CVE-2022-1882

CVE-2022-1882: A use-after-free in Linux kernel pipes handling (pipes.post_one_notification after free_pipe_info) allows a local user to crash the system and potentially escalate privileges. Documented in CVE-2022-1882 with CVSS v3 base 7.8 (LOCAL, LOW complexity, user is not required to interact...

CVE-2022-49469

CVE-2022-49469 is a Linux kernel issue affecting the btrfs subsystem. The vulnerability arises in create_subvol() where, on failures of btrfs_qgroup_inherit(), btrfs_alloc_tree_block, or btrfs_insert_root(), anon_dev could leak because error handling did not free it. The fix reorganizes the error...

CVE-2023-1855

CVE-2023-1855 describes a use-after-free in xgene_hwmon_remove (drivers/hwmon/xgene-hwmon.c) of the Linux kernel hardware monitoring driver. The Astra Linux security bulletin mirrors this flaw and notes it could allow a local attacker to crash the system or leak kernel memory due to a race condit...

CVE-2023-52615

CVE-2023-52615 : The Linux kernel patch fixes a deadlock in the hwrng read path when a user reads from /dev/hwrng and mmap()’ed memory overlap. Root cause is a page fault during copy_to_user invoked from the hwrng core read path, which could trigger a recursive read and deadlock. The fix switches...

CVE-2024-42079

CVE-2024-42079 is a Linux kernel vulnerability in the gfs2 subsystem that could lead to a NULL pointer dereference during log flush operations. The root cause is a race between outstanding glock work and unmount, which could cause gfs2_log_flush() to dereference a freed or NULL sdp->sd_jdesc. ...

CVE-2025-21964

CVE-2025-21964 affects the Linux kernel CIFS mount option acregmax. The issue arises when user-provided acregmax (u32) is not yet validated; its value is converted from seconds to jiffies, which can overflow an integer. This is a local vulnerability in which an attacker with local access could po...

CVE-2015-1573

CVE-2015-1573 affects the Linux kernel, where nft_flush_table() in net/netfilter/nf_tables_api.c mishandles cross-chain jumps with ruleset flushes, allowing a local user with CAP_NET_ADMIN to trigger a denial of service (panic) by flushing affected rules. Affected kernel versions are those before...

CVE-2016-9576

CVE-2016-9576 affects the Linux kernel’s SCSI generic (sg) path. The blk_rq_map_user_iov() function in block/blk-map.c did not properly restrict the iterator type, enabling a local attacker with access to /dev/sg to read or write arbitrary kernel memory or trigger a use-after-free. CVE-2016-10088...

CVE-2017-18257

CVE-2017-18257 affects the Linux kernel: the __get_data_block function in fs/f2fs/data.c (before 4.11) can be triggered by crafted open and fallocate calls via an FS_IOC_FIEMAP ioctl, causing local denial of service (integer overflow and loop). Public advisories from Unity Linux, Ubuntu USN-3696-...

CVE-2017-5970

Summary (CVE-2017-5970): The Linux kernel (ipv4_pktinfo_prepare in net/ipv4/ip_sockglue.c) up to version 4.9.9 is affected. A flaw can cause a denial of service (system crash) when triggered by (1) crafted system calls from an application or (2) IPv4 traffic carrying invalid IP options. The root ...

CVE-2018-13094

CVE-2018-13094 affects the Linux kernel’s XFS code: a NULL bp passed to xfs_da_shrink_inode() can trigger an OOPS in fs/xfs/libxfs/xfs_attr_leaf.c for images up to kernel 4.17.3. Public docs confirm the underlying issue is a NULL pointer dereference that can cause a crash; Debian/CentOS/Red Hat a...

CVE-2018-14678

CVE-2018-14678 affects the Linux kernel up to 4.17.11 (and Xen up to 4.11.x). The xen_failsafe_callback entry in arch/x86/entry/entry_64.S does not properly preserve RBX, enabling local attackers to trigger uninitialized memory usage, causing a denial of service; 64-bit x86 PV Linux guests may cr...

