CVE-2023-42752

CVE-2023-42752 - Linux kernel integer overflow in skb_shared_info allocation . The vulnerability arises when the kernel’s overflow allows skb_shared_info to be allocated in userspace. This is exploitable on systems without SMAP protection because skb_shared_info may contain references to function...

CVE-2024-26846

The Linux kernel contains a vulnerability in the nvme-fc module where a race condition exists in the module exit path between deleting all controllers and freeing 'left over IDs' . This race condition could potentially lead to a double free of memory. To resolve this, synchronization between nvme...

CVE-2024-35853

A memory leak exists in the Linux kernel within the mlxsw: spectrum_acl_tcam component during the rehash operation. The issue occurs because the code fails to verify if a backup chunk is NULL when a rollback of a failed migration is attempted, causing the backup chunk to be overwritten and leaked...

CVE-2024-39472

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2024-40901

CVE-2024-40901 affects the Linux kernel SCSI MPT3SAS path. The issue is a potential out-of-bounds access from test_bit()/set_bit() on a single word, where operations can exceed word boundaries. Mitigation implemented by ensuring allocations are at least sizeof(unsigned long) to provide space for ...

CVE-2024-43904

CVE-2024-43904 is a Linux kernel issue affecting the AMD display pipeline. The vulnerability stemmed from missing null checks in drm/amd/display code, where the variables stream and plane could be dereferenced without verifying non-null values in dcn30_apply_idle_power_optimizations, risking a nu...

CVE-2024-44931

CVE-2024-44931 describes a speculative information-leak in the Linux kernel gpio path: userspace can trigger a speculative read beyond the gpio descriptor array by calling gpio_ioctl() with an out-of-range offset. The fix sanitizes the offset before using it as an index by applying array_index_no...

CVE-2024-50035

CVE-2024-50035 affects the Linux kernel PPP path, specifically a fault in ppp_async_encode() that can be triggered by a zero-size pppoe_sendmsg() followed by an empty skb, leading to a possible uninitialized access (KMSAN) in drivers/net/ppp/ppp_async.c. The issue was fixed in upstream Linux comm...

CVE-2024-50137

CVE-2024-50137 affects the Linux kernel, specifically the StarFive JH7110 reset driver. A fault in reset_control_status can cause data->asserted to be NULL on the JH7110 SoC, triggering errors when accessing an empty member. The issue has been fixed by adding a judgment condition to avoid null...

CVE-2024-56604

Summary (CVE-2024-56604): In the Linux kernel, Bluetooth RFCOMM can leave a dangling sk pointer in rfcomm_sock_alloc() when rfcomm_dlc_alloc() fails, leading to a use-after-free. The root cause is bt_sock_alloc() attaching the sk to the sock object and the code path not clearing the pointer on fa...

CVE-2024-57843

CVE-2024-57843 concerns the Linux kernel’s virtio-net driver, specifically virtnet_rq_alloc. The defect arises when a fragment is exactly one page and the combined size of the buffer and virtnet_rq_dma (which reserves 16 bytes at the start of a new fragment) exceeds a page, causing an overflow. T...

CVE-2025-21682

CVE-2025-21682 affects the bnxt driver in the Linux kernel. The issue occurs when XDP is detached: the driver may fail to recalculate features, causing HW-GRO to be unpredictably restored only during a later reconfiguration and potentially leaving the RSS map in an inconsistent state. This can le...

CVE-2025-37785

The CVE-2025-37785 issue affects the Linux kernel ext4 filesystem. A corrupted directory containing a '.' entry with rec_len equal to a full block could cause an out-of-bounds read when ext4_empty_dir() loads the '.' entry and derives '..' location, due to incorrect handling of directory entries ...

CVE-2016-4913

The CVE-2016-4913 issue affects the Linux kernel (fs/isofs/rock.c) and concerns get_rock_ridge_filename mishandling of NM (alternate name) entries containing a NUL character. A local attacker mounting a crafted isofs filesystem could read kernel memory due to this information leak. The vulnerabil...

