CVE-2000-0006

CVE-2000-0006 affects the strace utility. The issue allows local users to read arbitrary files via memory-mapped file names. The connected records identify strace as the affected component and describe the vulnerability as a local-read exposure through mmap-based file-name handling. No explicit e...

CVE-2012-6657

CVE-2012-6657 affects the Linux kernel up to version 3.5.7. The vulnerability lies in sock_setsockopt in net/core/sock.c, where a keepalive action may not be properly associated with a stream socket, enabling a local attacker to cause a denial of service (system crash) by leveraging the ability t...

CVE-2017-18232

CVE-2017-18232 affects the Linux kernel SAS (libsas): a mutex mishandling in the SAS implementation up to kernel 4.15.9 allows local users to cause a denial of service (deadlock) by triggering certain error-handling code. Connected advisories (Unity Linux UTSA-2026-…) confirm a kernel security up...

CVE-2021-4159

CVE-2021-4159 is described in connected documents as a Linux kernel EBPF verifier flaw that could allow a local attacker to leak internal kernel memory by causing uninitialized or sensitive data to be exposed to userspace when handling internal data structures during eBPF code insertion. The issu...

CVE-2022-40307

CVE-2022-40307 is a Linux kernel issue in drivers/firmware/efi/capsule-loader.c that creates a race condition with a resulting use-after-free . Connections show multiple references: Debian’s LTS advisory for linux-5.10 includes CVE-2022-40307 among the listed fixes, indicating affected kernel ser...

CVE-2022-48773

CVE-2022-48773 — Linux kernel (xprtrdma rpcrdma_ep_create): Affected code path dereferenced non-NULL pointers in error handling. When rpcrdma_ep_create fails, non-NULL pointers could be left with an error value, causing rpcrdma_ep_destroy to free them and trigger a kernel Oops. The fix adds point...

CVE-2023-1611

CVE-2023-1611 is a use-after-free in btrfs_search_slot (fs/btrfs/ctree.c) in the Linux kernel, enabling local crashes and potentially kernel information leaks. Connected advisories (e.g., Red Hat and Astra/AL) confirm the issue and advocate updating the kernel to mitigate. Affected product is the...

CVE-2023-45862

CVE-2023-45862 affects the ENE UB6250 USB reader driver in Linux kernels prior to 6.2.5. The issue is a memory-allocation overrun in drivers/usb/storage/ene_ub6250.c where an object could extend beyond the end of an allocation. Risk details are not elaborated in the provided documents beyond this...

CVE-2023-52614

CVE-2023-52614 (Linux kernel) : The vulnerability is a buffer overflow in trans_stat_show() within PM/devfreq. The fix converts a simple snprintf to scnprintf with size PAGE_SIZE, adds a boundary check to exit when PAGE_SIZE is exceeded, issues a warning that stats are disabled, and returns -EFBI...

CVE-2024-26733

CVE-2024-26733 (Linux kernel) : A heap-based buffer overflow in arp_req_get() was fixed. The issue occurs when ioctl(SIOCGARP) copies neigh->ha into arpreq.arp_ha.sa_data (14-byte sockaddr) with a 14-byte copy, risking overflow into arp_flags and overwriting arp_netmask if dev->addr_len exc...

CVE-2024-26933

CVE-2024-26933 is described in connected advisories as a Linux kernel USB core fix: it resolves a deadlock in the port "disable" sysfs attribute handling. The show/store callbacks for the disable sysfs file in port.c acquire the hub’s device lock, while removing a hub (and potentially changing it...

CVE-2025-38352

CVE-2025-38352: In the Linux kernel, a TOCTOU race affects posix-cpu-timers between handle_posix_cpu_timers() and posix_cpu_timer_del() when an exiting non-autoreaping task runs from IRQ. The fix adds a tsk->exit_state check into run_posix_cpu_timers() to prevent misdetection of timer->it.c...

