CVE-2026-64414

CVE-2026-64414 : In the Linux kernel, the netfilter path handling unreadable fragments has been resolved. The issue arises when an skb with unreadable fragments (eg, from devmem TCP) is processed by the u32 module, causing skb_copy_bits() to return a negative error code. Mitigations described acr...

CVE-2026-53230

CVE-2026-53230 describes a slab-out-of-bounds vulnerability in the Linux kernel mlx5 driver: mlx5_query_nic_vport_mac_list sizes its firmware command buffer using the PF’s log_max_current_uc/mc_list, risking an overflow when querying a VF vport with a larger max. The resulting memory access is a ...

CVE-2026-53238

CVE-2026-53238 affects the Linux kernel netlabel/privacy path in netlbl_unlabel_addrinfo_get, where the address attribute length was used to infer IPv4/IPv6 data but the corresponding mask length was not independently validated. A crafted Generic Netlink request could supply a valid IPv4/IPv6 add...

CVE-2026-53339

CVE-2026-53339 is a Linux kernel vulnerability in the i2c-qcom-cci driver. On Qualcomm CCI controllers with two I2C masters, unbinding or removing the driver may trigger a NULL pointer dereference because cci_halt() runs for both masters while completion is only initialized for the enabled one. T...

CVE-2026-64118

The CVE-2026-64118 issue is a Linux kernel memory-management bug in qed_cxt_tables_alloc(): if a later PF/VF CID bitmap allocation fails, qed_cid_map_alloc() jumps to cid_map_fail and frees previously allocated CID bitmaps; then qed_cxt_tables_alloc() calls qed_cxt_mngr_free(), which invokes qed_...

CVE-2026-64226

In the Linux kernel, CVE-2026-64226 is addressed in sched_ext: Avoid UAF in scx_root_enable_workfn() init failure path. The vulnerable sequence dereferenced p->comm and p->pid after put_task_struct(p) in scx_root_enable_workfn(); when the iterator’s reference was last dropped, the task coul...

CVE-2026-64352

CVE-2026-64352 affects the Linux kernel BPF subsystem , specifically the LPM (Longest Prefix Match) trie implementation in kernel/bpf/lpm_trie.c. The root cause is incorrect RCU lock annotations : trie_lookup_elem() used rcu_read_lock_bh_held() which does not accept the Tasks Trace RCU held by sl...

CVE-2026-64442

The CVE-2026-64442 issue affects the Linux kernel rtl8723bs Wi‑Fi driver. It introduces out-of-bounds reads in two IE parsing loops (issue_assocreq and join_cmd_hdl) due to missing header bounds checks when parsing Information Elements from AP beacon/probe responses. The vulnerability arises if a...

CVE-1999-0330

The CVE-1999-0330 entry concerns the Linux bdash game and a buffer overflow that allows local users to gain root access. The connected documents corroborate a local-privilege-elevation flaw in the bdash game kernel/user-space handling, with no explicit product version, patch, or root-cause code s...

CVE-2001-1399

CVE-2001-1399 refers to an off-by-one/byte-copy bug in the Linux kernel prior to 2.2.19 on x86 that could allow a local attacker to modify kernel memory. Public references in 2001 advisories (Mandrake MDKSA-2001:037, Debian DSA-047-1, Debian/OpenVAS entries) describe the CPIA driver and related x...

CVE-2002-0499

The CVE relates to the Linux kernel vulnerability where the d_path function truncates long pathnames without error in Linux kernel versions 2.2.20 and earlier, and 2.4.18 and earlier. This behavior can cause local users to cause programs to operate on incorrect directories, potentially enabling i...

CVE-2006-6057

CVE-2006-6057 affects the Linux kernel (2.6.x up to 2.6.18) and possibly other OSes, notably Fedora Core 6, with a vulnerability in the GFS2 file system driver. The issue is triggered by a malformed gfs2 file stream that leads to a NULL pointer dereference in the init_journal function, causing a ...

