CVE-2024-50014

CVE-2024-50014 – Linux kernel ext4 replay path issue Affects: Linux kernel ext4 on systems using fast-commit enabled filesystems (replay path). Affected code path is ext4_fc_replay during journal replay; the replay path attempts to lock sbi->s_bdev_wb_lock before it has been initialized. Root ...

CVE-2024-50282

The connected Astra Linux entry clarifies CVE-2024-50282 in the Linux kernel: a missing size check in drm/amdgpu_debugfs_gprwave_read() can cause a buffer overflow when size > 4K. The fix (cherry-picked commit f5d873f5825b40d886d03bd2aede91d4cf002434) adds the size check to prevent overflow. N...

CVE-2024-53208

CVE-2024-53208 is a slab-use-after-free in Bluetooth MGMT set_powered_sync in the Linux kernel. Noise in the Miracle/SUSE advisories confirms the issue and lists it among fixed items in kernel live patches for SLES SLE 15 SPx. Remediation: upgrade/apply the kernel live patch referenced in SUSE/SO...

CVE-2024-58002

CVE-2024-58002 — Linux kernel vulnerability (as reported in Astra Linux bulletin): In media: uvcvideo, an async control writes a pointer to the file handle that started an operation. If the user closes the file descriptor before the device completes, that structure is freed and a dangling pointer...

CVE-2021-20261

CVE-2021-20261 is a local race-condition vulnerability in the Linux kernel floppy disk drive controller (fd0) driver. The issue’s impact is mitigated by default file permissions on /dev/fd0 being root-only; changes to device permissions can greatly increase risk. The initial description notes a l...

CVE-2022-49753

In the Linux kernel, the following vulnerability has been resolved: dmaengine: Fix double increment of client_count in dma_chan_get() The first time dma_chan_get() is called for a channel the channelclient_count is incorrectly incremented twice for public channels,first in balance_ref_count(), an...

CVE-2023-28327

CVE-2023-28327 : A NULL pointer dereference in the Linux kernel’s UNIX protocol (net/unix/diag.c, function unix_diag_get_exact) occurs when the newly allocated skb is created without an associated sk, leaving a NULL sk pointer. This can allow a local attacker to crash the kernel or cause a denial...

CVE-2024-23307

CVE-2024-23307 affects the Linux kernel (md, raid, raid5 modules) with an Integer Overflow or Wraparound vulnerability. The connected Astra/Linux bulletin reproduces the same description but provides no technical details or patch information in the supplied documents. No mitigation details are pr...

CVE-2024-35807

CVE-2024-35807 pertains to a Linux kernel ext4 online resize corruption when resizing a filesystem larger than 16 TiB with 4k blocks. The issue occurs during on-line resize across an 8 GiB boundary, affecting the backup block group descriptor for non-meta_bg layouts and can corrupt data. The root...

CVE-2024-35854

CVE-2024-35854 : In the Linux kernel, the mlxsw: spectrum_acl_tcam component could trigger a use-after-free during rehash. The root cause is destruction of a region that still has filters when migration can fail (despite non-negative credits), leading to OOB/dereference via use-after-free. The fi...

CVE-2024-36031

In the Linux kernel, the following vulnerability has been resolved: keys: Fix overwrite of key expiration on instantiation The expiry time of a key is unconditionally overwritten duringinstantiation, defaulting to turn it permanent. This causes a problemfor DNS resolution as the expiration set by...

CVE-2024-49960

CVE-2024-49960 concerns ext4 on the Linux kernel. The issue is a timer use-after-free during failed mounts: the s_err_report timer can remain active while sbi is freed, because ext4_handle_error re-arms the timer before kfree(sbi). The root cause is not canceling the s_err_report timer after ext4...

CVE-2025-21692

Summary: CVE-2025-21692 affects the Linux kernel net/sched ETS Qdisc, where ets_class_from_arg() can index an out-of-bounds ets_class when clid is 0, leading to an Out-Of-Bounds condition and potential local privilege escalation. The vulnerability is demonstrated in the provided trace and is link...

