CVE-2020-29370

CVE-2020-29370 (Linux kernel): An issue in kmem_cache_alloc_bulk (mm/slub.c) before 5.5.11 where the slowpath path does not increment the TID as required (CID-fd4d9c7d0c71). Affected: Linux kernel prior to 5.5.11. Impact described in connected advisories as a vulnerability in the kernel memory al...

CVE-2021-45095

CVE-2021-45095 affects the Linux kernel PhoNet (pep_sock_accept in net/phonet/pep.c). Root cause: reference-count leak in certain error paths, enabling memory exhaustion. Affected: Linux kernel up to 5.15.x (examples cite 5.15.8); remediation: patch released, kernels updated to 5.15.18.1-1 (Marin...

CVE-2022-2585

CVE-2022-2585 is a Linux kernel use-after-free vulnerability in POSIX CPU timers when exec() occurs from a non-leader thread. The issue stems from armed timers left on a list but freed, enabling local privilege escalation. Public advisories (e.g., AlmaLinux/ALAS and Debian bulletins) confirm the ...

CVE-2022-45887

CVE-2022-45887 affects the Linux kernel up to 6.0.9. The issue is a memory leak in drivers/media/usb/ttusb-dec/ttusb_dec.c caused by the absence of a dvb_frontend_detach call. Impact is potential denial of service via memory exhaustion (CVSS indicates HIGH availability impact). No remediation det...

CVE-2026-43038

CVE-2026-43038 affects the Linux kernel IPv6 ICMP error path. A forged IPv4 ICMP error with CIPSO options could cause ip6_err_gen_icmpv6_unreach() to misinterpret an inner IPv4 inet_skb_parm as an IPv6 parameter, allowing an offset misreference (dsthao) that could enable out-of-bounds or memory a...

CVE-2022-42328

Technical details about CVE-2022-42328 (and related CVEs) are not provided in the connected documents. Monitor the cited Xen/XenServer advisories and AWS Amazon/Linux advisories for updates and fixes.

CVE-2023-4147

CVE-2023-4147 is a local-privilege-escalation use-after-free in the Linux kernel nf_tables/netfilter code. The flaw occurs when adding a rule with NFTA_RULE_CHAIN_ID, where nft_tables_delrule or related NFT rule handling can release objects in a way that leaves a dangling pointer, enabling local ...

CVE-2024-56785

CVE-2024-56785 affects the Linux kernel lifecycle on MIPS Loongson64 platforms (ls7a). The issue centers on DTS/PCIe port node handling: incorrect PCIe port node definitions in ls7a DTS files caused dtc/interpreter warnings and a runtime warning related to address-cell/interrupt-provider mappings...

CVE-2011-2189

Summary (CVE-2011-2189): The Linux kernel (2.6.32 and earlier) has a flaw in net_namespace.c that mishandles a high rate of network-namespace creation/cleanup. This can allow remote attackers to cause a denial of service via memory consumption in a daemon that creates a separate namespace per con...

CVE-2022-4269

CVE-2022-4269 : Linux kernel Traffic Control (TC) vulnerability. When using the mirred action to redirect egress to ingress, a local unprivileged user may trigger a CPU soft lockup (ABBA deadlock) during TCP/SCTP retransmission, causing denial of service. Affected: Linux kernel TC subsystem. Root...

CVE-2018-13095

CVE-2018-13095 affects the Linux kernel up to 4.17.3 in fs/xfs/libxfs/xfs_inode_buf.c. A corrupted XFS image with an inode in extent format that has more extents than fit in the inode fork can trigger memory corruption and a bug (DoS). The connected advisories (Unity Linux, various Nessus plugins...

CVE-2018-14734

CVE-2018-14734 affects the Linux kernel before 4.17.11, where ucma_leave_multicast can access a data structure after cleanup in ucma_process_join, enabling a use-after-free that leads to DoS. The vulnerability is in drivers/infiniband/core/ucma.c. Exploitation status is not provided in the suppli...

