CVE-2026-52923

The CVE-2026-52923 issue affects the Linux kernel IPC ID allocation in the checkpoint/restore path. ipc_idr_alloc() forwards the next_id request to idr_alloc() with an open-ended upper bound, so if the valid SysV IPC id tail is full the allocation can spill past ipc_mni. The encoded id may then r...

CVE-2012-6538

CVE-2012-6538 affects the Linux kernel prior to 3.6. The vulnerability lives in net/xfrm/xfrm_user.c: the function copy_to_user_auth uses an incorrect C library function for copying a string, enabling local users with CAP_NET_ADMIN to read sensitive information from kernel heap memory. The Miracl...

CVE-2014-0181

The CVE-2014-0181 issue affects the Linux kernel Netlink implementation prior to 3.14.1, where there is no authorization based on the opener of a Netlink socket. This can allow a local user to bypass intended access restrictions and modify network configurations by using a Netlink socket for the ...

CVE-2015-8539

CVE-2015-8539 is referenced in MiracleLinux AXSA-2018-2578 as a Linux kernel KEYS subsystem flaw fixed by updating the kernel to a version with mitigations. The vulnerability arises in the KEYS subsystem of the Linux kernel prior to 4.4, where crafted keyctl commands can negatively instantiate a ...

CVE-2022-2977

CVE-2022-2977 affects the Linux kernel’s proxied virtualized TPM devices. When virtual TPMs are configured, a local attacker can trigger a use-after-free that may lead to privilege escalation. Public documents confirm the vulnerability description, but neither exploit details nor a concrete remed...

CVE-2022-39190

CVE-2022-39190 affects the Linux kernel nf_tables_api.c and enables a local denial-of-service by binding to an already bound netfilter chain. The issue is described as present in Linux kernel versions up to 5.19.5 (before 5.19.6). A patch addressing this vulnerability is included in 5.19.6 (Chang...

CVE-2023-46862

CVE-2023-46862 (Linux kernel) affects kernels up to 6.5.9. A race during SQ thread exit can trigger a NULL pointer dereference in io_uring_show_fdinfo (io_uring/fdinfo.c), potentially crashing the system or causing denial of service. The issue is tied to the io_uring subsystem and occurs under sp...

CVE-2024-27057

CVE-2024-27057 affects the Linux kernel ASoC: SOF ipc4-pcm path. The issue arises when suspend occurs with audio active; sof_ipc4_pcm_hw_free() resets pipelines, but if the firmware crashes or the state change via sof_ipc4_set_multi_pipeline_state() fails, kernel/firmware state can become misalig...

CVE-2024-27411

CVE-2024-27411 affects the Linux kernel Nouveau driver (drm/nouveau nvkm). The vulnerability stems from deallocating a pair of DMA buffers that are required for suspend/resume post GPU init, which can trigger a system-wide rendering freeze on multi-GPU systems. A patch fixes the regression by mov...

CVE-2024-35946

CVE-2024-35946 affects the Linux kernel’s wifi rt89 (rtw89) driver, where a null pointer dereference could occur during abort/cancel of a scan because the code might reference a vif that wasn’t scanning. The public description and connected advisories confirm the issue and cite resolving it by en...

CVE-2024-46693

CVE-2024-46693 (Linux kernel) : A race during initialization of soc: qcom: pmic_glink drivers can dereference a NULL client pointer due to the client object being used before client registration completes. The root cause is that protection-domain notifiers can fire and schedule work before the cl...

CVE-2024-49884

CVE-2024-49884 : Linux kernel ext4 slab-use-after-free in ext4_split_extent_at() during unwritten/extents handling. The issue stems from use-after-free of path data (path) when updating extents after an error (-ENOMEM/-EIO). The connected Astra Linux and kernel notes describe the root cause chain...

CVE-2024-57940

CVE-2024-57940 (Linux kernel exfat): The issue occurs when a corrupted exFAT cluster chain links a cluster to itself and an unused directory entry exists in that cluster. In this case, dentry is not incremented and the traversal can loop indefinitely, preventing s_lock release and causing hangs (...

