CVE-2024-56769

CVE-2024-56769 affects the Linux kernel media DVB frontends, specifically the dib3000mb driver. The issue is a KMSAN-detected uninitialized value in dib3000_read_reg, arising from an inadequate error handling path in i2c_transfer() where a read buffer rb[2] can end up with undefined values if the...

CVE-2024-57903

CVE-2024-57903 is a Linux kernel vulnerability affecting the net module: SO_REUSEPORT was restricted to inet sockets after a blamed commit. The issue could involve destroying crypto sockets via an RCU callback and attempted mutex acquisition within that context. The description notes that the pat...

CVE-2025-21867

CVE-2025-21867 concerns the Linux kernel’s BPF test_run path, where eth_skb_pkt_type() could read skb data without an Ethernet header if bpf_prog_test_run_xdp() passed an invalid user_data value. KMSAN reported a use-after-free in this path. The root cause is access to data that may not contain E...

CVE-2019-15291

CVE-2019-15291 affects the Linux kernel up to 5.2.9, with a NULL pointer dereference caused by a malicious USB device in flexcop_usb_probe (drivers/media/usb/b2c2/flexcop-usb.c). Unity Nessus advisories report a security update (UTSA-2026-003882/003688/000335) addressing this issue; no exploit de...

CVE-2023-28464

CVE-2023-28464 is described in MiracleLinux/Alibaba Cloud Linux advisories as a use-after-free in the Linux kernel Bluetooth subsystem (hci_conn_cleanup in net/bluetooth/hci_conn.c) observed up to kernel 6.2.9, with a double-free leading to possible privilege escalation. The connected Nessus entr...

CVE-2024-24857

Summary (CVE-2024-24857) : A race condition in the Linux kernel’s net/bluetooth driver function conn_info_{min,max}age_set() may cause an integrity overflow, potentially causing Bluetooth connection abnormalities or DoS. Public sources place this as a kernel issue affecting the Bluetooth subsyste...

CVE-2024-39503

CVE-2024-39503 : Linux kernel netfilter ipset race in the list:set type (namespace cleanup vs. gc) has a confirmed fix. The issue was a race that could cause use-after-free by GC data being accessed after the set is destroyed. The patch changes destruction order: when destroying all sets, first r...

CVE-2024-44995

Concrete details found: CVE-2024-44995 affects the Linux kernel net driver hns3, where configuring TC during reset could deadlock due to the sequence of napi_disable/napi_enable/netif_napi_del/netif_napi_add. The fix inserts a DOWN path in UINIT to avoid the race. Connected Astra Linux entry mirr...

CVE-2024-49883

In CVE-2024-49883, the Linux kernel ext4 ext4_ext_insert_extent() is vulnerable to use-after-free when a path is reallocated in ext4_ext_create_new_leaf(), leaving a stale path in ext4_ext_insert_extent() and triggering UAF (KASAN) during map/write paths. The issue is reproduced via a realloc of ...

CVE-2025-21764

The CVE-2025-21764 issue affects the Linux kernel: ndisc_alloc_skb() could be invoked without RTNL or RCU held, enabling a potential use-after-free. The published fixes add RCU protection to ndisc_alloc_skb() to prevent UAF. Affected advisories (e.g., kernel security updates in Astra Linux, ALAS/...

CVE-2018-10882

CVE-2018-10882 affects the Linux kernel ext4 implementation. A local user can trigger an out-of-bounds write in fs/jbd2/transaction.c by mounting/unmounting a crafted ext4 image, causing denial of service and potential system crash. Public details describe the vulnerability as part of ext4 file-s...

CVE-2022-26365

Astra Linux security bulletins summarize CVE-2022-26365 among several Linux kernel issues affecting Linux-5.10/5.15 series. They describe that Linux Block and Network PV device frontends do not zero memory regions before sharing with the backend, and that grant-table granularity can co-locate unr...

CVE-2023-52475

CVE-2023-52475 : Linux kernel powermate driver has a use-after-free when the device is disconnected. The issue occurs when an asynchronous control message completes after the powermate_device is freed, leaving a dead lock reference. The recommended fix is to cancel in-progress requests on disconn...

