CVE-2023-52637

CVE-2023-52637 refers to a Linux kernel vulnerability in the j1939 subsystem where a use-after-free (UAF) could occur due to modification of jsk->filters while receiving packets and during setsockopt(SO_J1939_FILTER). The fix adds locking on jsk->sk to prevent UAF and stabilize access to fi...

CVE-2024-26660

CVE-2024-26660 was fixed in the Linux kernel’s DRM AMD display path for DCN301. The issue was a bounds-check omission on stream encoder creation: the code accessed an index beyond the four pre-initialized entries of stream_enc_regs, risking an out-of-bounds read when eng_id equals 5. The fix adds...

CVE-2024-35864

CVE-2024-35864 is a Linux kernel SMB client issue. The root cause is a use-after-free in smb2_is_valid_lease_break() that can occur while handling SMB2 lease breaks, with sessions in SES_EXITING state skipped to avoid UAF. The vulnerability is linked to local attack vectors and a highImpact scena...

CVE-2024-35912

Technical details about CVE-2024-35912 are not provided in the connected documents. No information on affected products/versions/vulnerability specifics is available here; monitor for updates from vendor/security advisories.

CVE-2024-36945

CVE-2024-36945 (Linux kernel, net/smc): The issue is a refcount leak in smc_ib_find_route() where neighbours from neigh_lookup() and rtables from ip_route_output_flow() were not released before function return. The leak is fixed by ensuring proper release/put of the neighbour and rtable before ex...

CVE-2024-40911

CVE-2024-40911 : In the Linux kernel wifi stack (cfg80211), a missing wiphy lock around rdev_get_station can cause a NULL pointer dereference if a STA disconnect/reconnect occurs before a scheduled batadv throughput work runs. The issue is addressed by locking the wiphy before cfg80211_get_statio...

CVE-2024-42302

CVE-2024-42302 : The Linux kernel fixed a use-after-free in PCI/DPC when a DPC event occurs concurrently with hot-removal on the same PCIe hierarchy. The underlying issue was that pci_bridge_wait_for_secondary_bus() did not hold a reference to the child pci_dev during a DPC event, allowing concur...

CVE-2024-49859

The CVE-2024-49859 entry concerns the Linux kernel file system f2fs. The vulnerability arises from ioctl interfaces (notably f2fs_ioc_set_pin_file(), f2fs_move_file_range(), and f2fs_defragment_range()) failing to consistently check the atomic_write status, which may enable a race condition. The ...

CVE-2024-49962

CVE-2024-49962 : In the Linux kernel, ACPICA toolchain fix guards against NULL returns from ACPI_ALLOCATE_ZEROED() in acpi_db_convert_to_package(). If ACPI_ALLOCATE_ZEROED() fails, elements may be NULL, leading to a NULL pointer dereference. The linked Astra/IBM bulletins reference the same root ...

CVE-2024-56688

CVE-2024-56688 affects the Linux kernel sunrpc transport path. The vulnerability arises because XPRT_SOCK_UPD_TIMEOUT is not cleared when transport->sock is set to NULL during transport reset, so xs_tcp_send_request() may dereference transport->sock (now NULL). This can lead to a crash or d...

CVE-2026-52924

The CVE-2026-52924 entry describes a Linux kernel SCTP use-after-free vulnerability triggered during Stale COOKIE-ECHO handling. In COOKIE_WAIT transitions, sctp_stream_update() can leave a stale out_curr pointer after rolling back from COOKIE_ECHOED to COOKIE_WAIT, so scheduler paths (FCFS/RR/PR...

CVE-2017-1000363

CVE-2017-1000363: Linux kernel lp driver bounds-check flaw in lp.c allows a local attacker with write access to kernel command line arguments to overflow parport_nr and execute arbitrary code. Root cause: missing bounds check in arg handling. Public disclosures include Debian security advisories ...

CVE-2018-14609

CVE-2018-14609 affects the Linux kernel (up to 4.17.10) with an invalid pointer dereference in __del_reloc_root() of fs/btrfs/relocation.c when mounting a crafted Btrfs image. The issue is triggered by removing reloc rb_trees when reloc control has not been initialized, leading to potential denia...