CVE-2017-12146

The CVE-2017-12146 issue affects the Linux kernel driver_override in drivers/base/platform.c prior to 4.12.1. A race between reads and stores of different overrides can allow a local user to gain privileges. Evidence from connected Nessus advisories (Unity Linux, EulerOS, OracleVM) confirms the v...

CVE-2017-2671

CVE-2017-2671 affects the Linux kernel ping_unhash in net/ipv4/ping.c. The issue is that a lock is obtained too late, failing to guarantee safety for disconnect calls, enabling a local attacker to trigger a denial of service (panic) by leveraging IPPROTO_ICMP in a socket syscall. Public reference...

CVE-2019-19227

The CVE-2019-19227 issue affects the Linux kernel AppleTalk subsystem prior to 5.1. The vulnerability is a potential NULL pointer dereference caused by register_snap_client returning NULL, which can trigger a denial of service in net/appletalk/aarp.c and net/appletalk/ddp.c (e.g., via unregister_...

CVE-2022-48703

CVE-2022-48703 affects the Linux kernel’s thermal/int340x_thermal code path. A GDDV package can return a zero-length buffer, causing kmemdup() to yield ZERO_SIZE_PTR and data_vault_read() to dereference NULL. The patch fixes this by introducing checks that treat ZERO_SIZE_PTR and NULL as invalid,...

CVE-2023-52664

The CVE-2023-52664 issue affects the Linux kernel net: Atlantic driver, where a logic error in ring data allocation/free can lead to a double-free scenario in error handling if memory allocation fails. The root cause is using the ring pointer as a failure indicator, while only ring data is alloca...

CVE-2024-26671

CVE-2024-26671 describes a Linux kernel IO hang caused by blk-mq wakeup/race where __add_wait_queue() can be reordered with blk_mq_get_driver_tag() on tag failure, leading __sbitmap_queue_wake_up() to miss the waiter and not wake up, while blk_mq_mark_tag_wait() cannot obtain a driver tag. The fi...

CVE-2024-26933

CVE-2024-26933 is described in connected advisories as a Linux kernel USB core fix: it resolves a deadlock in the port "disable" sysfs attribute handling. The show/store callbacks for the disable sysfs file in port.c acquire the hub’s device lock, while removing a hub (and potentially changing it...

CVE-2024-35867

CVE-2024-35867 pertains to the Linux kernel SMB client. The vulnerability arises from a potential use-after-free in cifs_stats_proc_show(), mitigated by skipping sessions that are tearing down (status SES_EXITING) to prevent UAF. The fix resolves a local-attack scenario with high impact on confid...

CVE-2024-35930

CVE-2024-35930 concerns the Linux kernel SCSI lpfc driver. It fixes a memory leak in lpfc_rcv_padisc() where a failed return from lpfc_sli4_resume_rpi() could leave an elsiocb unreleased and its resources leaked. The remediation is to check the return value of lpfc_sli4_resume_rpi() and, on failu...

CVE-2024-35960

The Linux kernel contains a NULL pointer dereference vulnerability (CWE-476) in the net/mlx5 component. The issue stems from a logic flaw where create_flow_handle could incorrectly reference a recently added rule multiple times within the same handle. This resulted in a rule with a refcount of 2 ...

CVE-2024-47748

CVE-2024-47748: Linux kernel vhost_vdpa code fixes an irq bypass producer token life-cycle bug. The token formerly registered in vhost_vdpa_setup_vq_irq() could outlive the eventfd_ctx, risking use-after-free when the eventfd is released. The patch binds the token lifecycle to VHOST_SET_VRING_CAL...

CVE-2024-56642

CVE-2024-56642 fixes a Linux kernel tipc use-after-free involving UDP sockets in cleanup_bearer(). The bug occurred when bearer_disable() leads to tipc_udp_disable(), and cleanup_bearer() decrements tipc_net(net)->wq_count too early, allowing a socket to be freed before its cleanup work comple...