CVE-2024-26804

CVE-2024-26804 affects the Linux kernel's IP tunnel infrastructure. The issue arises when packets are routed through a GRE tunnel and then encapsulated again (via ip_tunnel_xmit/ipip_tunnel_xmit), causing gre0 and ipip0 to inflate dev->needed_headroom iteratively. The neigh layer pulls skb wit...

CVE-2024-41042

Based on the provided documents, CVE-2024-41042 affects the Linux kernel nf_tables component. The vulnerability stems from the loop-detection path: nf_tables_check_loops() and its helpers were used to detect cycles in nft chains. The affected code path is nf_tables: the fix replaces or removes lo...

CVE-2024-43892

The CVE-2024-43892 issue lies in the Linux kernel memcg path: idr_alloc()/idr_replace() are protected by cgroup_mutex, but idr_remove() for mem_cgroup_idr was not, allowing races when memcg references drop to zero. This can cause multiple memcgs to share or lose IDs, corrupting mem_cgroup_idr and...

CVE-2024-56605

CVE-2024-56605 is a Linux kernel vulnerability in Bluetooth L2CAP handling. The issue arises when bt_sock_alloc() creates an sk object and attaches it to a sock; on error, l2cap_sock_alloc() frees the sk but leaves a dangling sk pointer attached to the sock, allowing a potential use-after-free in...

CVE-2025-21675

The CVE-2025-21675 issue affects the Linux kernel code path for mlx5_lag_port_sel_create, where resource cleanup was incomplete and could lead to double-destruction of definers after a failure to create the port select structure. The resulting cleanup gap caused a NULL pointer dereference on erro...

CVE-2017-14051

CVE-2017-14051 : An integer overflow in the Linux kernel’s qla2x00_sysfs_write_optrom_ctl (drivers/scsi/qla2xxx/qla_attr.c) up to version 4.12.10 enables a local user with root privileges to cause memory corruption and a system crash (DoS). Affected components/versions: Linux kernel ≤ 4.12.10. Mi...

CVE-2022-1205

CVE-2022-1205 is a NULL pointer dereference in the Linux kernel’s Amateur Radio AX.25 protocol handler that occurs during connection setup, enabling a local attacker to crash the system (local DoS). Affected component is the AX.25 hamradio implementation in the kernel; the issue is not a remote e...

CVE-2022-49173

In the Linux kernel, CVE-2022-49173 affects the SPI FSI path where data transfer routines poll a status register and may hang if a hardware bad state occurs. The fix adds a timeout to polling and returns an error when exceeded, preventing infinite loops. Affected component: spi: fsi in the Linux ...

CVE-2024-35847

CVE-2024-35847 affects the Linux kernel irqchip/gic-v3-its path. The vulnerability stems from the error handling in its_vpe_irq_domain_alloc(), where a double free occurs if its_vpe_init() fails after at least one interrupt was allocated. The code frees the area bitmap and vprop_page in its_vpe_i...

CVE-2024-35862

CVE-2024-35862 (CVE entry) : Astra Linux security advisory describes a Linux kernel SMB client issue where a potential Use-After-Free (UAF) in smb2_is_network_name_deleted() could occur. The advisory notes that sessions being torn down (status SES_EXITING) are skipped to avoid UAF, indicating a f...

CVE-2024-35947

The Linux kernel contains a vulnerability in the dyndbg component's >control parser due to an old BUG_ON condition from 2009. Incorrect error handling in the ddebug_tokenize() function can lead to a service failure . The issue has been resolved by replacing the BUG_ON with pr_err and returning...

CVE-2024-36940

CVE-2024-36940 – Linux kernel pinctrl double-free issue Root cause: In the pinctrl core, freeing the pctldev is managed via devm_pinctrl_dev_release(), but the code in pinctrl_enable() frees that struct again, causing a double-free. The devm lifecycle is intended to release automatically; manual ...

