CVE-2017-7184

The CVE-2017-7184 issue affects the Linux kernel xfrm subsystem, where xfrm_replay_verify_len in net/xfrm/xfrm_user.c up to 4.10.6 does not validate certain size data after an XFRM_MSG_NEWAE update, enabling a local attacker with CAP_NET_ADMIN to cause a heap-based out-of-bounds access and potent...

CVE-2019-15218

CVE-2019-15218: Linux kernel before 5.1.8 contains a NULL pointer dereference in drivers/media/usb/siano/smsusb.c triggered by a malicious USB device. Affected is the Linux kernel version range up to 5.1.7; exploitation could lead to a crash or denial of service on affected systems. Remediation i...

CVE-2021-35477

The CVE-2021-35477 vulnerability affects the Linux kernel (through 5.13.7): an unprivileged BPF program can read sensitive kernel memory via a Speculative Store Bypass side-channel due to a preempting store not reliably ordering before an attacker-controlled store. The issue is rooted in the eBPF...

CVE-2023-40283

CVE-2023-40283 affects the Linux kernel before 6.4.10. It stems from a use-after-free in l2cap_sock_release (net/bluetooth/l2cap_sock.c) where the children of an sk are mishandled. The vulnerability allows a local attacker to run arbitrary code or cause a denial of service by crafting a targeted ...

CVE-2019-19066

CVE-2019-19066 is a memory-leak issue in the Linux kernel: bfad_im_get_stats() in drivers/scsi/bfa/bfad_attr.c (up to 5.3.11) can leak memory and enable denial-of-service via repeated bfa_port_get_stats() failures. Affected component: Linux kernel bfad_attr/bfad_attr. Root cause is a memory leak ...

CVE-2021-28972

CVE-2021-28972 affects the Linux kernel RPA PCI Hotplug driver (drivers/pci/hotplug/rpadlpar_sysfs.c) up to version 5.11.8. It is a user‑tolerable buffer overflow caused by improper handling of drc_name termination in add_slot_store/remove_slot_store, allowing userspace to write into the kernel s...

CVE-2022-41858

The CVE-2022-41858 entry concerns a NULL pointer dereference in the Linux kernel slip driver path, specifically detaching in sl_tx_timeout (drivers/net/slip/slip.c). The connected Astra Linux bulletin reiterates the same description for the Linux kernel 5.x variant, confirming the vulnerability i...

CVE-2024-43908

The CVE-2024-43908 issue is confirmed in the Linux kernel’s DRM/AMDGPU code: a null pointer dereference in ras_manager that can arise when ras_manager is consulted. The published fix is to check ras_manager before using it, preventing dereference of a null pointer. The connected Nessus advisories...

CVE-2023-26545

CVE-2023-26545 affects the Linux kernel’s MPLS implementation: a double-free in net/mpls/af_mpls.c can occur on allocation failure when renaming a device during sysctl table relocation, prior to kernel 6.1.13. The issue enables local exploitation with impact on availability (denial of service) as...

CVE-2023-6535

CVE-2023-6535 affects the Linux kernel NVMe driver. A crafted TCP packet sequence over NVMe over TCP may cause a NULL pointer dereference in the NVMe driver, leading to a kernel panic and denial of service. Connected documents confirm the same vulnerability text and its presence in multiple advis...

CVE-2024-50085

CVE-2024-50085 affects the Linux kernel’s MPTCP path management, specifically the UaF read in mptcp_pm_nl_rm_addr_or_subflow() within net/mptcp/pm_netlink.c. The issue was reported by Syzkaller as a slab-use-after-free in mptcp_pm_nl_rm_addr_or_subflow (trace shows allocation via subflow_create_c...

CVE-2017-7533

CVE-2017-7533 describes a race condition in the Linux kernel where inotify_handle_event and vfs_rename concurrently executing can be exploited by a local attacker to cause memory corruption, a denial of service, or privilege escalation. It affects Linux kernel versions up to 4.12.4; exploitation ...

CVE-2017-6214

CVE-2017-6214 affects the Linux kernel TCP splice/tcp_splice_read handling of urgent data (URG flag). The vulnerability can cause a denial of service via an infinite loop/soft lockup in the kernel when processing certain TCP packets. Affected are Linux kernels older than 4.9.11; patching to 4.9.1...

