CVE-2023-3640

CVE-2023-3640 – summary (Linux kernel x86 per-CPU entry area leak) A local memory leakage flaw was identified in the Linux kernel’s cpu_entry_area mapping for X86, enabling a local user to infer addresses of exception stacks and other kernel data. The vulnerability stems from partial randomness o...

CVE-2015-9289

Mode C: CVE-2015-9289 affects the Linux kernel (drivers/media/dvb-frontends/cx24116.c). A buffer overflow can occur when validating userspace parameters for DiSEqC commands: the API specifies a maximum of 6, but code accepts values up to 23. This is in kernels before 4.1.4; the fix is in Linux 4....

CVE-2017-15868

The CVE-2017-15868 vulnerability affects the Linux kernel up to version 3.18 (pre-3.19). The issue lies in bnep_add_connection() in net/bluetooth/bnep/core.c, which does not ensure an l2cap socket is available, enabling local users to gain privileges through a crafted application. Affected compon...

CVE-2018-13095

CVE-2018-13095 affects the Linux kernel up to 4.17.3 in fs/xfs/libxfs/xfs_inode_buf.c. A corrupted XFS image with an inode in extent format that has more extents than fit in the inode fork can trigger memory corruption and a bug (DoS). The connected advisories (Unity Linux, various Nessus plugins...

CVE-2018-5344

CVE-2018-5344 : The Linux kernel vulnerability affects the driver code at drivers/block/loop.c, where improper lo_release serialization can lead to a use-after-free in __lock_acquire. This can cause a local denial of service (system crash) and may have unspecified other impact. The description in...

CVE-2020-14416

CVE-2020-14416 is a Linux kernel issue fixed in 5.4.16. A race condition in tty->disc_data handling for slip and slcan line disciplines can cause a use-after-free, affecting drivers/net/slip/slip.c and drivers/net/can/slcan.c. The connected Nessus advisories reproduce the vulnerability across ...

CVE-2022-40768

CVE-2022-40768 affects the Linux kernel (through 5.19.9) where stex_queuecommand_lck does not memset for the PASSTHRU_CMD path, enabling local users to read kernel memory. Affected: drivers/scsi/stex.c in the kernel. Impact: information disclosure from kernel memory; local, low complexity, no use...

CVE-2023-1838

The CVE-2023-1838 entry centers on a use-after-free flaw in the Linux kernel’s vhost_net_set_backend (drivers/vhost/net.c, virtio network subcomponent) caused by a double fget. This can allow a local attacker to crash the system and potentially leak kernel information. Connected documents (Astra ...

CVE-2026-53264

CVE-2026-53264 concerns the Linux kernel’s networking scheduler (net/sched) where a race between simultaneous NEWTFILTER and DELFILTER operations can lead to a use-after-free of an action. The provided description and patches state that final freeing of the action was incorrectly performed withou...

CVE-1999-0061

CVE-1999-0061 concerns the BSD line printer daemon (lpd). Multiple sources confirm a vulnerability in lpd related to file creation and deletion and remote execution. Affected software is BSD-derived lpd implementations; the root cause is not explicitly detailed in the provided documents. Reported...

CVE-2022-1195

CVE-2022-1195 describes a use-after-free in the Linux kernel driver for hamradio (drivers/net/hamradio), specifically involving the mkiss and sixpack paths. The flaw allows a local attacker with user privileges to trigger a denial of service when the mkiss/sixpack device is detached and resources...

CVE-2024-26633

The Linux kernel is vulnerable to a denial of service (DoS) condition due to incorrect handling of NEXTHDR_FRAGMENT in the ip6_tnl_parse_tlv_enc_lim() function. The root cause is that the frag_off operation is performed without ensuring sufficient bytes were pulled into the skb->head field, po...

CVE-2024-26808

The CVE-2024-26808 issue affects the Linux kernel netfilter nft_chain_filter logic. When NETDEV_UNREGISTER is reported, the fix removes the netdevice from the inet/ingress basechain to prevent a stale reference in the hook list. The vulnerability is exploitable locally (attack vector LOCAL) with ...

CVE-2024-53055

The CVE-2024-53055 issue affects the Linux kernel’s wifi: iwlwifi mvm 6 GHz scanning. It was caused by a loop variable of type u8 in the 6 GHz scan construction, which could loop forever when more than 255 colocated APs are found during 2.4/5 GHz scanning. The code was changed to use a u32 loop v...

CVE-2024-53162

Linux kernel vulnerability CVE-2024-53162 in crypto: qat/qat_4xxx driver. Off-by-one in uof_get_name() can trigger out-of-bounds read when iterating fw_objs[] (/fw_objs has num_objs elements). The fix changes a comparison from > to >= to prevent reading beyond the array. No exploitation det...

CVE-2019-15222

CVE-2019-15222 entry is rejected/not used and not an active vulnerability.

CVE-2022-32296

CVE-2022-32296 affects the Linux kernel where, prior to 5.17.9, the TCP source port selection (Algorithm 4, Double-Hash Port Selection from RFC 6056) can allow a remote or local observer to identify clients by observed source ports. Connected advisories confirm the issue in kernel ments and note ...

