CVE-2022-3521

CVE-2022-3521 is a race-condition vulnerability in the Linux Kernel KCM subsystem (function kcm_tx_work in net/kcm/kcmsock.c). The issue can allow a local attacker to trigger a crash via race conditions in the KCM path. Technical details in connected sources confirm the affected component and roo...

CVE-2023-1476

CVE-2023-1476 refers to a Linux kernel vulnerability affecting the mm/mremap path. A use-after-free occurs due to a race between rmap walk and mremap, enabling a local user to crash the system and potentially escalate privileges by exploiting a stale TLB during a PUD move. Connected documents ide...

CVE-2023-52578

CVE-2023-52578 affects the Linux kernel, specifically in the bridge code path (net/bridge) where br_handle_frame_finish() can race across CPUs, risking data races on dev->stats fields. The fix adopts SMP-safe DEV_STATS_INC() to update dev->stats (including tx_dropped) safely across CPUs, mi...

CVE-2024-26678

CVE-2024-26678 affects the Linux kernel’s x86/efistub pathway. The vulnerability arises from using a 1:1 file:memory mapping for the PE/COFF .compat section, which is an 8-byte dummy section containing the 32-bit entrypoint address of a 64-bit kernel image when booted from 32-bit firmware (CONFIG...

CVE-2024-26857

CVE-2024-26857 affects the Linux kernel, specifically the Geneve tunnel path. The issue stems from not safely handling skb/header state during inner header pull in geneve_rx(), risking uninitialized usage of headers after pskb_inet_may_pull(). The root cause is tied to how skb->network_header ...

CVE-2024-35854

CVE-2024-35854 : In the Linux kernel, the mlxsw: spectrum_acl_tcam component could trigger a use-after-free during rehash. The root cause is destruction of a region that still has filters when migration can fail (despite non-negative credits), leading to OOB/dereference via use-after-free. The fi...

CVE-2024-37356

CVE-2024-37356 : In Linux kernel, the vulnerability is a shift-out-of-bounds in dctcp_update_alpha() triggered by setting dctcp_shift_g to large values (e.g., 100). The issue arises from alpha and delivered_ce computations using dctcp_shift_g, leading to an UBSAN shift-out-of-bounds and potential...

CVE-2024-39499

CVE-2024-39499 (Linux kernel, vmci): The vulnerability allows speculative leaks via event_deliver() because user-controlled event_msg->event_data.event was used as an index without sanitization. The fix sanitizes the index to mitigate speculative information leaks. The issue is exploitable loc...

CVE-2024-41007

CVE-2024-41007 relates to a Linux kernel TCP issue where a socket using TCP_USER_TIMEOUT could have the retransmit timer emit packets for minutes after the user timeout expired if the peer reduced its window to zero. The underlying cause was tcp_retransmit_timer() ignoring icsk_user_timeout under...

CVE-2024-43905

CVE-2024-43905 affects the Linux kernel component drm/amd/pm specifically the vega10_hwmgr . The root cause was a potential null pointer dereference arising from insufficient null-check handling. The published fix adds validation of return values and proper null-pointer handling to prevent derefe...

CVE-2024-50127

CVE-2024-50127 : The Linux kernel patch for the taprio_change() use-after-free fixes a dangling admin pointer caused by sched switch/removal via advance_sched(). The critical section protected by q->current_entry_lock is too small to prevent the scenario, and KASAN can detect the issue. The fi...

CVE-2014-3645

CVE-2014-3645 affects the Linux kernel KVM implementation in arch/x86/kvm/vmx.c, with versions before 3.12. The root cause is that the code path handling the INVEPT instruction lacks an exit handler, which can allow a guest OS user to trigger a denial of service by crashing the guest via a crafte...

CVE-2014-4943

CVE-2014-4943 affects the Linux kernel up to 3.15.6, specifically the PPPoL2TP feature in net/l2tp/l2tp_ppp.c. The vulnerability arises from data-structure differences between an l2tp socket and an inet socket, enabling local privilege escalation. Public details in connected sources include PoC/e...

