CVE-2016-4998

CVE-2016-4998 affects the Linux kernel netfilter IPT_SO_SET_REPLACE handling. The vulnerability allows a local attacker (e.g., with container/root access) to trigger an out-of-bounds read and potentially leak kernel heap memory or cause a Denial of Service by supplying a crafted offset that cross...

CVE-2017-12188

CVE-2017-12188 affects arch/x86/kvm/mmu.c in the Linux kernel up to 4.13.5 where nested virtualization can mis-traverse guest page tables, enabling L1 guests to run arbitrary host code or trigger host denial of service. Connected advisories ( MiracleLinux AXSA-2018-2625, Unity Linux UTSA advisori...

CVE-2021-3600

CVE-2021-3600 is reported in the provided documents as an eBPF bound-tracking issue in the Linux kernel: 32-bit source registers used in div/mod may cause bounds information to be mishandled, enabling a local attacker to possibly execute arbitrary code. The MiracleLinux AXSA-2021-2785:26/NASL lis...

CVE-2022-3646

CVE-2022-3646 is a Linux kernel vulnerability affecting the nilfs_attach_log_writer function in fs/nilfs2/segment.c (BPF component). The issue enables a memory leak and may be exploitable remotely. A patch is recommended to fix this issue (VDB-211961).

CVE-2022-48701

The CVE-2022-48701 issue is in the Linux kernel ALSA usb-audio driver: an out-of-bounds read can occur in __snd_usb_parse_audio_interface() when parsing a USB device (USB ID 0x04fa:0x4201) that has fewer than 4 interfaces. The fix is to validate the interface count before parsing. Public referenc...

CVE-2023-32250

CVE-2023-32250 : A race condition in the Linux kernel ksmbd SMB server’s handling of SMB2_SESSION_SETUP commands due to missing locking can allow an attacker to execute code in kernel context. The vulnerability is tied to the in-kernel ksmbd implementation and is reflected in multiple advisories ...

CVE-2023-4134

The CVE-2023-4134 issue affects the Linux kernel cyttsp4_core driver. A use-after-free occurs in the device cleanup routine due to a possible rearming of the watchdog_timer from the workqueue, enabling a local attacker to crash the system and cause a denial of service. The provided documents cons...

CVE-2023-4569

CVE-2023-4569 – Linux kernel nf_tables memory leak : A memory leak is triggered by nft_set_catchall_flush in net/netfilter/nf_tables_api.c. Several connected advisories describe this as a local issue that can leak memory when catchall elements are deactivated. Affected software is the Linux kerne...

CVE-2024-26906

CVE-2024-26906 : In the Linux kernel, x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault(). A bpf program reading the vsyscall page with bpf_probe_read_kernel() can trigger copy_from_kernel_nofault(), which calls __get_user_asm() and may fault because the vsyscall page is not readab...

CVE-2024-35863

CVE-2024-35863 : In the Linux kernel, a Use-After-Free (UAF) issue was fixed in the SMB client by guarding the is_valid_oplock_break path. The patch skips sessions that are tearing down (status == SES_EXITING) to avoid UAF, mitigating a local-vectored vulnerability in the SMB client code path. Th...

CVE-2024-38538

CVE-2024-38538 is a Linux kernel vulnerability in the bridge xmit path. The issue arises when a short skb (less than ETH_HLEN) is processed, risking uninitialized data in br_dev_xmit. The fix adds a guard to ensure the kernel only pulls the required ETH header bytes and does not assume availabili...

CVE-2024-40901

CVE-2024-40901 affects the Linux kernel SCSI MPT3SAS path. The issue is a potential out-of-bounds access from test_bit()/set_bit() on a single word, where operations can exceed word boundaries. Mitigation implemented by ensuring allocations are at least sizeof(unsigned long) to provide space for ...

CVE-2024-42268

Technical details about CVE-2024-42268 are not provided in the connected documents; no vendor/product specifics or fixes are included here. Monitor for updates.

CVE-2024-42301

CVE-2024-42301 affects the Linux kernel’s dev/parport component, where an array out-of-bounds risk was introduced. The vulnerability was addressed by replacing unsafe data copying (sprintf) with snprintf to prevent buffer overflow. The initial report includes a kernel stack and Do_Hardware_Base_A...

CVE-2024-43830

CVE-2024-43830 : Linux kernel vulnerability in leds: trigger race. The issue arises when unregistering trigger sysfs attributes after deactivate(), creating a window where trigger-data could be referenced post-free. The documented fix moves device_remove_groups() to before deactivate(), ensuring ...

CVE-2024-43866

The CVE-2024-43866 issue is in the Linux kernel mlx5 driver: in shutdown, health work must be drained to avoid races/NULL pointer dereferences. The fix changes the shutdown callback to drain the health work queue (drain health WQ) to ensure no health work is left running during device shutdown. I...

CVE-2024-53095

CVE-2024-53095 – Linux kernel SMB/CIFS use-after-free in non-root network namespaces Affected component: Linux kernel CIFS client (smb) using kernel sockets. Root cause: incorrect reference counting for network namespaces; CIFS sockets do not hold netns refcnt, so freeing sockets must occur befor...

