CVE-2024-53095

CVE-2024-53095 – Linux kernel SMB CIFS client UAF Issue: The CIFS/SMB client in the Linux kernel can use-after-free the network namespace (netns) when sockets are freed after the netns lifetime, triggering oopses during reconnect in Kubernetes pods that mount CIFS shares in non-root netns. Root c...

CVE-2024-53120

CVE-2024-53120 relates to the Linux kernel mlx5 core offload path. The vulnerability occurs in net/mlx5e when offloading CT rules: in mlx5_tc_ct_entry_add_rule(), if ct_rule_add() returns an error, zone_rule->attr is used uninitialized, causing a NULL pointer dereference (kernel OOPS). The fix...

CVE-2024-57798

CVE-2024-57798 affects the Linux kernel drm_dp_mst handling of MST up requests. If another thread removes MST topology during processing, mst_primary could be freed and set to NULL, risking a NULL pointer dereference in drm_dp_mst_handle_up_req(). The fix is to hold a reference to mst_primary whi...

CVE-2024-57843

CVE-2024-57843 : In the Linux kernel, a vulnerability in virtio-net can cause overflow in virtnet_rq_alloc when a fragment spans a page and the total buffer size plus virtnet_rq_dma exceeds one page. This can lead to reliable VM crashes or SCP failures. Root cause: virtnet_rq_dma reserves 16 byte...

CVE-2025-21694

CVE-2025-21694 : Linux kernel vulnerability in fs/proc/__read_vmcore (kdump path). Root cause: second loop in __read_vmcore could still hit softlockups; fix adds cond_resched() to yield in that loop. Impact: softlockups may interfere with RCU memory freeing and cause crashdump stalls in memory-co...

CVE-2025-21718

CVE-2025-21718 affects the Linux kernel Rose timer handling. The issue arises when Rose timers acquire only the socket spinlock and do not verify socket ownership, enabling a race against user threads. The described fix adds a socket ownership check and rearms timers as needed, addressing a KASAN...

CVE-2025-21964

CVE-2025-21964 affects the Linux kernel CIFS mount option acregmax. The issue arises when user-provided acregmax (u32) is not yet validated; its value is converted from seconds to jiffies, which can overflow an integer. This is a local vulnerability in which an attacker with local access could po...

CVE-2026-43500

Summary: CVE-2026-43500 affects the Linux kernel RXRPC path for DATA/RESPONSE packets. The issue occurs when skb fragments are externally owned (e.g., via splice() or frag lists) and the code path decrypts in place, binding frag pages into the AEAD/skcipher SGL. The fix extends the gate to unshar...

CVE-2016-2184

CVE-2016-2184 affects the Linux kernel snd-usb-audio driver (pre-4.5.1). The vulnerability stems from create_fixed_stream_quirk in sound/usb/quirks.c, which allows a physically proximate attacker to trigger a denial of service via a crafted endpoints value in a USB device descriptor. Consequences...

CVE-2017-18360

CVE-2017-18360 affects the Linux kernel: in drivers/usb/serial/io_ti.c, change_port_settings before version 4.11.3 allows a local attacker to trigger a division-by-zero in the serial device layer when attempting to set very high baud rates, causing a denial of service. Public references (NVD entr...

CVE-2017-2596

CVE-2017-2596 affects the Linux kernel’s KVM VMX handling. The nested_vmx_check_vmptr function in arch/x86/kvm/vmx.c through kernel 4.9.8 incorrectly emulates the VMXON instruction, enabling a local L1 guest user to cause host memory exhaustion and a denial of service by abusing mishandled page r...

CVE-2019-17056

CVE-2019-17056 affects the Linux kernel AF_NFC implementation (llcp_sock_create in net/nfc/llcp_sock.c). Description: it does not enforce CAP_NET_RAW, allowing unprivileged users to create a raw socket. Root cause: missing capability check in llcp_sock_create. Impact: enables local privilege-rest...