CVE-2022-47940

CVE-2022-47940 affects ksmbd in the Linux kernel (versions 5.15–5.18 before 5.18.18). The issue is a missing length validation in the non-padding path of smb2_write (fs/ksmbd/smb2pdu.c), as disclosed in connected advisories. Exploitation details are not provided in the documents beyond this root ...

CVE-2023-52478

CVE-2023-52478 concerns the Linux kernel HID driver for Logitech HID++ (logitech-hidpp). The advisory describes four TOCTOU races in hidpp_connect_event(): a harmless protocol retrieval race, a harmless HID name update race, a problematic battery power_supply initialization race, and a potentiall...

CVE-2024-26664

CVE-2024-26664 : The Linux kernel hwmon: coretemp fix addresses an out-of-bounds memory access. The bug arises when pdata->cpu_map[] is set before the out-of-bounds check, potentially triggering on systems with more than 128 cores per package. Connected sources corroborate the vulnerability an...

CVE-2024-26759

The CVE-2024-26759 entry concerns a race in the Linux kernel mm/swap path when skipping the swapcache for SWP_SYNCHRONOUS_IO. If multiple threads swap in the same entry concurrently, they may end up installing different pages (A, B) and trigger an ABA-like scenario where the PTE appears unchanged...

CVE-2024-26782

In CVE-2024-26782, the Linux kernel mptcp code is affected: when a server accepts a connection, it clones the listener socket and the new socket’s inet_opt pointer ends up pointing to the same object as the original. This leads to a double-free on socket destruction (inet_sock_destruct) at exit, ...

CVE-2024-50033

CVE-2024-50033 is a Linux kernel issue in the SLIP driver (drivers/net/slip/slhc.c). The root cause was that slhc_remember() did not adequately validate malicious packets, only checking that the packet length was at least 20 bytes. This allowed malformed frames to slip through without ensuring th...

CVE-2024-53076

Technical details for CVE-2024-53076 are not publicly available in the provided documents. Monitor for updates.

CVE-2024-53103

CVE-2024-53103 refers to a Linux kernel vulnerability in hv_sock where, on release of an hvs, vsk->trans could be left uninitialized, creating a dangling pointer. The issue is resolved by explicitly initializing vsk->trans to NULL to prevent use-after-free scenarios. Connected advisories (A...

CVE-2025-21666

CVE-2025-21666 involves a null-pointer dereference in the Linux kernel when vsock_*_has_data/has_space is invoked on a socket that has been de-assigned from a transport. The problem is mitigated by returning 0 (no space/data) with a warning to keep execution stable. Connected documents confirm th...

CVE-2011-4621

The CVE-2011-4621 entry concerns the Linux kernel prior to 2.6.37, where a clock-update optimization is flawed, allowing a local user to cause a denial of service (system hang) by running code in a loop. Affected software is the Linux kernel up to version before 2.6.37; the description does not s...

CVE-2012-6689

The CVE affects the Linux kernel before 3.5.5, where net/netlink/af_netlink.c:netlink_sendmsg does not validate dst_pid, enabling local spoofing of Netlink messages. Affected product is the Linux kernel (prior to 3.5.5); impact is listed as unspecified (local) with full confidentiality/integrity/...

CVE-2016-4470

CVE-2016-4470 affects the Linux kernel keyring handling: in key_reject_and_link() an uninitialized pointer may be dereferenced after an error, enabling a local attacker to trigger a denial of service (system crash) via crafted keyctl request2. Connected advisories confirm this is a kernel issue w...

CVE-2016-7910

CVE-2016-7910 is a Linux kernel use-after-free vulnerability in the disk_seqf_stop function (block/genhd.c) that allows a local attacker to gain elevated privileges by taking advantage of a stop operation after a failed start. Affected: Linux kernel versions before 4.7.1. Root cause: use-after-fr...

CVE-2017-12190

CVE-2017-12190 affects the Linux kernel before 4.13.8. The issue arises in the SCSI I/O path where bio_map_user_iov and bio_unmap_user perform unbalanced refcounting when a SCSI I/O vector has small consecutive buffers belonging to the same page. The bio_add_pc_page function merges them into one,...

