CVE-2024-40954

The CVE-2024-40954 entry concerns a Linux kernel UAF: a dangling sk pointer may be created on socket creation failure when an fentry probe hits __sock_release() and bpf_get_socket_cookie() is invoked, enabling a use-after-free in __sock_gen_cookie. Reproducing scenario described via traceroute -I...

CVE-2024-35869

CVE-2024-35869 affects the Linux kernel SMB client code path. The issue is described as a fix to guarantee that all children from the parent SMB session (@tcon->ses) are refcounted when walking DFS referrals, mounting, or performing DFS failover. The underlying problem was potential use-after-...

CVE-2024-35912

Technical details about CVE-2024-35912 are not provided in the connected documents. No information on affected products/versions/vulnerability specifics is available here; monitor for updates from vendor/security advisories.

CVE-2024-36015

In CVE-2024-36015, the Linux kernel exposes a flaw in ppdev: register_device does not validate the index returned by ida_simple_get, risking use of an invalid index. The fix is to check the index after ida_simple_get, and if abnormal, print a warning, drop the port, and record the value. Public a...

CVE-2024-38627

CVE-2024-38627 (Linux kernel) : The vuln is a local double-free in the stm class during stm_register_device(). The code path frees the same stm object twice: the first free happens when stm_device_release() is triggered by put_device(&stm->dev), and a subsequent vfree(stm) on the next line res...

CVE-2024-42225

CVE-2024-42225 : Linux kernel WiFi mt76 vulnerability due to reusing uninitialized data in the MT76 path; root cause is use of uninitialized skb data. A remote attacker could execute arbitrary code. A fix replaces skb_put with skb_put_zero in wifi: mt76, and patches are available in the cited ker...

CVE-2024-47678

The CVE-2024-47678 issue in the Linux kernel was fixed by reordering ICMP rate limiting: apply the per-destination check before the host-wide limit. The patch ensures icmp_global_allow() only checks quota (credits not consumed yet), then updates the per-destination rate via inetpeer (which may ad...

CVE-2024-49569

The CVE-2024-49569 entry concerns the Linux kernel NVMe/RDMA path. Affected component: nvme_rdma admin queue handling. Root cause: admin_q is quiesced (quiesced admin_q) but not unquiesced before destroy when admin ctrl creation fails, causing pending admin requests to never drain. Impact: kernel...

CVE-2024-50150

The CVE-2024-50150 entry describes a Linux kernel vulnerability in usb: typec: altmode where the altmode device release did not keep a reference to its parent. The fix registers a reference to the parent during altmode registration and stores it in the release path to prevent use-after-free scena...

CVE-2024-57798

CVE-2024-57798 affects the Linux kernel drm_dp_mst handling of MST up requests. If another thread removes MST topology during processing, mst_primary could be freed and set to NULL, risking a NULL pointer dereference in drm_dp_mst_handle_up_req(). The fix is to hold a reference to mst_primary whi...

CVE-2025-21919

CVE-2025-21919 (Linux kernel sched/fair): A memory-corruption issue was fixed in child_cfs_rq_on_list. The prev pointer used in converting to a cfs_rq could originate from rq->leaf_cfs_rq_list, making container_of incorrect and risking memory fault or garbage reads. The patch adds a guard: aft...

CVE-2025-21969

CVE-2025-21969 is a Linux kernel vulnerability in the Bluetooth stack (L2CAP). The issue is a slab-use-after-free in l2cap_send_cmd when the hci sync path releases l2cap_conn but a worker still references it. The root cause is a race between the hci receive data work queue and the l2cap_conn life...

CVE-2025-37738

CVE-2025-37738 details from Connected docs show a Linux kernel ext4 vulnerability: ext4_xattr_inode_dec_ref_all may read past the end while processing xattrs, leading to a slab-use-after-free as reported by KASAN. The fix makes ext4_xattr handling ignore xattrs entries beyond the end, preventing ...