CVE-2024-50039

CVE-2024-50039 (Linux kernel) : The vulnerability resides in the net/sched subsystem where TCA_STAB is accepted only for the root qdisc. The bug arises because most qdiscs track backlog assuming invariance of qdisc_pkt_len(skb) between enqueue() and dequeue(), but a syzbot-triggered combination o...

CVE-2024-50044

CVE-2024-50044 affects the Linux kernel Bluetooth RFCOMM path. The issue is a deadlock in rfcomm_sk_state_change caused by rfcomm_sock_ioctl attempting to lock sock_lock while another path already holds the lock, creating circular locking. The vulnerability is resolved in kernel code by ensuring ...

CVE-2024-50073

CVE-2024-50073: Linux kernel tty/n_gsm use-after-free in gsm_cleanup_mux (UAF on gsm_msg in gsm_mux tx lists). Unity Linux advisory confirms fix: protect gsm_msg by adding a gsm tx lock to prevent multi-threaded free via ioctl. Affects kernel 6.11.0+; patch details referenced in Unity/Nessus desc...

CVE-2024-56658

CVE-2024-56658 affects the Linux kernel (net subsystem). The issue is a slab-use-after-free in the dst_destroy path triggered when net namespaces dismantle, specifically around xfrm6_net_init()/xfrm4_net_init() where copied dst_ops templates in net→xfrm can be freed before dst callbacks finish. T...

CVE-2017-17712

Technical details about CVE-2017-17712 are not publicly available in the provided connected documents. Monitor for updates from vendor advisories and upstream kernel patches.

CVE-2017-7472

CVE-2017-7472 affects the KEYS subsystem of the Linux kernel prior to version 4.10.13. A local attacker can exhaust memory by repeatedly invoking keyctl_set_reqkey_keyring on KEY_REQKEY_DEFL_THREAD_KEYRING, leading to a denial of service. The vulnerability is triggered by a sequence of calls in t...

CVE-2018-18710

CVE-2018-18710 affects the Linux kernel up to 4.19, in the CDROM driver: cdrom_ioctl_select_disc in drivers/cdrom/cdrom.c. A cast from unsigned long to int can bypass bounds checking, enabling a local attacker to read kernel memory (information disclosure). The issue is analogous to CVE-2018-1094...

CVE-2018-8087

The CVE-2018-8087 issue affects the Linux kernel driver code in mac80211_hwsim.c (hwsim_new_radio_nl). It describes a memory leak that can be triggered by an out-of-array error, allowing local users to cause denial of service through memory consumption. The vulnerability is reported for the kerne...

CVE-2022-1280

CVE-2022-1280 is a Linux kernel use-after-free in drm_lease_held (drivers/gpu/drm/drm_lease.c) caused by a race. Exploitation may enable local privilege attackers to cause DoS or kernel information leak. Connected docs also reference a separate disclosure chain noting a race between drm_setmaster...

CVE-2022-48773

CVE-2022-48773 — Linux kernel (xprtrdma rpcrdma_ep_create): Affected code path dereferenced non-NULL pointers in error handling. When rpcrdma_ep_create fails, non-NULL pointers could be left with an error value, causing rpcrdma_ep_destroy to free them and trigger a kernel Oops. The fix adds point...

CVE-2023-46862

CVE-2023-46862 (Linux kernel) affects kernels up to 6.5.9. A race during SQ thread exit can trigger a NULL pointer dereference in io_uring_show_fdinfo (io_uring/fdinfo.c), potentially crashing the system or causing denial of service. The issue is tied to the io_uring subsystem and occurs under sp...

CVE-2024-38780

CVE-2024-38780 affects the Linux kernel's dma-buf/sw-sync path. The root cause was replacing spin_unlock_irqrestore() with spin_unlock_irq() in sync_print_obj() (and in sync_debugfs_show()) after commit a6aa8fca4d79, triggering a lockdep warning about inconsistent lock state. The fix uses plain s...

