CVE-2025-21785

The CVE-2025-21785 issue is in the Linux kernel (arm64) cacheinfo handling. A loop that detects/populates cache information previously did a bounds check on the array size but did not account for cache levels with separate data/instructions caches, allowing an out-of-bounds write to the cacheinfo...

CVE-2024-43830

CVE-2024-43830 : Linux kernel vulnerability in leds: trigger race. The issue arises when unregistering trigger sysfs attributes after deactivate(), creating a window where trigger-data could be referenced post-free. The documented fix moves device_remove_groups() to before deactivate(), ensuring ...

CVE-2024-53124

CVE-2024-53124 affects the Linux kernel net subsystem, specifically data races around sk->sk_forward_alloc. The provided documents show that two threads can call tcp_v6_do_rcv()/sk_forward_alloc_add() concurrently when sk->sk_state == TCP_LISTEN and sk->sk_lock is unlocked, leading to a ...

CVE-2024-56756

The CVE-2024-56756 issue occurs in the Linux kernel’s nvme-pci driver, where the HMB descriptor table could be freed with an incorrect size. The root cause is that __nvme_alloc_host_mem might exit earlier on memory allocation failure and end up using fewer descriptors than planned, causing an inc...

CVE-2011-1495

CVE-2011-1495 affects the Linux kernel up to 2.6.38, in drivers/scsi/mpt2sas/mpt2sas_ctl.c. The issue arises because length and offset values are not validated before memory copy operations, potentially allowing a local user to gain privileges, cause memory corruption (DoS), or read sensitive ker...

CVE-2016-4565

CVE-2016-4565 affects the Linux kernel InfiniBand (IB) stack prior to 4.5.3, where certain IB interfaces improperly rely on write() semantics via a uAPI interface. This could allow a local unprivileged user to cause a denial of service (kernel memory write) and potentially other impact/escalation...

CVE-2017-5577

CVE-2017-5577 affects the Linux kernel VideoCore DRM vc4 driver. The vc4_get_bcl function in vc4_gem.c can encounter overflow while handling size values in VC4_SUBMIT_CL, and does not set an errno value, which can lead to an incorrect pointer dereference and a kernel OOPS, causing a denial of ser...

CVE-2017-7477

CVE-2017-7477 affects the Linux kernel MACsec driver (drivers/net/macsec.c) up to version 4.10.12. It is a heap-based buffer overflow triggered by using MAX_SKB_FRAGS+1 with NETIF_F_FRAGLIST, causing denial of service and potentially other unspecified impacts via skb_to_sgvec. Public details in c...

CVE-2017-7616

CVE-2017-7616 affects the Linux kernel (mm/mempolicy.c) where incorrect error handling in set_mempolicy/mbind compat syscalls can leak uninitialized stack data to local attackers. The issue is documented across multiple advisories (e.g., Debian, CentOS, Cloud Foundry) and is mitigated by updating...

CVE-2018-13096

CVE-2018-13096 : A vulnerability in the Linux kernel (fs/f2fs/super.c) up to version 4.14 allows a denial of service via out-of-bounds memory access when mounting a crafted f2fs image. The issue occurs on abnormal bitmap sizes and can trigger a BUG. The connected Nessus advisories reiterate this ...

CVE-2019-19048

CVE-2019-19048 corresponds to a memory leak in the Linux kernel’s crypto_reportstat() path inside drivers/virt/vboxguest/vboxguest_utils.c, before 5.3.9. The issue arises when copy_form_user() fails, enabling a denial of service via memory exhaustion. The connected Nessus advisories (Unity Linux ...

CVE-2019-19318

The CVE-2019-19318 issue affects Linux kernel 5.3.11. Root cause: mounting a crafted btrfs image twice can trigger a use-after-free in rwsem_down_write_slowpath because rwsem_can_spin_on_owner’s rwsem_owner_flags returns an already freed pointer. Documented impact per sources indicates an availab...