CVE-2025-38001

The CVE-2025-38001 issue affects the Linux kernel HFSC scheduling path (net_sched) and is triggered by a flawed enqueue path. The root cause is a reentrancy problem in hfsc_enqueue where a class can be inserted twice into the eltree when HFSC_RSC is used, because the code only checks cl->cl_na...

CVE-2014-3645

CVE-2014-3645 affects the Linux kernel KVM implementation in arch/x86/kvm/vmx.c, with versions before 3.12. The root cause is that the code path handling the INVEPT instruction lacks an exit handler, which can allow a guest OS user to trigger a denial of service by crashing the guest via a crafte...

CVE-2017-1000365

CVE-2017-1000365 affects the Linux kernel where size limits for arguments and environment strings passed via RLIMIT_STACK/RLIMIT_INFINITY do not properly account for the argument/environment pointers, enabling a local attacker to potentially execute arbitrary code. The issue is described as a lim...

CVE-2017-2596

CVE-2017-2596 affects the Linux kernel’s KVM VMX handling. The nested_vmx_check_vmptr function in arch/x86/kvm/vmx.c through kernel 4.9.8 incorrectly emulates the VMXON instruction, enabling a local L1 guest user to cause host memory exhaustion and a denial of service by abusing mishandled page r...

CVE-2021-4135

CVE-2021-4135 affects the Linux kernel, specifically the netdevsim (Simulated networking device) driver’s eBPF path. The issue is a memory leak in the nsim_map_alloc_elem path that can be triggered by user-controlled use of BPF for the device, enabling a local attacker to access kernel data. Publ...

CVE-2022-3521

CVE-2022-3521 is a race-condition vulnerability in the Linux Kernel KCM subsystem (function kcm_tx_work in net/kcm/kcmsock.c). The issue can allow a local attacker to trigger a crash via race conditions in the KCM path. Technical details in connected sources confirm the affected component and roo...

CVE-2022-49371

CVE-2022-49371: In the Linux kernel, driver core: fix deadlock in __device_attach. The deadlock occurs when async_probe is scheduled while holding device_lock(dev); async_helper may also acquire dev, causing A-A deadlock. The fix moves async_schedule_dev outside the device_lock path, leveraging t...

CVE-2023-1872

CVE-2023-1872 is a use-after-free in the Linux kernel io_uring subsystem caused by the io_file_get_fixed path not validating ctx->uring_lock, enabling a race with fixed files unregistration. This can lead to local privilege escalation and possible denial of service. Affected component is the k...

CVE-2023-52581

CVE-2023-52581 : Linux kernel netfilter nft_tables memo‑leak when more than 255 elements expire. Root cause: u8 wrap occurs before boundary and nft_trans_gc_space() returns true, causing recycle of the initial gc container and loss of earlier elements. Also fixes dereferencing GC after handing it...

CVE-2024-26660

CVE-2024-26660 was fixed in the Linux kernel’s DRM AMD display path for DCN301. The issue was a bounds-check omission on stream encoder creation: the code accessed an index beyond the four pre-initialized entries of stream_enc_regs, risking an out-of-bounds read when eng_id equals 5. The fix adds...

CVE-2024-35817

CVE-2024-35817 is a Linux kernel issue affecting the AMDGPU driver (drm/amdgpu). The root cause is that after GTT/ Gart space is freed, amdgpu_ttm_backend_unbind does not clear the GTT page table entry, leaving a valid mapping to a stale system page. If the GPU accesses the stale GART address, it...

CVE-2024-35878

CVE-2024-35878 : The connected documentation provides concrete details—this Linux kernel vulnerability concerns a NULL pointer dereference in vsnprintf() triggered by improper handling of the str/len parameters in of_modalias(). The issue could oops when a NULL pointer is passed unless length is ...

CVE-2024-39476

The CVE-2024-39476 entry describes a Linux kernel md/raid5 deadlock scenario affecting raid5d where a deadlock can occur when MD_SB_CHANGE_PENDING is not cleared promptly. Root cause, as stated, is a dependency chain: md_check_recovery() from raid5d() must hold reconfig_mutex to clear MD_SB_CHANG...