CVE-2015-8215

CVE-2015-8215 concerns the Linux kernel IPv6 stack (net/ipv6/addrconf.c) where MTU validation is missing. This affects kernel versions before 4.0 and can enable a context-dependent attacker to trigger packet loss through Router Advertisement processing, as the MTU value may be invalid (either bel...

CVE-2016-7097

CVE-2016-7097 is a Linux kernel vulnerability in which the setgid bit was not cleared during setxattr, allowing local users to gain group privileges if a setgid executable exists with restricted execute permissions. The issue is reported across the Linux filesystem/ACL handling and was addressed ...

CVE-2017-15649

CVE-2017-15649 affects the Linux kernel’s AF_PACKET path (net/packet/af_packet.c) up to version before 4.13.6. A race between fanout_add and packet_do_bind can mishandle packet_fanout data structures, causing a use-after-free condition. A local user with CAP_NET_RAW can trigger this to obtain pri...

CVE-2018-16276

CVE-2018-16276 concerns the Linux kernel, specifically the yurex_read function in drivers/usb/misc/yurex.c. The issue is a bounds-check vulnerability that could allow a local attacker with access to the system to crash the kernel or potentially escalate privileges. Affected code path is in the US...

CVE-2018-16880

CVE-2018-16880 affects the Linux kernel’s handle_rx() in the vhost_net driver. Under specific conditions a malicious guest can trigger an out-of-bounds write in a kmalloc-8 slab on the host, potentially causing kernel memory corruption and a system panic; privilege escalation cannot be ruled out....

CVE-2019-19047

CVE-2019-19047 is a memory-leak & potential DoS in the Linux kernel's mlx5_fw_fatal_reporter_dump() (drivers/net/ethernet/mellanox/mlx5/core/health.c) triggered by mlx5_crdump_collect() failures. Affected: Linux kernel versions before 5.3.11. Impact is memory consumption leading to DoS; exploitat...

CVE-2022-1419

CVE-2022-1419 affects the Linux kernel DRM/vgem path: ioctl DRM_IOCTL_MODE_DESTROY_DUMB can concurrently reduce the refcount of drm_vgem_gem_object created by vgem_gem_dumb_create, while that create path may access the freed object. The public description for this CVE notes that on 32-bit systems...

CVE-2022-49294

CVE-2022-49294 affects the Linux kernel (drm/amd/display) and is caused by an unchecked modulo division that can read 0, leading to a divide-by-zero panic. The available connected documents confirm the root cause and indicate a fix in the kernel to check for modulo == 0 before dividing. The explo...

CVE-2023-3358

CVE-2023-3358 describes a NULL pointer dereference in the Linux kernel ISH (Integrated Sensor Hub) driver. The impact stated is that a local user could crash the system. The connected Nessus/NASL entries corroborate the same issue across multiple advisories and lists, but the provided documents d...

CVE-2024-26773

Summary (CVE-2024-26773): The Linux kernel ext4 allocator could allocate blocks from a group whose block bitmap was corrupted, due to a concurrency window where ac_b_ex was used in ext4_mb_try_best_found(). The issue was tied to validating whether a group bitmap is corrupted before block allocati...

CVE-2024-26804

CVE-2024-26804 concerns a Linux kernel vulnerability in the net/ip_tunnel subsystem where headroom could inflate without bound when gre/ipip tunnels route in a cycle. The root cause, as described in the vulnerability report, is that ip_tunnel_xmit can trigger an ever-increasing needed_headroom on...

CVE-2024-26927

CVE-2024-26927 (Linux kernel, ASoC: SOF) has been fixed by adding bounds checks for firmware data to prevent underflow in head->full_size - head->header_size. The description notes Smatch detected potential negative values and an upper bounds check, addressing a bounds-related vulnerability...

