CVE-2024-36953

CVE-2024-36953 affects the Linux kernel KVM for arm64 with vgic-v2. The issue: vgic_v2_parse_attr() searches for a vCPU matching the CPUID and may receive a NULL from kvm_get_vcpu_by_id() if the ID is invalid. Unlike the safe GICv3 flow, the code did not verify the returned vCPU object. Affected ...

CVE-2024-38555

CVE-2024-38555: In the Linux kernel, the net/mlx5 driver fixes a use-after-free by discarding FW command completions arriving during an internal error state. The patch prevents calling the completion handler when the device will flush the command interface, avoiding use-after-free/refcount underf...

CVE-2024-42294

CVE-2024-42294 : The Azure/MiracleLinux and Linux kernel records describe a fix for a deadlock in the Linux kernel caused by blocking ABBA between sd_remove and sd_release. The issue arises when a SCSI/USB device is disconnected while the block/SD stack is mutexp-locked during device removal, lea...

CVE-2024-44987

Summary of CVE-2024-44987 (Linux kernel) : A use-after-free in ip6_send_skb() was reported by syzbot. After ip6_local_out() returns, dereferencing rt could occur without holding rcu_read_lock(), enabling a slab-use-after-free as shown in the kasan trace net/ipv6/ip6_output.c:1964. The issue is mi...

CVE-2024-50029

CVE-2024-50029 refers to a Linux kernel bug in Bluetooth handling. The issue is a use-after-free in hci_enhanced_setup_sync where the ACL connection can be destroyed while a cmd_sync is pending, leading to a KASAN slab-use-after-free in hci_enhanced_setup_sync. The description includes a trace sh...

CVE-2024-56623

The Linux kernel contains a use-after-free vulnerability within the scsi: qla2xxx driver during the unload process. The root cause is the simultaneous use of the UNLOADING flag and kthread_stop to signal the dpc_thread to terminate; if dpc_thread exits upon seeing the UNLOADING flag, a subsequent...

CVE-2024-56758

CVE-2024-56758 affects the Linux kernel (btrfs) and describes a race where, after folio unlock during relocation, another thread can modify the folio mapping before folio_lock() and lead to an invalid page, potentially causing a NULL pointer dereference during concurrent transaction aborts. The i...

CVE-2024-56767

CVE-2024-56767 affects the Linux kernel in dmaengine/at_xdmac where at_xdmac_memset_create_desc may return NULL, risking a null pointer dereference and a potential crash (availability impact). Connected sources confirm the issue in upstream kernel code and note patches/upgraded packages: e.g., De...

CVE-2025-38416

Mode C: CVE-2025-38416 affects the Linux kernel NFC: nci: uart path. The vulnerability arises from setting tty->disc_data before the NCI device open/driver request succeeds, creating a small window where the device may start sending data and leaving state inconsistent on error paths. The fix e...

CVE-2015-2925

The vulnerability CVE-2015-2925 affects the Linux kernel prior to 4.2.4, specifically the prepend_path function in fs/dcache.c. It allows a local attacker to bypass container protections by renaming a directory inside a bind mount, enabling a double-chroot-style escape. The impact is enabling pri...

CVE-2015-8956

CVE-2015-8956 detailed in connected sources: The Linux kernel’s rfcomm_sock_bind in net/bluetooth/rfcomm/sock.c, vulnerable before 4.2, may allow a local attacker to obtain sensitive information or cause a denial of service (NULL pointer dereference) via a bind system call on a Bluetooth RFCOMM s...

CVE-2017-17864

CVE-2017-17864 affects the Linux kernel up to version 4.14.8, specifically the BPF verifier code (kernel/bpf/verifier.c). The root cause is a mishandling of states_equal comparisons between the pointer data type and the UNKNOWN_VALUE data type, which can allow a local user to leak potentially sen...