CVE-2025-21802

CVE-2025-21802 is a Linux kernel issue affecting the networking driver path for hns3. The vulnerability arises during driver unload when the hclge path attempts to disable SR-IOV for each ae_dev in hnae3_ae_dev_list while the ae_dev list is being modified, which can cause an oops. The root cause ...

CVE-2014-8134

CVE-2014-8134 affects the Linux kernel’s KVM paravirt code path (arch/x86/kernel/kvm.c, paravirt_ops_setup) through version 3.18. The root cause is an improper paravirt_enabled setting for KVM guest kernels, which could allow a guest user to bypass ASLR via a crafted application that reads a 16‑b...

CVE-2017-17450

CVE-2017-17450 affects the Linux kernel up to 4.14.4 in net/netfilter/xt_osf.c, where add_callback/remove_callback do not require CAP_NET_ADMIN, allowing local users to bypass intended access controls because xt_osf_fingers is shared across net namespaces. The vulnerability is rooted in privilege...

CVE-2017-5551

CVE-2017-5551 affects the Linux kernel; the simple_set_acl function in fs/posix_acl.c does not clear the setgid bit during a setxattr call on tmpfs, enabling a local user to gain group privileges if a setgid program exists with restricted execute permissions. This is tied to an incomplete fix of ...

CVE-2017-9242

CVE-2017-9242 affects the Linux kernel prior to a fix that corrects an out-of-order overwrite check in the IPv6 stack. The vulnerability stems from the __ip6_append_data function in net/ipv6/ip6_output.c, where the overwrite check is performed too late, allowing a local attacker to crash the syst...

CVE-2019-19531

CVE-2019-19531 affects the Linux kernel prior to 5.2.9. The issue is a use-after-free triggered by a malicious USB device in the drivers/usb/misc/yurex.c component (CID-fc05481b2fca). Exploitation would occur locally (physical access) via crafted USB input, with the kernel potentially resolving t...

CVE-2021-3923

CVE-2021-3923 describes a local information-leak in the Linux kernel RDMA over InfiniBand path. A privileged local attacker can leak kernel stack data when issuing commands to /dev/infiniband/rdma_cm, with the impact noting potential to defeat kernel protections. Remediation/fixes are not detaile...

CVE-2022-1516

CVE-2022-1516: A NULL pointer dereference in the Linux kernel’s X.25 protocol stack allows a local attacker to crash the system during session termination via a simulated Ethernet card. Connected sources consistently describe this flaw as a local (LOCAL) impact with no remote vector provided; no ...

CVE-2022-29156

The CVE-2022-29156 issue is a Linux kernel vulnerability: a double free in drivers/infiniband/ulp/rtrs/rtrs-clt.c (rtrs_clt_dev_release) present in kernels before 5.16.12. This is a local-attackable condition with high impact on confidentiality, integrity, and availability as reflected by CVSS. R...

CVE-2023-52803

The CVE-2023-52803 entry corresponds to a Linux kernel vulnerability: SUNRPC RPC client dereferenced freed pipefs dentries due to a mismatch of the current and original pipefs superblock during cleanup, potentially freeing dentries of the previously released pipefs. The issue occurs when a pipefs...

CVE-2024-26638

In the Linux kernel, the following vulnerability has been resolved: nbd: always initialize struct msghdr completely syzbot complains that msg->msg_get_inq value can be uninitialized [1] struct msghdr got many new fields recently, we should always makesure their values is zero by default. [1]BU...

CVE-2024-26675

CVE-2024-26675 (Linux kernel) affects the ppp_async path. The issue arises from MRU (Maximum Receive Unit) limits not being enforced for PPP async messages, which can trigger a warning in __alloc_pages via a memory/page allocation path when handling large skb allocations during PPP input. The des...

