CVE-2019-19813

CVE-2019-19813 is a Linux kernel use-after-free in __mutex_lock on Linux kernel 5.0.21 when mounting a crafted btrfs image, performing operations, and calling syncfs, related to mutex_can_spin_on_owner, __btrfs_qgroup_free_meta, and btrfs_insert_delayed_items. It is a local, user-interaction-requ...

CVE-2022-1199

CVE-2022-1199 is a Linux kernel flaw that can crash the kernel via user-space activity simulating amateur radio, producing a NULL pointer dereference and a use-after-free. The connected Astra Linux bulletin confirms the same vulnerability details and, for mitigating environments, Siemens’ accompa...

CVE-2022-2938

CVE-2022-2938 : A flaw in the Linux kernel’s Pressure Stall Information (PSI) implementation could allow a local attacker to crash the system or cause memory-corruption side effects, even though PSI is disabled by default. The connected documents consistently describe the issue as a Linux kernel ...

CVE-2023-1078

CVE-2023-1078 affects the Linux kernel RDS implementation. The flaw is caused by rds_rm_zerocopy_callback() using list_entry() on the head of a list, causing a type confusion where a pointer of type struct rds_msg_zcopy_info *info may actually refer to something else controlled by a local user. T...

CVE-2023-28327

CVE-2023-28327 : A NULL pointer dereference in the Linux kernel’s UNIX protocol (net/unix/diag.c, function unix_diag_get_exact) occurs when the newly allocated skb is created without an associated sk, leaving a NULL sk pointer. This can allow a local attacker to crash the kernel or cause a denial...

CVE-2023-31085

CVE-2023-31085 – Linux kernel 6.2 (drivers/mtd/ubi/cdev.c) shows a divide-by-zero in do_div(sz,mtd-> erasesize) when mtd->erasesize is 0, triggered via ctrl_cdev_ioctl. Connected advisories reference upstream Linux commits and vendor advisories (e.g., Astra Linux and Amazon Linux 2) noting ...

CVE-2023-52565

CVE-2023-52565 is a Linux kernel vulnerability affecting the media: uvcvideo subsystem. The issue is an out-of-bounds read in uvc_query_v4l2_menu() when the user-provided index exceeds the mask size, potentially allowing reading memory outside the intended bounds. The connected MiracleLinux advis...

CVE-2023-52598

CVE-2023-52598 concerns the Linux kernel (s390/ptrace) where an incorrect handling of the fpc register during ptrace can corrupt fp/vx state of the tracing process. The root cause is that when a traced process’s fpc value is validated, it is temporarily loaded into the fpc register, and the trace...

CVE-2023-52752

CVE-2023-52752 (Linux kernel) is backed by concrete fix details in connected docs: a use-after-free in the SMB/CIFS client code path (cifs_debug_data_proc_show) when reading /proc/fs/cifs/DebugData during mount/umount. The fix adds a check to skip SMB sessions that are tearing down (ses_status ==...

CVE-2024-26640

The CVE-2024-26640 entry is about a Linux kernel TCP RX zerocopy patch that adds sanity checks in can_map_frag(): pages must not be compound and page->mapping must be NULL. Connected docs confirm this as a concrete kernel fix (patches and CVSS details). Impact is described as a local denial of...

CVE-2024-26663

CVE-2024-26663 (Linux kernel) concerns TIPc bearer handling. Connected sources confirm concrete technical details: when tipc_nl_bearer_add() is invoked with the TIPC_NLA_BEARER_UDP_OPTS attribute, the code may call tipc_udp_nl_bearer_add() even if the bearer is not UDP, leading to an invalid medi...

CVE-2024-26890

The CVE-2024-26890 vulnerability is in the Linux kernel Bluetooth stack (btrtl driver). When the btrtl driver is used with hci_h5, private HCI data memory was not allocated after hci_dev, causing a potential out-of-bounds write detected by KASAN. The fix adds memory allocation for the hci_h5 path...

