CVE-2024-50151

Technical details about CVE-2024-50151 are not publicly provided in the connected documents. They mention an SMB2_IOCTL OOB issue in the CIFS client, but no affected versions, root-cause, or fix specifics are given here. Monitor for updates.

CVE-2024-36020

The CVE-2024-36020 issue in the Linux kernel relates to the i40e driver: a VF pointer could be used uninitialized due to interchangeability of variables (v vs vf) introduced by a regression. A fix was implemented to remove redundant v, and to iterate using a single VF pointer across the affected ...

CVE-2024-36927

The CVE-2024-36927 issue is in the Linux kernel IPv4 path: uninit-value access in __ip_make_skb() due to a race with HDRINCL. The fix checks FLOWI_FLAG_KNOWN_NH on fl4->flowi4_flags instead of socket HDRINCL, and explicitly initializes fl4_icmp_type and fl4_icmp_code in raw_sendmsg() (the fiel...

CVE-2024-42237

CVE-2024-42237 - Linux kernel cs_dsp payload length validation Affects: Linux kernel firmware cs_dsp loading paths (cs_dsp_load and cs_dsp_coeff_load).Cause: The block payload length could be used before validating the length, potentially enabling out-of-bounds processing.Fix: Move and perform th...

CVE-2024-46868

In CVE-2024-46868, the Linux kernel firmware: qcom: uefisecapp fix addresses a deadlock in qcuefi_acquire: if the __qcuefi pointer isn’t set, the original code could hold the lock and deadlock when set later. The fix drops the lock on the error path to match caller expectations. Impact and exploi...

CVE-2024-56759

CVE-2024-56759 concerns the Linux kernel: when Btrfs COWs a tree block with tracing enabled (trace_btrfs_cow_block) and preemption is on, a use-after-free can occur on the COWed extent buffer. The root cause is that tracepoint handling could observe a buffer after it is freed via RCUs, if preempt...

CVE-2024-57890

CVE-2024-57890 affects the Linux kernel RDMA/uverbs path. The issue is an integer overflow in user-supplied values during multiplications: cmd.wqe_size * cmd.wr_count and cmd.sge_count * sizeof(struct ib_uverbs_sge). On 32‑bit systems these can overflow, and the result may wrap as it’s passed to ...

CVE-2025-21640

Summary of CVE-2025-21640 (Linux kernel SCTP): The vulnerability is in the Linux kernel SCTP sysctl handling for cookie_hmac_alg, linked to using current->nsproxy. The description notes that current->nsproxy can be NULL (e.g., when the current task is exiting), which can lead to an Oops (nu...

CVE-2025-21997

CVE-2025-21997 : In the Linux kernel, a vulnerability in the XDP socket (xsk) path fixes an integer overflow in xp_create_and_assign_umem(). Because i and pool->chunk_size are 32‑bit values, their product can wrap and be cast to 64‑bit, which may cause two distinct XDP buffers to point to the ...

CVE-2014-4943

CVE-2014-4943 affects the Linux kernel up to 3.15.6, specifically the PPPoL2TP feature in net/l2tp/l2tp_ppp.c. The vulnerability arises from data-structure differences between an l2tp socket and an inet socket, enabling local privilege escalation. Public details in connected sources include PoC/e...

CVE-2015-8543

CVE-2015-8543 affects the Linux kernel networking stack (up to version 4.3.3 as used in Android and others). The issue: the networking implementation does not validate protocol identifiers for certain protocol families, enabling local users to cause a NULL pointer dereference and system crash, wi...

CVE-2016-7097

CVE-2016-7097 is a Linux kernel vulnerability in which the setgid bit was not cleared during setxattr, allowing local users to gain group privileges if a setgid executable exists with restricted execute permissions. The issue is reported across the Linux filesystem/ACL handling and was addressed ...

CVE-2017-14489

CVE-2017-14489 affects the Linux kernel iSCSI transport (drivers/scsi/scsi_transport_iscsi.c: iscsi_if_rx). The root cause is incorrect length validation, enabling a local authenticated attacker to trigger a denial of service (kernel panic) or memory corruption. Affected as of kernel versions up ...

