CVE-2024-35937

CVE-2024-35937 affects the Linux kernel wifi stack: cfg80211 A-MSDU handling can read data out of bounds if a subframe header appears but is not fully present. The vulnerability root cause is insufficient validation of A-MSDU subframes; the fix tightens checks to ensure a subframe header can actu...

CVE-2024-35967

CVE-2024-35967: Linux Bluetooth SCO path vulnerable to not validating setsockopt input. syzbot reports copying data without input length check, causing slab-out-of-bounds reads via copy_from_sockptr_offset in include/linux/sockptr.h and an observed slab-out-of-bounds in sco_sock_setsockopt+0xc0b/...

CVE-2024-38619

CVE-2024-38619 (Linux kernel, usb-storage alauda) : The issue arises in the alauda media handling where the field uzonesize can stay zero if alauda_init_media() fails, potentially causing divide errors in alauda_read_data() and alauda_write_lba(). The fix, as described in the description, adds a ...

CVE-2024-41042

Based on the provided documents, CVE-2024-41042 affects the Linux kernel nf_tables component. The vulnerability stems from the loop-detection path: nf_tables_check_loops() and its helpers were used to detect cycles in nft chains. The affected code path is nf_tables: the fix replaces or removes lo...

CVE-2024-43899

CVE-2024-43899 affects the Linux kernel’s DRM AMD display path. The vulnerability is a NULL pointer dereference in dcn20_resource.c that can cause a hang when MPV runs on a DCN401 dGPU, specifically during fullscreen playback after enabling fullscreen (double click). Affected component/function c...

CVE-2024-45002

CVE-2024-45002 is a Linux kernel vulnerability affecting rtla/osnoise: a NULL dereference in error handling when tool->data allocation fails. The issue is confirmed in multiple vendor advisories (Azure Linux Nessus, Astra Linux bulletin, Debian DLA-4008) and is tied to kernel code paths involv...

CVE-2024-50039

CVE-2024-50039 (Linux kernel) : The vulnerability resides in the net/sched subsystem where TCA_STAB is accepted only for the root qdisc. The bug arises because most qdiscs track backlog assuming invariance of qdisc_pkt_len(skb) between enqueue() and dequeue(), but a syzbot-triggered combination o...

CVE-2024-53069

CVE-2024-53069 affects the Linux kernel firmware driver for Qualcomm SCM. The vulnerability is a NULL-pointer dereference when SCM calls are made with __scm set to NULL (driver may not be probed due to absent SCM entry in device-tree). The fix prevents dereferencing a NULL pointer, addressing pot...

CVE-2024-53134

CVE-2024-53134 affects the Linux kernel, specifically the pmdomain: imx93-blk-ctrl path. The root cause is a faulty loop condition in the remove path: it used bc->onecell_data.num_domains instead of i onecell_data.num_domains, which can cause an infinite loop and kernel panic. The advisory ind...

CVE-2025-21862

CVE-2025-21862 affects the Linux kernel drop_monitor path. Root cause: incorrect initialization order leading to a spinlock not being initialized if drop_monitor is loaded as a module, enabling a potential race during module loading. Impact: may cause instability or erroneous behavior in netlink/...

CVE-2010-4258

The CVE-2010-4258 issue affects the Linux kernel versions prior to 2.6.36.2. The do_exit function in kernel/exit.c mishandles a KERNEL_DS get_fs value, bypassing access_ok checks and enabling local privilege escalation by overwriting arbitrary kernel memory. Exploitation vectors include use of th...

CVE-2018-5953

CVE-2018-5953 concerns the Linux kernel vulnerability where the function swiotlb_print_info (lib/swiotlb.c) in kernels up to 4.14.14 can leak sensitive address information via a software IO TLB printk in dmesg, exploitable by a local attacker. The connected Nessus entries for Unity Linux 20.x (ke...

