CVE-2022-49058

In CVE-2022-49058, the Linux kernel CIFS subsystem is affected by a potential buffer overflow in handling symlinks. The root cause is that Smatch marks link_len as untrusted (originating from sscanf()) and may allow a length to exceed the destination buffer, risking a overflow in poly1305-related...

CVE-2023-52623

Technical details about CVE-2023-52623 are not publicly available in the provided documents. Monitor for updates from vendors and security bulletins.

CVE-2024-26758

The Linux kernel contains a vulnerability in the md driver where the md_check_recovery() function incorrectly ignores suspended arrays. Because mddev_suspend() does not stop the sync_thread, failing to process these arrays can prevent the sync_thread from being unregistered, leading to a system h...

CVE-2024-26773

CVE-2024-26773: The Linux kernel ext4 block allocator vulnerability is resolved. The fix prevents allocating blocks from a group whose block bitmap is corrupted during concurrent operations by verifying the group bitmap integrity before using ac_b_ex in ext4_mb_try_best_found(), and by guarding t...

CVE-2024-26801

CVE-2024-26801 (Linux kernel Bluetooth): In HCI_EV_HARDWARE_ERROR handling when the BT controller does not respond, the GPIO reset could free the hci_dev, causing a use-after-free in hci_error_reset. A patch has been released that maintains the hci_dev reference count during processing of the eve...

CVE-2024-26927

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Add some bounds checking to firmware data Smatch complains about "head->full_size - head->header_size" canunderflow. To some extent, we're always going to have to trust thefirmware a bit. However, it's easy enoug...

CVE-2024-53069

CVE-2024-53069 affects the Linux kernel firmware driver for Qualcomm SCM. The vulnerability is a NULL-pointer dereference when SCM calls are made with __scm set to NULL (driver may not be probed due to absent SCM entry in device-tree). The fix prevents dereferencing a NULL pointer, addressing pot...

CVE-2024-53124

CVE-2024-53124 affects the Linux kernel net subsystem, specifically data races around sk->sk_forward_alloc. The provided documents show that two threads can call tcp_v6_do_rcv()/sk_forward_alloc_add() concurrently when sk->sk_state == TCP_LISTEN and sk->sk_lock is unlocked, leading to a ...

CVE-2024-53146

CVE-2024-53146 affects the Linux kernel NFSD path. The issue is an integer overflow in decoding the NFSv4/CBOM length when tag length >= U32_MAX - 3, solved by splitting the decoding into several steps so decode_cb_compound4res() no longer arithmetic on the unsafe length. Impact is availabilit...

CVE-2014-0038

The CVE-2014-0038 issue affects the Linux kernel before 3.13.2 when CONFIG_X86_X32 is enabled: the compat_sys_recvmmsg function in net/compat.c can be exploited via recvmmsg with a crafted timeout pointer to gain local privileges. Public references document a local privilege escalation (exploitab...

CVE-2016-2184

CVE-2016-2184 affects the Linux kernel snd-usb-audio driver (pre-4.5.1). The vulnerability stems from create_fixed_stream_quirk in sound/usb/quirks.c, which allows a physically proximate attacker to trigger a denial of service via a crafted endpoints value in a USB device descriptor. Consequences...

CVE-2017-1000370

CVE-2017-1000370 affects the Linux kernel (4.11.5 and earlier) on i386. The offset2lib patch vulnerability lets a PIE binary be execve’d with an enormous 1 GB argument/environment list, causing the stack to occupy 0x80000000 and the PIE binary to be mapped above 0x40000000, bypassing the patch’s ...

CVE-2017-12193

CVE-2017-12193 affects the Linux kernel: the function assoc_array_insert_into_terminal_node in lib/assoc_array.c mishandles node splitting, leading to a NULL pointer dereference and kernel panic via a crafted application. The vulnerability is in kernels prior to 4.13.11, enabling local attackers ...

CVE-2023-1078

CVE-2023-1078 affects the Linux kernel RDS implementation. The flaw is caused by rds_rm_zerocopy_callback() using list_entry() on the head of a list, causing a type confusion where a pointer of type struct rds_msg_zcopy_info *info may actually refer to something else controlled by a local user. T...

CVE-2023-2007

CVE-2023-2007 affects the DPT I2O Controller driver in the Linux kernel. The issue arises from missing locking during object operations, enabling a local attacker to escalate privileges and execute arbitrary code in kernel context. Public references in Unity Linux (UTSA-2026-004778) and multiple ...

CVE-2023-52581

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix memleak when more than 255 elements expired When more than 255 elements expired we're supposed to switch to a new gccontainer structure. This never happens: u8 type will wrap before reaching the boundary...

CVE-2024-35939

CVE-2024-35939 : The Linux kernel vulnerability in the dma-direct path leaks pages on dma_set_decrypted() failure, allowing a local attacker to cause a denial of service by leaking memory rather than freeing it. Affected component: dma-direct in the Linux kernel (TDX context noted). Conditions: a...