CVE-2022-49647

CVE-2022-49647 affects the Linux kernel cgroups migration code. The vulnerability stems from overloading cset->mg_preload_node for both src and dst preload lists during task migrations, which could allow a cset to be simultaneously sourced and destined, risking a use-after-free if all tasks le...

CVE-2023-28866

The CVE-2023-28866 issue affects the Linux kernel up to 6.2.8, specifically net/bluetooth/hci_sync.c, where amp_init1[] and amp_init2[] were intended to include an invalid element but do not, enabling out-of-bounds access. The documented CVSS shows Network access with low attack complexity and no...

CVE-2024-26898

Summary: CVE-2024-26898 relates to the AoE driver in the Linux kernel where aoecmd_cfg_pkts() incorrectly handled the refcnt of net_device, enabling a potential use-after-free via racing with tx paths. The issue has been resolved by patch f98364e92662, which stops calling dev_put(ifp) in the succ...

CVE-2024-35835

CVE-2024-35835 concerns the Linux kernel net/mlx5e subsystem, where arfs_create_groups has a double-free: if kvzalloc allocation for in fails, arfs_create_groups frees ft->g and returns an error, but arfs_create_table (the caller) then invokes mlx5e_destroy_flow_table, causing ft->g to be f...

CVE-2024-35904

CVE-2024-35904 relates to a Linux kernel fix for SELinux: avoid dereferencing a garbage pointer after a mount failure. The patch ensures that when kern_mount() fails, the code returns in the error branch instead of continuing, preventing dereferencing the error pointer, and it drops the selinuxfs...

CVE-2024-35958

CVE-2024-35958 (Linux kernel, net: ena) fixes an incorrect descriptor free behavior in ENA TX queues. There are two queue types: (1) TX packets from the network stack and (2) TX packets redirected/forwarded by XDP. The bug caused ena_free_tx_bufs() to free descriptors assuming the first category,...

CVE-2024-42271

CVE-2024-42271 affects the Linux kernel’s IUCV subsystem. The issue is a use-after-free in iucv_sock_close() and iucv_sever_path() caused by a race on severing the path, with iucv_path_sever being called from both process and bh contexts. Without atomic compare-and-swap, a window may exist where ...

CVE-2024-50014

CVE-2024-50014 – Linux kernel ext4 replay path issue Affects: Linux kernel ext4 on systems using fast-commit enabled filesystems (replay path). Affected code path is ext4_fc_replay during journal replay; the replay path attempts to lock sbi->s_bdev_wb_lock before it has been initialized. Root ...

CVE-2024-53120

CVE-2024-53120 concerns the Linux kernel net/mlx5e offload code (mlx5_core). In the error path of mlx5_tc_ct_entry_add_rule(), if ct_rule_add() returns an error, zone_rule->attr is used uninitialized, causing a NULL pointer dereference. The fix uses attr (with the required pointer value) inste...

CVE-2024-53140

CVE-2024-53140 affects the Linux kernel netlink dump path. The vulnerability arises because dumps can be left incomplete if a user closes the netlink socket, and the prior cleanup deferred via a workqueue could end up releasing a socket reference still in an unsafe state. The fix removes the work...

CVE-2024-53237

CVE-2024-53237 is a Linux kernel vulnerability describing a use-after-free in the Bluetooth device lifecycle, specifically in the function device_for_each_child. The issue was surfaced by KASAN and tied to a scenario where a parent device could be freed while a child device still holds a referenc...

CVE-2024-58002

CVE-2024-58002 — Linux kernel vulnerability (as reported in Astra Linux bulletin): In media: uvcvideo, an async control writes a pointer to the file handle that started an operation. If the user closes the file descriptor before the device completes, that structure is freed and a dangling pointer...