CVE-2024-53121

Summary of CVE-2024-53121 (Linux kernel) : The vulnerability affects the mlx5 netfilter offload path, where a two‑step FTE deletion (lock/delete in hardware, NULL hardware delete func, then delete software copy) can race with a simultaneous rule addition. This race may allow a rule with the same ...

CVE-2025-21694

CVE-2025-21694 : Linux kernel vulnerability in fs/proc/__read_vmcore (kdump path). Root cause: second loop in __read_vmcore could still hit softlockups; fix adds cond_resched() to yield in that loop. Impact: softlockups may interfere with RCU memory freeing and cause crashdump stalls in memory-co...

CVE-2025-21785

The CVE-2025-21785 issue is in the Linux kernel (arm64) cacheinfo handling. A loop that detects/populates cache information previously did a bounds check on the array size but did not account for cache levels with separate data/instructions caches, allowing an out-of-bounds write to the cacheinfo...

CVE-2025-21919

CVE-2025-21919 (Linux kernel sched/fair): A memory-corruption issue was fixed in child_cfs_rq_on_list. The prev pointer used in converting to a cfs_rq could originate from rq->leaf_cfs_rq_list, making container_of incorrect and risking memory fault or garbage reads. The patch adds a guard: aft...

CVE-2010-3705

The vulnerability CVE-2010-3705 affects the Linux kernel SCTP code: sctp_auth_asoc_get_hmac in net/sctp/auth.c does not validate the hmac_ids array from a remote peer, enabling remote attackers to trigger memory corruption and a kernel panic. Affected versions are Linux kernel before 2.6.36; reme...

CVE-2016-6480

CVE-2016-6480 is a race condition in the Adaptec AAC RAID driver (ioctl_send_fib in drivers/scsi/aacraid/commctrl.c) that could allow a local attacker to trigger a denial of service via an out-of-bounds access or system crash. Technical details show a TOCTTOU-like bug in FIB message handling; exp...

CVE-2021-45402

CVE-2021-45402 affects the Linux kernel where check_alu_op() in kernel/bpf/verifier.c does not update bounds properly when handling mov32, enabling local attackers to leak potentially sensitive addresses (pointer leak). The description is consistently cited across multiple connected advisories (e...

CVE-2024-26857

CVE-2024-26857 affects the Linux kernel’s geneve_rx path in drivers/net/geneve.c, where skb->network_header must be saved before calling pskb_inet_may_pull() to recompute the network header after pulling headers. The issue is tied to uninitialized values in IP_ECN_decapsulate and the chain lea...

CVE-2024-35950

CVE-2024-35950 affects the Linux kernel DRM client code. The modes[] array references modes on connectors’ mode lists and was not protected by dev->mode_config.mutex, risking use-after-free or memory reuse. The fix extends the same mutex protection to modes[] to ensure elements aren’t freed or...

CVE-2024-35967

CVE-2024-35967: Linux Bluetooth SCO path vulnerable to not validating setsockopt input. syzbot reports copying data without input length check, causing slab-out-of-bounds reads via copy_from_sockptr_offset in include/linux/sockptr.h and an observed slab-out-of-bounds in sco_sock_setsockopt+0xc0b/...

CVE-2024-39499

CVE-2024-39499 (Linux kernel, vmci): The vulnerability allows speculative leaks via event_deliver() because user-controlled event_msg->event_data.event was used as an index without sanitization. The fix sanitizes the index to mitigate speculative information leaks. The issue is exploitable loc...

CVE-2024-42265

CVE-2024-42265 pertains to the Linux kernel and was resolved by protecting the fetch of ->fd[fd] in do_dup2() from mispredictions. The issue arose when a mispredicted path could cause tofree = fdt->fd[fd] to be speculatively executed, which is incorrect for bounds reasons. The documented fi...

CVE-2024-42283

The CVE-2024-42283 issue in the Linux kernel concerns net/nexthop: two reserved fields in the nexthop_grp were not initialized by nla_put_nh_group(), allowing garbage to leak from the kernel. The public description notes these fields are reserved and currently unused, but their non‑zero values ca...

CVE-2024-53140

CVE-2024-53140 affects the Linux kernel netlink dump path. The vulnerability arises because dumps can be left incomplete if a user closes the netlink socket, and the prior cleanup deferred via a workqueue could end up releasing a socket reference still in an unsafe state. The fix removes the work...

CVE-2024-53156

CVE-2024-53156: In the Linux kernel’s ath9k wireless driver, insufficient verification of conn_rsp_epid in htc_connect_service() can trigger an UBSAN array-out-of-bounds in htc_hst.c (index 255 out of range for htc_endpoint[22]). Astra Linux and related advisories confirm the issue and its fix: a...

CVE-2024-56623

The Linux kernel contains a use-after-free vulnerability in the scsi: qla2xxx driver during module unloading. The issue stems from the dpc_thread receiving two termination signals: an UNLOADING flag and kthread_stop. If dpc_thread exits upon seeing the UNLOADING flag, a subsequent call to kthread...