CVE-2021-3923

CVE-2021-3923 describes a local information-leak in the Linux kernel RDMA over InfiniBand path. A privileged local attacker can leak kernel stack data when issuing commands to /dev/infiniband/rdma_cm, with the impact noting potential to defeat kernel protections. Remediation/fixes are not detaile...

CVE-2021-47274

CVE-2021-47274 (Linux kernel tracing): The issue stems from a length check in tracing that can cause memory corruption in ftrace data, leading to kernel crashes. A fix was added (commit b220c049d519) to validate the length before exposing the trace buffer, addressing overflow introduced by a prio...

CVE-2022-3646

CVE-2022-3646 is a Linux kernel vulnerability affecting the nilfs_attach_log_writer function in fs/nilfs2/segment.c (BPF component). The issue enables a memory leak and may be exploitable remotely. A patch is recommended to fix this issue (VDB-211961).

CVE-2023-2007

CVE-2023-2007 affects the DPT I2O Controller driver in the Linux kernel. The issue arises from missing locking during object operations, enabling a local attacker to escalate privileges and execute arbitrary code in kernel context. Public references in Unity Linux (UTSA-2026-004778) and multiple ...

CVE-2024-26669

CVE-2024-26669 (Linux kernel net/sched: flower) The issue arises when deleting a qdisc on a device using flower: the stack replays filter removals but does not send a FLOW_CLS_TMPLT_DESTROY for chain templates, causing a memory leak. The fix adds a new tmplt_reoffload operation and lets the stack...

CVE-2024-26717

CVE-2024-26717: Linux kernel HID I2C- HID OF driver fix for NULL pointer dereference on power-up failure. The OF driver did not initialize the client pointer, which is dereferenced when power-up fails, potentially leading to a NULL-deref. The entry documents a resolved issue in the HID i2c-hid-of...

CVE-2024-26906

CVE-2024-26906 : In the Linux kernel, x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault(). A bpf program reading the vsyscall page with bpf_probe_read_kernel() can trigger copy_from_kernel_nofault(), which calls __get_user_asm() and may fault because the vsyscall page is not readab...

CVE-2024-35862

CVE-2024-35862 (CVE entry) : Astra Linux security advisory describes a Linux kernel SMB client issue where a potential Use-After-Free (UAF) in smb2_is_network_name_deleted() could occur. The advisory notes that sessions being torn down (status SES_EXITING) are skipped to avoid UAF, indicating a f...

CVE-2024-41014

The CVE CVE-2024-41014 affects the Linux kernel (xfs) and is caused by insufficient bounds checking in xlog_recover_process_data, specifically verifying the space for fixed members of xlog_op_header. A crafted XFS image can trigger an out-of-bounds read by altering the xlog_op_header and xlog_rec...

CVE-2024-41020

CVE-2024-41020 is a Linux kernel vulnerability fixed by applying the same fcntl/close race recovery patch to the compat path for 32-bit kernels. The issue concerns a race condition in filelock handling during fcntl/close, resolved by ensuring reliable lock removal across both normal and 32-bit co...

CVE-2024-53095

CVE-2024-53095 – Linux kernel SMB/CIFS use-after-free in non-root network namespaces Affected component: Linux kernel CIFS client (smb) using kernel sockets. Root cause: incorrect reference counting for network namespaces; CIFS sockets do not hold netns refcnt, so freeing sockets must occur befor...

CVE-2025-21964

CVE-2025-21964 affects the Linux kernel CIFS mount option acregmax. The issue arises when user-provided acregmax (u32) is not yet validated; its value is converted from seconds to jiffies, which can overflow an integer. This is a local vulnerability in which an attacker with local access could po...

CVE-2026-23401

CVE-2026-23401: In the Linux kernel KVM x86/mmu, a race allowed installing an MMIO SPTE without first zapping an existing shadow-present SPTE when guest memory writes occurred outside KVM’s scope. This could enable a guest‑memory–related fault to leave a shadow SPTE intact when an MMIO SPTE is in...