CVE-2024-27019

The CVE-2024-27019 issue affects the Linux kernel nf_tables code. It describes a potential data race when nft_unregister_obj() runs concurrently with __nft_obj_type_get(), due to lack of protection while iterating nf_tables_objects. Mitigation in the advisory includes using list_for_each_entry_rc...

CVE-2024-35864

In CVE-2024-35864, the Linux kernel SMB client (smb2) had a potential use-after-free in smb2_is_valid_lease_break(); fixes skip sessions that are tearing down (status SES_EXITING) to avoid UAF. The issue is local and could be triggered by SMB lease-break handling; the CVSS vector indicates high i...

CVE-2024-35950

CVE-2024-35950 concerns a Linux kernel DRM issue where the modes[] array (points to connectors’ mode list entries) was not protected by the same mutex as mode_config, risking use-after-free if elements reference freed memory. The fix extends protection to modes[] via dev->mode_config.mutex, ad...

CVE-2024-36927

The CVE-2024-36927 issue is in the Linux kernel IPv4 path: uninit-value access in __ip_make_skb() due to a race with HDRINCL. The fix checks FLOWI_FLAG_KNOWN_NH on fl4->flowi4_flags instead of socket HDRINCL, and explicitly initializes fl4_icmp_type and fl4_icmp_code in raw_sendmsg() (the fiel...

CVE-2024-40998

CVE-2024-40998 — Normal (details provided) Affects Linux kernel ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super(). The root cause is registering sysfs before s_msg_ratelimit_state.lock is initialized, allowing concurrent updates to rs->interval (non-zero) to trigge...

CVE-2024-49960

CVE-2024-49960 concerns ext4 on the Linux kernel. The issue is a timer use-after-free during failed mounts: the s_err_report timer can remain active while sbi is freed, because ext4_handle_error re-arms the timer before kfree(sbi). The root cause is not canceling the s_err_report timer after ext4...

CVE-2024-49991

The CVE-2024-49991 issue affects the Linux kernel DRM/AMD stack: amdkfd_free_gtt_mem cleared the wrong pointer, causing a use-after-free when amdgpu_bo_unref resets the pointer. The patch passes the correct pointer reference to amdgpu_bo_unref to ensure the original pointer is NULL’d correctly. T...

CVE-2024-50151

Technical details about CVE-2024-50151 are not publicly provided in the connected documents. They mention an SMB2_IOCTL OOB issue in the CIFS client, but no affected versions, root-cause, or fix specifics are given here. Monitor for updates.

CVE-2024-53140

CVE-2024-53140 — Linux kernel netlink dump cleanup issue : The vulnerability arises when a user closes the netlink socket during an asynchronous dump operation. Dumping is driven by .start/.dump/.done calls in response to socket recvmsg(), and cleanup could be deferred to a workqueue. If the sock...

CVE-2014-0038

The CVE-2014-0038 issue affects the Linux kernel before 3.13.2 when CONFIG_X86_X32 is enabled: the compat_sys_recvmmsg function in net/compat.c can be exploited via recvmmsg with a crafted timeout pointer to gain local privileges. Public references document a local privilege escalation (exploitab...

CVE-2016-0774

CVE-2016-0774 affects Linux kernel backports in Debian wheezy (before 3.2.73-2+deb7u3) and RHEL 7.1 (before 3.10.0-229.26.2). The flaw is in the pipe_read/pipe_write paths in fs/pipe.c where the side effects of failed __copy_to_user_inatomic/__copy_from_user_inatomic calls are not properly handle...

CVE-2022-49371

CVE-2022-49371: In the Linux kernel, driver core: fix deadlock in __device_attach. The deadlock occurs when async_probe is scheduled while holding device_lock(dev); async_helper may also acquire dev, causing A-A deadlock. The fix moves async_schedule_dev outside the device_lock path, leveraging t...

CVE-2023-2598

The CVE-2023-2598 issue arises from a flaw in Linux kernel io_uring buffer registration (io_sqe_buffer_register) that can trigger out-of-bounds access to physical memory beyond the end of the buffer, enabling local privilege escalation. Public discussions and PoC-like exploits demonstrate local e...