CVE-2022-26966

CVE-2022-26966 affects the Linux kernel up to 5.16.12, via the drivers/net/usb/sr9700.c component. A local attacker can attach a specially crafted USB device and cause information disclosure by leaking heap memory from the device, as described in multiple connected documents (upstream kernel note...

CVE-2022-36402

CVE-2022-36402 is described in connected advisories as an integer overflow in the vmwgfx driver (Linux kernel) within vmwgfx_execbuf.c, affecting GPUs exposed via /dev/dri/renderD128 (Dxxx). The vulnerability allows a local attacker with a user account to gain elevated privileges and can cause a ...

CVE-2022-4095

CVE-2022-4095 affects the Linux kernel; a use-after-free in cmd_hdl_filter (drivers/staging/rtl8712/rtl8712_cmd.c) allows a local attacker to cause DoS and escalate privileges. Affected: Linux kernel before 5.19.2. Impact is local/privilege escalation with high severity. Mitigation: upgrade to ke...

CVE-2023-45863

The CVE-2023-45863 issue affects the Linux kernel prior to 6.2.3 and is triggered by a race condition in lib/kobject.c that causes a fill_kobj_path out-of-bounds write when run with root privileges. Public sources in connected documents (Astra Linux bulletin and IBM advisories) describe the same ...

CVE-2023-6111

CVE-2023-6111 is a use-after-free in the Linux kernel netfilter nf_tables GC path: the function nft_trans_gc_catchall can fail to remove a catchall set element from catchall_list when sync is true, allowing a catchall element to be freed multiple times. This enables local privilege escalation. Th...

CVE-2024-0443

CVE-2024-0443 : Linux kernel flaw in the blkgs destruction path (block/blk-cgroup.c) causes a cgroup blkio memory leak during destruction. The leak stems from cgroup_rstat_flush() being invoked only from css_release_work_fn() when the blkcg refcount reaches 0, creating a circular dependency that ...

CVE-2024-36886

The CVE-2024-36886 issue is a use-after-free in TIPC (tipc_buf_append) in the Linux kernel, leading to a remote code execution vulnerability via the tipc path. The associated advisories (e.g., ALSA-2024:4583) confirm a fix in kernel security updates and list CVE-2024-36886 among fixed items. Affe...

CVE-2024-43902

CVE-2024-43902 is a Linux kernel vulnerability in drm/amd/display where a null pointer could be dereferenced. The fix adds a null checker before passing variables to functions, addressing three NULL_RETURNS issues reported by Coverity. Connected documents confirm the root cause and the remediatio...

CVE-2024-50134

CVE-2024-50134 affects the Linux kernel driver drm/vboxvideo (vbva_mouse_pointer_shape). The issue stems from a fake VLA at the end of vbva_mouse_pointer_shape triggering a field-spanning memcpy write in hgsmi_base.c:154. The patch replaces the fake VLA with a real VLA to fix the warning and pote...

CVE-2016-9794

CVE-2016-9794 is a local, use-after-free race in ALSA’s snd_pcm_period_elapsed() in the Linux kernel before 4.7. A crafted SNDRV_PCM_TRIGGER_START can trigger memory corruption, enabling a local attacker to cause a denial of service (and possibly other impact) on affected systems. Public write-up...

CVE-2020-29371

CVE-2020-29371 affects Linux kernel romfs_dev_read (fs/romfs/storage.c) prior to 5.8.4, where uninitialized memory leaks to userspace. The vulnerability stems from uninitialized memory paths, enabling leakage to user space. Affected component is the ROMFS code in the kernel; no exploit details ar...

CVE-2021-20292

CVE-2021-20292 affects the Linux kernel up to version

CVE-2021-3659

CVE-2021-3659 is a local NULL pointer dereference in the Linux kernel’s IEEE 802.15.4 LR-WPAN subsystem. The specific code path cited in connected sources is a NULL pointer dereference in llsec_key_alloc() within net/mac802154/llsec.c, which can be triggered during LR-WPAN connection closure and ...

