt_loader.c . The issue arises when the MDT loader is used by clients other than remoteproc, where the ELF header could be traversed without sufficient bounds checks. The patch fixed by validating the firmware buffer size and the header...

CVE-2025-39816

CVE-2025-39816 pertains to the Linux kernel’s io_uring/kbuf path. The issue stems from reading ring-provided buffer lengths without a stable read, risking changes between checks and commits since buffers come from userspace. The fix mandates using READ_ONCE() when reading these lengths and tighte...

CVE-2025-39826

CVE-2025-39826 : In the Linux kernel, the net/rose_neigh struct’s use field was a non-atomic reference counter, risking use-after-free if the rose_neigh is freed while still referenced. The fix converts the field from unsigned short to refcount_t and switches code paths to rose_neigh_hold() and r...

CVE-2025-39877

The CVE-2025-39877 issue is a Linux kernel use-after-free in mm/damon/sysfs: state_show() reads kdamond->damon_ctx without holding damon_sysfs_lock, allowing a UAF when damon_ctx is freed under damon_sysfs_lock. A fix mirrors pid_show() by taking damon_sysfs_lock before dereferencing the conte...

CVE-2025-39886

CVE-2025-39886 in the Linux kernel relates to a locking issue triggered when bpf_map_kmalloc_node() is called from __bpf_async_init(), potentially affecting memcg accounting and causing MEMCG_MAX events. The documented fix changes the bpf_timer_init() path to use allow_spinning=false and, per ups...

CVE-2025-39925

CVE-2025-39925 affects the Linux kernel’s CAN J1939 implementation. The issue stems from the j1939 protocol not having a NETDEV_UNREGISTER notification handler, which meant that when a NETDEV_UNREGISTER event fires, the extra ref held by j1939_sk_bind() could prevent the net_device usage count fr...

CVE-2025-40164

Technical details for CVE-2025-40164 are not publicly provided in the connected documents. Monitor for updates; current sources only list the CVE without vendor/affected products, impact, or remediation specifics.

CVE-2025-71107

CVE-2025-71107: In Linux kernel F2FS, a race allows f2fs_put_super() to run before all node-page reads complete, causing an apparent filesystem reference-count leak during unmount (kernel.c fs/f2fs/super.c:1939). Mitigation: upstream patch adds f2fs_wait_on_all_pages() for F2FS_RD_NODE to ensure ...

CVE-2025-71154

CVE-2025-71154 concerns Linux kernel code for the rtl8150 USB driver. When usb_submit_urb() fails in async_set_registers(), the allocated async_req and URB are not freed, causing a memory leak. The completion callback async_set_reg_cb() frees these allocations only after a successful URB submissi...

CVE-2025-71188

CVE-2025-71188 affects the Linux kernel DMA engine path for the lpc18xx-dmamux component, where a reference leak to the platform device during route allocation could occur. The fix drops the reference after looking up the DMA mux platform device, mitigating the leak. OSV entries show Root:Ubuntu ...

CVE-2025-71315

The CVE-2025-71315 vulnerability concerns the Linux kernel’s drm/vkms path. Connected sources confirm a concrete fix: vkms’ vblank timer was replaced with DRM’s vblank timer implementation, removing the hrtimer from vkms_output and delegating to the DRM vblank timeout path via handle_vblank_timeo...

CVE-2026-22981

CVE-2026-22981 pertains to the Linux kernel driver for IDPF (Intel Ethernet 800/900-series? context in the doc refers to idpf) where, during reset handling, netdev interfaces are detached/closed to protect the reset path. The vulnerability description states that if reset handling succeeds, netde...