CVE-2024-26686

CVE-2024-26686 refers to a Linux kernel issue where lock_task_sighand could trigger a hard lockup if NR_CPUS threads execute do_task_stat concurrently while a process has NR_THREADS. The fix changes do_task_stat() to gather thread/child statistics using sig->stats_lock outside the sighand lock...

CVE-2024-35869

CVE-2024-35869 affects the Linux kernel SMB client code path. The issue is described as a fix to guarantee that all children from the parent SMB session (@tcon->ses) are refcounted when walking DFS referrals, mounting, or performing DFS failover. The underlying problem was potential use-after-...

CVE-2024-35905

CVE-2024-35905 is a Linux kernel issue where a patch re-introduced protection against negative stack-access sizes in BPF code. The fix guards against out-of-bounds accesses in check_stack_range_initialized() when an access size can overflow its signed int representation. The vulnerability was mit...

CVE-2024-35925

The CVE-2024-35925 issue concerns the Linux kernel blk_rq_stat_sum() path. The root cause is a potential division by zero when computing stats, caused by the expression dst->nr_samples + src->nr_samples reaching zero due to overflow. Multiple connected advisories (Unity Linux security updat...

CVE-2024-40958

CVE-2024-40958 relates to the Linux kernel: get_net_ns() may perform a refcount increment on a net namespace with zero refcount, triggering a use-after-free warning and potential kernel panic. The root cause is an addition on 0 refcount via get_net_ns(), surfaced during operations like netns swit...

CVE-2024-42082

CVE-2024-42082 is a Linux kernel vulnerability where a syzkaller-triggered WARN was introduced in __xdp_reg_mem_model() when __mem_id_init_hash_table() failed. The issue arose only from memory allocation failure; a static const rhashtable_params prevented rhashtable_init() misconfiguration. The w...

CVE-2024-42159

The CVE-2024-42159 entry corresponds to a Linux kernel vulnerability in the SCSI mpi3mr driver where values stored in mr_sas_port->phy_mask could exceed the field size, risking improper handling and potential memory corruption. Public advisories (ALAS/Red Hat/Debian) list the fixed kernel upda...

CVE-2024-42237

CVE-2024-42237 - Linux kernel cs_dsp payload length validation Affects: Linux kernel firmware cs_dsp loading paths (cs_dsp_load and cs_dsp_coeff_load).Cause: The block payload length could be used before validating the length, potentially enabling out-of-bounds processing.Fix: Move and perform th...

CVE-2024-42245

CVE-2024-42245 is a Linux kernel vulnerability resolved by reverting the patch that changed load balancing in sched/fair. The original change caused an O(n) detachment scan in detach_tasks() when many tasks on a CPU were pinned, and the load-balancer code runs with rq lock held (often in softirq ...

CVE-2024-53074

The CVE-2024-53074 issue affects the Linux kernel wireless stack (iwlwifi, mvm). The vulnerability arises from not releasing the link mapping resource when an AP is removed, leading to a leak of a link on AP removal. This specifically impacts devices that do not support the MLD API (9260 and earl...

CVE-2024-53161

CVE-2024-53161 is tied to the Linux kernel EDAC/bluefield issue: the 64-bit get-DIMM-info SMC argument used mem_ctrl_idx left-shifted by 16 and OR’d with the DIMM index; with mem_ctrl_idx treated as 32-bit this can truncate the upper 16 bits, risking data loss. The advisory states the mem_ctrl_id...

CVE-2024-57798

CVE-2024-57798 affects the Linux kernel drm_dp_mst handling of MST up requests. If another thread removes MST topology during processing, mst_primary could be freed and set to NULL, risking a NULL pointer dereference in drm_dp_mst_handle_up_req(). The fix is to hold a reference to mst_primary whi...

CVE-2025-21865

CVE-2025-21865 : In the Linux kernel, a list corruption scenario in gtp_net_exit_batch_rtnl() could trigger double dellink() on the same device when netns cleanup traverses multiple namespaces. The root cause is a for_each_netdev() loop that conflicts with existing netns destruction, enabling a p...