CVE-2025-21776

CVE-2025-21776 affects the Linux kernel USB hub driver where non‑compliant hubs with more than one config/interface can trigger a crash (usb_hub_to_struct_hub dereference). A fix exists: the driver now refuses hubs violating USB spec (more than one configuration or interface). Connected advisorie...

CVE-2016-4578

CVE-2016-4578 affects the Linux kernel’s ALSA timer subsystem (snd_timer_user_ccallback and snd_timer_user_tinterrupt). The provided sources confirm a local information leak: if the snd_timer interfaces are used, uninitialized r1 data can be read from kernel stack memory, enabling a local attacke...

CVE-2023-23000

CVE-2023-23000 affects Linux kernel pre-5.17: in drivers/phy/tegra/xusb.c, tegra_xusb_find_port_node return value is mishandled, with callers expecting NULL in error cases but an error pointer is returned. The referenced fixes appear in kernel 5.17 changelog.

CVE-2024-26649

CVE-2024-26649 (linux kernel, drm/amdgpu) fixes a NULL pointer dereference in RLC firmware loading. Root cause: when RLC firmware header size is invalid, the firmware pointer is released and later dereferenced. The patch skips the validation to prevent the NULL pointer dereference during subseque...

CVE-2024-26679

CVE-2024-26679 : Linux kernel vulnerability where inet_recv_error() reads sk->sk_family without holding the socket lock, enabling a mutation from IPv6 to IPv4 via IPV6_ADDRFORM and potentially triggering a KCSAN warning. Documented fixes exist in kernel commits (see references to stable/commit...

CVE-2024-45006

CVE-2024-45006 affects the Linux kernel xHCI Panther Point. Root cause: after a failed address-device command during re-enumeration of full-speed USB devices, the software bandwidth table pointers aren’t set, causing a NULL pointer dereference when usb_ep0_reinit() invokes xhci_configure_endpoint...

CVE-2024-56763

The CVE applies to the Linux kernel tracing subsystem, specifically tracing_cpumask_write. A large count can trigger a warning in bitmap_parse_user and there is an additional zero-count check. The fix is described as: Prevent bad count for tracing_cpumask_write and also check zero for it. Connect...

CVE-2015-8812

CVE-2015-8812 affects the Linux kernel CXGB3 driver; a use-after-free in drivers/infiniband/hw/cxgb3/iwch_cm.c can be triggered by crafted packets to remotely execute code or cause a denial of service. Impact is a remote-code execution/DoS via network traffic with the vulnerability labeled as hig...

CVE-2017-12154

The CVE-2017-12154 entry describes a Linux kernel KVM/vmx issue (arch/x86/kvm/vmx.c: prepare_vmcs02) present through kernel 4.13.3. Root cause: it does not ensure that the CR8-load exiting and CR8-store exiting vmcs02 controls exist when L1 omits the use_TPR_shadow VMCS12 control, enabling a KVM ...

CVE-2017-5986

CVE-2017-5986 affects the Linux kernel SCTP implementation (net/sctp/socket.c). A race condition in sctp_wait_for_sndbuf during certain buffer-full/wait states allows a local attacker to peel off an association with another thread, leading to an assertion failure or a crash (DoS). The issue was t...

CVE-2018-5995

CVE-2018-5995 affects the Linux kernel (up to 4.14.14). The flaw is in pcpu_embed_first_chunk() in mm/percpu.c, which can let a local user read dmesg data (from a pages/cpu printk call) and disclose sensitive kernel addresses. Impact: partial kernel address disclosure with local access. Root caus...

CVE-2023-1249

CVE-2023-1249: A use-after-free in the Linux kernel core dump subsystem could allow a local user to crash the system; this requires patch 390031c94211 to be applied to be affected. Technical details are not publicly provided in the supplied documents. Monitor for updates.

CVE-2023-32250

CVE-2023-32250 : A race condition in the Linux kernel ksmbd SMB server’s handling of SMB2_SESSION_SETUP commands due to missing locking can allow an attacker to execute code in kernel context. The vulnerability is tied to the in-kernel ksmbd implementation and is reflected in multiple advisories ...