CVE-2025-21689

The CVE concerns Linux kernel USB: serial (quatech2) where qt2_process_read_urb() could dereference NULL due to an out-of-bounds access. The root cause was an incorrect bounds check using if (newport > serial->num_ports) which allowed newport to reach serial->num_ports and make port NULL...

CVE-2025-21718

CVE-2025-21718 affects the Linux kernel Rose timer handling. The issue arises when Rose timers acquire only the socket spinlock and do not verify socket ownership, enabling a race against user threads. The described fix adds a socket ownership check and rearms timers as needed, addressing a KASAN...

CVE-2013-2206

CVE-2013-2206 concerns the Linux kernel SCTP implementation. The sctp_sf_do_5_2_4_dupcook function in net/sctp/sm_statefuns.c does not properly handle associations during processing of a duplicate COOKIE ECHO chunk, allowing remote attackers to trigger a denial of service via NULL pointer derefer...

CVE-2016-4486

CVE-2016-4486 affects the Linux kernel prior to 4.5.5, where the function rtnetlink.c: rtnl_fill_link_ifmap does not initialize a certain data structure. This allows a local attacker to read kernel stack memory via a crafted Netlink message, leading to information disclosure. Public references (i...

CVE-2016-9588

CVE-2016-9588 affects the Linux kernel KVM arch/x86/kvm/vmx.c: it mismanages #BP and #OF exceptions, allowing a local attacker in an L2 guest to crash the L1 guest (DoS). The issue is fixed in kernel updates after 4.9, with advisories noting upgrades to 4.9.11+ (e.g., 4.9.11-1/2, 4.9.11+ upstream...

CVE-2017-17558

Technical details about CVE-2017-17558 are not publicly provided in the supplied documents. Monitor for official advisories for affected products, impact, and mitigations; no concrete exploit information or patch details are available here.

CVE-2018-13096

CVE-2018-13096 : A vulnerability in the Linux kernel (fs/f2fs/super.c) up to version 4.14 allows a denial of service via out-of-bounds memory access when mounting a crafted f2fs image. The issue occurs on abnormal bitmap sizes and can trigger a BUG. The connected Nessus advisories reiterate this ...

CVE-2019-12984

CVE-2019-12984 is a NULL pointer dereference in the Linux kernel before 5.1.13, specifically in nfc_genl_deactivate_target() within net/nfc/netlink.c. A malicious user-mode program that omits certain NFC attributes can trigger this vulnerability, resulting in denial of service. Affected software ...

CVE-2019-20794

CVE-2019-20794 : The Linux kernel versions 4.18–5.6.11 are affected when unprivileged user namespaces are allowed. A user can create their own PID namespace and mount a FUSE filesystem; if the userspace component is terminated by killing PID 1, the interaction with the FUSE mount can hang the tas...

CVE-2021-4150

CVE-2021-4150 is a Linux kernel use-after-free in add_partition (block/partitions/core.c). The vulnerability arises from missing cleanup when device_add fails while adding a partition, enabling a local attacker with user privileges to cause a denial of service. Affected component is the kernel’s ...

CVE-2021-47101

CVE-2021-47101: In the Linux kernel, a fix for an uninitialized read in the ASIX USB Ethernet driver was applied. asix_read_cmd() could read fewer bytes than sizeof(smsr), leaving smsр uninitialized and potentially exposing uninitialized data during later use. The issue was observed in KMSAN repo...

CVE-2021-47274

In the Linux kernel, the following vulnerability has been resolved: tracing: Correct the length check which causes memory corruption We've suffered from severe kernel crashes due to memory corruption onour production environment, like, Call Trace:[1640542.554277] general protection fault: 0000 [#...

CVE-2023-52752

CVE-2023-52752 (Linux kernel) is backed by concrete fix details in connected docs: a use-after-free in the SMB/CIFS client code path (cifs_debug_data_proc_show) when reading /proc/fs/cifs/DebugData during mount/umount. The fix adds a check to skip SMB sessions that are tearing down (ses_status ==...

CVE-2024-26840

CVE-2024-26840 affects the Linux kernel cachefiles subsystem. The available technical details show a memory leak in cachefiles_add_cache() after unbinding /dev/cachefiles, fixed by releasing/adjusting the cache_cred reference count. The documented fix paths include: (1) increase reference handlin...

CVE-2024-26890

CVE-2024-26890 affects the Linux kernel Bluetooth stack, specifically the btrtl driver when used with hci_h5. The issue arises from missing private-hci data allocation after hci_dev, causing a slab-out-of-bounds write (8 bytes) during btrtl_initialize, detectable via KASAN. The root cause is memo...

CVE-2024-27436

CVE-2024-27436 — Linux kernel ALSA: usb-audio issue Root cause: ALSA usb-audio parsing channels bits could overrun the map array if a device reports more bits than channels, allowing a write beyond bounds. Synopsis in connected sources: the vulnerability was resolved in the Linux kernel by stoppi...

CVE-2024-35995

CVE-2024-35995 describes a Linux kernel issue where the ACPI CPPC code misread system memory by relying on bit_width, risking incorrect memory access. The fix switches to using access_width for size calculation and reads/writes using an offset and width, with a fallback to bit_width if access_wid...