CVE-2021-29266

CVE-2021-29266 affects the Linux kernel prior to 5.11.9. The use-after-free vulnerability is in drivers/vhost/vdpa.c where v->config_ctx may hold an invalid value when a character device is reopened, enabling a use-after-free scenario. The issue is addressed in ChangeLog-5.11.9 (kernel patch f...

CVE-2024-26826

Mode C: CVE-2024-26826 is a Linux kernel vulnerability affecting the MPTCP path handling. The issue is described as a broken check when re-injecting data on a stale subflow: the MPTCP PM uses a TCP-specific helper on an MPTCP socket to test for unacked data in the RTX queue, which could lead to u...

CVE-2024-26898

Summary: CVE-2024-26898 relates to the AoE driver in the Linux kernel where aoecmd_cfg_pkts() incorrectly handled the refcnt of net_device, enabling a potential use-after-free via racing with tx paths. The issue has been resolved by patch f98364e92662, which stops calling dev_put(ifp) in the succ...

CVE-2024-26952

CVE-2024-26952 : In the Linux kernel, ksmbd had an out-of-bounds risk when buffer offset fields in some requests are invalid. The issue arises from insufficient validation of buffer offsets, and a patch increases the minimum allowed buffer offset to validate the buffer length. The Astra Linux adv...

CVE-2024-35835

CVE-2024-35835 is a Linux kernel vulnerability involving a double-free in arfs_create_groups. When the input allocation (kvzalloc) fails, arfs_create_groups frees ft->g, but arfs_create_table (the caller) then calls mlx5e_destroy_flow_table, which frees ft->g again, causing a potential doub...

CVE-2024-35862

CVE-2024-35862 (Linux kernel SMB client) : The issue is a use-after-free (UAF) in smb2_is_network_name_deleted() when a session is tearing down. The fix, as described in connected advisories, is to skip sessions that are in the process of tearing down (status == SES_EXITING) to prevent UAF. This ...

CVE-2024-35904

CVE-2024-35904 relates to a Linux kernel fix for SELinux: avoid dereferencing a garbage pointer after a mount failure. The patch ensures that when kern_mount() fails, the code returns in the error branch instead of continuing, preventing dereferencing the error pointer, and it drops the selinuxfs...

CVE-2024-36945

In the Linux kernel, CVE-2024-36945 affects net/smc: fix of a neighbour and rtable leak in smc_ib_find_route(). The issue arises because the neighbour found by neigh_lookup() and the rtable resolved by ip_route_output_flow() were not released before returning, causing a refcount leak. The documen...

CVE-2024-36953

CVE-2024-36953 affects the Linux kernel KVM for arm64 with vgic-v2. The issue: vgic_v2_parse_attr() searches for a vCPU matching the CPUID and may receive a NULL from kvm_get_vcpu_by_id() if the ID is invalid. Unlike the safe GICv3 flow, the code did not verify the returned vCPU object. Affected ...

CVE-2024-36960

The CVE-2024-36960 entry maps to a Linux kernel issue in drm/vmwgfx where the length field for drm_event was incorrectly set to the parent structure, causing out-of-bounds reads when drm_read copies events to userspace. The provided documents confirm the root cause and fix: set drm_event length t...

CVE-2024-53074

The CVE-2024-53074 issue affects the Linux kernel wireless stack (iwlwifi, mvm). The vulnerability arises from not releasing the link mapping resource when an AP is removed, leading to a leak of a link on AP removal. This specifically impacts devices that do not support the MLD API (9260 and earl...

CVE-2019-19525

CVE-2019-19525 affects the Linux kernel prior to 5.3.6, where a use-after-free can be triggered by a malicious USB device via drivers/net/ieee802154/atusb.c (CID-7fd25e6fc035). The vulnerability has an availability impact and a MEDIUM base score (CVSS v3.1: 4.6) with LOCAL/PHYSICAL factors descri...

CVE-2023-32250

CVE-2023-32250 : A race condition in the Linux kernel ksmbd SMB server’s handling of SMB2_SESSION_SETUP commands due to missing locking can allow an attacker to execute code in kernel context. The vulnerability is tied to the in-kernel ksmbd implementation and is reflected in multiple advisories ...

