CVE-2016-10294

CVE-2016-10294 describes a local information-disclosure vulnerability in the Qualcomm power driver used in Android. The issue could allow a local malicious application to access data outside its permission levels by exploiting the Qualcomm power driver in affected Android kernels (Kernel-3.10 and...

CVE-2012-0058

The CVE-2012-0058 issue affects the Linux kernel up to version 3.2.2, in the kiocb_batch_free function of fs/aio.c, caused by incorrect iocb management. It allows local attackers to cause a denial of service (OOPS). Impact is confined to local execution, with availability as the primary effect de...

CVE-2016-8404

CVE-2016-8404 is an information-disclosure vulnerability in Android kernel components (ION subsystem, Binder, USB driver, and networking). A local malicious application could access data outside its permission levels after compromising a privileged process. Affected product/versions: Android kern...

CVE-2016-8473

CVE-2016-8473 is an information-disclosure vulnerability in the STMicroelectronics driver on Android (Kernel-3.10). A local, malicious app could access data outside its permissions after compromising a privileged process. Affected devices listed for this CVE include Nexus 5X and Nexus 6P. The pat...

CVE-2017-0536

CVE-2017-0536 concerns an information-disclosure flaw in the Synaptics touchscreen driver on Android, affecting Kernel-3.10 and Kernel-3.18. The vulnerability could let a local malicious process access data outside its privileges, requiring compromise of a privileged process. Publicly disclosed d...

CVE-2017-0629

CVE-2017-0629 is an information-disclosure vulnerability in the Qualcomm camera driver for Android, enabling a local malicious app to access data outside its permissions after compromising a privileged process. Affected: Android kernels 3.10/3.18 (Qualcomm camera driver). Base impact: partial con...

CVE-2021-4460

CVE-2021-4460 affects the Linux kernel drm/amdkfd path. The issue is a UBSAN shift-out-of-bounds warning when get_num_sdma_queues or get_num_xgmi_sdma_queues is 0, causing a shift by the operand’s bit width (undefined behavior). The fix changes the code to set num_sdma_queues or num_xgmi_sdma_que...

CVE-2022-50255

CVE-2022-50255 (Linux kernel tracing) : The issue affects the tracing subsystem where the synthetic event field, specifically the character array file[], could be read as a string without validating the user-space address. This caused crashes when reading from user memory during open/openat strin...

CVE-2022-50262

CVE-2022-50262 concerns the Linux kernel NTFS handling in the ntfs3 file system. Technical details in the connected documents show that when the NTFS BOOT record_size is negative (treated as a shift value), there is no validation of the resulting shift. This allows an invalid size to propagate in...

CVE-2022-50356

CVE-2022-50356 affects the Linux kernel’s net: sched: sfb path. When the default qdisc is sfb and dev_queue initialization fails during mqprio_init(), the code calls sfb_reset() to free resources, but the qdisc pointer (q->qdisc) may be NULL, leading to a general protection fault (null pointer...

CVE-2022-50381

CVE-2022-50381 targets the Linux kernel mempool_free crash observed during mdend/mempool usage in environments such as EulerOS and Unity Linux. The root cause is a race between wake-up of pending_writes and the subsequent free of bios (bio) in mempool_free, where bio_put could race with other act...

CVE-2022-50411

CVE-2022-50411 concerns the Linux kernel. A use-after-free vulnerability occurs in the ACPI sub-system: after a failed invocation of acpi_ds_call_control_method(), the thread’s next_walk_state is freed but not popped, causing acpi_ps_parse_aml() to obtain an invalid current walk state. The fix ma...

CVE-2022-50413

CVE-2022-50413 describes a Linux kernel issue in wifi/mac80211 where the assoc_data is freed and another copy of the AP (MLD) address must be used. The vulnerability is described in multiple sources as resolved, with the core problem being a use-after-free in mac80211 that can impact confidential...

CVE-2022-50417

The CVE-2022-50417 issue affects the Linux kernel (drm/panfrost) where panfrost_gem_create_with_handle() could return a BO whose only reference came from the handle, enabling a potential use-after-free if the handle was released by user space. Additionally, if panfrost_gem_mapping_get() in panfro...

CVE-2023-53179

The CVE-2023-53179 entry concerns the Linux kernel netfilter ipset component. Issue: the missing IP_SET_HASH_WITH_NET0 macro in ip_set_hash_netportnet.c caused an incorrect CIDR_POS(c) calculation, risking slab-out-of-bounds access due to integer underflow. Root cause: absence of IP_SET_HASH_WITH...

CVE-2023-53189

In CVE-2023-53189, the Linux kernel IPv6 addrconf subsystem has a fix for a potential refcount underflow affecting idev in addrconf_mod_rs_timer. The root cause is a timing gap where rs_timer may activate without holding idev, risking a refcount mismanagement. The fix is to hold idev when mod_tim...

CVE-2023-53262

Mode C: Affected software/issue details: CVE-2023-53262 concerns the Linux kernel with f2fs: fix scheduling while atomic in decompression path. The connected sources describe a root cause in the decompression path related to scheduling during atomic operations, evidenced by a long call trace endi...