CVE-2022-3586

CVE-2022-3586 : A use-after-free in the Linux kernel networking path (sch_sfb enqueue function using SKB cb field after enqueueing/freeding into a child qdisc) allows a local, unprivileged user to crash the system, causing a denial of service. Affected component: kernel networking code; root caus...

CVE-2022-3649

CVE-2022-3649 affects the Linux kernel (nilfs_new_inode in fs/nilfs2/inode.c, component BPF). The issue is a use-after-free in nilfs_new_inode that can be triggered remotely, per the initial document and connected advisories. A patch exists to fix this issue (references include a kernel commit ID...

CVE-2024-36920

CVE-2024-36920 relates to a Linux kernel SCSI MPI3MR warning: a 128-byte memcpy was written into a 1-byte array (replay_buf[1]) in mpi3mr_bsg_in_reply_buf, triggering a field-spanning write warning. The description states the array is intended as a flexible length and the warning is a false posit...

CVE-2024-50154

The CVE-2024-50154 vulnerability is in the Linux kernel. Root cause: a use-after-free can occur in reqsk_timer_handler() when a race around timer_pending() in reqsk_queue_unlink() allows a timer to fire after the socket is closed. The fix prevents del_timer_sync() from being missed by removing ti...

CVE-2010-4249

CVE-2010-4249 affects the Linux kernel before 2.6.37-rc3-next-20101125: the wait_for_unix_gc routine in net/unix/garbage.c does not properly select times for garbage-collecting inflight sockets, enabling local users to cause a denial of service (system hang) by crafting socketpair and sendmsg cal...

CVE-2017-6001

CVE-2017-6001 is a Linux kernel race condition in the perf_events subsystem. The initial description notes a race between concurrent perf_event_open calls for moving a software group into a hardware context, allowing local privilege escalation and tied to an incomplete fix for CVE-2016-6786. Conn...

CVE-2019-19078

CVE-2019-19078 refers to a memory leak in the ath10k_usb_hif_tx_sg() function (drivers/net/wireless/ath/ath10k/usb.c) of the Linux kernel up to 5.3.11. An attacker can cause denial of service via memory consumption by triggering usb_submit_urb() failures. The vulnerability is scoped to the kernel...

CVE-2019-3901

CVE-2019-3901 describes a race condition in perf_event_open() that can leak data from setuid processes. The root cause is that cred_guard_mutex is not held during the ptrace_may_access() check, allowing a target task to execve() with setuid execution before perf_event_alloc() attaches, bypassing ...

CVE-2020-29373

CVE-2020-29373 affects the Linux kernel (pre-5.6) in fs/io_uring.c, where the root directory is unsafely handled during path lookups inside a mount namespace, allowing a process to escape to unintended filesystem locations. The issue is confirmed by the CVE description and linked ChangeLog-5.6 an...

CVE-2023-33203

The CVE-2023-33203 entry concerns the Linux kernel prior to version 6.2.9, where a race condition can lead to a use-after-free in drivers/net/ethernet/qualcomm/emac/emac.c when a physically proximate attacker unplugs an emac device. Affected software: Linux kernel up to 6.2.9 (including distribut...

CVE-2024-50064

CVE-2024-50064 refers to a Linux kernel ZRAM issue: on reset of a zram device with multi-streams, the code failed to free memory by kfree()ing secondary algorithm names, causing a memory leak. The connected Azure Linux advisory and Miracle Linux Nessus entries confirm the vulnerability and refere...

CVE-2014-8559

CVE-2014-8559 is tied to the Linux kernel up to version 3.17.2, where the d_walk function in fs/dcache.c fails to properly preserve the semantics of rename_lock. This can allow a local attacker to cause a denial of service via a deadlock and system hang. The connected advisories state that the is...

CVE-2015-3636

CVE-2015-3636 affects the Linux kernel up to 4.0.2, in the ping_unhash path of net/ipv4/ping.c. The issue arises because a certain list data structure is not initialized during an unhash operation, enabling a local user with ping socket access to crash the system or potentially gain privileges by...

CVE-2016-3134

The CVE-2016-3134 issue affects the Linux kernel netfilter/ip_tables.c, where the mark_source_chains() path can process an IPT_SET_REPLACE entry with an unvalidated next_offset. This can lead to out-of-bounds writes that enable local privilege escalation or cause a denial of service (heap memory ...

CVE-2016-6828

The vulnerability CVE-2016-6828 affects the Linux kernel and is triggered by a local attacker exploiting a use-after-free in the TCP transmit path. Specifically, the tcp_check_send_head path in include/net/tcp.h leaves SACK state in an inconsistent condition after a failed data copy, enabling a l...

CVE-2017-18203

The vulnerability CVE-2017-18203 affects the Linux kernel in the DM (device-mapper) path: dm_get_from_kobject() in drivers/md/dm.c is vulnerable to a race with __dm_destroy during creation/removal of DM devices. Exploitation from a local attacker could cause a Denial of Service. Affected are kern...