CVE-2021-38209

CVE-2021-38209 affects the Linux kernel prior to 5.12.2, where nf_conntrack_standalone.c leaks namespace changes across all net namespaces via NF_SYSCTL_CT_MAX, NF_SYSCTL_CT_EXPECT_MAX, and NF_SYSCTL_CT_BUCKETS. The issue enables observation of changes in any net namespace because updates are lea...

CVE-2023-52614

CVE-2023-52614 (Linux kernel) : The vulnerability is a buffer overflow in trans_stat_show() within PM/devfreq. The fix converts a simple snprintf to scnprintf with size PAGE_SIZE, adds a boundary check to exit when PAGE_SIZE is exceeded, issues a warning that stats are disabled, and returns -EFBI...

CVE-2024-26645

CVE-2024-26645 : The issue is in the Linux kernel tracing subsystem (tracing_map) where a race can occur when inserting a new element. The root cause is CPU reordering between memcpy(elt->key, key, map->key_size) and entry->val = elt in __tracing_map_insert(), which can cause a later che...

CVE-2024-26882

CVE-2024-26882 relates to the Linux kernel vulnerability in the IPv4 IP tunnel receive path. The issue stems from not preserving the original skb->network_header when pulling inner headers during decapsulation in ip_tunnel_rcv(), which could interact with skb_head handling and header recomputa...

CVE-2024-27020

In CVE-2024-27020, the Linux kernel nf_tables code had a potential data race when nft_unregister_expr() ran concurrently with __nft_expr_type_get() due to insufficient protection while iterating nf_tables_expressions. The fix involves iterating nf_tables_expressions with list_for_each_entry_rcu()...

CVE-2024-40960

CVE-2024-40960: Linux kernel IPv6 routing (rt6_probe) NULL-pointer dereference. The code could dereference a non-canonical address due to missing NULL check in __in6_dev_get(); syzbot trace shows a crash (OOPs) in rt6_probe and call path through rt6_nh_find_match and fib6_table_lookup. The vulner...

CVE-2024-56769

CVE-2024-56769 affects the Linux kernel media DVB frontends, specifically the dib3000mb driver. The issue is a KMSAN-detected uninitialized value in dib3000_read_reg, arising from an inadequate error handling path in i2c_transfer() where a read buffer rb[2] can end up with undefined values if the...

CVE-2016-7039

CVE-2016-7039 affects the Linux kernel IP stack up to version 4.8.2. An attacker can trigger the GRO path with large crafted packets (e.g., VLAN header packets), causing stack consumption and a possible panic/DoS; this is related to CVE-2016-8666. Nessus/UTSA advisories for Unity Linux reference ...

CVE-2018-1093

CVE-2018-1093 affects the Linux kernel (ext4) where ext4_valid_block_bitmap() in fs/ext4/balloc.c can trigger an out-of-bounds read due to missing validation of bitmap block numbers in balloc.c/ialloc.c. The issue allows a local attacker who can mount a crafted ext4 image to cause a denial of ser...

CVE-2020-10774

CVE-2020-10774: A local memory disclosure flaw in the Linux kernel sysctl subsystem allows reading uninitialized kernel memory when reading /proc/sys/kernel/rh_features, affecting kernel versions before 4.18.0-193.el8. Root cause is a memory disclosure in the sysctl path; impact is confidentialit...

CVE-2023-31085

CVE-2023-31085 – Linux kernel 6.2 (drivers/mtd/ubi/cdev.c) shows a divide-by-zero in do_div(sz,mtd-> erasesize) when mtd->erasesize is 0, triggered via ctrl_cdev_ioctl. Connected advisories reference upstream Linux commits and vendor advisories (e.g., Astra Linux and Amazon Linux 2) noting ...

CVE-2024-1085

CVE-2024-1085 is a Linux kernel nf_tables use-after-free vulnerability that can enable local privilege escalation. The issue stems from nft_setelem_catchall_deactivate() freeing a catch-all set element based on the current generation, while it is only marked inactive for the next generation, allo...

