CVE-2017-7477

CVE-2017-7477 affects the Linux kernel MACsec driver (drivers/net/macsec.c) up to version 4.10.12. It is a heap-based buffer overflow triggered by using MAX_SKB_FRAGS+1 with NETIF_F_FRAGLIST, causing denial of service and potentially other unspecified impacts via skb_to_sgvec. Public details in c...

CVE-2019-19377

CVE-2019-19377 concerns Linux kernel 5.0.21 where mounting a crafted btrfs image, performing actions, and unmounting can trigger a use-after-free in btrfs_queue_work (fs/btrfs/async-thread.c). Connected Nessus advisories for Unity Linux (UTSA-2026-004393) reiterate this, tying the issue to kernel...

CVE-2020-27675

CVE-2020-27675 describes a race condition in the Xen event-channel handling code (drivers/xen/events/events_base.c) that permits removal of an event channel during event handling, causing a use-after-free or NULL dereference and potentially a dom0 crash. The issue is present in the Linux kernel u...

CVE-2021-45402

CVE-2021-45402 affects the Linux kernel where check_alu_op() in kernel/bpf/verifier.c does not update bounds properly when handling mov32, enabling local attackers to leak potentially sensitive addresses (pointer leak). The description is consistently cited across multiple connected advisories (e...

CVE-2023-52803

The CVE-2023-52803 entry corresponds to a Linux kernel vulnerability: SUNRPC RPC client dereferenced freed pipefs dentries due to a mismatch of the current and original pipefs superblock during cleanup, potentially freeing dentries of the previously released pipefs. The issue occurs when a pipefs...

CVE-2024-26663

CVE-2024-26663 — Linux kernel (TIPC) bearer handling : The issue occurs in tipc_nl_bearer_add() when the UDP options attribute is used; it can call tipc_udp_nl_bearer_add() for non-UDP bearers, causing tipc_udp_is_known_peer() to dereference a non-UDP bearer and trigger a general protection fault...

CVE-2024-26890

CVE-2024-26890 affects the Linux kernel Bluetooth stack, specifically the btrtl driver when used with hci_h5. The issue arises from missing private-hci data allocation after hci_dev, causing a slab-out-of-bounds write (8 bytes) during btrtl_initialize, detectable via KASAN. The root cause is memo...

CVE-2024-26906

CVE-2024-26906 : In the Linux kernel, x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault(). A bpf program reading the vsyscall page with bpf_probe_read_kernel() can trigger copy_from_kernel_nofault(), which calls __get_user_asm() and may fault because the vsyscall page is not readab...

CVE-2024-41020

CVE-2024-41020 is a Linux kernel vulnerability fixed by applying the same fcntl/close race recovery patch to the compat path for 32-bit kernels. The issue concerns a race condition in filelock handling during fcntl/close, resolved by ensuring reliable lock removal across both normal and 32-bit co...

CVE-2024-46698

CVE-2024-46698 (Linux kernel) is resolved. The issue was in video/aperture handling where sysfb_disable() was only invoked for VGA-class boot devices, allowing a non‑VGA boot device to trigger a NULL pointer dereference when the non-primary GPU subsequently called sysfb_disable() after resources ...

CVE-2024-53237

CVE-2024-53237 is a Linux kernel vulnerability describing a use-after-free in the Bluetooth device lifecycle, specifically in the function device_for_each_child. The issue was surfaced by KASAN and tied to a scenario where a parent device could be freed while a child device still holds a referenc...

CVE-2024-56776

Technical details for CVE-2024-56776 are not provided in the supplied connected documents. Public details are unavailable here. Action: monitor for updates from security advisories.

CVE-2024-57979

The CVE-2024-57979 entry is supported by connected documents detailing a Linux kernel use-after-free in pps during device teardown. The root cause is described as pps_device_destruct() freeing the pps_device immediately after cdev_del(), while fops from previously opened cdevs may still be callab...

CVE-2025-21785

The CVE-2025-21785 issue is in the Linux kernel (arm64) cacheinfo handling. A loop that detects/populates cache information previously did a bounds check on the array size but did not account for cache levels with separate data/instructions caches, allowing an out-of-bounds write to the cacheinfo...

CVE-2025-38350

CVE-2025-38350 affects the Linux kernel net/sched HFSC and other classful qdiscs. The issue arises when a child qdisc becomes empty during enqueue/dequeue interactions, potentially leading to a use-after-free on stale class pointers after backlog/backlog accounting. The known fix changes the back...

CVE-2016-5829

CVE-2016-5829 is a Linux kernel vulnerability in the hiddev driver (hiddev_ioctl_usage in drivers/hid/usbhid/hiddev.c) that allows a local user to trigger heap-based buffer overflows by sending crafted ioctls (HIDIOCGUSAGES or HIDIOCSUSAGES). Affected kernels are up to 4.6.3 (through 4.6.3). The ...

CVE-2017-12153

CVE-2017-12153 refers to a security flaw in the Linux kernel where nl80211_set_rekey_data() in net/wireless/nl80211.c does not validate required Netlink attributes, enabling a local attacker with CAP_NET_ADMIN to trigger a NULL pointer dereference and system crash. The vulnerability is described ...