CVE-2024-35807

CVE-2024-35807 pertains to a Linux kernel ext4 online resize corruption when resizing a filesystem larger than 16 TiB with 4k blocks. The issue occurs during on-line resize across an 8 GiB boundary, affecting the backup block group descriptor for non-meta_bg layouts and can corrupt data. The root...

CVE-2024-35965

CVE-2024-35965 affects the Linux kernel Bluetooth stack (L2CAP) where setsockopt input length is not validated before copying data. The root cause is missing validation of user input length, enabling potential memory/contagion issues as described in vendor advisories that reference this CVE (e.g....

CVE-2024-42159

The CVE-2024-42159 entry corresponds to a Linux kernel vulnerability in the SCSI mpi3mr driver where values stored in mr_sas_port->phy_mask could exceed the field size, risking improper handling and potential memory corruption. Public advisories (ALAS/Red Hat/Debian) list the fixed kernel upda...

CVE-2024-49883

In CVE-2024-49883, the Linux kernel ext4 ext4_ext_insert_extent() is vulnerable to use-after-free when a path is reallocated in ext4_ext_create_new_leaf(), leaving a stale path in ext4_ext_insert_extent() and triggering UAF (KASAN) during map/write paths. The issue is reproduced via a realloc of ...

CVE-2024-50143

CVE-2024-50143 affects the Linux kernel; the udf subsystem introduced an uninitialized-value use in udf_get_fileshortad, mitigated by a fix that also checks for overflow when computing alen in udf_current_aext to address a KMSAN bug. The patch prevents triggering issues after application, and pub...

CVE-2024-56748

CVE-2024-56748 affects the Linux kernel SCSI qedf driver (QLogic/QED) where memory allocated for sb (scsi block) was leaked on sb_init failure. The root cause was that the dma memory sb_virt allocated for the SB was not freed when qed_ops->common->sb_init failed, leading to a memory leak. T...

CVE-2024-56776

Technical details for CVE-2024-56776 are not provided in the supplied connected documents. Public details are unavailable here. Action: monitor for updates from security advisories.

CVE-2009-2698

CVE-2009-2698 affects the Linux kernel UDP implementation (net/ipv4/udp.c and net/ipv6/udp.c) prior to 2.6.19. Local users can gain privileges or cause a denial of service (NULL pointer dereference/system crash) via UDP socket use with MSG_MORE. Oracle Linux/MiracleLinux advisories reference this...

CVE-2017-5967

CVE-2017-5967 affects the Linux kernel: when CONFIG_TIMER_STATS is enabled, the time subsystem through kernel 4.9.9 allows a local attacker to reveal real PID values (outside of PID namespaces) by reading /proc/timer_list, via the print_timer path in kernel/time/timer_list.c and the __timer_stats...

CVE-2018-25020

Summary of CVE-2018-25020 (Linux kernel BPF): The vulnerability is in the BPF subsystem where a long jump over an instruction sequence can cause an overflow. It specifically affects the kernel's BPF implementations in files kernel/bpf/core.c and net/core/filter.c, for Linux kernels prior to 4.17....

CVE-2019-19039

CVE-2019-19039 is a Linux kernel vulnerability affecting btrfs: the function __btrfs_free_extent in fs/btrfs/extent-tree.c may trigger a path in btrfs_print_leaf during an ENOENT case, enabling a local attacker to obtain potentially sensitive information about register values via dmesg. The descr...

CVE-2022-48695

CVE-2022-48695 is a Linux kernel vulnerability in the scsi: mpt3sas driver that results in a use-after-free (refcount_t underflow) observed during controller reset. The issue is fixed in the kernel by the referenced commits listed in the connected sources. The vulnerability is described as a loca...

CVE-2023-51780

CVE-2023-51780: Linux kernel before 6.6.8 contains a use-after-free in do_vcc_ioctl (net/atm/ioctl.c) caused by a vcc_recvmsg race, enabling local exploitation. Affected: Linux kernel versions prior to 6.6.8. Root cause: race between vcc_recvmsg and do_vcc_ioctl leading to use-after-free. Impact:...