CVE-2026-43037

CVE-2026-43037 affects the Linux kernel; vulnerability arises from ip4ip6_err() using a cloned skb where the IPv6 receive path writes cb[] as inet6_skb_parm, which is then misinterpreted as IPv4 inet_skb_parm by __ip_options_echo(), causing a potential data leak/compromise. The fix includes clear...

CVE-2009-2698

CVE-2009-2698 affects the Linux kernel UDP implementation (net/ipv4/udp.c and net/ipv6/udp.c) prior to 2.6.19. Local users can gain privileges or cause a denial of service (NULL pointer dereference/system crash) via UDP socket use with MSG_MORE. Oracle Linux/MiracleLinux advisories reference this...

CVE-2017-12193

CVE-2017-12193 affects the Linux kernel: the function assoc_array_insert_into_terminal_node in lib/assoc_array.c mishandles node splitting, leading to a NULL pointer dereference and kernel panic via a crafted application. The vulnerability is in kernels prior to 4.13.11, enabling local attackers ...

CVE-2017-16537

CVE-2017-16537 affects the Linux kernel: the imon_probe function in drivers/media/rc/imon.c up to version 4.13.11 allows a local user to trigger a NULL pointer dereference via a crafted USB device, leading to a denial of service (system crash) and potentially other impact. The connected Nessus en...

CVE-2024-26804

CVE-2024-26804 affects the Linux kernel's IP tunnel infrastructure. The issue arises when packets are routed through a GRE tunnel and then encapsulated again (via ip_tunnel_xmit/ipip_tunnel_xmit), causing gre0 and ipip0 to inflate dev->needed_headroom iteratively. The neigh layer pulls skb wit...

CVE-2024-26890

CVE-2024-26890 affects the Linux kernel Bluetooth stack, specifically the btrtl driver when used with hci_h5. The issue arises from missing private-hci data allocation after hci_dev, causing a slab-out-of-bounds write (8 bytes) during btrtl_initialize, detectable via KASAN. The root cause is memo...

CVE-2024-35965

CVE-2024-35965 affects the Linux kernel Bluetooth stack (L2CAP) where setsockopt input length is not validated before copying data. The root cause is missing validation of user input length, enabling potential memory/contagion issues as described in vendor advisories that reference this CVE (e.g....

CVE-2024-41007

The CVE-2024-41007 issue is in the Linux kernel TCP retransmission logic. When a TCP socket uses TCP_USER_TIMEOUT and the peer retracts its window to zero, tcp_retransmit_timer() could endlessly retransmit a packet every two jiffies (~2 ms for HZ=1000) for about 4 minutes after expiration. The fi...

CVE-2024-56623

CVE-2024-56623 : In the Linux kernel, the qla2xxx SCSI driver contains a use-after-free during unload, causing a system crash with a stack trace in SLUB. The root cause is a double-thread termination signal: an UNLOADING flag may race with kthread_stop, leading to use-after-free on cleanup. The f...

CVE-2024-57850

CVE-2024-57850 affects the Linux kernel feature jffs2, where the rtime decompression code could corrupt memory outside the decompression buffer if compressed data is malformed. The issue is resolved by adding bounds checks during the rtime decompression pass. Supported documents confirm the vulne...

CVE-2022-48655

CVE-2022-48655 in the Linux kernel: vulnerability in the SCMI firmware path (arm_scmi) where reset domains descriptors could be accessed by index, risking out-of-bounds due to SCMI driver misbehavior. The root cause is lack of an internal consistency check before domain descriptor accesses. The f...

CVE-2023-22998

CVE-2023-22998 affects the Linux kernel prior to 6.0.3. The vulnerability stems from drivers/gpu/drm/virtio/virtgpu_object.c misinterpreting the drm_gem_shmem_get_sg_table return value (treating an error pointer as NULL). This can allow a remote authenticated attacker on the local network to caus...