CVE-2021-38207

CVE-2021-38207 affects the Linux kernel driver: drivers/net/ethernet/xilinx/ll_temac_main.c. It allows remote attackers to cause a denial of service (buffer overflow and lockup) by sending heavy network traffic for about ten minutes. The issue is in the ll_temac_main.c path, and the vulnerability...

CVE-2017-7645

The CVE-2017-7645 issue affects the Linux kernel NFSv2/v3 server (nfsd) and is triggered by processing long RPC replies. The root cause is an out-of-bounds memory access in the NFS server paths (net/sunrpc/svc.c, fs/nfsd/nfs3xdr.c, fs/nfsd/nfsxdr.c) that can lead to a system crash (DoS). Affected...

CVE-2019-19528

CVE-2019-19528: Linux kernel pre-5.3.7 contains a use-after-free in the iowarrior USB driver (drivers/usb/misc/iowarrior.c) triggered by a malicious USB device. Public advisories (MiracleLinux AXSA:2021-2148:12 and Unity Linux UTSA references) confirm this CVE and map it to kernel builds up to 5....

CVE-2020-29369

CVE-2020-29369 is a real Linux kernel vulnerability described in the connected docs. It is a race condition in mm/mmap.c (expand_downwards vs. expand_upwards) that can occur during munmap page-table free operations, present in Linux kernels before 5.7.11 (CID-246c320a8cfe). The issue is triggered...

CVE-2024-25739

CVE-2024-25739 affects Linux kernel up to 6.7.4, where create_empty_lvol in drivers/mtd/ubi/vtbl.c may allocate zero bytes due to a missing check for ubi->leb_size, causing a crash (local, to crash an attacker-controlled workload). The issue is mapped to the ubi/VTBL path in the kernel; a fix ...

CVE-2016-5696

Technical details about CVE-2016-5696 are not publicly provided in the supplied connected documents; monitor for updates.

CVE-2020-10781

CVE-2020-10781 affects the Linux kernel ZRAM module: a local attacker who can read /sys/class/zram-control/hot_add can create ZRAM device nodes in /dev, and repeated reads can allocated memory and trigger OOM killer, potentially making the system inoperable. Connected advisories (e.g., ALAS2KERNE...

CVE-2020-26088

CVE-2020-26088 affects the Linux kernel up to version 5.8.2, where a missing CAP_NET_RAW check in NFC socket creation (net/nfc/rawsock.c) could let a local attacker create raw sockets and bypass security mechanisms. This is demonstrated in multiple Nessus advisories (Unity Linux/OpenSUSE/EulerOS ...

CVE-2020-28588

The CVE-2020-28588 information disclosure exists in the Linux Kernel /proc/pid/syscall interface for 5.1 Stable through 5.4.66, introduced in v5.1-rc4 (commit 631b7abacd02b88f4b0795c08b54ad4fc3e7c7c0) and still present in 5.10-rc4. An attacker can read /proc/pid/syscall to trigger memory contents...

CVE-2020-36558

CVE-2020-36558 refers to a race condition in the Linux kernel before 5.5.7 involving VT_RESIZEX that can cause a NULL pointer dereference and a general protection fault. The vulnerability is triggered locally within the kernel, with impact described as high availability risk if exploited, and the...

CVE-2020-8835

CVE-2020-8835 affects Linux kernel 5.5.0 and newer, with backports to 5.4.x. The issue is in the BPF verifier (kernel/bpf/verifier.c): it truncates 64-bit values to 32-bit for 32-bit operations, causing the verifier’s checked bounds to diverge from actual execution. This can lead to out-of-bounds...

CVE-2023-52444

CVE-2023-52444 : In Linux kernel f2fs, a dirent corruption risk during cross-directory rename (dir/.. links) was fixed. The issue arose in f2fs_rename() when the sourceDir and targetDir differ and a whiteout is not present; a missing f2fs_set_link() could fail to update the ".." inumber, causing ...