CVE-2019-19922

CVE-2019-19922 affects the Linux kernel sched subsystem (kernel/sched/fair.c) and is triggered when cpu.cfs_quota_us is in use (e.g., with Kubernetes). The issue allows a local attacker to cause a denial of service for non–CPU-bound applications by generating work that triggers slice expiration, ...

CVE-2022-3628

CVE-2022-3628 is a buffer overflow in the Linux kernel Broadcom Full MAC Wi‑Fi driver (brcmfmac) that triggers when a user connects a malicious USB device. The linked documents consistently describe it as a local overflow that could crash the system or escalate privileges. Affected: Linux kernel ...

CVE-2018-10878

CVE-2018-10878 is confirmed in the Linux kernel ext4 filesystem. The connected Nessus advisories reference a local attacker mounting a crafted ext4 image to trigger an out-of-bounds write, leading to denial of service and potential other impacts. Unity Linux UTSA advisories (e.g., UTSA-2026-00113...

CVE-2019-3819

CVE-2019-3819 : In the Linux kernel HID subsystem, hid_debug_events_read() may enter an infinite loop under certain user-supplied parameters, causing a denial of service via system lockup. The issue is accessible to root (local) and affects Linux kernels from 4.18 onward in affected lines. Public...

CVE-2021-42252

The CVE-2021-42252 issue affects the Linux kernel up to version 5.14.5 in aspeed_lpc_ctrl_mmap (drivers/soc/aspeed/aspeed-lpc-ctrl.c). A memory overwrite can occur via the Aspeed LPC control interface when a comparison uses non-memory-size values, enabling a local attacker to potentially escalate...

CVE-2017-18551

CVE-2017-18551 : The Linux kernel contains an out-of-bounds write in drivers/i2c/i2c-core-smbus.c, specifically in the function i2c_smbus_xfer_emulated, affecting kernels prior to 4.14.15. The vulnerability can enable local attacker privilege/escalation due to memory corruption. Remediation is to...

CVE-2018-5333

This CVE affects Linux kernel up to 4.14.13, specifically the rds_cmsg_atomic() path in net/rds/rdma.c. The root cause is that rm->atomic.op_active is not cleared, causing rds_atomic_free_op() to dereference a null page link via set_page_dirty(), leading to a NULL pointer dereference. The vuln...

CVE-2020-10773

CVE-2020-10773 is a local-information-disclosure flaw in the Linux kernel for s390/s390x memory-management. The issue stems from incorrect writes to the /proc/sys/vm/cmm_timeout file, enabling a local attacker to read kernel data. The provided documents confirm the vulnerability and its affected ...

CVE-2021-28952

CVE-2021-28952 concerns a buffer overflow in the Linux kernel’s sound/soc/qcom/sdm845.c soundwire driver when an unexpected port ID is encountered. Affected: Linux kernel 5.11.8 and earlier (through 5.11.x); root cause: buffer overflow in the driver. Impact described in sources as potentially ena...

CVE-2016-0758

CVE-2016-0758 concerns an integer overflow in the Linux kernel’s ASN.1 DER decoder (lib/asn1_decoder.c) that could allow local privilege escalation. The Android 2016-10-05 bulletin documents this as a kernel ASN.1 decoder elevation-of-privilege issue with Critical severity, affecting Nexus device...

CVE-2017-18509

CVE-2017-18509 targets the Linux kernel (net/ipv6/ip6mr.c). By sending a specific socket option, an attacker can manipulate a kernel pointer in ip6_mroute_* and trigger an inet_csk_listen_stop general protection fault, potentially enabling arbitrary code execution with root privileges. Impact can...

CVE-2019-16413

CVE-2019-16413 : Affects the Linux kernel prior to 5.0.4 where the 9p filesystem does not properly protect i_size_write(), causing i_size_read() to loop indefinitely and trigger a denial of service on SMP systems. The public evidence ties this to a kernel patch in ChangeLog-5.0.4 and the commit r...