CVE-2025-21997

CVE-2025-21997 : In the Linux kernel, a vulnerability in the XDP socket (xsk) path fixes an integer overflow in xp_create_and_assign_umem(). Because i and pool->chunk_size are 32‑bit values, their product can wrap and be cast to 64‑bit, which may cause two distinct XDP buffers to point to the ...

CVE-2015-8830

CVE-2015-8830 is a Linux kernel vulnerability caused by an integer overflow in the aio_setup_single_vector path (fs/aio.c) when handling a large AIO iovec. The issue could allow a local attacker to cause a denial of service or potentially other impact, as described in the CVE entry and reflected ...

CVE-2015-8970

CVE-2015-8970 affects the Linux kernel prior to 4.4.2. The vulnerability is in crypto/algif_skcipher.c where a setkey operation on an AF_ALG socket may not be verified before an accept system call is processed, allowing a local attacker to trigger a NULL pointer dereference and system crash via a...

CVE-2018-12232

CVE-2018-12232: In the Linux kernel up to 4.17.1, there is a race between fchownat and close when targeting the same socket file descriptor. fchownat does not increment the file descriptor reference count, allowing close to set the socket to NULL during fchownat’s execution, causing a NULL pointe...

CVE-2021-26934

CVE-2021-26934 affects the Linux kernel versions 4.18 through 5.10.16 as used by Xen. The root cause is that the backend allocation (be-alloc) mode of the drm_xen_front drivers was not intended to be a supported configuration, but this was not clearly stated in its support status entry. Public do...

CVE-2021-47393

Summary for CVE-2021-47393 (Linux kernel): The mlxreg_fan hardware monitor driver (mlxsw_core) contains a defect where returning a non-zero error when the fan current state is enforced via sysfs prevents thermal statistics updates. This occurs in scenarios where a minimum fan speed is requested v...

CVE-2023-52683

CVE-2023-52683: Linux kernel ACPI LPIT integer-overflow in lpit_update_residency() (tsc_khz > UINT_MAX/1000) fixed by replacing a u32 multiplication with mul_u32_u32(). The MiracleLinux advisories (AXSA entries) reference this CVE among affected Linux kernel series and note remediation via ker...

CVE-2024-26631

CVE-2024-26631 (Linux kernel) : A data race was fixed in IPv6 multicast handling (ipv6_mc_down / mld_ifc_work) where idev->mc_ifc_count could be written without proper locking. The fix encapsulates calls to mld_ifc_stop_work() (and mld_gq_stop_work()) with mutex_lock()/mutex_unlock(), since th...

CVE-2024-26678

CVE-2024-26678 affects the Linux kernel’s x86/efistub pathway. The vulnerability arises from using a 1:1 file:memory mapping for the PE/COFF .compat section, which is an 8-byte dummy section containing the 32-bit entrypoint address of a 64-bit kernel image when booted from 32-bit firmware (CONFIG...

CVE-2024-37356

CVE-2024-37356 : In Linux kernel, the vulnerability is a shift-out-of-bounds in dctcp_update_alpha() triggered by setting dctcp_shift_g to large values (e.g., 100). The issue arises from alpha and delivered_ce computations using dctcp_shift_g, leading to an UBSAN shift-out-of-bounds and potential...

CVE-2024-41001

CVE-2024-41001: In the Linux kernel, io_uring/sqpoll may leak audit memory during connect handling due to path conditions in prep/issue auditing; a blanket NOP before SQPOLL mitigates this. The issue, rated CVSSv3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, is locally exploitable and impacts availabi...

CVE-2024-46797

CVE-2024-46797 : In the Linux kernel (PowerPC/MCS qspinlock), a deadlock can occur when an interrupt happens in queued_spin_lock_slowpath() after qnodesp->count is incremented but before node->lock is initialized. This can allow a CPU to see stale lock values and write the wrong qnode’s nex...