CVE-2017-2618

CVE-2017-2618 is a Linux kernel local vulnerability caused by how SELinux attributes are cleared on /proc/pid/attr. An empty write to that file can crash the system by triggering access to unmapped kernel memory. The connected Nessus entries (Unity Linux, MiracleLinux AXSA advisory, and related p...

CVE-2018-10882

CVE-2018-10882 affects the Linux kernel ext4 implementation. A local user can trigger an out-of-bounds write in fs/jbd2/transaction.c by mounting/unmounting a crafted ext4 image, causing denial of service and potential system crash. Public details describe the vulnerability as part of ext4 file-s...

CVE-2019-12378

CVE-2019-12378 affects the Linux kernel (up to 5.1.5) in ip6_ra_control (net/ipv6/ipv6_sockglue.c). It involves an unchecked kmalloc of new_ra that could lead to a NULL pointer dereference and system crash (DoS). Note: the issue has been disputed as not an issue in some sources. No public patch d...

CVE-2022-41849

CVE-2022-41849 affects the Linux kernel, specifically drivers/video/fbdev/smscufx.c, where a race between ufx_ops_open and ufx_usb_disconnect can cause a use-after-free if a nearby attacker unplugs a USB device during open(). The vulnerability is locally exploitable with physical access and has a...

CVE-2023-1582

CVE-2023-1582 is described in connected documents as a race condition in the Linux kernel's fs/proc/task_mmu.c under the memory management component. It may allow a local privileged user to cause a denial of service. The MiracleLinux advisory block lists the vulnerability and confirms the race co...

CVE-2023-1611

CVE-2023-1611 is a use-after-free in btrfs_search_slot (fs/btrfs/ctree.c) in the Linux kernel, enabling local crashes and potentially kernel information leaks. Connected advisories (e.g., Red Hat and Astra/AL) confirm the issue and advocate updating the kernel to mitigate. Affected product is the...

CVE-2024-26665

CVE-2024-26665 : Linux kernel vulnerability in tunnel PMTU error handling. When ICMPv6 error is built from a non-linear skb, there is an out-of-bounds/read issue due to using csum_partial. The fix replaces csum_partial with skb_checksum to correctly handle non-linear SKBs during IPv6 PMTU error c...

CVE-2024-26671

CVE-2024-26671 describes a Linux kernel IO hang caused by blk-mq wakeup/race where __add_wait_queue() can be reordered with blk_mq_get_driver_tag() on tag failure, leading __sbitmap_queue_wake_up() to miss the waiter and not wake up, while blk_mq_mark_tag_wait() cannot obtain a driver tag. The fi...

CVE-2024-42090

The CVE CVE-2024-42090 affects the Linux kernel pinctrl subsystem. Root cause: in create_pinctrl(), pinctrl_maps_mutex is held when add_setting() can return -EPROBE_DEFER, and the code then calls pinctrl_free(), which attempts to re-acquire pinctrl_maps_mutex, risking a deadlock. The patch fixes ...

CVE-2024-43904

CVE-2024-43904 is a Linux kernel issue affecting the AMD display pipeline. The vulnerability stemmed from missing null checks in drm/amd/display code, where the variables stream and plane could be dereferenced without verifying non-null values in dcn30_apply_idle_power_optimizations, risking a nu...

CVE-2024-45006

CVE-2024-45006 affects the Linux kernel xHCI Panther Point. Root cause: after a failed address-device command during re-enumeration of full-speed USB devices, the software bandwidth table pointers aren’t set, causing a NULL pointer dereference when usb_ep0_reinit() invokes xhci_configure_endpoint...

CVE-2024-50137

CVE-2024-50137 affects the Linux kernel, specifically the StarFive JH7110 reset driver. A fault in reset_control_status can cause data->asserted to be NULL on the JH7110 SoC, triggering errors when accessing an empty member. The issue has been fixed by adding a judgment condition to avoid null...

CVE-2024-53194

In the Linux kernel, the following vulnerability has been resolved: PCI: Fix use-after-free of slot->bus on hot remove Dennis reports a boot crash on recent Lenovo laptops with a USB4 dock. Since commit 0fc70886569c ("thunderbolt: Reset USB4 v2 host router") andcommit 59a54c5f3dbd ("thunderbol...