CVE-2019-19535

CVE-2019-19535 affects the Linux kernel up to 5.2.8 via the PCAN-USB FD driver (drivers/net/can/usb/peak_usb/pcan_usb_fd.c). A malicious USB device can trigger an info-leak in this driver (CID-30a8beeb3042), causing partial information disclosure. Affected product: Linux kernel before 5.2.9; vuln...

CVE-2022-49294

CVE-2022-49294 affects the Linux kernel (drm/amd/display) and is caused by an unchecked modulo division that can read 0, leading to a divide-by-zero panic. The available connected documents confirm the root cause and indicate a fix in the kernel to check for modulo == 0 before dividing. The explo...

CVE-2022-49753

A vulnerability exists in the Linux kernel within the dmaengine component. The issue is caused by a double increment of the client_count in the dma_chan_get() function for public channels, where the count is incorrectly incremented first in balance_ref_count() and again before the function return...

CVE-2023-52581

The Linux kernel contains a memory leak vulnerability in netfilter: nf_tables . The issue occurs when more than 255 elements expire, as a u8 type wraps before reaching the boundary, causing the system to recycle the initial gc container structure and lose track of preceding elements. A local auth...

CVE-2024-35854

CVE-2024-35854 : In the Linux kernel, the mlxsw: spectrum_acl_tcam component could trigger a use-after-free during rehash. The root cause is destruction of a region that still has filters when migration can fail (despite non-negative credits), leading to OOB/dereference via use-after-free. The fi...

CVE-2024-35869

CVE-2024-35869 affects the Linux kernel SMB client code path. The issue is described as a fix to guarantee that all children from the parent SMB session (@tcon->ses) are refcounted when walking DFS referrals, mounting, or performing DFS failover. The underlying problem was potential use-after-...

CVE-2024-36927

The CVE-2024-36927 issue is in the Linux kernel IPv4 path: uninit-value access in __ip_make_skb() due to a race with HDRINCL. The fix checks FLOWI_FLAG_KNOWN_NH on fl4->flowi4_flags instead of socket HDRINCL, and explicitly initializes fl4_icmp_type and fl4_icmp_code in raw_sendmsg() (the fiel...

CVE-2024-36960

The CVE-2024-36960 entry maps to a Linux kernel issue in drm/vmwgfx where the length field for drm_event was incorrectly set to the parent structure, causing out-of-bounds reads when drm_read copies events to userspace. The provided documents confirm the root cause and fix: set drm_event length t...

CVE-2024-40958

CVE-2024-40958 relates to the Linux kernel: get_net_ns() may perform a refcount increment on a net namespace with zero refcount, triggering a use-after-free warning and potential kernel panic. The root cause is an addition on 0 refcount via get_net_ns(), surfaced during operations like netns swit...

CVE-2024-40998

CVE-2024-40998 — Normal (details provided) Affects Linux kernel ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super(). The root cause is registering sysfs before s_msg_ratelimit_state.lock is initialized, allowing concurrent updates to rs->interval (non-zero) to trigge...

CVE-2024-47711

Technical details about CVE-2024-47711 (affected products, impact, and fixes) are not provided in the supplied documents. Monitor official advisories and vendor patches for updates.

CVE-2024-49860

CVE-2024-49860 relates to the Linux kernel ACPI subsystem, specifically the sysfs path and the _STR method. The vulnerability arises when the _STR method returns a value that is not a buffer object; only buffers are valid, and returning other data types can cause description_show() to access inva...

CVE-2024-49882

CVE-2024-49882 : In the Linux kernel’s ext4 code, a double free/UAF issue was fixed in ext4_ext_try_to_merge_up() where path[1].p_bh could be freed twice if not NULL after release. The problem manifested as a warning “brelse a buffer twice” during writeback when ext4 extents were merged and buffe...