CVE-2016-7913

CVE-2016-7913 affects the Linux kernel tuner driver xc2028 (drivers/media/tuners/tuner-xc2028.c). The vulnerability stems from xc2028_set_config: if the firmware name is omitted from a data structure, a local attacker can trigger a use-after-free, enabling privilege escalation or a denial of serv...

CVE-2017-7472

CVE-2017-7472 affects the KEYS subsystem of the Linux kernel prior to version 4.10.13. A local attacker can exhaust memory by repeatedly invoking keyctl_set_reqkey_keyring on KEY_REQKEY_DEFL_THREAD_KEYRING, leading to a denial of service. The vulnerability is triggered by a sequence of calls in t...

CVE-2019-12379

The connected Nessus UNPATCHED_CVE_2019_12379 entry confirms CVE-2019-12379 affects Linux kernel code path con_insert_unipair in drivers/tty/vt/consolemap.c (up to kernel 5.1.5) with a memory leak in an ENOMEM/kmalloc scenario. The description explicitly notes this issue is disputed as an actual ...

CVE-2022-49173

In the Linux kernel, CVE-2022-49173 affects the SPI FSI path where data transfer routines poll a status register and may hang if a hardware bad state occurs. The fix adds a timeout to polling and returns an error when exceeded, preventing infinite loops. Affected component: spi: fsi in the Linux ...

CVE-2023-52475

CVE-2023-52475 : Linux kernel powermate driver has a use-after-free when the device is disconnected. The issue occurs when an asynchronous control message completes after the powermate_device is freed, leaving a dead lock reference. The recommended fix is to cancel in-progress requests on disconn...

CVE-2024-26679

CVE-2024-26679 : Linux kernel vulnerability where inet_recv_error() reads sk->sk_family without holding the socket lock, enabling a mutation from IPv6 to IPv4 via IPV6_ADDRFORM and potentially triggering a KCSAN warning. Documented fixes exist in kernel commits (see references to stable/commit...

CVE-2024-35886

CVE-2024-35886: Linux kernel vulnerability in IPv6 routing dump logic caused infinite recursion in fib6_dump_done() during netlink dump (AF_UNSPEC RTM_GETROUTE/more data). Logs show repeated fib6_dump_done() calls and a stack guard page hit due to recursive destructor behavior. The publicly repor...

CVE-2024-39472

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2024-40960

CVE-2024-40960: Linux kernel IPv6 routing (rt6_probe) NULL-pointer dereference. The code could dereference a non-canonical address due to missing NULL check in __in6_dev_get(); syzbot trace shows a crash (OOPs) in rt6_probe and call path through rt6_nh_find_match and fib6_table_lookup. The vulner...

CVE-2017-2647

CVE-2017-2647 affects the Linux kernel KEYS subsystem (keyring_search_iterator in keyring.c) and allows a local, authenticated user to trigger a NULL pointer dereference, enabling a crash or possible privilege escalation. The vulnerability is documented across multiple advisories; remediation is ...

CVE-2017-2671

CVE-2017-2671 affects the Linux kernel ping_unhash in net/ipv4/ping.c. The issue is that a lock is obtained too late, failing to guarantee safety for disconnect calls, enabling a local attacker to trigger a denial of service (panic) by leveraging IPPROTO_ICMP in a socket syscall. Public reference...

CVE-2019-9162

CVE-2019-9162 concerns the Linux kernel prior to 4.20.12, where the SNMP NAT module's net/ipv4/netfilter/nf_nat_snmp_basic_main.c contains insufficient ASN.1 length checks. This can trigger an out-of-bounds read/write (array index) leading to a kernel oops or local privilege escalation, specifica...

CVE-2020-27675

CVE-2020-27675 describes a race condition in the Xen event-channel handling code (drivers/xen/events/events_base.c) that permits removal of an event channel during event handling, causing a use-after-free or NULL dereference and potentially a dom0 crash. The issue is present in the Linux kernel u...