CVE-2019-19927

CVE-2019-19927 affects Linux kernel 5.0.0-rc7 (as in ubuntu/linux.git) where mounting a crafted f2fs image and performing certain operations can cause slab-out-of-bounds read access in ttm_put_pages (ttm_page_alloc.c). The issue is linked to vmwgfx/ttm modules and may enable local, non-privileged...

CVE-2019-19965

CVE-2019-19965 is a vulnerability in the Linux kernel (affecting the SAS SAS discover path) where a NULL pointer dereference occurs in drivers/scsi/libsas/sas_discover.c due to mishandling of port disconnection during discovery, related to a PHY down race condition (CID-f70267f379b5). The Unity L...

CVE-2021-4149

CVE-2021-4149: Local privilege escalation via Linux kernel btrfs deadlock. Affects btrfs_alloc_tree_b in fs/btrfs/extent-tree.c where an improper lock operation can deadlock, enabling a local user to cause a denial-of-service. Debian LTS advisory DLA-3065-1 lists CVE-2021-4149 and notes the patch...

CVE-2023-6817

CVE-2023-6817 is a use-after-free in the Linux kernel nf_tables netfilter component (PIPAPO: Pile Packet Policies). The issue arises from nft_pipapo_walk not skipping inactive elements during a set walk, which can cause double deactivations of PIPAPO elements and lead to use-after-free. Evidence ...

CVE-2017-1000111

CVE-2017-1000111 describes a heap/out-of-bounds race in the Linux kernel’s AF_PACKET socket handling (packet_set_ring) that can be exploited by a local user possessing CAP_NET_RAW to elevate privileges. The issue arises when a socket option changes socket state and races with safety checks; the r...

CVE-2018-10880

CVE-2018-10880 is a Linux kernel/ext4 vulnerability: a stack-out-of-bounds write in ext4_update_inline_data() when mounting or writing to a crafted ext4 image, leading to a potential system crash and DoS. The issue originates from insufficient bounds checking in ext4’s handling of inline data dur...

CVE-2018-7740

CVE-2018-7740 affects the Linux kernel, where the resv_map_release function in mm/hugetlb.c up to version 4.15.7 is vulnerable. A local attacker can cause a denial of service by crafting an app that uses mmap and a large pgoff with remap_file_pages, triggering a BUG. The connected Nessus reports ...

CVE-2021-3764

Summary: CVE-2021-3764 is a memory-leak DoS in the Linux kernel related to the ccp_run_aes_gcm_cmd() function in the CCP crypto path (ccp-ops). Connected sources (Astra Linux advisories and Amazon Linux advisories) corroborate a memory-leak/DoS impact similar to CVE-2019-18808, with the highest t...

CVE-2022-3435

CVE-2022-3435 affects the Linux kernel: an out-of-bounds read in fib_nh_match (net/ipv4/fib_semantics.c) could be exploited remotely by a remote, unauthenticated/partially privileged actor per the CVSS vector. The issue is rated CVSS v3.1 base 4.3 (Medium) with low impact to confidentiality and n...

CVE-2023-39189

CVE-2023-39189 is documented in connected sources as affecting the Linux kernel Netfilter component, specifically the nftables path nf_osf_match_one(), which can trigger an out-of-bounds read leading to a crash or information disclosure. The vulnerability is reported across multiple advisories (e...

CVE-2024-53141

CVE-2024-53141 affects the Linux kernel netfilter ipset bitmap_ip_uadt logic. When tb[IPSET_ATTR_IP_TO] is absent but tb[IPSET_ATTR_CIDR] is present, the ip and ip_to values can be swapped, causing a missing range check for ip. The fix adds the missing range checks and removes unnecessary ones. C...

CVE-2018-20961

CVE-2018-20961 affects the Linux kernel prior to 4.16.4. It is a double-free in the f_midi_set_alt function of drivers/usb/gadget/function/f_midi.c (f_midi driver) that may allow a denial of service or potentially other impacts. Affected versions are Linux kernel before 4.16.4; remediation is pro...

