CVE-2018-18281

CVE-2018-18281 is a Linux kernel local vulnerability due to a race in mremap() where TLB flushes can occur too late, potentially allowing a process to access memory after it has been freed. The issue stems from moving page tables during mremap(), where stale TLB entries may remain until after the...

CVE-2018-18445

CVE-2018-18445 affects the Linux kernel in 4.14.x–4.18.x; prior to 4.18.13, the BPF verifier’s adjust_scalar_min_max_vals mishandles 32-bit right shifts, enabling out-of-bounds memory accesses. Several advisories confirm the issue and reference the fix in 4.18.13 (and backported patches for earli...

CVE-2019-14898

CVE-2019-14898 refers to an incomplete fix for CVE-2019-11599 in the Linux kernel prior to 5.0.10. The issue allows a local attacker to trigger a race between mmget_not_zero() and get_task_mm(), which can lead to information disclosure, denial of service, or other unspecified impacts as described...

CVE-2019-15807

CVE-2019-15807 : In the Linux kernel prior to 5.1.13, there is a memory leak in drivers/scsi/libsas/sas_expander.c when SAS expander discovery fails, which can cause a BUG and result in a denial of service. The issue is addressed in kernel 5.1.13 as indicated by ChangeLog-5.1.13. Affected product...

CVE-2024-25744

In CVE-2024-25744, Linux kernel versions before 6.6.7 are vulnerable: an untrusted VMM can trigger int80 syscall handling at any point due to code in arch/x86/coco/tdx/tdx.c and arch/x86/mm/mem_encrypt_amd.c. This is a local-privilege impact condition as described by the advisory, with a base sco...

CVE-2019-20810

CVE-2019-20810 affects the Linux kernel’s go7007 driver: go7007_snd_init in drivers/media/usb/go7007/snd-go7007.c fails to call snd_card_free on a failure path, causing a memory leak (CID-9453264ef586). Public docs specify this vulnerability exists in kernels before 5.6. The described remediation...

CVE-2022-3640

CVE-2022-3640 is a Linux Kernel issue affecting the Bluetooth layer. The vulnerability stems from a use-after-free in the l2cap_conn_del function in net/bluetooth/l2cap_core.c. The Astra Linux bulletin confirms the same flaw and notes affected kernel lines (linux-5.10, linux-5.15), indicating the...

CVE-2022-41222

CVE-2022-41222 : A use-after-free in mm/mremap.c of the Linux kernel (prior to 5.13.3) enables stale TLB access due to an rmap lock not being held during a PUD move. Impact is described as potential denial of service, memory corruption, privilege escalation, or information leak when a local user ...

CVE-2023-1118

CVE-2023-1118 is a use-after-free in the Linux kernel’s infrared (ene_ir) remote-control driver. The flaw occurs when a user detaches an rc device, enabling a local user to crash the system and potentially escalate privileges. The description appears consistently across sources (e.g., Astra Linux...

CVE-2023-37453

CVE-2023-37453: Linux kernel USB subsystem contains an out-of-bounds read in read_descriptors() within drivers/usb/core/sysfs.c, which can crash the system when handling a crafted USB device. The connected documents provide description and impact but do not specify a public patch/version. Monitor...

CVE-2024-50081

CVE-2024-50081 is confirmed in connected advisory: the Linux kernel vulnerability in blk-mq was due to race where q->tag_set may not be initialized when the cpuhp handler runs, triggering an oops. The MiracleLinux AXSA advisory (kernel 5.14.0-570.12.1.el9_6) explicitly lists CVE-2024-50081 and...

CVE-2015-8660

CVE-2015-8660 targets the ovl_setattr path in Linux overlayfs (fs/overlayfs/inode.c) up to kernel 4.3.3. The issue arises from attempting to merge distinct setattr operations, allowing local users to bypass access restrictions and modify attributes of arbitrary overlay files via a crafted applica...

CVE-2022-0480

CVE-2022-0480 is a Linux kernel vulnerability in filelock_init (fs/locks.c) where memory exhaustion can occur because memcg does not limit the number of POSIX file locks. Connected documents confirm the issue across multiple Linux distributions (Astra Linux, AlmaLinux, IBM Power PowerVM advisory)...