CVE-2023-52922

CVE-2023-52922 affects the Linux kernel can/bcm: Fix UAF in bcm_proc_show(). The issue arises when bcm_op is freed before the corresponding procfs entry is removed in bcm_release(), which may allow bcm_proc_show() to read a freed bcm_op. Connected advisories confirm the root cause and mention a p...

CVE-2024-53142

CVE-2024-53142: Linux kernel initramfs fix for filename buffer overrun. Root cause: during initramfs cpio extraction, the do_name() path passed a non-zero-terminated filename to kernel file operations, allowing trailing bytes from uninitialized memory to be incorporated into a created path. Impac...

CVE-2023-3610

The CVE-2023-3610 issue is a use-after-free in the Linux kernel nf_tables (netfilter) logic, specifically in the NFT_MSG_NEWRULE abort path, caused by flawed error handling of bound chains. This vulnerability can enable local privilege escalation for an attacker possessing CAP_NET_ADMIN, within a...

CVE-2023-3773

The CVE-2023-3773 entry describes a flaw in the Linux kernel’s XFRM (IP framework) where parsing netlink attributes can trigger a 4-byte out-of-bounds read of XFRMA_MTIMER_THRESH. This could allow a malicious user with CAP_NET_ADMIN to leak sensitive heap data to userspace. The provided descripti...

CVE-2023-39191

The CVE-2023-39191 issue affects the Linux kernel eBPF subsystem: improper validation of dynamic pointers in user-supplied eBPF programs can be exploited by a user with CAP_BPF privileges to escalate privileges and run code in kernel context. Multiple connected advisories (e.g., Red Hat RHSA entr...

CVE-2023-6931

CVE-2023-6931 describes a heap/out-of-bounds write in the Linux kernel’s Performance Events subsystem. The issue arises when a perf_event read_size overflows, causing an out-of-bounds increment or write in perf_read_group(). The vulnerability is described as enabling local privilege escalation. M...

CVE-2024-41013

CVE-2024-41013 : The Linux kernel vulnerability in xfs: don't walk off the end of a directory data block has been fixed. The issue was caused by insufficient bounds checks for xfs_dir2_data_unused and xfs_dir2_data_entry, which could allow an out-of-bounds read during directory traversal if a cra...

CVE-2024-56551

Summary (CVE-2024-56551) : In the Linux kernel, the drm/amdgpu driver fixes a use-after-free in the slab allocator. The vulnerability is triggered by a use-after-free in the GPU scheduling path, specifically involving drm_sched_entity_flush, where a 8-byte read could occur after an object had bee...

CVE-2017-18241

CVE-2017-18241 affects Linux kernel fs/f2fs/segment.c prior to 4.13. Local users can cause a denial of service via a NULL pointer dereference in a flush_cmd_control when using the noflush_merge option, leading to a panic. No exploitation details are provided in the documents. Remediation: upgrade...

CVE-2020-16119

CVE-2020-16119 is a Linux kernel use-after-free vulnerability in DCCP where a socket reused as a listener after release (with an attached dccps_hc_tx_ccid) can be exploited locally. Affected: Linux kernel variants affected by upstream fixes; the issue allows local escalation to execute code or ca...

CVE-2022-28389

CVE-2022-28389 : In the Linux kernel up to version 5.17.1, mcba_usb_start_xmit implemented in drivers/net/can/usb/mcba_usb.c has a double free vulnerability. The issue is documented in multiple advisories linked to this CVE, including Astra Linux and Amazon Linux 2 ALAS advisories, which explicit...

CVE-2023-2162

Astra Linux security bulletin mirrors CVE-2023-2162, documenting a use-after-free in Linux kernel (iscsi_sw_tcp_session_create in drivers/scsi/iscsi_tcp.c) that could allow a local attacker to leak kernel internal information. The Astra Linux entry identifies the affected kernel subcomponent (SCS...

CVE-2023-3161

CVE-2023-3161 : Linux Kernel fbcon has a shift-out-of-bounds in fbcon_set_font when font->width/height > 32, causing undefined behavior and potential denial of service. Connected documents corroborate the same fbcon font handling issue in the Linux kernel. The Astra Linux bulletin mentions ...