CVE-2000-0006

CVE-2000-0006 affects the strace utility. The issue allows local users to read arbitrary files via memory-mapped file names. The connected records identify strace as the affected component and describe the vulnerability as a local-read exposure through mmap-based file-name handling. No explicit e...

CVE-2015-5307

CVE-2015-5307 affects the Linux kernel KVM subsystem (through 4.2.6) and Xen (4.3.x–4.6.x). An attacker who has local access in a guest can trigger many #AC exceptions (Alignment Check), potentially causing a host panic/hang. Root cause involves svm.c/vmx.c handling of alignment-related events. P...

CVE-2017-2647

CVE-2017-2647 affects the Linux kernel KEYS subsystem (keyring_search_iterator in keyring.c) and allows a local, authenticated user to trigger a NULL pointer dereference, enabling a crash or possible privilege escalation. The vulnerability is documented across multiple advisories; remediation is ...

CVE-2019-19377

CVE-2019-19377 concerns Linux kernel 5.0.21 where mounting a crafted btrfs image, performing actions, and unmounting can trigger a use-after-free in btrfs_queue_work (fs/btrfs/async-thread.c). Connected Nessus advisories for Unity Linux (UTSA-2026-004393) reiterate this, tying the issue to kernel...

CVE-2019-9162

CVE-2019-9162 concerns the Linux kernel prior to 4.20.12, where the SNMP NAT module's net/ipv4/netfilter/nf_nat_snmp_basic_main.c contains insufficient ASN.1 length checks. This can trigger an out-of-bounds read/write (array index) leading to a kernel oops or local privilege escalation, specifica...

CVE-2020-27152

CVE-2020-27152 affects the Linux kernel prior to 5.9.2 in arch/x86/kvm/ioapic.c (ioapic_lazy_update_eoi). The issue is an infinite loop caused by improper interaction between a resampler and edge triggering. Affected software: Linux kernel up to 5.9.1, with fixed 5.9.2 per ChangeLog-5.9.2. Exploi...

CVE-2021-42327

CVE-2021-42327 is a Linux kernel heap-based buffer overflow in the AMDGPU display driver debugfs path (amdgpu_dm_debugfs.c). The flaw occurs in dp_link_settings_write where parse_write_buffer_into_params copies a userspace buffer into a 40-byte heap buffer without proper size checks against copy_...

CVE-2022-26878

CVE-2022-26878 refers to a memory leak in the Linux kernel’s VirtIO Bluetooth driver (drivers/bluetooth/virtio_bt.c) where socket buffers were allocated but not freed. Affected: Linux kernel before 5.16.3. Impact stated: memory leak (potential resource exhaustion). Remediation: patch released in ...

CVE-2024-26663

CVE-2024-26663 — Linux kernel (TIPC) bearer handling : The issue occurs in tipc_nl_bearer_add() when the UDP options attribute is used; it can call tipc_udp_nl_bearer_add() for non-UDP bearers, causing tipc_udp_is_known_peer() to dereference a non-UDP bearer and trigger a general protection fault...

CVE-2024-26704

CVE-2024-26704 affects the Linux kernel ext4 filesystem. The issue was a double-free of blocks in ext4_move_extents: moved_len was only updated when all moves succeeded, causing potential overlap with preallocated extents to be freed twice and triggering a zero-division in mb_update_avg_fragment_...

CVE-2024-26779

CVE-2024-26779 affects the Linux kernel wifi/mac80211 subsystem. A race condition occurs when enabling fast-xmit before the station is uploaded to the driver, potentially passing an not-yet-uploaded STA via drv_tx to the driver and causing crashes due to uninitialized drv_priv data. The fix adds ...

CVE-2024-26898

Summary: CVE-2024-26898 relates to the AoE driver in the Linux kernel where aoecmd_cfg_pkts() incorrectly handled the refcnt of net_device, enabling a potential use-after-free via racing with tx paths. The issue has been resolved by patch f98364e92662, which stops calling dev_put(ifp) in the succ...