CVE-2025-21802

CVE-2025-21802 is a Linux kernel issue affecting the networking driver path for hns3. The vulnerability arises during driver unload when the hclge path attempts to disable SR-IOV for each ae_dev in hnae3_ae_dev_list while the ae_dev list is being modified, which can cause an oops. The root cause ...

CVE-2015-8215

CVE-2015-8215 concerns the Linux kernel IPv6 stack (net/ipv6/addrconf.c) where MTU validation is missing. This affects kernel versions before 4.0 and can enable a context-dependent attacker to trigger packet loss through Router Advertisement processing, as the MTU value may be invalid (either bel...

CVE-2017-12188

CVE-2017-12188 affects arch/x86/kvm/mmu.c in the Linux kernel up to 4.13.5 where nested virtualization can mis-traverse guest page tables, enabling L1 guests to run arbitrary host code or trigger host denial of service. Connected advisories ( MiracleLinux AXSA-2018-2625, Unity Linux UTSA advisori...

CVE-2019-19531

CVE-2019-19531 affects the Linux kernel prior to 5.2.9. The issue is a use-after-free triggered by a malicious USB device in the drivers/usb/misc/yurex.c component (CID-fc05481b2fca). Exploitation would occur locally (physical access) via crafted USB input, with the kernel potentially resolving t...

CVE-2022-48701

The CVE-2022-48701 issue is in the Linux kernel ALSA usb-audio driver: an out-of-bounds read can occur in __snd_usb_parse_audio_interface() when parsing a USB device (USB ID 0x04fa:0x4201) that has fewer than 4 interfaces. The fix is to validate the interface count before parsing. Public referenc...

CVE-2024-26631

CVE-2024-26631 (Linux kernel) : A data race was fixed in IPv6 multicast handling (ipv6_mc_down / mld_ifc_work) where idev->mc_ifc_count could be written without proper locking. The fix encapsulates calls to mld_ifc_stop_work() (and mld_gq_stop_work()) with mutex_lock()/mutex_unlock(), since th...

CVE-2024-26801

CVE-2024-26801 (Linux kernel Bluetooth): In HCI_EV_HARDWARE_ERROR handling when the BT controller does not respond, the GPIO reset could free the hci_dev, causing a use-after-free in hci_error_reset. A patch has been released that maintains the hci_dev reference count during processing of the eve...

CVE-2024-26826

CVE-2024-26826 (Linux kernel, MPTCP) : The issue occurs when a subflow becomes stale in MPTCP; the data re-injection step incorrectly uses a TCP-specific helper on an MPTCP socket, making the RTX queue check for any unacked data unreliable and potentially causing improper re-injection of mptcp-le...

CVE-2024-26843

CVE-2024-26843: In the Linux kernel, the EFI runtime subsystem had a fix for a potential overflow in the soft-reserved region size. Specifically, md_size could be narrowed when there are >= 4 GiB worth of pages in a soft-reserved region. The vulnerability is reported as a local vulnerability w...

CVE-2024-35864

CVE-2024-35864 is a Linux kernel SMB client issue. The root cause is a use-after-free in smb2_is_valid_lease_break() that can occur while handling SMB2 lease breaks, with sessions in SES_EXITING state skipped to avoid UAF. The vulnerability is linked to local attack vectors and a highImpact scena...

CVE-2024-35939

CVE-2024-35939 : The Linux kernel vulnerability in the dma-direct path leaks pages on dma_set_decrypted() failure, allowing a local attacker to cause a denial of service by leaking memory rather than freeing it. Affected component: dma-direct in the Linux kernel (TDX context noted). Conditions: a...

CVE-2024-36945

CVE-2024-36945 (Linux kernel, net/smc): The issue is a refcount leak in smc_ib_find_route() where neighbours from neigh_lookup() and rtables from ip_route_output_flow() were not released before function return. The leak is fixed by ensuring proper release/put of the neighbour and rtable before ex...