CVE-2024-49894

CVE-2024-49894 : Linux kernel DRM/AMD display degamma translation had an index-out-of-bounds in cm_helper_translate_curve_to_degamma_hw_format when i exceeded TRANSFER_FUNC_POINTS. A bounds check was added to ensure i stays within transfer function points; otherwise the function returns an error....

CVE-2024-50301

CVE-2024-50301 is a Linux kernel vulnerability: slab-out-of-bounds in key_task_permission within security/keys, leading to a read as observed by KASAN and reported under stress-ng conditions. The issue stems from key management logic in the kernel keys subsystem; multiple advisories (ALAS2, ALAS2...

CVE-2024-53208

CVE-2024-53208 is a slab-use-after-free in Bluetooth MGMT set_powered_sync in the Linux kernel. Noise in the Miracle/SUSE advisories confirms the issue and lists it among fixed items in kernel live patches for SLES SLE 15 SPx. Remediation: upgrade/apply the kernel live patch referenced in SUSE/SO...

CVE-2017-17806

CVE-2017-17806 affects the Linux kernel before 4.14.8. The HMAC implementation (crypto/hmac.c) does not validate that the underlying hash algorithm is unkeyed, allowing a local attacker who can use the AF_ALG-based hash interface (CONFIG_CRYPTO_USER_API_HASH) and SHA-3 (CONFIG_CRYPTO_SHA3) to tri...

CVE-2019-19048

CVE-2019-19048 corresponds to a memory leak in the Linux kernel’s crypto_reportstat() path inside drivers/virt/vboxguest/vboxguest_utils.c, before 5.3.9. The issue arises when copy_form_user() fails, enabling a denial of service via memory exhaustion. The connected Nessus advisories (Unity Linux ...

CVE-2019-19813

CVE-2019-19813 is a Linux kernel use-after-free in __mutex_lock on Linux kernel 5.0.21 when mounting a crafted btrfs image, performing operations, and calling syncfs, related to mutex_can_spin_on_owner, __btrfs_qgroup_free_meta, and btrfs_insert_delayed_items. It is a local, user-interaction-requ...

CVE-2023-51043

CVE-2023-51043 affects the Linux kernel prior to 6.4.5. The issue is a use-after-free in drivers/gpu/drm/drm_atomic.c caused by a race between a nonblocking atomic commit and a driver unload. The vulnerability results in a potentially exploitable crash if a race occurs during unload while a nonbl...

CVE-2024-26758

The Linux kernel contains a vulnerability in the drivers/md/md.c module where the md_check_recovery() function incorrectly ignores suspended arrays. Because mddev_suspend() does not stop the sync_thread , this logic error can prevent the thread from being unregistered, leading to a system hang . ...

CVE-2024-26801

CVE-2024-26801 (Linux kernel Bluetooth): In HCI_EV_HARDWARE_ERROR handling when the BT controller does not respond, the GPIO reset could free the hci_dev, causing a use-after-free in hci_error_reset. A patch has been released that maintains the hci_dev reference count during processing of the eve...

CVE-2024-26927

The Linux kernel has resolved a vulnerability in the ASoC: SOF component where a calculation involving head->full_size - head->header_size could cause an underflow . To mitigate this, the kernel now includes checks for negative values and upper bounds on firmware data. While the system gene...

CVE-2024-35905

CVE-2024-35905 is a Linux kernel issue where a patch re-introduced protection against negative stack-access sizes in BPF code. The fix guards against out-of-bounds accesses in check_stack_range_initialized() when an access size can overflow its signed int representation. The vulnerability was mit...

CVE-2024-41014

The CVE CVE-2024-41014 affects the Linux kernel (xfs) and is caused by insufficient bounds checking in xlog_recover_process_data, specifically verifying the space for fixed members of xlog_op_header. A crafted XFS image can trigger an out-of-bounds read by altering the xlog_op_header and xlog_rec...