CVE-2025-21682

CVE-2025-21682 affects the bnxt driver in the Linux kernel. The issue occurs when XDP is detached: the driver may fail to recalculate features, causing HW-GRO to be unpredictably restored only during a later reconfiguration and potentially leaving the RSS map in an inconsistent state. This can le...

CVE-2017-7472

CVE-2017-7472 affects the KEYS subsystem of the Linux kernel prior to version 4.10.13. A local attacker can exhaust memory by repeatedly invoking keyctl_set_reqkey_keyring on KEY_REQKEY_DEFL_THREAD_KEYRING, leading to a denial of service. The vulnerability is triggered by a sequence of calls in t...

CVE-2021-28951

CVE-2021-28951 is a Linux kernel flaw affecting fs/io_uring.c up to 5.11.8 that can cause a denial of service (deadlock) when exit waits for a SQPOLL thread while the thread awaits a start signal. The issue is documented in multiple advisories (e.g., ALAS2KERNEL entries for Kernel-5.10/5.15 and r...

CVE-2022-48703

CVE-2022-48703 affects the Linux kernel’s thermal/int340x_thermal code path. A GDDV package can return a zero-length buffer, causing kmemdup() to yield ZERO_SIZE_PTR and data_vault_read() to dereference NULL. The patch fixes this by introducing checks that treat ZERO_SIZE_PTR and NULL as invalid,...

CVE-2023-1872

CVE-2023-1872 is a use-after-free in the Linux kernel io_uring subsystem caused by the io_file_get_fixed path not validating ctx->uring_lock, enabling a race with fixed files unregistration. This can lead to local privilege escalation and possible denial of service. Affected component is the k...

CVE-2024-35867

CVE-2024-35867 pertains to the Linux kernel SMB client. The vulnerability arises from a potential use-after-free in cifs_stats_proc_show(), mitigated by skipping sessions that are tearing down (status SES_EXITING) to prevent UAF. The fix resolves a local-attack scenario with high impact on confid...

CVE-2024-47748

CVE-2024-47748: Linux kernel vhost_vdpa code fixes an irq bypass producer token life-cycle bug. The token formerly registered in vhost_vdpa_setup_vq_irq() could outlive the eventfd_ctx, risking use-after-free when the eventfd is released. The patch binds the token lifecycle to VHOST_SET_VRING_CAL...

CVE-2024-56658

CVE-2024-56658 affects the Linux kernel (net subsystem). The issue is a slab-use-after-free in the dst_destroy path triggered when net namespaces dismantle, specifically around xfrm6_net_init()/xfrm4_net_init() where copied dst_ops templates in net→xfrm can be freed before dst callbacks finish. T...

CVE-2017-7616

CVE-2017-7616 affects the Linux kernel (mm/mempolicy.c) where incorrect error handling in set_mempolicy/mbind compat syscalls can leak uninitialized stack data to local attackers. The issue is documented across multiple advisories (e.g., Debian, CentOS, Cloud Foundry) and is mitigated by updating...

CVE-2018-15572

CVE-2018-15572: Linux kernel

CVE-2020-36694

The CVE-2020-36694 issue affects the Linux kernel netfilter path prior to 5.10, enabling a use-after-free in the packet processing context due to mishandling of the per-CPU sequence counter during concurrent iptables rule replacements. Exploitation requires CAP_NET_ADMIN in an unprivileged namesp...

CVE-2023-23000

CVE-2023-23000 affects Linux kernel pre-5.17: in drivers/phy/tegra/xusb.c, tegra_xusb_find_port_node return value is mishandled, with callers expecting NULL in error cases but an error pointer is returned. The referenced fixes appear in kernel 5.17 changelog.

CVE-2023-52565

CVE-2023-52565 is a Linux kernel vulnerability affecting the media: uvcvideo subsystem. The issue is an out-of-bounds read in uvc_query_v4l2_menu() when the user-provided index exceeds the mask size, potentially allowing reading memory outside the intended bounds. The connected MiracleLinux advis...