CVE-2023-3006

CVE-2023-3006 describes a Spectre-BHB (Branch History Injection) cache-speculation vulnerability affecting AmpereOne hardware. Malicious code can use the CPU Branch History Buffer to influence mispredicted branches, triggering speculative execution that leads to cache allocation and potential inf...

CVE-2024-26631

CVE-2024-26631 – data race in IPv6 multicast path (Linux kernel) Root cause: ipv6_mc_down path allows writing idev->mc_ifc_count without proper synchronization, enabling data races with ipv6/mld_work paths. What’s fixed: The patch encapsulates calls to mld_ifc_stop_work() (and mld_gq_stop_work...

CVE-2024-26843

CVE-2024-26843: In the Linux kernel, the EFI runtime subsystem had a fix for a potential overflow in the soft-reserved region size. Specifically, md_size could be narrowed when there are >= 4 GiB worth of pages in a soft-reserved region. The vulnerability is reported as a local vulnerability w...

CVE-2024-35910

CVE-2024-35910: In the Linux kernel, TCP timer termination for kernel sockets was improved. Previously, inet_csk_clear_xmit_timers() stopped timers via del_timer(), which could allow in-flight kernel-timers to finish after the associated netns had been dismantled, risking use-after-free when the ...

CVE-2024-36020

CVE-2024-36020 centers on the Linux kernel i40e driver: a regression caused a may-be-uninitialized VF pointer, leading to stale VF references and potential instability. The fix removes a redundant variable and uses a single VF pointer across the affected function to guarantee pointer validity. Th...

CVE-2024-38581

CVE-2024-38581 : Linux kernel vulnerability affecting the AMDGPU MES path. The issue is a use-after-free in drm/amdgpu/mes triggered by the ramdom use-after-free caused by the fence fallback timer. The fix deletes the fence fallback timer to resolve the issue, and this change moved to amdgpu_mes....

CVE-2024-39476

The CVE-2024-39476 entry describes a Linux kernel md/raid5 deadlock scenario affecting raid5d where a deadlock can occur when MD_SB_CHANGE_PENDING is not cleared promptly. Root cause, as stated, is a dependency chain: md_check_recovery() from raid5d() must hold reconfig_mutex to clear MD_SB_CHANG...

CVE-2024-40954

The CVE-2024-40954 entry concerns a Linux kernel UAF: a dangling sk pointer may be created on socket creation failure when an fentry probe hits __sock_release() and bpf_get_socket_cookie() is invoked, enabling a use-after-free in __sock_gen_cookie. Reproducing scenario described via traceroute -I...

CVE-2024-43830

CVE-2024-43830 : Linux kernel vulnerability in leds: trigger race. The issue arises when unregistering trigger sysfs attributes after deactivate(), creating a window where trigger-data could be referenced post-free. The documented fix moves device_remove_groups() to before deactivate(), ensuring ...

CVE-2024-46797

CVE-2024-46797 : In the Linux kernel (PowerPC/MCS qspinlock), a deadlock can occur when an interrupt happens in queued_spin_lock_slowpath() after qnodesp->count is incremented but before node->lock is initialized. This can allow a CPU to see stale lock values and write the wrong qnode’s nex...

CVE-2024-50150

The CVE-2024-50150 entry describes a Linux kernel vulnerability in usb: typec: altmode where the altmode device release did not keep a reference to its parent. The fix registers a reference to the parent during altmode registration and stores it in the release path to prevent use-after-free scena...

CVE-2024-53095

CVE-2024-53095 – Linux kernel SMB CIFS client UAF Issue: The CIFS/SMB client in the Linux kernel can use-after-free the network namespace (netns) when sockets are freed after the netns lifetime, triggering oopses during reconnect in Kubernetes pods that mount CIFS shares in non-root netns. Root c...