CVE-2023-52623

Technical details about CVE-2023-52623 are not publicly available in the provided documents. Monitor for updates from vendors and security bulletins.

CVE-2023-52752

CVE-2023-52752 (Linux kernel) is backed by concrete fix details in connected docs: a use-after-free in the SMB/CIFS client code path (cifs_debug_data_proc_show) when reading /proc/fs/cifs/DebugData during mount/umount. The fix adds a check to skip SMB sessions that are tearing down (ses_status ==...

CVE-2024-26837

CVE-2024-26837 affects the Linux kernel MDB offload replay handling. A race between generating the replay list and new MDB memberships could cause duplicates of a single event, leaving hardware-mounted memberships orphaned on bridge destruction. The fix guards MDB replay against deferred events ...

CVE-2024-26840

CVE-2024-26840 affects the Linux kernel cachefiles subsystem. The available technical details show a memory leak in cachefiles_add_cache() after unbinding /dev/cachefiles, fixed by releasing/adjusting the cache_cred reference count. The documented fix paths include: (1) increase reference handlin...

CVE-2024-27015

CVE-2024-27015 affects the Linux kernel netfilter flowtable implementation. The issue is an incorrect pppoe tuple handling where the PPPoE header is expected at the network header offset, causing flowtable lookups to miss and PPPoE traffic to enter the classical forwarding path. Connected advisor...

CVE-2024-27436

CVE-2024-27436 — Linux kernel ALSA: usb-audio issue Root cause: ALSA usb-audio parsing channels bits could overrun the map array if a device reports more bits than channels, allowing a write beyond bounds. Synopsis in connected sources: the vulnerability was resolved in the Linux kernel by stoppi...

CVE-2024-38538

CVE-2024-38538 is a Linux kernel vulnerability in the bridge xmit path. The issue arises when a short skb (less than ETH_HLEN) is processed, risking uninitialized data in br_dev_xmit. The fix adds a guard to ensure the kernel only pulls the required ETH header bytes and does not assume availabili...

CVE-2024-40997

CVE-2024-40997 involves a Linux kernel vulnerability where a memory leak in the amd-pstate cpufreq path was fixed. The issue was that kzalloc() allocated cpudata during amd_pstate_epp_cpu_init() but could not be freed in the corresponding exit path, leading to a leak on CPU EPP exit. The primary ...

CVE-2024-41064

CVE-2024-41064 concerns the Linux kernel: powerpc/eeh can crash if edev->pdev changes when a PCI device is removed during eeh_pe_report_edev(). The technical detail specified across connected sources is that the crash occurs due to improper handling of edev->pdev; the recommended remedy is ...

CVE-2024-42294

CVE-2024-42294 : The Azure/MiracleLinux and Linux kernel records describe a fix for a deadlock in the Linux kernel caused by blocking ABBA between sd_remove and sd_release. The issue arises when a SCSI/USB device is disconnected while the block/SD stack is mutexp-locked during device removal, lea...

CVE-2024-43905

CVE-2024-43905 affects the Linux kernel component drm/amd/pm specifically the vega10_hwmgr . The root cause was a potential null pointer dereference arising from insufficient null-check handling. The published fix adds validation of return values and proper null-pointer handling to prevent derefe...

CVE-2024-50282

The connected Astra Linux entry clarifies CVE-2024-50282 in the Linux kernel: a missing size check in drm/amdgpu_debugfs_gprwave_read() can cause a buffer overflow when size > 4K. The fix (cherry-picked commit f5d873f5825b40d886d03bd2aede91d4cf002434) adds the size check to prevent overflow. N...

CVE-2024-56758

CVE-2024-56758 affects the Linux kernel (btrfs) and describes a race where, after folio unlock during relocation, another thread can modify the folio mapping before folio_lock() and lead to an invalid page, potentially causing a NULL pointer dereference during concurrent transaction aborts. The i...