CVE-2024-35965

CVE-2024-35965 affects the Linux kernel Bluetooth stack (L2CAP) where setsockopt input length is not validated before copying data. The root cause is missing validation of user input length, enabling potential memory/contagion issues as described in vendor advisories that reference this CVE (e.g....

CVE-2024-36927

The CVE-2024-36927 issue is in the Linux kernel IPv4 path: uninit-value access in __ip_make_skb() due to a race with HDRINCL. The fix checks FLOWI_FLAG_KNOWN_NH on fl4->flowi4_flags instead of socket HDRINCL, and explicitly initializes fl4_icmp_type and fl4_icmp_code in raw_sendmsg() (the fiel...

CVE-2024-36960

The CVE-2024-36960 entry maps to a Linux kernel issue in drm/vmwgfx where the length field for drm_event was incorrectly set to the parent structure, causing out-of-bounds reads when drm_read copies events to userspace. The provided documents confirm the root cause and fix: set drm_event length t...

CVE-2024-38555

CVE-2024-38555: In the Linux kernel, the net/mlx5 driver fixes a use-after-free by discarding FW command completions arriving during an internal error state. The patch prevents calling the completion handler when the device will flush the command interface, avoiding use-after-free/refcount underf...

CVE-2024-40997

CVE-2024-40997 involves a Linux kernel vulnerability where a memory leak in the amd-pstate cpufreq path was fixed. The issue was that kzalloc() allocated cpudata during amd_pstate_epp_cpu_init() but could not be freed in the corresponding exit path, leading to a leak on CPU EPP exit. The primary ...

CVE-2024-43905

CVE-2024-43905 affects the Linux kernel component drm/amd/pm specifically the vega10_hwmgr . The root cause was a potential null pointer dereference arising from insufficient null-check handling. The published fix adds validation of return values and proper null-pointer handling to prevent derefe...

CVE-2024-45002

CVE-2024-45002 is a Linux kernel vulnerability affecting rtla/osnoise: a NULL dereference in error handling when tool->data allocation fails. The issue is confirmed in multiple vendor advisories (Azure Linux Nessus, Astra Linux bulletin, Debian DLA-4008) and is tied to kernel code paths involv...

CVE-2024-47742

CVE-2024-47742 : Linux kernel firmware_loader path traversal vulnerability. Several code paths construct firmware filenames from device or userspace data (e.g., lpfc_sli4_request_firmware_update, nfp_net_fw_find, module_flash_fw_schedule). The issue arises when dynamic firmware names can include ...

CVE-2024-47745

The CVE-2024-47745 entry describes a Linux kernel vulnerability where remap_file_pages bypassed W^X enforcement when using personality(READ_IMPLIES_EXEC) followed by a RW remap, due to the remap_file_pages path calling do_mmap() before the LSM security check. A fix adds a security_mmap_file LSM h...

CVE-2024-50036

CVE-2024-50036 is a Linux kernel vulnerability where dst_entries_add() uses per-CPU data that can be freed during netns dismantle, making dst_entries_destroy() race with dst_release() and potentially causing a use-after-free. The issue arises because the count of dsts must be decremented earlier,...

CVE-2024-50073

CVE-2024-50073: Linux kernel tty/n_gsm use-after-free in gsm_cleanup_mux (UAF on gsm_msg in gsm_mux tx lists). Unity Linux advisory confirms fix: protect gsm_msg by adding a gsm tx lock to prevent multi-threaded free via ioctl. Affects kernel 6.11.0+; patch details referenced in Unity/Nessus desc...

CVE-2024-50143

CVE-2024-50143 affects the Linux kernel; the udf subsystem introduced an uninitialized-value use in udf_get_fileshortad, mitigated by a fix that also checks for overflow when computing alen in udf_current_aext to address a KMSAN bug. The patch prevents triggering issues after application, and pub...

CVE-2024-53131

CVE-2024-53131 concerns the Linux kernel nilfs2 subsystem. The issue manifests as a NULL pointer dereference when the tracepoint block_touch_buffer is exercised from __nilfs_get_folio_block() via touch_buffer(), which accesses bh->b_bdev->bd_dev even if the buffer head lacks a valid block_d...

CVE-2024-53134

CVE-2024-53134 affects the Linux kernel, specifically the pmdomain: imx93-blk-ctrl path. The root cause is a faulty loop condition in the remove path: it used bc->onecell_data.num_domains instead of i onecell_data.num_domains, which can cause an infinite loop and kernel panic. The advisory ind...

CVE-2024-56776

Technical details for CVE-2024-56776 are not provided in the supplied connected documents. Public details are unavailable here. Action: monitor for updates from security advisories.

CVE-2024-57979

The CVE-2024-57979 entry is supported by connected documents detailing a Linux kernel use-after-free in pps during device teardown. The root cause is described as pps_device_destruct() freeing the pps_device immediately after cdev_del(), while fops from previously opened cdevs may still be callab...

CVE-2025-38416

Mode C: CVE-2025-38416 affects the Linux kernel NFC: nci: uart path. The vulnerability arises from setting tty->disc_data before the NCI device open/driver request succeeds, creating a small window where the device may start sending data and leaving state inconsistent on error paths. The fix e...