CVE-2021-46984

CVE-2021-46984 : Linux kernel kyber driver had an out-of-bounds read due to a race between blk_mq_get_ctx() calls when a thread is preempted, causing ctx->index_hw[hctx->type] to differ from hctx. The fix passes the request_queue to kyber_bio_merge() (via ->bio_merge()) so Kyber can map ...

CVE-2023-52477

In CVE-2023-52477, the Linux kernel USB hub code (drivers/usb/core/hub.c/hub.h) incorrectly accessed fields inside udev->bos without verifying that the BOS descriptor was allocated/initialized. If usb_get_bos_descriptor() fails, udev->bos can be NULL, causing a NULL pointer dereference and ...

CVE-2024-26882

CVE-2024-26882 relates to the Linux kernel vulnerability in the IPv4 IP tunnel receive path. The issue stems from not preserving the original skb->network_header when pulling inner headers during decapsulation in ip_tunnel_rcv(), which could interact with skb_head handling and header recomputa...

CVE-2024-38780

CVE-2024-38780 affects the Linux kernel's dma-buf/sw-sync path. The root cause was replacing spin_unlock_irqrestore() with spin_unlock_irq() in sync_print_obj() (and in sync_debugfs_show()) after commit a6aa8fca4d79, triggering a lockdep warning about inconsistent lock state. The fix uses plain s...

CVE-2024-50137

CVE-2024-50137 affects the Linux kernel, specifically the StarFive JH7110 reset driver. A fault in reset_control_status can cause data->asserted to be NULL on the JH7110 SoC, triggering errors when accessing an empty member. The issue has been fixed by adding a judgment condition to avoid null...

CVE-2024-56601

CVE-2024-56601 is a Linux kernel vulnerability in the inet/ code path. The issue arises because sock_init_data() attaches a kernel socket (sk) to a sock, and if inet_create() fails later, the sk is freed but the sock retains a dangling sk pointer, enabling a use-after-free on the sock. The docume...

CVE-2025-21666

CVE-2025-21666 involves a null-pointer dereference in the Linux kernel when vsock_*_has_data/has_space is invoked on a socket that has been de-assigned from a transport. The problem is mitigated by returning 0 (no space/data) with a warning to keep execution stable. Connected documents confirm th...

CVE-2025-21675

The CVE-2025-21675 issue affects the Linux kernel code path for mlx5_lag_port_sel_create, where resource cleanup was incomplete and could lead to double-destruction of definers after a failure to create the port select structure. The resulting cleanup gap caused a NULL pointer dereference on erro...

CVE-2015-8767

CVE-2015-8767 affects the Linux kernel SCTP path: net/sctp/sm_sideeffect.c fails to properly synchronize a lock with a socket during heartbeat timeout processing, allowing a local attacker to cause a denial of service (deadlock) via crafted sctp_accept calls. Affected: Linux kernel before 4.3 (pe...

CVE-2019-19377

CVE-2019-19377 concerns Linux kernel 5.0.21 where mounting a crafted btrfs image, performing actions, and unmounting can trigger a use-after-free in btrfs_queue_work (fs/btrfs/async-thread.c). Connected Nessus advisories for Unity Linux (UTSA-2026-004393) reiterate this, tying the issue to kernel...

CVE-2020-27830

CVE-2020-27830 is a Linux Kernel vulnerability where spk_ttyio_receive_buf2() can dereference spk_ttyio_synth when it is NULL, causing a NULL-pointer dereference crash. The connected Nessus advisories (Unity Linux UTSA-2026-001485, UTSA-2026-004226, UTSA-2026-003925) reference this CVE as part of...

CVE-2021-42327

CVE-2021-42327 is a Linux kernel heap-based buffer overflow in the AMDGPU display driver debugfs path (amdgpu_dm_debugfs.c). The flaw occurs in dp_link_settings_write where parse_write_buffer_into_params copies a userspace buffer into a 40-byte heap buffer without proper size checks against copy_...

CVE-2024-26671

CVE-2024-26671 describes a Linux kernel IO hang caused by blk-mq wakeup/race where __add_wait_queue() can be reordered with blk_mq_get_driver_tag() on tag failure, leading __sbitmap_queue_wake_up() to miss the waiter and not wake up, while blk_mq_mark_tag_wait() cannot obtain a driver tag. The fi...