CVE-2022-2153

CVE-2022-2153 is a vulnerability in the Linux kernel’s KVM related to setting a SynIC IRQ. The issue allows a misbehaving VMM to write to SYNIC/STIMER MSRs, which can cause a NULL pointer dereference and a kernel oops, enabling an unprivileged local attacker on the host to trigger a denial of ser...

CVE-2024-26934

CVE-2024-26934: Linux kernel USB core deadlock in usb_deauthorize_interface() when sysfs attribute callbacks hold a parent device lock. Affected: drivers/usb/core/sysfs.c (interface_authorized_store) acquiring parent device lock; fix uses sysfs_break_active_protection() to avoid waiting for the c...

CVE-2017-17807

CVE-2017-17807 : Linux kernel KEYS subsystem vulnerability where the request_key() path can bypass access control when adding a key to the current task’s default request-key keyring. An unpatched kernel (pre-4.14.6) could allow a local attacker to craft a sequence of system calls to insert keys i...

CVE-2018-1066

CVE-2018-1066 affects the Linux kernel prior to 4.11, where a NULL pointer dereference in fs/cifs/cifsencrypt.c:setup_ntlmv2_rsp() can cause a kernel panic on clients mounting a CIFS server, due to mishandling of an empty TargetInfo field in NTLMSSP during session recovery. Connected documents co...

CVE-2020-12652

CVE-2020-12652 concerns the Linux kernel. The issue is in the function "__mptctl_ioctl" in drivers/message/fusion/mptctl.c, where an operation may hold an incorrect lock during an ioctl, enabling a local race condition (double fetch). The vulnerability affects Linux kernels prior to 5.4.14. Explo...

CVE-2023-31084

The CVE-2023-31084 issue affects Linux kernel 6.2 in drivers/media/dvb-core/dvb_frontend.c. The root cause is a blocking operation when a task is not TASK_RUNNING: in dvb_frontend_get_event wait_event_interruptible checks dvb_frontend_test_event(fepriv, events) and, if false, down(&fepriv->sem...

CVE-2023-5633

CVE-2023-5633 is documented in an IBM QRadar SIEM bulletin as a Linux Kernel use-after-free vulnerability: a memory-management flaw in handling memory objects for GEM objects can allow a local, authenticated attacker to gain elevated privileges within a VM with 3D acceleration (VMware guest). The...

CVE-2017-1000364

CVE-2017-1000364 affects the Linux kernel stack guard page (4k) so the stack-pointer can jump over the guard, enabling local privilege escalation. Affected: Linux kernel 4.11.5 and earlier. Impact: privilege escalation via stack-clash-like behavior; no remote vector described. Root cause: insuffi...

CVE-2019-19074

The CVE-2019-19074 entry describes a memory leak in the ath9k_wmi_cmd() function (drivers/net/wireless/ath/ath9k/wmi.c) of the Linux kernel up to version 5.3.11, which can be exploited to cause a denial of service via memory consumption. Root cause is a leak within ath9k_wmi_cmd() that enables me...

CVE-2022-1679

CVE-2022-1679 is a use-after-free flaw in the Linux kernel’s Atheros ath9k_htc driver. Connected advisories specify a use-after-free in ath9k_htc_wait_for_target (and related notes) that can allow a local user to crash or escalate privileges. Affected component: Linux kernel wireless driver (ath9...

CVE-2022-42719

Summary of CVE-2022-42719 : A use-after-free in the mac80211 wireless stack when parsing a multi-BSSID element in the Linux kernel (versions 5.2–5.19.14) could allow a remote attacker who can inject WLAN frames to crash the kernel and potentially execute code. The vulnerability impacts the Linux ...

CVE-2023-39198

CVE-2023-39198 describes a race condition in the Linux kernel’s QXL driver. The qxl_mode_dumb_create() path dereferences the qxl_gem_object_create_with_handle() result while the handle is the sole reference, enabling a caller to guess the handle value and trigger a use-after-free. This can lead t...