CVE-2024-41038

CVE-2024-41038 affects the Linux kernel firmware path for cs_dsp handling of V2 WMFW headers. The issue stems from variable-length strings in the V2 algorithm header, which can shift field positions and header length, creating a risk that some fields may overflow the available firmware data buffe...

CVE-2024-42228

CVE-2024-42228 : Linux kernel vulnerability involving the AMDGPU driver. The issue arises from using an uninitialized value (*size) when calling amdgpu_vce_cs_reloc, which can lead to arbitrary code execution or denial of service via a crafted relocation path. The fix initializes the size prior t...

CVE-2024-43866

The CVE-2024-43866 issue is in the Linux kernel mlx5 driver: in shutdown, health work must be drained to avoid races/NULL pointer dereferences. The fix changes the shutdown callback to drain the health work queue (drain health WQ) to ensure no health work is left running during device shutdown. I...

CVE-2024-47710

CVE-2024-47710 : Linux kernel vulnerability where destroying a sock_map with many buckets could trigger soft lockups. The fix adds a cond_resched() in sock_hash_free() to yield the CPU when needed, addressing repeated syzbot soft lockup reports. Affected component: sock_map/sock_hash_free in Linu...

CVE-2024-50062

CVE-2024-50062 affects the Linux kernel's RDMA/rtrs-srv path establishment. The connected documents describe a root cause where the RTRS client/server exchange (info_req) requires all connections to be established and the RTRS path to be in CONNECTED state; without proper sanity checks, this can ...

CVE-2024-50073

CVE-2024-50073: Linux kernel tty/n_gsm use-after-free in gsm_cleanup_mux (UAF on gsm_msg in gsm_mux tx lists). Unity Linux advisory confirms fix: protect gsm_msg by adding a gsm tx lock to prevent multi-threaded free via ioctl. Affects kernel 6.11.0+; patch details referenced in Unity/Nessus desc...

CVE-2025-21859

CVE-2025-21859 affects the Linux kernel USB gadget f_midi path; a deadlock occurs when a lock is acquired twice in a re-entrant f_midi_transmit. The fix is to schedule the inner f_midi_transmit via a high-priority work queue using queue_work() from the completion handler. Patched commits are refe...

CVE-2025-22004

The CVE-2025-22004 issue is in the Linux kernel’s ATM driver (net: atm) where the skb is freed during lec_send(), risking use-after-free. The fix saves the skb length before calling the send() operation to prevent freeing the length-dependent data, and is reflected in kernel security advisories r...

CVE-2016-0774

CVE-2016-0774 affects Linux kernel backports in Debian wheezy (before 3.2.73-2+deb7u3) and RHEL 7.1 (before 3.10.0-229.26.2). The flaw is in the pipe_read/pipe_write paths in fs/pipe.c where the side effects of failed __copy_to_user_inatomic/__copy_from_user_inatomic calls are not properly handle...

CVE-2017-18360

CVE-2017-18360 affects the Linux kernel: in drivers/usb/serial/io_ti.c, change_port_settings before version 4.11.3 allows a local attacker to trigger a division-by-zero in the serial device layer when attempting to set very high baud rates, causing a denial of service. Public references (NVD entr...

CVE-2021-29266

CVE-2021-29266 affects the Linux kernel prior to 5.11.9. The use-after-free vulnerability is in drivers/vhost/vdpa.c where v->config_ctx may hold an invalid value when a character device is reopened, enabling a use-after-free scenario. The issue is addressed in ChangeLog-5.11.9 (kernel patch f...

CVE-2022-1419

CVE-2022-1419 affects the Linux kernel DRM/vgem path: ioctl DRM_IOCTL_MODE_DESTROY_DUMB can concurrently reduce the refcount of drm_vgem_gem_object created by vgem_gem_dumb_create, while that create path may access the freed object. The public description for this CVE notes that on 32-bit systems...