CVE-2024-37356

CVE-2024-37356 : In Linux kernel, the vulnerability is a shift-out-of-bounds in dctcp_update_alpha() triggered by setting dctcp_shift_g to large values (e.g., 100). The issue arises from alpha and delivered_ce computations using dctcp_shift_g, leading to an UBSAN shift-out-of-bounds and potential...

CVE-2024-38581

CVE-2024-38581 : Linux kernel vulnerability affecting the AMDGPU MES path. The issue is a use-after-free in drm/amdgpu/mes triggered by the ramdom use-after-free caused by the fence fallback timer. The fix deletes the fence fallback timer to resolve the issue, and this change moved to amdgpu_mes....

CVE-2024-53074

The CVE-2024-53074 issue affects the Linux kernel wireless stack (iwlwifi, mvm). The vulnerability arises from not releasing the link mapping resource when an AP is removed, leading to a leak of a link on AP removal. This specifically impacts devices that do not support the MLD API (9260 and earl...

CVE-2025-39728

The CVE-2025-39728 issue is in the Linux kernel clock framework for Samsung clocks. With UBSAN_ARRAY_BOUNDS=y, code dereferences ctx->clk_data.hws before setting ctx->clk_data.num, causing an UBSAN array bounds panic. The fix moves the assignment of nr_clks (ctx->clk_data.num) before der...

CVE-2017-15649

CVE-2017-15649 affects the Linux kernel’s AF_PACKET path (net/packet/af_packet.c) up to version before 4.13.6. A race between fanout_add and packet_do_bind can mishandle packet_fanout data structures, causing a use-after-free condition. A local user with CAP_NET_RAW can trigger this to obtain pri...

CVE-2018-16880

CVE-2018-16880 affects the Linux kernel’s handle_rx() in the vhost_net driver. Under specific conditions a malicious guest can trigger an out-of-bounds write in a kmalloc-8 slab on the host, potentially causing kernel memory corruption and a system panic; privilege escalation cannot be ruled out....

CVE-2022-1974

CVE-2022-1974 describes a use-after-free in the Linux kernel NFC core due to a race between kobject creation and deletion. The vulnerability permits a local attacker with CAP_NET_ADMIN to leak kernel information. The description and references indicate this is tied to the Linux NFC subsystem and ...

CVE-2022-49287

CVE-2022-49287 concerns a Linux kernel refcount issue in tpm_chip handling that can trigger a use-after-free when interacting with TPM devices. The description details a sequence where a TPM command is written to /dev/tpmrm after unloading tpm_tis_spi, causing a refcount warning: refcount_t: addi...

CVE-2023-3006

CVE-2023-3006 describes a Spectre-BHB (Branch History Injection) cache-speculation vulnerability affecting AmpereOne hardware. Malicious code can use the CPU Branch History Buffer to influence mispredicted branches, triggering speculative execution that leads to cache allocation and potential inf...

CVE-2023-3358

CVE-2023-3358 describes a NULL pointer dereference in the Linux kernel ISH (Integrated Sensor Hub) driver. The impact stated is that a local user could crash the system. The connected Nessus/NASL entries corroborate the same issue across multiple advisories and lists, but the provided documents d...

CVE-2023-52578

CVE-2023-52578 affects the Linux kernel, specifically in the bridge code path (net/bridge) where br_handle_frame_finish() can race across CPUs, risking data races on dev->stats fields. The fix adopts SMP-safe DEV_STATS_INC() to update dev->stats (including tx_dropped) safely across CPUs, mi...

CVE-2024-26952

CVE-2024-26952 : In the Linux kernel, ksmbd had an out-of-bounds risk when buffer offset fields in some requests are invalid. The issue arises from insufficient validation of buffer offsets, and a patch increases the minimum allowed buffer offset to validate the buffer length. The Astra Linux adv...

CVE-2024-35869

CVE-2024-35869 affects the Linux kernel SMB client code path. The issue is described as a fix to guarantee that all children from the parent SMB session (@tcon->ses) are refcounted when walking DFS referrals, mounting, or performing DFS failover. The underlying problem was potential use-after-...