CVE-2023-52522

CVE-2023-52522 is a Linux kernel issue addressed in the Astra Linux advisory: a store tearing race in neigh_periodic_work() when deleting an RCUP item from a list. The fix requires proper RCUs handling on the writer side, specifically using either rcu_assign_pointer() (to enable lockdep support, ...

CVE-2024-26638

CVE-2024-26638 affects Linux kernel nbd: the patch fixes a KMSAN warning by always zero-initializing the msghdr structure (preventing uninitialized fields like msg_get_inq from leaking into recv paths). The issue arises because several recent msghdr fields could be left with indeterminate values,...

CVE-2024-26686

CVE-2024-26686 refers to a Linux kernel issue where lock_task_sighand could trigger a hard lockup if NR_CPUS threads execute do_task_stat concurrently while a process has NR_THREADS. The fix changes do_task_stat() to gather thread/child statistics using sig->stats_lock outside the sighand lock...

CVE-2024-35807

CVE-2024-35807 pertains to a Linux kernel ext4 online resize corruption when resizing a filesystem larger than 16 TiB with 4k blocks. The issue occurs during on-line resize across an 8 GiB boundary, affecting the backup block group descriptor for non-meta_bg layouts and can corrupt data. The root...

CVE-2024-36288

CVE-2024-36288 affects the Linux kernel SUNRPC path. The bug is in gss_free_in_token_pages(): the in_token->pages[] array is not NULL-terminated, which can trigger a KASAN memory access issue (wild-memory-access) and, per references, contributes to a high-severity impact. Connected advisories/...

CVE-2024-42159

The CVE-2024-42159 entry corresponds to a Linux kernel vulnerability in the SCSI mpi3mr driver where values stored in mr_sas_port->phy_mask could exceed the field size, risking improper handling and potential memory corruption. Public advisories (ALAS/Red Hat/Debian) list the fixed kernel upda...

CVE-2024-46791

CVE-2024-46791 concerns the Linux kernel, where a deadlock can occur in the MCP251X CAN driver if an interrupt arrives while mcp251x_open holds priv->mcp_lock. The root cause is that mcp251x_hw_wake() disables interrupts with the mutex still held, causing the interrupt handler to deadlock when...

CVE-2024-49860

CVE-2024-49860 relates to the Linux kernel ACPI subsystem, specifically the sysfs path and the _STR method. The vulnerability arises when the _STR method returns a value that is not a buffer object; only buffers are valid, and returning other data types can cause description_show() to access inva...

CVE-2025-21718

CVE-2025-21718 affects the Linux kernel Rose timer handling. The issue arises when Rose timers acquire only the socket spinlock and do not verify socket ownership, enabling a race against user threads. The described fix adds a socket ownership check and rearms timers as needed, addressing a KASAN...

CVE-2016-7425

CVE-2016-7425 affects the Linux kernel component arcmsr_iop_message_xfer in drivers/scsi/arcmsr/arcmsr_hba.c. The vulnerability arises because a length field is not properly restricted, enabling a local user to trigger a heap-based buffer overflow via the ARCMSR_MESSAGE_WRITE_WQBUFFER control cod...

CVE-2019-19813

CVE-2019-19813 is a Linux kernel use-after-free in __mutex_lock on Linux kernel 5.0.21 when mounting a crafted btrfs image, performing operations, and calling syncfs, related to mutex_can_spin_on_owner, __btrfs_qgroup_free_meta, and btrfs_insert_delayed_items. It is a local, user-interaction-requ...

CVE-2022-1199

CVE-2022-1199 is a Linux kernel flaw that can crash the kernel via user-space activity simulating amateur radio, producing a NULL pointer dereference and a use-after-free. The connected Astra Linux bulletin confirms the same vulnerability details and, for mitigating environments, Siemens’ accompa...

CVE-2022-49294

CVE-2022-49294 affects the Linux kernel (drm/amd/display) and is caused by an unchecked modulo division that can read 0, leading to a divide-by-zero panic. The available connected documents confirm the root cause and indicate a fix in the kernel to check for modulo == 0 before dividing. The explo...