CVE-2024-26900

CVE-2024-26900: Linux kernel md subsystem vulnerability fixed; kmemleak occurs when rdev->serial is not freed if kobject_add() fails in bind_rdev_to_array(). Root cause: missing free of rdev->serial during serial pool init; impact: local kmemleak exposure (no remote code execution). CVSS v3...

CVE-2024-35910

The CVE-2024-35910 issue affects the Linux kernel TCP timer handling for kernel sockets. Root cause: inet_csk_clear_xmit_timers() could be invoked with the socket lock held and uses del_timer(), risking timers running after the netns is freed. Fix: introduced inet_csk_clear_xmit_timers_sync() usi...

CVE-2024-39474

CVE-2024-39474 involves a Linux kernel vmalloc regression where __GFP_NOFAIL allocations may return NULL, due to a race with OOM-killer flow and GFP_KERNEL handling. The fix updates vm_area_alloc_pages() to not check fatal_signal_pending() when __GFP_NOFAIL is set, preventing a NULL vmalloc() ret...

CVE-2024-41042

Based on the provided documents, CVE-2024-41042 affects the Linux kernel nf_tables component. The vulnerability stems from the loop-detection path: nf_tables_check_loops() and its helpers were used to detect cycles in nft chains. The affected code path is nf_tables: the fix replaces or removes lo...

CVE-2024-56760

The CVE-2024-56760 issue is a Linux kernel PCI/MSI handling bug where a lack of irqdomain on RISCV platforms triggered a bogus legacy fallback warning. The root cause is an incorrect legacy-mode check in the PCI MSI domain path; the fix updates pci_msi_domain_supports() to evaluate legacy mode an...

CVE-2025-21760

CVE-2025-21760: Linux kernel vulnerability in NDISC code. The issue arises because ndisc_send_skb() could be called without RTNL or RCU held, risking use-after-free. The fix adds acquiring rcu_read_lock() earlier to enable use of dev_net_rcu() and prevent UAF. Connected docs also reference relate...

CVE-2009-2698

CVE-2009-2698 affects the Linux kernel UDP implementation (net/ipv4/udp.c and net/ipv6/udp.c) prior to 2.6.19. Local users can gain privileges or cause a denial of service (NULL pointer dereference/system crash) via UDP socket use with MSG_MORE. Oracle Linux/MiracleLinux advisories reference this...

CVE-2014-9940

CVE-2014-9940 affects the Linux kernel regulator_ena_gpio_free function in drivers/regulator/core.c, with exploitation possible through local access to gain privileges or cause a denial of service via a use-after-free. Affected condition is kernel versions before 3.19. Impact per sources is high ...

CVE-2015-8956

CVE-2015-8956 detailed in connected sources: The Linux kernel’s rfcomm_sock_bind in net/bluetooth/rfcomm/sock.c, vulnerable before 4.2, may allow a local attacker to obtain sensitive information or cause a denial of service (NULL pointer dereference) via a bind system call on a Bluetooth RFCOMM s...

CVE-2017-12153

CVE-2017-12153 refers to a security flaw in the Linux kernel where nl80211_set_rekey_data() in net/wireless/nl80211.c does not validate required Netlink attributes, enabling a local attacker with CAP_NET_ADMIN to trigger a NULL pointer dereference and system crash. The vulnerability is described ...

CVE-2021-38206

The CVE-2021-38206 issue affects the Linux kernel mac80211 subsystem before 5.12.13: when a 5 GHz-only device is used, injecting a frame with 802.11a rates can trigger a NULL pointer dereference in the radiotap parser, causing a Denial of Service. The vulnerability is addressed in Linux kernel 5....

CVE-2023-32250

CVE-2023-32250 : A race condition in the Linux kernel ksmbd SMB server’s handling of SMB2_SESSION_SETUP commands due to missing locking can allow an attacker to execute code in kernel context. The vulnerability is tied to the in-kernel ksmbd implementation and is reflected in multiple advisories ...