CVE-2024-35862

CVE-2024-35862 (CVE entry) : Astra Linux security advisory describes a Linux kernel SMB client issue where a potential Use-After-Free (UAF) in smb2_is_network_name_deleted() could occur. The advisory notes that sessions being torn down (status SES_EXITING) are skipped to avoid UAF, indicating a f...

CVE-2024-36901

CVE-2024-36901 affects the Linux kernel IPv6 stack. The issue is a NULL dereference in ip6_output() when ip6_dst_idev() returns NULL, causing a general protection fault. The syzbot report indicates a crash path in ip6_output+0x231/0x3f0, traceable to net/ipv6/ip6_output.c:237, with a NULL idev de...

CVE-2025-21776

CVE-2025-21776 affects the Linux kernel USB hub driver where non‑compliant hubs with more than one config/interface can trigger a crash (usb_hub_to_struct_hub dereference). A fix exists: the driver now refuses hubs violating USB spec (more than one configuration or interface). Connected advisorie...

CVE-2025-37738

CVE-2025-37738 details from Connected docs show a Linux kernel ext4 vulnerability: ext4_xattr_inode_dec_ref_all may read past the end while processing xattrs, leading to a slab-use-after-free as reported by KASAN. The fix makes ext4_xattr handling ignore xattrs entries beyond the end, preventing ...

CVE-2015-8767

CVE-2015-8767 affects the Linux kernel SCTP path: net/sctp/sm_sideeffect.c fails to properly synchronize a lock with a socket during heartbeat timeout processing, allowing a local attacker to cause a denial of service (deadlock) via crafted sctp_accept calls. Affected: Linux kernel before 4.3 (pe...

CVE-2016-7913

CVE-2016-7913 affects the Linux kernel tuner driver xc2028 (drivers/media/tuners/tuner-xc2028.c). The vulnerability stems from xc2028_set_config: if the firmware name is omitted from a data structure, a local attacker can trigger a use-after-free, enabling privilege escalation or a denial of serv...

CVE-2017-17862

CVE-2017-17862 affects the Linux kernel up to 4.14.8. The issue stems from kernel/bpf/verifier.c mis-pruning of unreachable code, which could be mishandled by JITs and enable a local denial-of-service by unprivileged users. Connected advisories and patches indicate this was addressed via kernel f...

CVE-2017-7477

CVE-2017-7477 affects the Linux kernel MACsec driver (drivers/net/macsec.c) up to version 4.10.12. It is a heap-based buffer overflow triggered by using MAX_SKB_FRAGS+1 with NETIF_F_FRAGLIST, causing denial of service and potentially other unspecified impacts via skb_to_sgvec. Public details in c...

CVE-2017-7618

CVE-2017-7618 affects the Linux kernel crypto/ahash.c, enabling denial of service by triggering EBUSY on a full request queue and causing infinite recursion in the AHASH path. The issue is referenced across multiple connected advisories (Cloud Foundry USN-3312-2, CNVD-2017-05429, Debian DLA-922-1...

CVE-2019-12379

The connected Nessus UNPATCHED_CVE_2019_12379 entry confirms CVE-2019-12379 affects Linux kernel code path con_insert_unipair in drivers/tty/vt/consolemap.c (up to kernel 5.1.5) with a memory leak in an ENOMEM/kmalloc scenario. The description explicitly notes this issue is disputed as an actual ...

CVE-2020-27675

CVE-2020-27675 describes a race condition in the Xen event-channel handling code (drivers/xen/events/events_base.c) that permits removal of an event channel during event handling, causing a use-after-free or NULL dereference and potentially a dom0 crash. The issue is present in the Linux kernel u...

CVE-2020-27830

CVE-2020-27830 is a Linux Kernel vulnerability where spk_ttyio_receive_buf2() can dereference spk_ttyio_synth when it is NULL, causing a NULL-pointer dereference crash. The connected Nessus advisories (Unity Linux UTSA-2026-001485, UTSA-2026-004226, UTSA-2026-003925) reference this CVE as part of...