CVE-2023-51043

CVE-2023-51043 affects the Linux kernel prior to 6.4.5. The issue is a use-after-free in drivers/gpu/drm/drm_atomic.c caused by a race between a nonblocking atomic commit and a driver unload. The vulnerability results in a potentially exploitable crash if a race occurs during unload while a nonbl...

CVE-2023-52628

CVE-2023-52628 : Linux kernel netfilter nftables exthdr fix for a 4-byte stack OOB write. If priv->len is a multiple of 4, dst[len/4] can overflow the destination array, causing stack corruption. The bug affected the kernel since the 4.1 cycle and was carried forward with tcp/sctp and IP optio...

CVE-2024-26660

CVE-2024-26660 — In the Linux kernel, the AMDGPU display driver bound to DCN301 had a bounds check bug in stream encoder creation. The code used eng_id as an index into a four-element stream_enc_regs array, and an access with eng_id=5 caused a buffer/out-of-bounds condition. The issue was fixed i...

CVE-2024-35863

CVE-2024-35863 (Linux kernel, SMB client) is addressed in the Miracle Linux advisory and linked Nessus entries, which confirm a use-after-free (UAF) condition in the SMB client when breaking oplocks. The root cause is a race during session teardown; the fix skips processing on sessions in teardow...

CVE-2024-38555

CVE-2024-38555: In the Linux kernel, the net/mlx5 driver fixes a use-after-free by discarding FW command completions arriving during an internal error state. The patch prevents calling the completion handler when the device will flush the command interface, avoiding use-after-free/refcount underf...

CVE-2024-38627

CVE-2024-38627 (Linux kernel) : The vuln is a local double-free in the stm class during stm_register_device(). The code path frees the same stm object twice: the first free happens when stm_device_release() is triggered by put_device(&stm->dev), and a subsequent vfree(stm) on the next line res...

CVE-2024-42225

CVE-2024-42225 : Linux kernel WiFi mt76 vulnerability due to reusing uninitialized data in the MT76 path; root cause is use of uninitialized skb data. A remote attacker could execute arbitrary code. A fix replaces skb_put with skb_put_zero in wifi: mt76, and patches are available in the cited ker...

CVE-2024-42237

CVE-2024-42237 - Linux kernel cs_dsp payload length validation Affects: Linux kernel firmware cs_dsp loading paths (cs_dsp_load and cs_dsp_coeff_load).Cause: The block payload length could be used before validating the length, potentially enabling out-of-bounds processing.Fix: Move and perform th...

CVE-2024-47710

CVE-2024-47710 : Linux kernel vulnerability where destroying a sock_map with many buckets could trigger soft lockups. The fix adds a cond_resched() in sock_hash_free() to yield the CPU when needed, addressing repeated syzbot soft lockup reports. Affected component: sock_map/sock_hash_free in Linu...

CVE-2024-50039

CVE-2024-50039 : Linux kernel net/sched vulnerability where accepting TCA_STAB on non-root qdiscs could crash via NULL pointer dereference (syzbot) when using a TBF/SFQ combo. The fix restricts STAB handling to root qdisc (per-qdisc storage isn’t maintained for arbitrary levels). Connected docs i...

CVE-2024-56595

CVE-2024-56595 concerns the Linux kernel JFS (Journaling File System) code path in dbAdjTree. The issue is an array-index-out-of-bounds that can occur when lp is 0 at the start of a for loop, which may become negative on the next assignment if not bailed out. The available connected documents con...

CVE-2024-57850

CVE-2024-57850 affects the Linux kernel feature jffs2, where the rtime decompression code could corrupt memory outside the decompression buffer if compressed data is malformed. The issue is resolved by adding bounds checks during the rtime decompression pass. Supported documents confirm the vulne...

CVE-2024-57890

CVE-2024-57890 affects the Linux kernel RDMA/uverbs path. The issue is an integer overflow in user-supplied values during multiplications: cmd.wqe_size * cmd.wr_count and cmd.sge_count * sizeof(struct ib_uverbs_sge). On 32‑bit systems these can overflow, and the result may wrap as it’s passed to ...