CVE-2019-20794

CVE-2019-20794 : The Linux kernel versions 4.18–5.6.11 are affected when unprivileged user namespaces are allowed. A user can create their own PID namespace and mount a FUSE filesystem; if the userspace component is terminated by killing PID 1, the interaction with the FUSE mount can hang the tas...

CVE-2021-4150

CVE-2021-4150 is a Linux kernel use-after-free in add_partition (block/partitions/core.c). The vulnerability arises from missing cleanup when device_add fails while adding a partition, enabling a local attacker with user privileges to cause a denial of service. Affected component is the kernel’s ...

CVE-2021-47432

The Linux kernel is affected by an integer overflow vulnerability in the lib/generic-radix-tree.c file. Specifically, the peek() function (and the __genradix_iter_peek() function in the include/linux/generic-radix-tree.h module) does not properly handle overflows when the system starts assigning ...

CVE-2023-1078

CVE-2023-1078 affects the Linux kernel RDS implementation. The flaw is caused by rds_rm_zerocopy_callback() using list_entry() on the head of a list, causing a type confusion where a pointer of type struct rds_msg_zcopy_info *info may actually refer to something else controlled by a local user. T...

CVE-2024-26840

CVE-2024-26840 affects the Linux kernel cachefiles subsystem. The available technical details show a memory leak in cachefiles_add_cache() after unbinding /dev/cachefiles, fixed by releasing/adjusting the cache_cred reference count. The documented fix paths include: (1) increase reference handlin...

CVE-2024-35950

CVE-2024-35950 affects the Linux kernel DRM client code. The modes[] array references modes on connectors’ mode lists and was not protected by dev->mode_config.mutex, risking use-after-free or memory reuse. The fix extends the same mutex protection to modes[] to ensure elements aren’t freed or...

CVE-2024-43830

CVE-2024-43830 : Linux kernel vulnerability in leds: trigger race. The issue arises when unregistering trigger sysfs attributes after deactivate(), creating a window where trigger-data could be referenced post-free. The documented fix moves device_remove_groups() to before deactivate(), ensuring ...

CVE-2024-43866

The CVE-2024-43866 issue is in the Linux kernel mlx5 driver: in shutdown, health work must be drained to avoid races/NULL pointer dereferences. The fix changes the shutdown callback to drain the health work queue (drain health WQ) to ensure no health work is left running during device shutdown. I...

CVE-2024-47745

The CVE-2024-47745 entry describes a Linux kernel vulnerability where remap_file_pages bypassed W^X enforcement when using personality(READ_IMPLIES_EXEC) followed by a RW remap, due to the remap_file_pages path calling do_mmap() before the LSM security check. A fix adds a security_mmap_file LSM h...

CVE-2024-50143

CVE-2024-50143 affects the Linux kernel; the udf subsystem introduced an uninitialized-value use in udf_get_fileshortad, mitigated by a fix that also checks for overflow when computing alen in udf_current_aext to address a KMSAN bug. The patch prevents triggering issues after application, and pub...

CVE-2024-50151

Technical details about CVE-2024-50151 are not publicly provided in the connected documents. They mention an SMB2_IOCTL OOB issue in the CIFS client, but no affected versions, root-cause, or fix specifics are given here. Monitor for updates.

CVE-2024-53074

The CVE-2024-53074 issue affects the Linux kernel wireless stack (iwlwifi, mvm). The vulnerability arises from not releasing the link mapping resource when an AP is removed, leading to a leak of a link on AP removal. This specifically impacts devices that do not support the MLD API (9260 and earl...

CVE-2024-53121

Summary of CVE-2024-53121 (Linux kernel) : The vulnerability affects the mlx5 netfilter offload path, where a two‑step FTE deletion (lock/delete in hardware, NULL hardware delete func, then delete software copy) can race with a simultaneous rule addition. This race may allow a rule with the same ...

CVE-2024-53146

CVE-2024-53146 affects the Linux kernel NFSD path. The issue is an integer overflow in decoding the NFSv4/CBOM length when tag length >= U32_MAX - 3, solved by splitting the decoding into several steps so decode_cb_compound4res() no longer arithmetic on the unsafe length. Impact is availabilit...

CVE-2024-53156

CVE-2024-53156: In the Linux kernel’s ath9k wireless driver, insufficient verification of conn_rsp_epid in htc_connect_service() can trigger an UBSAN array-out-of-bounds in htc_hst.c (index 255 out of range for htc_endpoint[22]). Astra Linux and related advisories confirm the issue and its fix: a...

CVE-2024-53161

CVE-2024-53161 is tied to the Linux kernel EDAC/bluefield issue: the 64-bit get-DIMM-info SMC argument used mem_ctrl_idx left-shifted by 16 and OR’d with the DIMM index; with mem_ctrl_idx treated as 32-bit this can truncate the upper 16 bits, risking data loss. The advisory states the mem_ctrl_id...

CVE-2024-58007

CVE-2024-58007 affects the Linux kernel in the soc: qcom: socinfo path, specifically on MSM8916 devices where the sysfs serial_number is constant. The root cause is an out-of-bounds read of the serial_num field in the socinfo structure due to checking the start offset instead of the end when vali...