CVE-2024-53168

CVE-2024-53168 is a Linux kernel vulnerability related to a use-after-free (UAF) in sunrpc over a kernel TCP socket. The issue, illustrated by a KASAN report (slab-use-after-free in tcp_write_timer_handler), was fixed in the kernel to address a UAF in sunrpc’s TCP path. Connected advisories (SUSE...

CVE-2017-1000112

CVE-2017-1000112 describes a local memory corruption in the Linux kernel UFO (UDP Fragmentation Offload) path. In ip_ufo_append_data() the code can flip from UFO to non-UFO between two send() calls, causing negative copy calculations, fragmentation, and ultimately skb_copy_and_csum_bits() writing...

CVE-2019-15924

CVE-2019-15924 : The issue is in the Linux kernel before 5.0.11, where fm10k_init_module in drivers/net/ethernet/intel/fm10k/fm10k_main.c can dereference NULL when an alloc_workqueue failure occurs due to missing -ENOMEM handling. This can lead to a crash or potential denial of service on affecte...

CVE-2020-15437

CVE-2020-15437 affects the Linux kernel up to version 5.7.x, where a NULL pointer dereference in drivers/tty/serial/8250/8250_core.c:serial8250_isa_init_ports() can be triggered by an uninitialized p->serial_in, enabling local denial of service. Affected component: kernel serial driver (8250) ...

CVE-2022-2663

CVE-2022-2663 is a Linux kernel issue in nf_conntrack_irc where message handling can be confused, causing incorrect matching and potentially allowing a firewall bypass when users operate with unencrypted IRC with nf_conntrack_irc enabled. The primary affected component is nf_conntrack_irc within ...

CVE-2022-3108

CVE-2022-3108 is a Linux kernel vulnerability affecting kernels up to 5.16-rc6 where kfd_parse_subtype_iolink (drivers/gpu/drm/amd/amdkfd/kfd_crat.c) does not check the return value of kmemdup(). The issue is a missing return-value check in memory copy logic, which could enable memory corruption ...

CVE-2024-35877

Technical details about CVE-2024-35877 are not provided in the connected documents. Public disclosures in the MiracleLinux advisory reference this CVE but do not include kernel-level root causes, impact specifics, or remediation details.

CVE-2024-43907

CVE-2024-43907 relates to Linux kernel: in the DRM AMDGPU driver, a null pointer could be dereferenced in drm/amdgpu/pm during apply_state_adjust_rules. The fix adds a pointer check to avoid dereferencing NULL, addressing a potential crash. The initial description shows a concrete fix for null de...

CVE-2017-1000405

CVE-2017-1000405 affects Linux kernel THP handling in versions 2.6.38–4.14. A flawed use of pmd_mkdirty() in touch_pmd() can be reached via get_user_pages(), allowing pmds to become dirty without a COW cycle. This enables overwriting read‑only huge pages (including zero pages and sealed SHMEM map...

CVE-2022-42720

CVE-2022-42720 concerns the Linux kernel mac80211 WLAN stack. It describes refcounting bugs in multi-BSS handling that can trigger use-after-free when WLAN frames are injected, potentially enabling local code execution. Affected are kernel versions 5.1–5.19.x prior to 5.19.16; several distributio...

CVE-2023-4147

CVE-2023-4147 is a local-privilege-escalation use-after-free in the Linux kernel nf_tables/netfilter code. The flaw occurs when adding a rule with NFTA_RULE_CHAIN_ID, where nft_tables_delrule or related NFT rule handling can release objects in a way that leaves a dangling pointer, enabling local ...

CVE-2026-46333

CVE-2026-46333 concerns a logic bug in the Linux kernel’s ptrace access check (__ptrace_may_access). When a thread lacks an MM pointer, ptrace_may_access uses a cached “last dumpable” flag, which can be bypassed by CAP_SYS_PTRACE to override. This can enable local privilege escalation or informat...