CVE-2023-1078

CVE-2023-1078 affects the Linux kernel RDS implementation. The flaw is caused by rds_rm_zerocopy_callback() using list_entry() on the head of a list, causing a type confusion where a pointer of type struct rds_msg_zcopy_info *info may actually refer to something else controlled by a local user. T...

CVE-2023-51780

CVE-2023-51780: Linux kernel before 6.6.8 contains a use-after-free in do_vcc_ioctl (net/atm/ioctl.c) caused by a vcc_recvmsg race, enabling local exploitation. Affected: Linux kernel versions prior to 6.6.8. Root cause: race between vcc_recvmsg and do_vcc_ioctl leading to use-after-free. Impact:...

CVE-2023-52565

CVE-2023-52565 is a Linux kernel vulnerability affecting the media: uvcvideo subsystem. The issue is an out-of-bounds read in uvc_query_v4l2_menu() when the user-provided index exceeds the mask size, potentially allowing reading memory outside the intended bounds. The connected MiracleLinux advis...

CVE-2024-26678

CVE-2024-26678 affects the Linux kernel’s x86/efistub pathway. The vulnerability arises from using a 1:1 file:memory mapping for the PE/COFF .compat section, which is an 8-byte dummy section containing the 32-bit entrypoint address of a 64-bit kernel image when booted from 32-bit firmware (CONFIG...

CVE-2024-26773

CVE-2024-26773: The Linux kernel ext4 block allocator vulnerability is resolved. The fix prevents allocating blocks from a group whose block bitmap is corrupted during concurrent operations by verifying the group bitmap integrity before using ac_b_ex in ext4_mb_try_best_found(), and by guarding t...

CVE-2024-26779

CVE-2024-26779 affects the Linux kernel wifi/mac80211 subsystem. A race condition occurs when enabling fast-xmit before the station is uploaded to the driver, potentially passing an not-yet-uploaded STA via drv_tx to the driver and causing crashes due to uninitialized drv_priv data. The fix adds ...

CVE-2024-27062

CVE-2024-27062 : In the Linux kernel, the nouveau module (nvkm) has a race condition due to missing locking around the client object tree when adding/removing client objects (notably VRAM bar mappings). This can trigger a general protection fault as vulnerabilities are exercised via nvkm_object_s...

CVE-2024-35854

CVE-2024-35854 : In the Linux kernel, the mlxsw: spectrum_acl_tcam component could trigger a use-after-free during rehash. The root cause is destruction of a region that still has filters when migration can fail (despite non-negative credits), leading to OOB/dereference via use-after-free. The fi...

CVE-2024-35905

CVE-2024-35905 is a Linux kernel issue where a patch re-introduced protection against negative stack-access sizes in BPF code. The fix guards against out-of-bounds accesses in check_stack_range_initialized() when an access size can overflow its signed int representation. The vulnerability was mit...

CVE-2024-35925

The CVE-2024-35925 issue concerns the Linux kernel blk_rq_stat_sum() path. The root cause is a potential division by zero when computing stats, caused by the expression dst->nr_samples + src->nr_samples reaching zero due to overflow. Multiple connected advisories (Unity Linux security updat...

CVE-2024-36960

The CVE-2024-36960 entry maps to a Linux kernel issue in drm/vmwgfx where the length field for drm_event was incorrectly set to the parent structure, causing out-of-bounds reads when drm_read copies events to userspace. The provided documents confirm the root cause and fix: set drm_event length t...

CVE-2024-38555

CVE-2024-38555: In the Linux kernel, the net/mlx5 driver fixes a use-after-free by discarding FW command completions arriving during an internal error state. The patch prevents calling the completion handler when the device will flush the command interface, avoiding use-after-free/refcount underf...