CVE-2019-19058

CVE-2019-19058 affects the Linux kernel, caused by a memory leak in alloc_sgtable() in drivers/net/wireless/intel/iwlwifi/fw/dbg.c. The leak can trigger memory exhaustion via alloc_page() failures, enabling a local attacker to cause DoS. The vulnerability is documented as present in kernel builds...

CVE-2023-1075

CVE-2023-1075 is a Linux kernel TLS TLS: tls_is_tx_ready vulnerability. The issue arises from tls_is_tx_ready() performing a flawed check of list emptiness on a tls-related list, allowing a type-confused entry to be treated as a valid list_head and potentially leaking the last byte of a field tha...

CVE-2017-17805

CVE-2017-17805 affects the Linux kernel prior to 4.14.8. The Salsa20 cipher implementation (crypto/salsa20_generic.c and arch/x86/crypto/salsa20_glue.c) mishandles zero-length inputs, allowing a local attacker to use the AF_ALG-based skcipher interface to trigger uninitialized memory free and ker...

CVE-2017-7542

CVE-2017-7542 is a Linux kernel vulnerability described as an integer overflow in ip6_find_1stfragopt() (net/ipv6/output_core.c) that can be triggered by a local attacker who can open a raw socket, potentially causing a denial of service via an infinite loop. The initial description cites Linux k...

CVE-2019-12817

CVE-2019-12817 affects the PowerPC Linux kernel: a bug in arch/powerpc/mm/mmu_context_book3s64.c before 5.1.15 can allow unrelated processes to read/write each other’s memory via an mmap above 512 TB on a subset of PowerPC systems. The issue is limited to those platforms; impact is memory confide...

CVE-2019-19073

CVE-2019-19073 is supported by connected docs: memory leaks in Linux kernel drivers/net/wireless/ath/ath9k/htc_hst.c through 5.3.11 allow local attackers to trigger wait_for_completion_timeout() failures and cause memory-based DoS. The issue involves multiple functions (htc_config_pipe_credits(),...

CVE-2023-6111

CVE-2023-6111 is a use-after-free in the Linux kernel netfilter nf_tables GC path: the function nft_trans_gc_catchall can fail to remove a catchall set element from catchall_list when sync is true, allowing a catchall element to be freed multiple times. This enables local privilege escalation. Th...

CVE-2023-7192

CVE-2023-7192 : Linux Kernel contains a memory-leak/denial-of-service issue in ctnetlink_create_conntrack() within net/netfilter/nf_conntrack_netlink.c. A local attacker with CAP_NET_ADMIN can trigger a refcount overflow to cause DoS. The initial documents confirm the vulnerability and its local-...

CVE-2016-10906

CVE-2016-10906 affects the Linux kernel’s arc_emac_main.c (drivers/net/ethernet/arc) with a use-after-free caused by a race between arc_emac_tx and arc_emac_tx_clean. The issue occurs in kernels prior to 4.5, enabling local attackers to exploit the race and potentially compromise kernel memory. T...

CVE-2017-15265

CVE-2017-15265 is a race condition in the ALSA sequencer subsystem of the Linux kernel, up to version 4.13.8. A local attacker can trigger a use-after-free via crafted /dev/snd/seq ioctl calls, leading to denial of service (crash) or potentially other impacts. The vulnerability is fixed in the up...

CVE-2017-17741

CVE-2017-17741 affects the Linux kernel KVM implementation through 4.14.7, enabling a write_mmio stack-based out-of-bounds read that can reveal potentially sensitive information from kernel memory. Affected code paths are in arch/x86/kvm/x86.c and include/trace/events/kvm.h. The supplied document...

CVE-2019-15117

CVE-2019-15117 affects the Linux kernel component parse_audio_mixer_unit in sound/usb/mixer.c. The issue arises when processing a short USB descriptor, resulting in out-of-bounds memory access. The vulnerability is local in scope with potential memory corruption as the impact. The initial entry s...

CVE-2020-25639

CVE-2020-25639: A NULL pointer dereference in the Linux kernel’s GPU Nouveau driver (prior to 5.12-rc1) via DRM_IOCTL_NOUVEAU_CHANNEL_ALLOC allows local users to crash the system. Affected: Linux kernel/Nouveau driver; Root cause: NULL pointer dereference in channel allocation path; Impact: local...