CVE-2016-10284

CVE-2016-10284 is a vulnerability in the Qualcomm video driver that enables an elevated-privilege path: a local, privileged process could be exploited by a malicious local app to run arbitrary code in the kernel context on Android devices. The issue affects Android kernel versions 3.10 and 3.18, ...

CVE-2016-10286

CVE-2016-10286 is an elevation-of-privilege vulnerability in the Qualcomm video driver on Android, enabling a local malicious application to execute arbitrary code in the kernel context. The issue affects Android with Kernel-3.18 and Android ID A-35400904; exploitation requires compromising a pri...

CVE-2016-6162

CVE-2016-6162 affects the Linux kernel file net/core/skbuff.c (kernel 4.7-rc6). The issue allows local users to trigger a denial of service (kernel panic) or potentially other unspecified impact through certain IPv6 socket operations. Multiple advisories (SUse, Red Hat, Debian, Ubuntu OSV, CNVD, ...

CVE-2016-8392

CVE-2016-8392 is a local privilege-escalation in the Qualcomm sound driver affecting Android devices (Nexus 5X/6/6P, Android One, Pixel/Pixel XL) via the kernel context. The vulnerability could let a malicious local app execute arbitrary code in the kernel after compromising a privileged process....

CVE-2016-8441

CVE-2016-8441 : Possible buffer overflow in the Android hypervisor due to inappropriate use of a static array in Kernel 3.18. Impact: local code execution with high severity (CVSS2 7.2, CVSS3 7.8). Connected documents confirm product/versions but do not provide a concrete patch/remediation detail...

CVE-2016-8452

CVE-2016-8452 is a vulnerability in the Qualcomm Wi-Fi driver on Android that allows a local, unprivileged process to escalate to kernel code execution. Root cause is elevation of privilege in the Qualcomm Wi‑Fi driver, with impact described as high since the attacker must first compromise a priv...

CVE-2016-8453

CVE-2016-8453 describes an elevation-of-privilege in the Broadcom Wi‑Fi driver for Android on Kernel-3.10. A local malicious app could run code in the kernel by exploiting this driver after compromising a privileged process. Impact is ability to execute arbitrary kernel code with high severity. R...

CVE-2016-8478

CVE-2016-8478 describes an information-disclosure vulnerability in the Qualcomm video driver on Android (Kernel 3.18). The issue allows a local malicious application to access data outside its permission levels, but only after compromising a privileged process. The root cause is information expos...

CVE-2016-8483

CVE-2016-8483 describes an information-disclosure vulnerability in the Qualcomm power driver used by Android on Kernel-3.10. A locally installed, malicious app could access data outside its permission levels due to a flaw in the Qualcomm power driver component. The issue is categorized as High ri...

CVE-2017-0520

CVE-2017-0520 is an elevation-of-privilege vulnerability in the Qualcomm crypto engine driver that could allow a local malicious Android app to execute code in the kernel context. Affected components: Qualcomm crypto engine driver; vulnerable against Android kernels 3.10 and 3.18. Trigger require...

CVE-2017-0631

CVE-2017-0631 is an information-disclosure vulnerability in the Qualcomm camera driver for Android. According to NVD, it affects Android on kernels 3.10 and 3.18, enabling a local malicious application to access data outside its permission levels after compromising a privileged process. The descr...

CVE-2017-8072

The vulnerability CVE-2017-8072 affects the Linux kernel 4.9.x with a flaw in cp2112_gpio_direction_input (drivers/hid/hid-cp2112.c): it does not return the expected EIO error for a zero-length report, enabling local users to cause an unspecified impact via unknown vectors. Affected: Linux kernel...

CVE-2022-50105

The CVE-2022-50105 issue affects the Linux kernel (powerpc/spufs) where of_find_node_by_path() could leak a refcount. The fix, as documented, is to call of_node_put() on the remotely referenced device node when done, preventing a refcount leak in spufs_init_isolated_loader. Connected advisories (...