CVE-2017-7616

CVE-2017-7616 affects the Linux kernel (mm/mempolicy.c) where incorrect error handling in set_mempolicy/mbind compat syscalls can leak uninitialized stack data to local attackers. The issue is documented across multiple advisories (e.g., Debian, CentOS, Cloud Foundry) and is mitigated by updating...

CVE-2020-27830

CVE-2020-27830 is a Linux Kernel vulnerability where spk_ttyio_receive_buf2() can dereference spk_ttyio_synth when it is NULL, causing a NULL-pointer dereference crash. The connected Nessus advisories (Unity Linux UTSA-2026-001485, UTSA-2026-004226, UTSA-2026-003925) reference this CVE as part of...

CVE-2020-36694

The CVE-2020-36694 issue affects the Linux kernel netfilter path prior to 5.10, enabling a use-after-free in the packet processing context due to mishandling of the per-CPU sequence counter during concurrent iptables rule replacements. Exploitation requires CAP_NET_ADMIN in an unprivileged namesp...

CVE-2021-4159

CVE-2021-4159 is described in connected documents as a Linux kernel EBPF verifier flaw that could allow a local attacker to leak internal kernel memory by causing uninitialized or sensitive data to be exposed to userspace when handling internal data structures during eBPF code insertion. The issu...

CVE-2023-1582

CVE-2023-1582 is described in connected documents as a race condition in the Linux kernel's fs/proc/task_mmu.c under the memory management component. It may allow a local privileged user to cause a denial of service. The MiracleLinux advisory block lists the vulnerability and confirms the race co...

CVE-2023-1872

CVE-2023-1872 is a use-after-free in the Linux kernel io_uring subsystem caused by the io_file_get_fixed path not validating ctx->uring_lock, enabling a race with fixed files unregistration. This can lead to local privilege escalation and possible denial of service. Affected component is the k...

CVE-2024-35866

CVE-2024-35866: Linux kernel SMB CIFS client use-after-free in cifs_dump_full_key() addressed by skipping sessions tearing down (status == SES_EXITING) to prevent UAF. Connected docs confirm this fix and list multiple downstream advisories (e.g., ALAS2KERNEL, ALAS2023, Debian DLA-4193-1) referenc...

CVE-2024-35910

The CVE-2024-35910 issue affects the Linux kernel TCP timer handling for kernel sockets. Root cause: inet_csk_clear_xmit_timers() could be invoked with the socket lock held and uses del_timer(), risking timers running after the netns is freed. Fix: introduced inet_csk_clear_xmit_timers_sync() usi...

CVE-2024-42265

CVE-2024-42265 pertains to the Linux kernel and was resolved by protecting the fetch of ->fd[fd] in do_dup2() from mispredictions. The issue arose when a mispredicted path could cause tofree = fdt->fd[fd] to be speculatively executed, which is incorrect for bounds reasons. The documented fi...

CVE-2024-44947

CVE-2024-44947 is a Linux kernel information-leak vulnerability in the fuse subsystem. The issue arises from fuse_notify_store() not enabling page zeroing like fuse_do_readpage(), causing beyond-EOF page contents to remain uninitialized and potentially be exposed to userspace via mmap when init-o...

CVE-2024-46800

CVE-2024-46800 affects the Linux kernel's netem (sch/netem) code. The issue is a use-after-free in netem_dequeue when enqueuing a packet to an inner qdisc that later returns __NET_XMIT_STOLEN; the packet is dropped but qdisc_tree_reduce_backlog() may not update the parent q.len, causing a use-aft...

CVE-2024-53140

CVE-2024-53140 affects the Linux kernel netlink dump path. The vulnerability arises because dumps can be left incomplete if a user closes the netlink socket, and the prior cleanup deferred via a workqueue could end up releasing a socket reference still in an unsafe state. The fix removes the work...