CVE-2024-23849

CVE-2024-23849 affects the Linux kernel’s RDS path (net/rds/af_rds.c) up to and including 6.7.1. The issue is an off-by-one in the RDS_MSG_RX_DGRAM_TRACE_MAX comparison, causing out-of-bounds access. Connected advisories confirm this vulnerability and show it in multiple vendor/OS contexts (Debia...

CVE-2024-56601

CVE-2024-56601 is a Linux kernel vulnerability in the inet/ code path. The issue arises because sock_init_data() attaches a kernel socket (sk) to a sock, and if inet_create() fails later, the sk is freed but the sock retains a dangling sk pointer, enabling a use-after-free on the sock. The docume...

CVE-2024-56615

CVE-2024-56615 affects the Linux kernel and concerns BPF maps (devmap/xskmap) where an index used to access map entries could be a signed int, causing out-of-bounds writes. The fix changes the index type from int to u32 for both map element access and the iterator used during dev_map_free() to pr...

CVE-2026-23401

The Linux kernel contains a vulnerability within the KVM subsystem related to x86/mmu shadow page table entry handling. Specifically, the system fails to drop/zap existing present SPTEs before installing emulated MMIO SPTEs when host userspace modifies a shadowed gPTE to switch from a memslot to ...

CVE-2023-2176

CVE-2023-2176 affects the Linux kernel RDMA path: a use of compare_netdev_and_ip in drivers/infiniband/core/cma.c can trigger an out-of-bounds read, allowing a local attacker to crash or escalate privileges. Multiple vendor advisories (e.g., SUSE SU-2025-02848-1, SUSE SU-2025-02846-1) reference a...

CVE-2023-52477

In CVE-2023-52477, the Linux kernel USB hub code (drivers/usb/core/hub.c/hub.h) incorrectly accessed fields inside udev->bos without verifying that the BOS descriptor was allocated/initialized. If usb_get_bos_descriptor() fails, udev->bos can be NULL, causing a NULL pointer dereference and ...

CVE-2023-52881

The CVE-2023-52881 entry describes a Linux kernel defect where the TCP ACK validation allowed acknowledging data never sent (ghost ACKs). Root cause: ACK sequence checks (per RFC 5961 guidance) could be bypassed, enabling ACKs that acknowledge bytes not yet transmitted, potentially leaking server...

CVE-2024-26665

CVE-2024-26665 : Linux kernel vulnerability in tunnel PMTU error handling. When ICMPv6 error is built from a non-linear skb, there is an out-of-bounds/read issue due to using csum_partial. The fix replaces csum_partial with skb_checksum to correctly handle non-linear SKBs during IPv6 PMTU error c...

CVE-2024-26960

CVE-2024-26960 is a Linux kernel vulnerability in mm: swap that fixes a race between free_swap_and_cache() and swapoff(). The theoretical window could allow swapoff() to teardown a swap_info_struct while free_swap_and_cache() runs, risking swap_page_trans_huge_swapped() accessing freed swap_map m...

CVE-2024-35809

The CVE-2024-35809 entry describes a race in the Linux kernel's PCI runtime power management path: the .runtime_idle() callback in rtsx_pcr PCI driver can still be running when pm_runtime_get_sync() returns, leading to a race with the post-sync code and a potential kernel crash due to an unhandle...

CVE-2024-38619

CVE-2024-38619 (Linux kernel, usb-storage alauda) : The issue arises in the alauda media handling where the field uzonesize can stay zero if alauda_init_media() fails, potentially causing divide errors in alauda_read_data() and alauda_write_lba(). The fix, as described in the description, adds a ...

CVE-2024-50136

CVE-2024-50136 affects the Linux kernel’s mlx5 driver (net/mlx5) where the notifier for eswitch init could remain registered after an init failure, causing a later eswitch enable to emit warnings like “notifier callback eswitch_vport_event [mlx5_core] already registered.” The root cause described...