CVE-2022-50233

The CVE-2022-50233 entry pertains to the Linux kernel Bluetooth stack (net/bluetooth/eir.c and net/bluetooth/mgmt.c). The root cause is using strlen on hdev->dev_name and hdev->short_name, which are not guaranteed to be NULL-terminated. This can lead to kernel memory reads when the terminal...

CVE-2022-50300

CVE-2022-50300 affects the Linux kernel's btrfs code, where an extent_map use-after-free can occur in read_one_chunk when handling a missing device and the degraded mount option is absent. The root cause is freeing the extent_map before storing the error code, despite the structure being referenc...

CVE-2022-50361

Summary: CVE-2022-50361 concerns the Linux kernel wilc1000 module. In wilc_netdev_ifc_init(), an unregister_netdev() path is missing in the error handling path. The fault report shows a kernel BUG at net/core/dev.c with an invalid opcode when alloc_ordered_workqueue() fails. The root issue is tha...

CVE-2022-50400

The CVE-2022-50400 issue concerns the Linux kernel greybus: audio_helper code, where debugfs usage was removed due to incorrect handling that could leak memory and even erase all debugfs entries. The fix is to remove all debugfs logic from the audio_helper code; if needed later, a fix for the inc...

CVE-2023-53188

CVE-2023-53188: In the Linux kernel, net: openvswitch: fix race on port output. The vulnerability arises when an Open vSwitch vport is racing with netns/namespace deletion, potentially triggering an infinite loop in skb_tx_hash in dev_queue_xmit if dev->real_num_tx_queues becomes 0 during unre...

CVE-2023-53287

CVE-2023-53287 : Linux kernel USB cdns3 driver fix—move the set_active() call outside the spin lock to avoid sleeping in atomic context during resume, preventing a WARN during resume (pm_runtime_resume path). The change protects the cdns data structure and removes the ‘sleeping function called fr...

CVE-2025-38150

The CVE-2025-38150 entry concerns the Linux kernel af_packet path, where the notifier call for packet_dev_mc was moved outside the RCU critical section. Technical details in the provided documents show that mclist modifications (add/del/flush/unregister) are now protected by RTNL, while the sklis...

CVE-2025-38580

The CVE-2025-38580 entry concerns a Linux kernel ext4 use-after-free in ext4_end_io_rsv_work(). The fix adds a check in ext4_io_end_defer_completion() to ensure io_end->list_vec is empty before adding to i_rsv_conversion_list, preventing starting an unnecessary worker. It also adds ext4_emerge...

CVE-2025-38605

CVE-2025-38605 affects the Linux kernel’s wifi/ath12k driver. In ath12k_dp_tx_get_encap_type(), arvif may be NULL during vdev delete, risking a kernel panic. The fix passes the valid ab pointer directly from the caller to avoid dereferencing arvif. Affected reference points to ath12k_dp_tx and re...

CVE-2025-38622

CVE-2025-38622 — Linux kernel UDP/GSO issue : The vulnerability occurs in the UDP receive path when a packet with virtio_net_hdr using SKB_GSO_UDP and a gso_size smaller than the UDP header can trigger a crash in skb_pull_rcsum, leading to a kernel BUG in net/core/skbuff.c and a local attacker ma...

CVE-2025-38688

CVE-2025-38688: In the Linux kernel’s iommufd code, ALIGN() overflow could occur while allocating IOVA ranges near ULONG_MAX, risking overlapping mappings or mapping against reserved ranges. The fix uses get_add_overflow() to guard ALIGN() and consolidates the checks under a single helper. Public...

CVE-2025-38709

CVE-2025-38709 affects the Linux kernel loop device where changing the loop block size while a filesystem is mounted can cause a block-size mismatch between the loop device and the superblock, triggering warnings such as in __getblk_slow(). The issue is remedied by obtaining an exclusive hold on ...