CVE-2015-3331

CVE-2015-3331 affects the Linux kernel up to 3.19.2, where __driver_rfc4106_decrypt in arch/x86/crypto/aesni-intel_glue.c mishandles memory locations for encrypted data, enabling a context-dependent attacker to trigger a buffer overflow via a crypto API call (e.g., with a libkcapi test program us...

CVE-2016-4565

CVE-2016-4565 affects the Linux kernel InfiniBand (IB) stack prior to 4.5.3, where certain IB interfaces improperly rely on write() semantics via a uAPI interface. This could allow a local unprivileged user to cause a denial of service (kernel memory write) and potentially other impact/escalation...

CVE-2018-13099

CVE-2018-13099 concerns the Linux kernel fs/f2fs/inline.c up to version 4.4, where a denial of service can occur via an out-of-bounds memory access and BUG when a modified f2fs image contains an inline inode with an invalid reserved blkaddr. The connected Nessus advisories (Unity Linux) describe ...

CVE-2022-49294

CVE-2022-49294 affects the Linux kernel (drm/amd/display) and is caused by an unchecked modulo division that can read 0, leading to a divide-by-zero panic. The available connected documents confirm the root cause and indicate a fix in the kernel to check for modulo == 0 before dividing. The explo...

CVE-2023-3006

CVE-2023-3006 describes a Spectre-BHB (Branch History Injection) cache-speculation vulnerability affecting AmpereOne hardware. Malicious code can use the CPU Branch History Buffer to influence mispredicted branches, triggering speculative execution that leads to cache allocation and potential inf...

CVE-2023-51043

CVE-2023-51043 affects the Linux kernel prior to 6.4.5. The issue is a use-after-free in drivers/gpu/drm/drm_atomic.c caused by a race between a nonblocking atomic commit and a driver unload. The vulnerability results in a potentially exploitable crash if a race occurs during unload while a nonbl...

CVE-2023-52598

CVE-2023-52598 concerns the Linux kernel (s390/ptrace) where an incorrect handling of the fpc register during ptrace can corrupt fp/vx state of the tracing process. The root cause is that when a traced process’s fpc value is validated, it is temporarily loaded into the fpc register, and the trace...

CVE-2024-26669

CVE-2024-26669 (Linux kernel net/sched: flower) The issue arises when deleting a qdisc on a device using flower: the stack replays filter removals but does not send a FLOW_CLS_TMPLT_DESTROY for chain templates, causing a memory leak. The fix adds a new tmplt_reoffload operation and lets the stack...

CVE-2024-26837

CVE-2024-26837 affects the Linux kernel MDB offload replay handling. A race between generating the replay list and new MDB memberships could cause duplicates of a single event, leaving hardware-mounted memberships orphaned on bridge destruction. The fix guards MDB replay against deferred events ...

CVE-2024-26907

CVE-2024-26907 affects the Linux kernel in the RDMA mlx5 stack. The vulnerability arises from a fortify source warning caused by a field-spanning write to eseg->inline_hdr.start in wr.c (memcpy path) during mlx5_ib_post_send, potentially enabling a local issue if exploited. Affected components...

CVE-2024-27019

CVE-2024-27019 affects the Linux kernel nf_tables component via a data race in __nft_obj_type_get() when nft_unregister_obj() runs concurrently with the iteration over nf_tables_objects. The fix is to iterate nf_tables_objects with list_for_each_entry_rcu() and to protect the entire type query wi...

CVE-2024-27062

CVE-2024-27062 : In the Linux kernel, the nouveau module (nvkm) has a race condition due to missing locking around the client object tree when adding/removing client objects (notably VRAM bar mappings). This can trigger a general protection fault as vulnerabilities are exercised via nvkm_object_s...

CVE-2024-35805

CVE-2024-35805 affects the Linux kernel in the dm snapshot code path. The issue was a lockup when exiting a snapshot with many exceptions, resolved by adding a cond_resched in the loop that frees the exceptions in dm_exception_table_exit. The root cause is a lockup during exit of large dm-snapsho...

CVE-2024-40954

The CVE-2024-40954 entry concerns a Linux kernel UAF: a dangling sk pointer may be created on socket creation failure when an fentry probe hits __sock_release() and bpf_get_socket_cookie() is invoked, enabling a use-after-free in __sock_gen_cookie. Reproducing scenario described via traceroute -I...

CVE-2024-41014

The CVE CVE-2024-41014 affects the Linux kernel (xfs) and is caused by insufficient bounds checking in xlog_recover_process_data, specifically verifying the space for fixed members of xlog_op_header. A crafted XFS image can trigger an out-of-bounds read by altering the xlog_op_header and xlog_rec...

CVE-2024-41060

CVE-2024-41060 is a Linux kernel security issue in the DRM Radeon driver. The root cause is a dereference of bo_va->bo that may be cleared by radeon_vm_clear_freed. The patch adds a NULL check to ensure bo_va->bo is non-NULL before use, preventing a potential NULL dereference crash. The des...