CVE-2021-20320

CVE-2021-20320 : A flaw in the Linux kernel, specifically in s390 eBPF JIT (bpf_jit_insn in arch/s390/net/bpf_jit_comp.c). The vulnerability could let a local attacker with restricted privileges bypass the verifier and cause a confidentiality impact. Connected advisories (Unity Linux UTSA-2026-00...

CVE-2023-45862

CVE-2023-45862 affects the ENE UB6250 USB reader driver in Linux kernels prior to 6.2.5. The issue is a memory-allocation overrun in drivers/usb/storage/ene_ub6250.c where an object could extend beyond the end of an allocation. Risk details are not elaborated in the provided documents beyond this...

CVE-2023-52622

CVE-2023-52622 concerns an ext4 online resizing failure when flexbg_size is oversized. Affected Linux kernel workflows (mkfs.ext4 -G, mount, resize2fs) could trigger WARN_ON at __alloc_pages/__kmalloc during ext4_resize_fs, caused by MAX_RESIZE_BG exceeding available memory groups. The minimum MA...

CVE-2024-35866

CVE-2024-35866: Linux kernel SMB CIFS client use-after-free in cifs_dump_full_key() addressed by skipping sessions tearing down (status == SES_EXITING) to prevent UAF. Connected docs confirm this fix and list multiple downstream advisories (e.g., ALAS2KERNEL, ALAS2023, Debian DLA-4193-1) referenc...

CVE-2024-35930

CVE-2024-35930 concerns the Linux kernel SCSI lpfc driver. It fixes a memory leak in lpfc_rcv_padisc() where a failed return from lpfc_sli4_resume_rpi() could leave an elsiocb unreleased and its resources leaked. The remediation is to check the return value of lpfc_sli4_resume_rpi() and, on failu...

CVE-2024-39471

CVE-2024-39471 is addressed in the Unity Linux advisory UTSA-2025-990372. The issue arises from the Linux kernel AMDGPU driver: when sdma_v4_0_irq_id_to_seq returns -EINVAL, an out-of-bounds read may occur. The patch adds an explicit error path to stop processing and return -EINVAL to prevent the...

CVE-2024-42078

The CVE-2024-42078 issue affects the Linux kernel’s NFS server (nfsd) where nfsd_info.mutex could be dereferenced after a new network namespace is created, potentially causing an oops. The fix, as described in the connected advisories, is to initialize nfsd_info.mutex earlier, before it can be de...

CVE-2024-43856

CVE-2024-43856 affects the Linux kernel DMA code. The vulnerability occurs in dma/dmam_free_coherent: after freeing a DMA allocation, the code frees the vaddr, then calls devres_destroy() to remove tracking data. A concurrent task could allocate the same vaddr and add it to the devres list betwee...

CVE-2024-56604

Summary (CVE-2024-56604): In the Linux kernel, Bluetooth RFCOMM can leave a dangling sk pointer in rfcomm_sock_alloc() when rfcomm_dlc_alloc() fails, leading to a use-after-free. The root cause is bt_sock_alloc() attaching the sk to the sock object and the code path not clearing the pointer on fa...

CVE-2024-56642

CVE-2024-56642 fixes a Linux kernel tipc use-after-free involving UDP sockets in cleanup_bearer(). The bug occurred when bearer_disable() leads to tipc_udp_disable(), and cleanup_bearer() decrements tipc_net(net)->wq_count too early, allowing a socket to be freed before its cleanup work comple...

CVE-2024-56763

The CVE applies to the Linux kernel tracing subsystem, specifically tracing_cpumask_write. A large count can trigger a warning in bitmap_parse_user and there is an additional zero-count check. The fix is described as: Prevent bad count for tracing_cpumask_write and also check zero for it. Connect...

CVE-2025-21867

CVE-2025-21867 concerns the Linux kernel’s BPF test_run path, where eth_skb_pkt_type() could read skb data without an Ethernet header if bpf_prog_test_run_xdp() passed an invalid user_data value. KMSAN reported a use-after-free in this path. The root cause is access to data that may not contain E...