CVE-2024-27020

In CVE-2024-27020, the Linux kernel nf_tables code had a potential data race when nft_unregister_expr() ran concurrently with __nft_expr_type_get() due to insufficient protection while iterating nf_tables_expressions. The fix involves iterating nf_tables_expressions with list_for_each_entry_rcu()...

CVE-2024-43892

The CVE-2024-43892 issue lies in the Linux kernel memcg path: idr_alloc()/idr_replace() are protected by cgroup_mutex, but idr_remove() for mem_cgroup_idr was not, allowing races when memcg references drop to zero. This can cause multiple memcgs to share or lose IDs, corrupting mem_cgroup_idr and...

CVE-2024-46740

CVE-2024-46740 affects the Linux kernel binder subsystem. The issue arises when copying raw data between binder objects during transactions: there is no bounds check for data outside the target data section, so excess raw data can overwrite the offsets section. This can corrupt object indices dur...

CVE-2024-53103

CVE-2024-53103 refers to a Linux kernel vulnerability in hv_sock where, on release of an hvs, vsk->trans could be left uninitialized, creating a dangling pointer. The issue is resolved by explicitly initializing vsk->trans to NULL to prevent use-after-free scenarios. Connected advisories (A...

CVE-2024-53173

CVE-2024-53173 — Linux kernel NFSv4.0 use-after-free fix . The vulnerability arises when two threads open files concurrently and abort before a reply is seen, leading to use-after-free of the defunct rpc task pointer due to nfs_release_seqid() in nfs4_opendata_free(). The patch ensures that if th...

CVE-2024-56595

CVE-2024-56595 concerns the Linux kernel JFS (Journaling File System) code path in dbAdjTree. The issue is an array-index-out-of-bounds that can occur when lp is 0 at the start of a for loop, which may become negative on the next assignment if not bailed out. The available connected documents con...

CVE-2024-56605

CVE-2024-56605 is a Linux kernel vulnerability in Bluetooth L2CAP handling. The issue arises when bt_sock_alloc() creates an sk object and attaches it to a sock; on error, l2cap_sock_alloc() frees the sk but leaves a dangling sk pointer attached to the sock, allowing a potential use-after-free in...

CVE-2010-3705

The vulnerability CVE-2010-3705 affects the Linux kernel SCTP code: sctp_auth_asoc_get_hmac in net/sctp/auth.c does not validate the hmac_ids array from a remote peer, enabling remote attackers to trigger memory corruption and a kernel panic. Affected versions are Linux kernel before 2.6.36; reme...

CVE-2012-6538

CVE-2012-6538 affects the Linux kernel prior to 3.6. The vulnerability lives in net/xfrm/xfrm_user.c: the function copy_to_user_auth uses an incorrect C library function for copying a string, enabling local users with CAP_NET_ADMIN to read sensitive information from kernel heap memory. The Miracl...

CVE-2014-0181

The CVE-2014-0181 issue affects the Linux kernel Netlink implementation prior to 3.14.1, where there is no authorization based on the opener of a Netlink socket. This can allow a local user to bypass intended access restrictions and modify network configurations by using a Netlink socket for the ...

CVE-2020-10774

CVE-2020-10774: A local memory disclosure flaw in the Linux kernel sysctl subsystem allows reading uninitialized kernel memory when reading /proc/sys/kernel/rh_features, affecting kernel versions before 4.18.0-193.el8. Root cause is a memory disclosure in the sysctl path; impact is confidentialit...

CVE-2021-20320

CVE-2021-20320 : A flaw in the Linux kernel, specifically in s390 eBPF JIT (bpf_jit_insn in arch/s390/net/bpf_jit_comp.c). The vulnerability could let a local attacker with restricted privileges bypass the verifier and cause a confidentiality impact. Connected advisories (Unity Linux UTSA-2026-00...