CVE-2019-19807

CVE-2019-19807 affects the Linux kernel before 5.3.11, due to a use-after-free in sound/core/timer.c (snd_timer_open/snd_timer_close_locked). The timeri variable was repurposed during a refactor, leading to a faulty lifecycle for a new timer instance. Connected sources confirm an upstream fix imp...

CVE-2022-33740

Summary: The CVE-2022-33740 issue concerns the Linux Block and Network PV device frontends leaking data to the backend. The root cause described in the sources is that memory regions are not zeroed before sharing with the backend, and the grant-table granularity (4K pages) means data from differe...

CVE-2024-27013

CVE-2024-27013 affects the Linux kernel tun subsystem. When vhost_worker calls tun callbacks to receive packets, excessive illegal packets trigger tun_do_read to dump packet contents, causing high CPU usage and potential soft lockups. The advisory notes using the net_ratelimit mechanism to cap su...

CVE-2016-8650

CVE-2016-8650 affects the Linux kernel: the mpi_powm function in lib/mpi/mpi-pow.c can fail to allocate memory for limb data, permitting a local attacker to trigger a denial of service (stack memory corruption/panic) via an add_key RSA operation with a zero exponent. Public advisories (F5) confir...

CVE-2018-18690

CVE-2018-18690 pertains to the Linux kernel before 4.17 where a local attacker able to set attributes on an xfs filesystem could render the filesystem non-operational until remount by triggering an unchecked error during an xfs attribute change. The root cause is mishandling of ATTR_REPLACE in xf...

CVE-2022-33743

CVE-2022-33743 maps to a Xen netfront memory-handling issue in the Linux kernel where SKBs with retained references can be freed, caused by a label move while adding XDP support. This can lead to use-after-free in the network backend and a potential Denial of Service when interacting with the Xen...

CVE-2022-40307

CVE-2022-40307 is a Linux kernel issue in drivers/firmware/efi/capsule-loader.c that creates a race condition with a resulting use-after-free . Connections show multiple references: Debian’s LTS advisory for linux-5.10 includes CVE-2022-40307 among the listed fixes, indicating affected kernel ser...

CVE-2023-3090

CVE-2023-3090 is a Linux kernel vulnerability affecting the ipvlan driver. It causes a heap out-of-bounds write due to missing skb->cb initialization, and is exploitable when CONFIG_IPVLAN is enabled. The issue enables local privilege escalation as described in multiple sources (e.g., Astra Li...

CVE-2023-3212

CVE-2023-3212 affects the Linux kernel gfs2 file system. A NULL pointer dereference occurs on corrupt gfs2 filesystems when the evict path references the journal descriptor structure after it has been freed, enabling a local privileged user to trigger a kernel panic. Affected: Linux kernel with g...

CVE-2024-26772

CVE-2024-26772: In the Linux kernel, the fix prevents allocating blocks from a corrupted ext4 group. The patch moves the block bitmap integrity check under the group lock in ext4_mb_find_by_goal(), ensuring blocks are not allocated from a group with a corrupted bitmap. This mitigates a local-priv...

CVE-2024-26984

The Linux kernel contains a vulnerability in the nouveau driver involving an instmem race condition related to pointer stores. Specifically, a race condition in nv50_instobj_acquire can lead to a NULL pointer dereference when pt->memory->ptrs is accessed before it is stored during concurren...

CVE-2025-21866

CVE-2025-21866 : In the Linux kernel, PowerPC text patching infrastructure allocated a virtual area and marked it VM_ALLOC, which is inappropriate since that memory is not vmalloc’d and isn’t initialized until __vmalloc_node_range() is called. This caused KASAN: vmalloc-out-of-bounds when booting...

CVE-2017-18174

In Linux kernel before 4.7, the amd_gpio_remove function in drivers/pinctrl/pinctrl-amd.c calls pinctrl_unregister, leading to a double free. Affected: kernels prior to 4.7 (various distributions). The issue was addressed in later kernel updates (e.g., commits from Linus Torvalds’ tree referenced...

CVE-2017-18249

CVE-2017-18249 affects the Linux kernel’s f2fs implementation: the add_free_nid function in fs/f2fs/node.c fails to properly track an allocated nid, enabling local attackers to cause a denial of service via a race condition (and potentially other impact) when multiple threads run concurrently. Af...

CVE-2018-5332

CVE-2018-5332 affects the Linux kernel up to version 3.2, where rds_message_alloc_sgs() does not validate a value used during DMA page allocation, causing a heap-based out-of-bounds write in net/rds/rdma.c (via rds_rdma_extra_size). Exploitation would rely on local access to trigger DMA-related a...

CVE-2018-6554

CVE-2018-6554 describes a memory leak in the Linux kernel’s irda_bind path (net/irda/af_irda.c and later staging/irda/net/af_irda.c). A local user can cause memory exhaustion by repeatedly binding an AF_IRDA socket, leading to denial of service. The vulnerability exists in kernels prior to 4.17 a...

CVE-2021-20268

The CVE-2021-20268 entry is confirmed to affect the Linux kernel eBPF verifier, where an out-of-bounds access via dev_map_init_map or sock_map_alloc could crash the system or enable local privilege escalation. Affected are kernel implementations before fixes in public advisories; mitigation is to...