CVE-2025-21718

CVE-2025-21718 affects the Linux kernel Rose timer handling. The issue arises when Rose timers acquire only the socket spinlock and do not verify socket ownership, enabling a race against user threads. The described fix adds a socket ownership check and rearms timers as needed, addressing a KASAN...

CVE-2000-0006

CVE-2000-0006 affects the strace utility. The issue allows local users to read arbitrary files via memory-mapped file names. The connected records identify strace as the affected component and describe the vulnerability as a local-read exposure through mmap-based file-name handling. No explicit e...

CVE-2013-2206

CVE-2013-2206 concerns the Linux kernel SCTP implementation. The sctp_sf_do_5_2_4_dupcook function in net/sctp/sm_statefuns.c does not properly handle associations during processing of a duplicate COOKIE ECHO chunk, allowing remote attackers to trigger a denial of service via NULL pointer derefer...

CVE-2014-6410

The vulnerability CVE-2014-6410 affects the Linux kernel (through 3.16.3) in the UDF filesystem: the __udf_read_inode function does not restrict ICB indirection, enabling a local, physically proximate attacker to cause a denial of service (infinite loop or stack consumption) via a crafted inode. ...

CVE-2014-9940

CVE-2014-9940 affects the Linux kernel regulator_ena_gpio_free function in drivers/regulator/core.c, with exploitation possible through local access to gain privileges or cause a denial of service via a use-after-free. Affected condition is kernel versions before 3.19. Impact per sources is high ...

CVE-2016-4565

CVE-2016-4565 affects the Linux kernel InfiniBand (IB) stack prior to 4.5.3, where certain IB interfaces improperly rely on write() semantics via a uAPI interface. This could allow a local unprivileged user to cause a denial of service (kernel memory write) and potentially other impact/escalation...

CVE-2016-4998

CVE-2016-4998 affects the Linux kernel netfilter IPT_SO_SET_REPLACE handling. The vulnerability allows a local attacker (e.g., with container/root access) to trigger an out-of-bounds read and potentially leak kernel heap memory or cause a Denial of Service by supplying a crafted offset that cross...

CVE-2017-12188

CVE-2017-12188 affects arch/x86/kvm/mmu.c in the Linux kernel up to 4.13.5 where nested virtualization can mis-traverse guest page tables, enabling L1 guests to run arbitrary host code or trigger host denial of service. Connected advisories ( MiracleLinux AXSA-2018-2625, Unity Linux UTSA advisori...

CVE-2023-51780

CVE-2023-51780: Linux kernel before 6.6.8 contains a use-after-free in do_vcc_ioctl (net/atm/ioctl.c) caused by a vcc_recvmsg race, enabling local exploitation. Affected: Linux kernel versions prior to 6.6.8. Root cause: race between vcc_recvmsg and do_vcc_ioctl leading to use-after-free. Impact:...

CVE-2024-27015

CVE-2024-27015 affects the Linux kernel netfilter flowtable implementation. The issue is an incorrect pppoe tuple handling where the PPPoE header is expected at the network header offset, causing flowtable lookups to miss and PPPoE traffic to enter the classical forwarding path. Connected advisor...

CVE-2024-36031

The Linux kernel contains a vulnerability where the expiration time of a key is unconditionally overwritten during instantiation, defaulting to a permanent state (TIME64_MAX ). This issue specifically impacts DNS resolution by disabling further DNS updates because the expiration set by user-space...

CVE-2024-36953

CVE-2024-36953 affects the Linux kernel KVM for arm64 with vgic-v2. The issue: vgic_v2_parse_attr() searches for a vCPU matching the CPUID and may receive a NULL from kvm_get_vcpu_by_id() if the ID is invalid. Unlike the safe GICv3 flow, the code did not verify the returned vCPU object. Affected ...

CVE-2024-38555

CVE-2024-38555: In the Linux kernel, the net/mlx5 driver fixes a use-after-free by discarding FW command completions arriving during an internal error state. The patch prevents calling the completion handler when the device will flush the command interface, avoiding use-after-free/refcount underf...

CVE-2024-42294

CVE-2024-42294 : The Azure/MiracleLinux and Linux kernel records describe a fix for a deadlock in the Linux kernel caused by blocking ABBA between sd_remove and sd_release. The issue arises when a SCSI/USB device is disconnected while the block/SD stack is mutexp-locked during device removal, lea...

CVE-2024-49960

CVE-2024-49960 concerns ext4 on the Linux kernel. The issue is a timer use-after-free during failed mounts: the s_err_report timer can remain active while sbi is freed, because ext4_handle_error re-arms the timer before kfree(sbi). The root cause is not canceling the s_err_report timer after ext4...

CVE-2024-50029

CVE-2024-50029 refers to a Linux kernel bug in Bluetooth handling. The issue is a use-after-free in hci_enhanced_setup_sync where the ACL connection can be destroyed while a cmd_sync is pending, leading to a KASAN slab-use-after-free in hci_enhanced_setup_sync. The description includes a trace sh...