CVE-2016-10229

The CVE-2016-10229 issue affects the Linux kernel’s UDP handling: udp.c in versions before 4.5 contains an unsafe second checksum calculation when a recv call uses MSG_PEEK, enabling remote code execution. Reports and advisories (e.g., ALAS-2017-832, Alpine, Debian, Broadcom/Big-IP advisories) co...

CVE-2018-19824

CVE-2018-19824 is a local-use-after-free in the Linux kernel’s ALSA USB audio driver. A local attacker could trigger the flaw by attaching a malicious USB sound device (configured with zero interfaces), which is mishandled during usb_audio_probe in sound/usb/card.c. Affected software is the Linux...

CVE-2021-38166

CVE-2021-38166 affects the Linux kernel (bpf/hashtab.c) up to 5.13.8. An integer overflow can cause an out-of-bounds write when many elements occupy a single bucket, potentially enabling local denial-of-service or arbitrary-code execution. Exploitation is mitigated by CAP_SYS_ADMIN requirements; ...

CVE-2021-38205

CVE-2021-38205 affects the xilinx_emaclite driver in the Linux kernel. The vulnerability arises because the driver prints a real IOMEM/kernel pointer, which can aid attackers in bypassing ASLR and facilitate information disclosure. Affected state is Linux kernels before 5.13.3; remediation is to ...

CVE-2023-52429

CVE-2023-52429 affects the Linux kernel driver path drivers/md/dm-table.c. The issue arises in dm_table_create’s alloc_targets path where, due to a missing check for struct dm_ioctl.target_count, it can allocate more than INT_MAX bytes and crash. Public sources in connected Nessus plugins confirm...

CVE-2023-6610

CVE-2023-6610 is an out-of-bounds read in Linux kernel’s smb2_dump_detail() (fs/smb/client/smb2ops.c). The vulnerability can allow a local attacker to crash the kernel or leak internal kernel information. Connected advisories (e.g., MiracleLinux/Tencent/Tenable Nessus entries) confirm the issue a...

CVE-2018-20854

CVE-2018-20854 affects the Linux kernel up to version 4.20, where an off-by-one error in drivers/phy/mscc/phy-ocelot-serdes.c can cause a ctrl->phys out-of-bounds read. The issue is rooted in a boundary condition in that SerDes driver, leading to potential information disclosure or instability...

CVE-2019-19072

The CVE-2019-19072 issue is a Linux kernel memory leak in the predicate_parse() function (kernel/trace/trace_events_filter.c) that affects kernels up to 5.3.11, potentially enabling local attackers to cause a denial of service via memory consumption. The connected Nessus entries confirm the same ...

CVE-2021-20177

CVE-2021-20177: Linux kernel flaw in string matching for packets; a privileged user (root or CAP_NET_ADMIN) inserting iptables rules can trigger a kernel panic. Affected kernels before 5.5-rc1. Mitigation is to apply a patch/upstream fix (5.5-rc1 or newer).

CVE-2021-35477

The CVE-2021-35477 vulnerability affects the Linux kernel (through 5.13.7): an unprivileged BPF program can read sensitive kernel memory via a Speculative Store Bypass side-channel due to a preempting store not reliably ordering before an attacker-controlled store. The issue is rooted in the eBPF...

CVE-2021-3753

CVE-2021-3753 describes a race in the Linux kernel’s vt_k_ioctl() (vt_ioctl.c) that may cause an out-of-bounds read in vt as vc_mode write access is not protected by a lock. Impact is listed as data confidentiality; exploitation details are not provided in the supplied documents. Connected source...

CVE-2022-26490

CVE-2022-26490 affects the Linux kernel ST21NFCA NFC driver (st21nfca_connectivity_event_received in drivers/nfc/st21nfca/se.c) up to and including kernel versions prior to the patched releases. The issue is a buffer overflow caused by untrusted length parameters (EVT_TRANSACTION), which can lead...

CVE-2024-43909

Technical details about CVE-2024-43909 (AMDGPU SMU7 null pointer dereference) are not provided in the connected documents. The initial description notes a fix but lacks vendor/product/version specifics or remediation steps beyond general description. Monitor for updates.