CVE-2025-38713

CVE-2025-38713 concerns a slab-out-of-bounds read in the Linux kernel’s hfsplus handling. The issue occurs in hfsplus_uni2asc(), which can be triggered via hfsplus_readdir() and may crash the kernel (KASAN slab-out-of-bounds). The connected documents confirm a fix in the kernel source to address ...

CVE-2025-39673

CVE-2025-39673 affects the Linux kernel PPP code, specifically the function ppp_fill_forward_path, which had two race conditions. First, the ppp->channels list could be reconfigured between list_empty() and list_first_entry() because ppp_lock() was not held, risking access to an empty head or ...

CVE-2025-39681

CVE-2025-39681 relates to the Linux kernel on x86 with Hygon CPUs. The root cause was a missing resctrl_cpu_detect() call in the Hygon BSP init path after resctrl_cpu_detect() was moved to vendor-specific init code. This caused a division-by-zero in get_rdt_mon_resources() during early boot due t...

CVE-2025-39747

Technical details about CVE-2025-39747 are not publicly provided in the supplied documents. Monitoring for updates from OSV/Root feeds is advised; no concrete affected products, root cause, or patch details are present here.

CVE-2025-39756

CVE-2025-39756 is a Linux kernel issue where extremely high nr_open values (e.g., 1073741816) can trigger massive file descriptor table allocations that exceed INT_MAX, causing a kernel warning and impractical memory requests (>8GB) during operations near the FD limit. The root cause involves ...

CVE-2025-39825

CVE-2025-39825 affects the Linux kernel SMB client. The vulnerability is a race with concurrent opens during rename(2): in addition to sending the rename to the server, the operation also closes deferred closes, waits for outstanding I/O, and marks existing open handles as deleted, which enlarges...

CVE-2025-39826

CVE-2025-39826 : In the Linux kernel, the net/rose_neigh struct’s use field was a non-atomic reference counter, risking use-after-free if the rose_neigh is freed while still referenced. The fix converts the field from unsigned short to refcount_t and switches code paths to rose_neigh_hold() and r...

CVE-2025-39877

The CVE-2025-39877 issue is a Linux kernel use-after-free in mm/damon/sysfs: state_show() reads kdamond->damon_ctx without holding damon_sysfs_lock, allowing a UAF when damon_ctx is freed under damon_sysfs_lock. A fix mirrors pid_show() by taking damon_sysfs_lock before dereferencing the conte...

CVE-2025-39914

CVE-2025-39914 affects the Linux kernel tracing subsystem. The issue occurs when a fault injection triggers a failure during chunk allocation in trace_pid_list_alloc, causing trace_pid_list_set to fail and potentially trigger a double registration of the same tracepoint (tracepoint_add_func). The...

CVE-2025-71154

CVE-2025-71154 concerns Linux kernel code for the rtl8150 USB driver. When usb_submit_urb() fails in async_set_registers(), the allocated async_req and URB are not freed, causing a memory leak. The completion callback async_set_reg_cb() frees these allocations only after a successful URB submissi...

CVE-2025-71229

CVE-2025-71229 is a Linux kernel vulnerability affecting the rtw88 Wi‑Fi driver (rtw_core_enable_beacon). The issue arises when the function reads 4 bytes from a non-4-byte-aligned address, which can trigger an alignment fault and crash the kernel on some systems. The fixed patch changes the acce...

CVE-2026-23013

CVE-2026-23013 pertains to the Linux kernel: in the octeon_ep_vf IRQ handling, the rollback path frees IRQs with a mismatched dev_id, using the literal 'oct' instead of the original ioq_vector. This can leave irqaction registrations alive, causing a use-after-free or crash when the interrupt fire...

CVE-2026-23019

CVE-2026-23019 describes a NULL dereference in the Linux kernel’s net: marvell: prestera code. The root cause is that prestera_devlink_alloc() calls devlink_priv() on the pointer returned by devlink_alloc() without verifying that the pointer is non-NULL; if allocation fails, this leads to a NULL ...