CVE-2025-21802

CVE-2025-21802 is a Linux kernel issue affecting the networking driver path for hns3. The vulnerability arises during driver unload when the hclge path attempts to disable SR-IOV for each ae_dev in hnae3_ae_dev_list while the ae_dev list is being modified, which can cause an oops. The root cause ...

CVE-2025-21859

CVE-2025-21859 affects the Linux kernel USB gadget f_midi path; a deadlock occurs when a lock is acquired twice in a re-entrant f_midi_transmit. The fix is to schedule the inner f_midi_transmit via a high-priority work queue using queue_work() from the completion handler. Patched commits are refe...

CVE-2025-39728

The CVE-2025-39728 issue is in the Linux kernel clock framework for Samsung clocks. With UBSAN_ARRAY_BOUNDS=y, code dereferences ctx->clk_data.hws before setting ctx->clk_data.num, causing an UBSAN array bounds panic. The fix moves the assignment of nr_clks (ctx->clk_data.num) before der...

CVE-2015-8970

CVE-2015-8970 affects the Linux kernel prior to 4.4.2. The vulnerability is in crypto/algif_skcipher.c where a setkey operation on an AF_ALG socket may not be verified before an accept system call is processed, allowing a local attacker to trigger a NULL pointer dereference and system crash via a...

CVE-2017-5897

CVE-2017-5897 involves an out-of-bounds read in the Linux kernel’s IPv6 GRE handling (ip6_gre.c, ip6gre_err). Connected sources (Debian DSA-3791-1 and Cloud Foundry USN-3265-2) confirm the issue and note mitigation via kernel updates (e.g., Debian Jessie fix in linux 3.16.39-1+deb8u1; vendor advi...

CVE-2018-7995

CVE-2018-7995 describes a race condition in Linux kernel’s store_int_with_restart() (arch/x86/kernel/cpu/mcheck/mce.c) up to version 4.15.7. This flaw lets a local attacker with root access to write to /sys/devices/system/machinecheck/machinecheck/check_interval and trigger a denial of service/pa...

CVE-2019-3887

CVE-2019-3887 covers a KVM x2APIC MSR access flaw that can allow a L1 guest to read L0 APIC values via a L2 guest when nested virtualization is enabled, potentially crashing the host kernel (DoS). Affected: Linux kernel with nested=1 supporting x2APIC mode; cited in multiple Unity Linux/Nessus ad...

CVE-2021-29649

The CVE-2021-29649 issue affects the Linux kernel prior to 5.11.11. It is a memory leak in the user mode driver (UMD) caused by incomplete cleanup in kernel/usermode_driver.c and kernel/bpf/preload/bpf_preload_kern.c. The vulnerability is local and does not imply remote code execution by itself; ...

CVE-2021-32606

CVE-2021-32606 affects the Linux kernel 5.11–5.12.2, where isotp_setsockopt in net/can/isotp.c permits local privilege escalation to root via a use-after-free. Exploitation details are not provided in the documents; impact is limited to environments with the affected kernel. Ongoing references in...

CVE-2021-38300

CVE-2021-38300 affects the Linux kernel on MIPS through arch/mips/net/bpf_jit.c, where the BPF JIT can emit incorrect machine code when transforming unprivileged cBPF programs. Root cause: conditional branches can exceed the 128 KB limit, enabling a local user to execute arbitrary code in kernel ...

CVE-2022-49287

CVE-2022-49287 concerns a Linux kernel refcount issue in tpm_chip handling that can trigger a use-after-free when interacting with TPM devices. The description details a sequence where a TPM command is written to /dev/tpmrm after unloading tpm_tis_spi, causing a refcount warning: refcount_t: addi...

CVE-2023-23039

CVE-2023-23039 : In the Linux kernel (up to 6.2.0-rc2), the race condition in drivers/tty/vcc.c between vcc_open() and vcc_remove() can cause a use-after-free when a physically proximate attacker removes a VCC device while open() is invoked. This yields a potential impact on integrity and availab...