CVE-2024-41064

CVE-2024-41064 concerns the Linux kernel: powerpc/eeh can crash if edev->pdev changes when a PCI device is removed during eeh_pe_report_edev(). The technical detail specified across connected sources is that the crash occurs due to improper handling of edev->pdev; the recommended remedy is ...

CVE-2024-42082

CVE-2024-42082 is a Linux kernel vulnerability where a syzkaller-triggered WARN was introduced in __xdp_reg_mem_model() when __mem_id_init_hash_table() failed. The issue arose only from memory allocation failure; a static const rhashtable_params prevented rhashtable_init() misconfiguration. The w...

CVE-2024-42283

The CVE-2024-42283 issue in the Linux kernel concerns net/nexthop: two reserved fields in the nexthop_grp were not initialized by nla_put_nh_group(), allowing garbage to leak from the kernel. The public description notes these fields are reserved and currently unused, but their non‑zero values ca...

CVE-2024-44946

CVE-2024-44946 (Linux kernel, KCM) has a confirmed UAF/double-free risk in kcm_release arising when one thread frees an skb still in the KCM write queue due to concurrent kcm_sendmsg() operations. The issue occurs when a thread building a MSG_MORE skb holds kcm->seq_skb while another thread co...

CVE-2024-50084

The Linux kernel contains a memory leak vulnerability in the net: microchip: vcap api component, specifically within the vcap_api_encode_rule_test() function. This issue was introduced by a previous fix (Commit a3c1e45156ad ) which resolved a use-after-free error but omitted the necessary vcap_fr...

CVE-2025-21802

CVE-2025-21802 is a Linux kernel issue affecting the networking driver path for hns3. The vulnerability arises during driver unload when the hclge path attempts to disable SR-IOV for each ae_dev in hnae3_ae_dev_list while the ae_dev list is being modified, which can cause an oops. The root cause ...

CVE-2025-21862

CVE-2025-21862 affects the Linux kernel drop_monitor path. Root cause: incorrect initialization order leading to a spinlock not being initialized if drop_monitor is loaded as a module, enabling a potential race during module loading. Impact: may cause instability or erroneous behavior in netlink/...

CVE-2016-2069

CVE-2016-2069 describes a race condition in arch/x86/mm/tlb.c of the Linux kernel that could allow local privilege escalation by a process triggering access to a paging structure on another CPU. The connected Nessus advisories confirm affected Linux kernel lines and reference Kernel versions befo...

CVE-2017-10911

Summary: CVE-2017-10911 affects the Linux kernel driver path drivers/block/xen-blkback/blkback.c, related to Xen block-interface responses (XSA-216). The vulnerability arises from copying uninitialized padding fields in Xen blkback response structures, which can let a guest OS user read host (or ...

CVE-2019-12984

CVE-2019-12984 is a NULL pointer dereference in the Linux kernel before 5.1.13, specifically in nfc_genl_deactivate_target() within net/nfc/netlink.c. A malicious user-mode program that omits certain NFC attributes can trigger this vulnerability, resulting in denial of service. Affected software ...

CVE-2023-28327

CVE-2023-28327 : A NULL pointer dereference in the Linux kernel’s UNIX protocol (net/unix/diag.c, function unix_diag_get_exact) occurs when the newly allocated skb is created without an associated sk, leaving a NULL sk pointer. This can allow a local attacker to crash the kernel or cause a denial...

CVE-2023-52598

CVE-2023-52598 concerns the Linux kernel (s390/ptrace) where an incorrect handling of the fpc register during ptrace can corrupt fp/vx state of the tracing process. The root cause is that when a traced process’s fpc value is validated, it is temporarily loaded into the fpc register, and the trace...

CVE-2023-6560

CVE-2023-6560 corresponds to an out-of-bounds memory access in the Linux kernel io_uring subsystem (SQ/CQ rings) that can allow a local user to crash the system. Affected component is the io_uring handling code, specifically the __io_uaddr_map() path. The vulnerability is local in scope with the ...