CVE-2024-57940

CVE-2024-57940 (Linux kernel exfat): The issue occurs when a corrupted exFAT cluster chain links a cluster to itself and an unused directory entry exists in that cluster. In this case, dentry is not incremented and the traversal can loop indefinitely, preventing s_lock release and causing hangs (...

CVE-2026-46135

CVE-2026-46135 affects the Linux kernel nvmet-tcp (NVMe over TCP). A race between ICReq handling and target‑side queue teardown can transition queue state in a non‑serialized way, potentially allowing a second teardown path and a re‑entry after a disconnect, including a possible double free scena...

CVE-2012-6657

CVE-2012-6657 affects the Linux kernel up to version 3.5.7. The vulnerability lies in sock_setsockopt in net/core/sock.c, where a keepalive action may not be properly associated with a stream socket, enabling a local attacker to cause a denial of service (system crash) by leveraging the ability t...

CVE-2017-9074

Affected software: Linux kernel IPv6 fragmentation code. Root cause: nexthdr field may be associated with an invalid option, leading to an out-of-bounds read/BUG via crafted socket and send calls. Impact: local denial of service and potential unspecified effects (information leakage/compromise as...

CVE-2018-10021

CVE-2018-10021 affects the Linux kernel’s SAS SCSI host driver (drivers/scsi/libsas/sas_scsi_host.c) prior to 4.16. A local user can trigger certain failure conditions to cause a denial of service (ata_qc leak). A third party disputes the report’s relevance, noting the issue can occur only with p...

CVE-2019-12379

The connected Nessus UNPATCHED_CVE_2019_12379 entry confirms CVE-2019-12379 affects Linux kernel code path con_insert_unipair in drivers/tty/vt/consolemap.c (up to kernel 5.1.5) with a memory leak in an ENOMEM/kmalloc scenario. The description explicitly notes this issue is disputed as an actual ...

CVE-2019-18198

Technical details beyond the initial description are not provided in the connected documents. CVE-2019-18198 concerns a reference count usage error in fib6_rule_suppress() in net/ipv6/fib6_rules.c (Linux kernel before 5.3.4) that can lead to memory corruption; no further public facts (affected ve...

CVE-2019-9162

CVE-2019-9162 concerns the Linux kernel prior to 4.20.12, where the SNMP NAT module's net/ipv4/netfilter/nf_nat_snmp_basic_main.c contains insufficient ASN.1 length checks. This can trigger an out-of-bounds read/write (array index) leading to a kernel oops or local privilege escalation, specifica...

CVE-2021-28951

CVE-2021-28951 is a Linux kernel flaw affecting fs/io_uring.c up to 5.11.8 that can cause a denial of service (deadlock) when exit waits for a SQPOLL thread while the thread awaits a start signal. The issue is documented in multiple advisories (e.g., ALAS2KERNEL entries for Kernel-5.10/5.15 and r...

CVE-2022-49058

In CVE-2022-49058, the Linux kernel CIFS subsystem is affected by a potential buffer overflow in handling symlinks. The root cause is that Smatch marks link_len as untrusted (originating from sscanf()) and may allow a length to exceed the destination buffer, risking a overflow in poly1305-related...

CVE-2023-1611

CVE-2023-1611 is a use-after-free in btrfs_search_slot (fs/btrfs/ctree.c) in the Linux kernel, enabling local crashes and potentially kernel information leaks. Connected advisories (e.g., Red Hat and Astra/AL) confirm the issue and advocate updating the kernel to mitigate. Affected product is the...

CVE-2023-52565

CVE-2023-52565 is a Linux kernel vulnerability affecting the media: uvcvideo subsystem. The issue is an out-of-bounds read in uvc_query_v4l2_menu() when the user-provided index exceeds the mask size, potentially allowing reading memory outside the intended bounds. The connected MiracleLinux advis...