CVE-2023-53304

CVE-2023-53304 concerns the Linux kernel netfilter nft_set_rbtree code. The advisory describes three concrete issues resolved by patching: 1) a lazy garbage-collection on insert that may fail to release the other half of an interval, impacting interval timing expiration walks; 2) incorrect use of...

CVE-2023-53375

The CVE refers to a Linux kernel tracing issue: when a tracing instance is removed, the error logs from that instance were not freed, causing a memory leak reported by kmemleak. The problem statement and example trace are provided in the initial document, and connected advisories (EulerOS kernel ...

CVE-2023-53445

CVE-2023-53445 concerns a refcount bug in the Linux kernel’s net/qrtr subsystem, specifically in qrtr_recvmsg(). The Syzbot report describes a-use-after-free scenario caused by a refcount increment on 0, leading to a potential crash. The issue is observed in a concurrent race between qrtr_recvmsg...

CVE-2025-38381

The CVE-2025-38381 issue affects the Linux kernel codepath handling cs40l50 uploads. Specifically, in cs40l50_upload_owt(), memory allocated via kmalloc() is not checked for allocation failure, which can lead to a NULL pointer dereference. The fix adds a NULL check and returns -ENOMEM on allocati...

CVE-2025-38394

The CVE-2025-38394 issue is in the Linux kernel HID path (appletkd/b appletb-kbd) where an input handler is registered to input core and then, if probe fails, freed memory remains in input_handler_list. This creates a use‑after‑free condition (UAF) in input_attach_handler during subsequent device...

CVE-2025-38534

CVE-2025-38534 affects the Linux kernel netfs copy-to-cache path used by Ceph with local caching. The issue: a write-to-cache request could hang after the backing filesystem completes the async DIO write because NETFS_RREQ_OFFLOAD_COLLECTION wasn’t set, causing an app to miss the collection notif...

CVE-2025-38589

The Connected documents confirm CVE-2025-38589 relates to a null-ptr-deref in neigh_flush_dev() within the Linux kernel, fixed by reverting to hash-table iteration in neigh_table_clear() after introducing per-netdev neighbour lists. The issue was triggered by neigh_table_clear() calling neigh_ifd...

CVE-2025-38626

CVE-2025-38626 affects the Linux kernel with the F2FS file system in foreground log-structured (lfs) mode. The issue arises in f2fs_map_blocks() where allocations can trigger block allocations aggressively under parallel aio/dio/bufio workloads, potentially exhausting space and causing a system p...

CVE-2025-38657

CVE-2025-38657 affects the Linux kernel’s wifi/rtw89 MCC path. The vulnerability arises because the user-controlled link_id parsed via debugfs can exceed BITS_PER_LONG, causing shift wrapping and potentially an out-of-bounds access. The issue is mitigated by capping the value to IEEE80211_MLD_MAX...

CVE-2025-38708

CVE-2025-38708 is a Linux kernel/DRBD issue where, with two-primaries enabled, concurrent writes could trigger a use-after-free due to a missing kref_get in handle_write_conflicts. The root cause is not in regular operation but in the code path for detecting concurrent writes on the DRBD layer, l...

CVE-2025-38711

CVE-2025-38711 : Linux kernel vulnerability fixed in smb/server deadlock scenario when linking with ReplaceIfExists. If smb2_create_link() is called with ReplaceIfExists and the target name exists, ksmbd_vfs_kern_path_locked() locks the parent, then ksmbd_vfs_remove_file() deletes the file, and k...

CVE-2025-39685

Summary (CVE-2025-39685) : In the Linux kernel, the comedi pcl726 driver could trigger an out-of-bounds when an excessively large IRQ number was passed (example 0x80008000). The fix adds an interrupt number check to prevent passing an IRQ number that is too large. It notes that if it->options[...

CVE-2025-39746

CVE-2025-39746 affects the Linux kernel device driver stack for wifi/ath10k on PCIe. When the hardware becomes unreliable, ath10k can lose PCIe connectivity, causing WMI command timeouts and a restart loop that may trigger a watchdog timeout and a system crash on suspend. The advisory describes a...

CVE-2025-39912

This CVE (CVE-2025-39912) affects the Linux kernel nfs/localio path. The issue occurs when the nfsd filecache code releases the nfsd_file before creds are properly handled, triggering a BUG_ON in __put_cred via current->cred. The vulnerability is resolved by restoring credentials before releas...

CVE-2025-39933

The Linux kernel SMB client (recv_done) is affected by CVE-2025-39933 due to improper verification of data_offset, data_length and remaining_data_length in recv_done. This root cause can lead to memory corruption in the SMB client path. Public advisories reference kernel fixes for this issue; rem...

CVE-2025-39945

The CVE-2025-39945 entry concerns a race in the Linux kernel cnic subsystem where a use-after-free can occur if a delayed work item (delete_task) remains active during cnic_dev deallocation. The root cause is that cancel_delayed_work() does not guarantee the delayed work item has finished if it i...