CVE-2023-52522

CVE-2023-52522 is a Linux kernel vulnerability related to store tearing in neigh_periodic_work() due to an RC list deletion without proper annotation. The issue arises when reading with rcu_deference(*np) while writers used an unsafe pointer update; the fix adds either rcu_assign_pointer() or WRI...

CVE-2024-26686

CVE-2024-26686 refers to a Linux kernel issue where lock_task_sighand could trigger a hard lockup if NR_CPUS threads execute do_task_stat concurrently while a process has NR_THREADS. The fix changes do_task_stat() to gather thread/child statistics using sig->stats_lock outside the sighand lock...

CVE-2024-26837

CVE-2024-26837 affects the Linux kernel MDB offload replay handling. A race between generating the replay list and new MDB memberships could cause duplicates of a single event, leaving hardware-mounted memberships orphaned on bridge destruction. The fix guards MDB replay against deferred events ...

CVE-2024-26907

CVE-2024-26907 affects the Linux kernel in the RDMA mlx5 stack. The vulnerability arises from a fortify source warning caused by a field-spanning write to eseg->inline_hdr.start in wr.c (memcpy path) during mlx5_ib_post_send, potentially enabling a local issue if exploited. Affected components...

CVE-2024-35867

CVE-2024-35867 pertains to the Linux kernel SMB client. The vulnerability arises from a potential use-after-free in cifs_stats_proc_show(), mitigated by skipping sessions that are tearing down (status SES_EXITING) to prevent UAF. The fix resolves a local-attack scenario with high impact on confid...

CVE-2024-35925

The CVE-2024-35925 issue concerns the Linux kernel blk_rq_stat_sum() path. The root cause is a potential division by zero when computing stats, caused by the expression dst->nr_samples + src->nr_samples reaching zero due to overflow. Multiple connected advisories (Unity Linux security updat...

CVE-2024-36031

CVE-2024-36031 is a Linux kernel vulnerability where, during key instantiation, the expiry time of a key is unconditionally overwritten to TIME64_MAX, effectively making it permanent and breaking DNS updates. The root cause is the unconditional key_set_expiry call during instantiation; the fix re...

CVE-2024-38538

CVE-2024-38538 is a Linux kernel vulnerability in the bridge xmit path. The issue arises when a short skb (less than ETH_HLEN) is processed, risking uninitialized data in br_dev_xmit. The fix adds a guard to ensure the kernel only pulls the required ETH header bytes and does not assume availabili...

CVE-2024-42082

CVE-2024-42082 is a Linux kernel vulnerability where a syzkaller-triggered WARN was introduced in __xdp_reg_mem_model() when __mem_id_init_hash_table() failed. The issue arose only from memory allocation failure; a static const rhashtable_params prevented rhashtable_init() misconfiguration. The w...

CVE-2024-50282

The connected Astra Linux entry clarifies CVE-2024-50282 in the Linux kernel: a missing size check in drm/amdgpu_debugfs_gprwave_read() can cause a buffer overflow when size > 4K. The fix (cherry-picked commit f5d873f5825b40d886d03bd2aede91d4cf002434) adds the size check to prevent overflow. N...

CVE-2024-56758

CVE-2024-56758 affects the Linux kernel (btrfs) and describes a race where, after folio unlock during relocation, another thread can modify the folio mapping before folio_lock() and lead to an invalid page, potentially causing a NULL pointer dereference during concurrent transaction aborts. The i...

CVE-2016-10200

CVE-2016-10200 describes a race condition in the Linux kernel’s L2TPv3 IP Encapsulation feature that can allow a local user to escalate privileges or cause a denial of service via repeated bind() calls without correctly checking SOCK_ZAPPED status. The issue affects Linux kernels prior to 4.8.14,...