CVE-2022-49114

The CVE-2022-49114 issue in the Linux kernel concerns a use-after-free in the SCSI/libfc path, specifically fc_exch_abts_resp(). The bug arises because fc_exch_release(ep) reduces the ep’s refcount to zero while ep is still used, leading to use-after-free. The fix is to Return after the fc_exch_r...

CVE-2022-49541

The CVE-2022-49541 issue is a Linux kernel CIFS vulnerability: a potential double free during a failed mount. It is classed as HIGH severity (LOCAL access, LOW attack complexity) with impact to confidentiality, integrity, and availability as per the CVSS metrics. Connected advisories (SUSE/RHEL-r...

CVE-2023-52607

CVE-2023-52607 is a Linux kernel vulnerability affecting the powerpc architecture, where a null-pointer dereference could occur in pgtable_cache_add due to a potentially NULL kasprintf() return when memory allocation fails. The issue arises because kasprintf() can return NULL and the code did not...

CVE-2023-52803

The CVE-2023-52803 entry corresponds to a Linux kernel vulnerability: SUNRPC RPC client dereferenced freed pipefs dentries due to a mismatch of the current and original pipefs superblock during cleanup, potentially freeing dentries of the previously released pipefs. The issue occurs when a pipefs...

CVE-2024-26744

CVE-2024-26744: In the Linux kernel, loading the ib_srpt module with srpt_service_guid can trigger a NULL pointer dereference crash. The vulnerability stems from loadingib_srpt with the srpt_service_guid parameter, which previously caused a kernel BUG: NULL pointer dereference when parsing argume...

CVE-2024-36926

CVE-2024-36926 affects the Linux kernel on PowerPC pseries hardware, where LPARs boot with a frozen PE may lack the ibm,dma-window property. This can cause a NULL pointer dereference while configuring PCI, leading to an oops/panic during boot. The vulnerability is described with kernel traces (pc...

CVE-2024-41001

CVE-2024-41001: In the Linux kernel, io_uring/sqpoll may leak audit memory during connect handling due to path conditions in prep/issue auditing; a blanket NOP before SQPOLL mitigates this. The issue, rated CVSSv3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, is locally exploitable and impacts availabi...

CVE-2024-42073

The CVE-2024-42073 issue is in the Linux kernel mlxsw spectrum_buffers path. The Shared Buffer Status Register (SBSR) payloads used by two operations were built with absolute port numbers rather than numbers relative to the first port of the port_page, causing memory corruption on Spectrum-4 syst...

CVE-2024-46743

CVE-2024-46743 affects the Linux kernel’s interrupt/IRQ handling in the of_irq_parse_raw path. When a device address is smaller than the interrupt parent node (involving #address-cells), KASAN detects a slab-out-of-bounds read while populating the initial match table during interrupt map walk. Th...

CVE-2024-47737

CVE-2024-47737 is a Linux kernel vulnerability in NFSD where, when xdr_reserve_space returns NULL due to insufficient buffer, a missing cache_put after a successful cache_get can occur if idmap_lookup triggers lookup_fn. This can create a mismatch in the nfsd cache handling. The CVE has a CVSSv3....

CVE-2024-49962

CVE-2024-49962 : In the Linux kernel, ACPICA toolchain fix guards against NULL returns from ACPI_ALLOCATE_ZEROED() in acpi_db_convert_to_package(). If ACPI_ALLOCATE_ZEROED() fails, elements may be NULL, leading to a NULL pointer dereference. The linked Astra/IBM bulletins reference the same root ...

CVE-2024-50199

CVE-2024-50199 (Linux kernel): The issue is in mm/swapfile handling where HugeTLB pages could be leaked after swapoff due to pud_none_or_clear_bad path, causing a bad pud error. The described fix is to skip HugeTLB pages for unuse_vma, preventing leakage when swapping. Affected areas are the swap...