CVE-2025-39949

The CVE-2025-39949 issue affects the Linux kernel QED driver path (drivers/net/ethernet/qlogic/qed/qeddebug.c) where qed_protection_override_dump may process more GRC elements than the allocated buffer, causing a write past the end and a kernel panic (BUG: unable to handle kernel paging request a...

CVE-2025-71104

The CVE-2025-71104 entry concerns the Linux kernel KVM on x86 with the HV timer. Root cause: when advancing the guest APIC timer expiration in periodic mode, adding a period to a past target expiration can create an unbounded sequence of hrtimer IRQs; if the guest is paused, this can trigger host...

CVE-2025-71107

CVE-2025-71107: In Linux kernel F2FS, a race allows f2fs_put_super() to run before all node-page reads complete, causing an apparent filesystem reference-count leak during unmount (kernel.c fs/f2fs/super.c:1939). Mitigation: upstream patch adds f2fs_wait_on_all_pages() for F2FS_RD_NODE to ensure ...

CVE-2025-71315

The CVE-2025-71315 vulnerability concerns the Linux kernel’s drm/vkms path. Connected sources confirm a concrete fix: vkms’ vblank timer was replaced with DRM’s vblank timer implementation, removing the hrtimer from vkms_output and delegating to the DRM vblank timeout path via handle_vblank_timeo...

CVE-2026-23006

The CVE-2026-23006 issue in the Linux kernel ASoC: tlv320adcx140 driver was fixed by correcting a null pointer dereference in adcx140_priv when snd_soc_component is only used for dev access. The fix removes the null pointer path by properly initializing/handling snd_soc_component. Public updates ...

CVE-2026-23012

CVE-2026-23012 affects the Linux kernel (mm/damon/core): a use-after-free in damon_call_control handling when a DAMON context is inactive. If damon_call() runs against a non-running context, the call returns an error but the damon_call_control object remains linked to the context’s call_controls ...

CVE-2026-23072

CVE-2026-23072: Linux kernel l2tp memleak in l2tp_udp_encap_recv() fixed by adding proper error handling after protocol version validation; the patch ensures l2tp_session_put() is called to avoid leaking objects (l2tp_session, l2tp_tunnel, sock). References indicate the commit addresses a memory‑...

CVE-2026-23082

Public technical details about CVE-2026-23082 are not provided in the supplied documents. Monitor for updates from vendors; no specifics on affected components, impact, or fixes can be stated from the given materials.

CVE-2026-23085

CVE-2026-23085 affects the Linux kernel irqchip/gic-v3-its on 32-bit ARM with CONFIG_ARM_LPAE, where lowmem allocations could be backed by physical memory above 4 GB. The ITS driver stored a 32-bit address in an unsigned long, triggering truncation. The fix changes the itt_addr and related physic...

CVE-2026-23086

Technical details about CVE-2026-23086 are not publicly available in the provided connected documents; monitor vendor advisories and official CVE writeups for updates.

CVE-2026-23102

CVE-2026-23102 affects the ARM64/Linux kernel path arm64/fpsimd: signal, where restoring SVE signal context with SME enabled can put a task into an invalid state. The vulnerability allows out-of-bounds memory reads or a potential fatal fault, or task termination via SIGKILL, if SVE signal data is...

CVE-2026-23127

CVE-2026-23127 affects the Linux kernel perf subsystem. The issue is caused by a refcount warning in perf_mmap_rb() when updating event->mmap_count during group-member mmap creation with PERF_FLAG_FD_OUTPUT. Specifically, refcount_inc(&event->mmap_count) can run when mmap_count is 0, trigge...

CVE-2026-23135

CVE-2026-23135 affects the Linux kernel in the wifi ath12k driver. The issue arises in dma_free_coherent() pointer handling: dma_alloc_coherent() stores addresses in XXX_unaligned fields, but those addresses are not consistently reused when freeing the buffer. The vulnerability is resolved by pat...

CVE-2026-23208

CVE-2026-23208 — Linux kernel ALSA USB audio OOB write fix . The issue arose when user-provided ALSA USB audio parameters led to an out-of-bounds write: calculated frames (packsize[0] * packets) exceeded URB buffer, triggering KASAN slab-out-of-bounds in sound/usb/pcm.c. The patch adds a safety c...

CVE-2026-23224

CVE-2026-23224 relates to the Linux kernel EROFS UAF race on file-backed mounts with the directio option. The issue arises in a race between z_erofs_read_folio, erofs_fileio_submit_bio, and related IO workqueue paths, where a dio ki_complete path frees an iocb/rq while access to the underlying fi...

CVE-2026-23288

The CVE-2026-23288 issue is in the Linux kernel’s accel/amdxdna component. It describes an out-of-bounds write caused by clearing the command header with memset() before validating the remaining space in a command slot, when the slot space is smaller than the header. The root cause is performing ...

CVE-2026-23296

CVE-2026-23296 affects the Linux kernel SCSI core, specifically a refcount leak in tagset_refcnt that can cause a hang when tearing down a SCSI host (e.g., iscsid hang during SCSI scanning). The vulnerability is local in nature with a base score of 5.5 (MEDIUM); exploitation details are not provi...