CVE-2017-14489

CVE-2017-14489 affects the Linux kernel iSCSI transport (drivers/scsi/scsi_transport_iscsi.c: iscsi_if_rx). The root cause is incorrect length validation, enabling a local authenticated attacker to trigger a denial of service (kernel panic) or memory corruption. Affected as of kernel versions up ...

CVE-2021-47441

CVE-2021-47441 concerns the Linux kernel mlxsw thermal driver. The issue arises when cooling state is set above the driver’s maximum state (e.g., cur_state=18 while max_state=10), which triggers out-of-bounds memory accesses in thermal statistics code. The thermal maintainer indicates it is the d...

CVE-2022-48655

CVE-2022-48655 in the Linux kernel: vulnerability in the SCMI firmware path (arm_scmi) where reset domains descriptors could be accessed by index, risking out-of-bounds due to SCMI driver misbehavior. The root cause is lack of an internal consistency check before domain descriptor accesses. The f...

CVE-2023-52623

CVE-2023-52623 is a Linux kernel vulnerability related to SUNRPC where a suspicious RCU usage warning was observed: the RCU-list was traversed in a non-reader section in net/sunrpc/xprtmultipath.c:349. The connected Astra Linux and other advisories confirm this CVE and describe the fix as address...

CVE-2024-26758

CVE-2024-26758 relates to the Linux kernel’s md subsystem: md_check_recovery() previously could fail to clear MD_RECOVERY_RUNNING when suspended, allowing a hanging sync_thread during suspend/resume of md devices. The fix ignores the suspended array in md_check_recovery(), addressing a hang where...

CVE-2024-46791

CVE-2024-46791 concerns the Linux kernel, where a deadlock can occur in the MCP251X CAN driver if an interrupt arrives while mcp251x_open holds priv->mcp_lock. The root cause is that mcp251x_hw_wake() disables interrupts with the mutex still held, causing the interrupt handler to deadlock when...

CVE-2024-47745

The CVE-2024-47745 entry describes a Linux kernel vulnerability where remap_file_pages bypassed W^X enforcement when using personality(READ_IMPLIES_EXEC) followed by a RW remap, due to the remap_file_pages path calling do_mmap() before the LSM security check. A fix adds a security_mmap_file LSM h...

CVE-2024-49860

CVE-2024-49860 relates to the Linux kernel ACPI subsystem, specifically the sysfs path and the _STR method. The vulnerability arises when the _STR method returns a value that is not a buffer object; only buffers are valid, and returning other data types can cause description_show() to access inva...

CVE-2024-53124

CVE-2024-53124 – Linux kernel data race around sk_forward_alloc in LISTEN state. Two threads can concurrently execute tcp_v6_do_rcv()/skb_clone_and_charge_r and sk_forward_alloc_add(), causing incorrect accounting and a possible use-after-free path. The issue arises when sk->sk_lock is unlocke...

CVE-2024-56757

The CVE-2024-56757 entry concerns the Linux kernel Bluetooth driver for MediaTek USB BT dongles (btusb/mediatek). The issue is the missing interface release flow when the USB disconnects, which can cause a kernel panic when unregistering the HCI device. A patch to introduce the interface release ...

CVE-2026-23111

CVE-2026-23111 (Linux kernel) : A bug in netfilter nf_tables nft_map_catchall_activate() inverted the genmask check, causing catchall elements to be processed incorrectly during abort of a DELSET operation. The function skipped inactive elements and processed active ones, leading to a use-after-f...

CVE-2017-1000365

CVE-2017-1000365 affects the Linux kernel where size limits for arguments and environment strings passed via RLIMIT_STACK/RLIMIT_INFINITY do not properly account for the argument/environment pointers, enabling a local attacker to potentially execute arbitrary code. The issue is described as a lim...

CVE-2019-19531

CVE-2019-19531 affects the Linux kernel prior to 5.2.9. The issue is a use-after-free triggered by a malicious USB device in the drivers/usb/misc/yurex.c component (CID-fc05481b2fca). Exploitation would occur locally (physical access) via crafted USB input, with the kernel potentially resolving t...