CVE-2023-52530

CVE-2023-52530 affects the Linux kernel’s wifi/mac80211 component. A use-after-free could occur when ieee80211_key_link() is called by ieee80211_gtk_rekey_add() and returns 0 due to KRACK protection (identical key reinstall); ieee80211_gtk_rekey_add() may still return a pointer into the key, crea...

CVE-2023-52664

The CVE-2023-52664 issue affects the Linux kernel net: Atlantic driver, where a logic error in ring data allocation/free can lead to a double-free scenario in error handling if memory allocation fails. The root cause is using the ring pointer as a failure indicator, while only ring data is alloca...

CVE-2024-1085

CVE-2024-1085 is a Linux kernel nf_tables use-after-free vulnerability that can enable local privilege escalation. The issue stems from nft_setelem_catchall_deactivate() freeing a catch-all set element based on the current generation, while it is only marked inactive for the next generation, allo...

CVE-2024-23848

CVE-2024-23848 : Linux kernel up to 6.7.1 contains a use-after-free in cec_queue_msg_fh, related to drivers/media/cec/core/cec-adap.c and drivers/media/cec/core/cec-api.c. The connected IBM/Linux kernel bulletin also lists this CVE among resolved issues. Public technical details about root cause ...

CVE-2024-35937

CVE-2024-35937 affects the Linux kernel wifi stack: cfg80211 A-MSDU handling can read data out of bounds if a subframe header appears but is not fully present. The vulnerability root cause is insufficient validation of A-MSDU subframes; the fix tightens checks to ensure a subframe header can actu...

CVE-2024-41007

The CVE-2024-41007 issue is in the Linux kernel TCP retransmission logic. When a TCP socket uses TCP_USER_TIMEOUT and the peer retracts its window to zero, tcp_retransmit_timer() could endlessly retransmit a packet every two jiffies (~2 ms for HZ=1000) for about 4 minutes after expiration. The fi...

CVE-2024-42244

CVE-2024-42244 concerns the Linux kernel USB serial mos7840 driver. The vulnerability caused a crash on resume when multiple port read URBs were submitted after resume, due to the second URB’s context pointer remaining tied to the core instead of the mos7840 port. A dedicated suspend/resume imple...

CVE-2024-42246

CVE-2024-42246 is a Linux kernel issue where -EPERM from a BPF program on kernel_connect() could cause xs_tcp_setup_socket() to loop and potentially freeze the kernel. The vulnerability’s root cause is EPERM propagation in the TCP/XS path; mitigations described in public notes include remapping E...

CVE-2024-50127

CVE-2024-50127 : The Linux kernel patch for the taprio_change() use-after-free fixes a dangling admin pointer caused by sched switch/removal via advance_sched(). The critical section protected by q->current_entry_lock is too small to prevent the scenario, and KASAN can detect the issue. The fi...

CVE-2024-50256

CVE-2024-50256 affects the Linux kernel (netfilter nf_reject_ipv6) and reports a crash in nf_send_reset6() when constructing an Ethernet header (dev->hard_header_len can be zero). The issue is addressed by using LL_MAX_HEADER to compute the header as done by related code paths. Public advisori...

CVE-2024-57843

CVE-2024-57843 concerns the Linux kernel’s virtio-net driver, specifically virtnet_rq_alloc. The defect arises when a fragment is exactly one page and the combined size of the buffer and virtnet_rq_dma (which reserves 16 bytes at the start of a new fragment) exceeds a page, causing an overflow. T...

CVE-2024-57850

CVE-2024-57850 affects the Linux kernel feature jffs2, where the rtime decompression code could corrupt memory outside the decompression buffer if compressed data is malformed. The issue is resolved by adding bounds checks during the rtime decompression pass. Supported documents confirm the vulne...

CVE-2025-37785

The CVE-2025-37785 issue affects the Linux kernel ext4 filesystem. A corrupted directory containing a '.' entry with rec_len equal to a full block could cause an out-of-bounds read when ext4_empty_dir() loads the '.' entry and derives '..' location, due to incorrect handling of directory entries ...