CVE-2024-42082

CVE-2024-42082 is a Linux kernel vulnerability where a syzkaller-triggered WARN was introduced in __xdp_reg_mem_model() when __mem_id_init_hash_table() failed. The issue arose only from memory allocation failure; a static const rhashtable_params prevented rhashtable_init() misconfiguration. The w...

CVE-2024-49960

CVE-2024-49960 concerns ext4 on the Linux kernel. The issue is a timer use-after-free during failed mounts: the s_err_report timer can remain active while sbi is freed, because ext4_handle_error re-arms the timer before kfree(sbi). The root cause is not canceling the s_err_report timer after ext4...

CVE-2024-49991

The CVE-2024-49991 issue affects the Linux kernel DRM/AMD stack: amdkfd_free_gtt_mem cleared the wrong pointer, causing a use-after-free when amdgpu_bo_unref resets the pointer. The patch passes the correct pointer reference to amdgpu_bo_unref to ensure the original pointer is NULL’d correctly. T...

CVE-2024-50151

Technical details about CVE-2024-50151 are not publicly provided in the connected documents. They mention an SMB2_IOCTL OOB issue in the CIFS client, but no affected versions, root-cause, or fix specifics are given here. Monitor for updates.

CVE-2024-56757

CVE-2024-56757 affects the Linux kernel btusb Mediatek driver; root cause is not releasing the special USB ISO data interface before unregistering the HCI device on USB disconnect, risking kernel panic. A fix has been implemented in the kernel (references to commits in stable trees); impact is lo...

CVE-2024-57890

CVE-2024-57890 affects the Linux kernel RDMA/uverbs path. The issue is an integer overflow in user-supplied values during multiplications: cmd.wqe_size * cmd.wr_count and cmd.sge_count * sizeof(struct ib_uverbs_sge). On 32‑bit systems these can overflow, and the result may wrap as it’s passed to ...

CVE-2016-10200

CVE-2016-10200 describes a race condition in the Linux kernel’s L2TPv3 IP Encapsulation feature that can allow a local user to escalate privileges or cause a denial of service via repeated bind() calls without correctly checking SOCK_ZAPPED status. The issue affects Linux kernels prior to 4.8.14,...

CVE-2017-5967

CVE-2017-5967 affects the Linux kernel: when CONFIG_TIMER_STATS is enabled, the time subsystem through kernel 4.9.9 allows a local attacker to reveal real PID values (outside of PID namespaces) by reading /proc/timer_list, via the print_timer path in kernel/time/timer_list.c and the __timer_stats...

CVE-2018-16276

CVE-2018-16276 concerns the Linux kernel, specifically the yurex_read function in drivers/usb/misc/yurex.c. The issue is a bounds-check vulnerability that could allow a local attacker with access to the system to crash the kernel or potentially escalate privileges. Affected code path is in the US...

CVE-2018-25020

Summary of CVE-2018-25020 (Linux kernel BPF): The vulnerability is in the BPF subsystem where a long jump over an instruction sequence can cause an overflow. It specifically affects the kernel's BPF implementations in files kernel/bpf/core.c and net/core/filter.c, for Linux kernels prior to 4.17....

CVE-2019-19039

CVE-2019-19039 is a Linux kernel vulnerability affecting btrfs: the function __btrfs_free_extent in fs/btrfs/extent-tree.c may trigger a path in btrfs_print_leaf during an ENOENT case, enabling a local attacker to obtain potentially sensitive information about register values via dmesg. The descr...

CVE-2021-47441

CVE-2021-47441 concerns the Linux kernel mlxsw thermal driver. The issue arises when cooling state is set above the driver’s maximum state (e.g., cur_state=18 while max_state=10), which triggers out-of-bounds memory accesses in thermal statistics code. The thermal maintainer indicates it is the d...

CVE-2022-48695

CVE-2022-48695 is a Linux kernel vulnerability in the scsi: mpt3sas driver that results in a use-after-free (refcount_t underflow) observed during controller reset. The issue is fixed in the kernel by the referenced commits listed in the connected sources. The vulnerability is described as a loca...