CVE-2018-16880

CVE-2018-16880 affects the Linux kernel’s handle_rx() in the vhost_net driver. Under specific conditions a malicious guest can trigger an out-of-bounds write in a kmalloc-8 slab on the host, potentially causing kernel memory corruption and a system panic; privilege escalation cannot be ruled out....

CVE-2019-19047

CVE-2019-19047 is a memory-leak & potential DoS in the Linux kernel's mlx5_fw_fatal_reporter_dump() (drivers/net/ethernet/mellanox/mlx5/core/health.c) triggered by mlx5_crdump_collect() failures. Affected: Linux kernel versions before 5.3.11. Impact is memory consumption leading to DoS; exploitat...

CVE-2022-1199

CVE-2022-1199 is a Linux kernel flaw that can crash the kernel via user-space activity simulating amateur radio, producing a NULL pointer dereference and a use-after-free. The connected Astra Linux bulletin confirms the same vulnerability details and, for mitigating environments, Siemens’ accompa...

CVE-2022-49647

CVE-2022-49647 affects the Linux kernel cgroups migration code. The vulnerability stems from overloading cset->mg_preload_node for both src and dst preload lists during task migrations, which could allow a cset to be simultaneously sourced and destined, risking a use-after-free if all tasks le...

CVE-2023-22998

CVE-2023-22998 affects the Linux kernel prior to 6.0.3. The vulnerability stems from drivers/gpu/drm/virtio/virtgpu_object.c misinterpreting the drm_gem_shmem_get_sg_table return value (treating an error pointer as NULL). This can allow a remote authenticated attacker on the local network to caus...

CVE-2023-3111

CVE-2023-3111 is a use-after-free in the Btrfs filesystem driver (fs/btrfs/relocation.c, function prepare_to_relocate). The flaw can be triggered by calling btrfs_ioctl_balance() before btrfs_ioctl_defrag(), leading to potential kernel memory corruption. Public documentation in connected advisori...

CVE-2023-52578

CVE-2023-52578 affects the Linux kernel, specifically in the bridge code path (net/bridge) where br_handle_frame_finish() can race across CPUs, risking data races on dev->stats fields. The fix adopts SMP-safe DEV_STATS_INC() to update dev->stats (including tx_dropped) safely across CPUs, mi...

CVE-2024-26707

The connected documents provide concrete details for CVE-2024-26707: in the Linux kernel net/hsr code, WARN_ONCE() in send_hsr_supervision_frame() is removed and replaced with netdev_warn_once(), and a similar change is suggested for send_prp_supervision_frame() to quiet syzkaller warnings. This ...

CVE-2024-26744

CVE-2024-26744: In the Linux kernel, loading the ib_srpt module with srpt_service_guid can trigger a NULL pointer dereference crash. The vulnerability stems from loadingib_srpt with the srpt_service_guid parameter, which previously caused a kernel BUG: NULL pointer dereference when parsing argume...

CVE-2024-26952

CVE-2024-26952 : In the Linux kernel, ksmbd had an out-of-bounds risk when buffer offset fields in some requests are invalid. The issue arises from insufficient validation of buffer offsets, and a patch increases the minimum allowed buffer offset to validate the buffer length. The Astra Linux adv...

CVE-2024-35817

CVE-2024-35817 is a Linux kernel issue affecting the AMDGPU driver (drm/amdgpu). The root cause is that after GTT/ Gart space is freed, amdgpu_ttm_backend_unbind does not clear the GTT page table entry, leaving a valid mapping to a stale system page. If the GPU accesses the stale GART address, it...

CVE-2024-35822

The connected documents confirm CVE-2024-35822 affects the Linux kernel USB gadget mass storage path (usb_udc) where a thread may disable an endpoint while the main thread queues a request. Root cause: a warning in usb_ep_queue() was triggered instead of a functional failure. Fix: replacing WARN_...

CVE-2024-35840

The CVE-2024-35840 issue affects the Linux kernel MPTCP path. In subflow_finish_connect(), four fields (backup, join_id, thmac, none) may contain garbage unless OPTION_MPTCP_MPJ_SYNACK is set in mptcp_parse_option(), which is the root cause. The fix enables OPTION_MPTCP_MPJ_SYNACK in mptcp_parse_...

CVE-2024-35958

CVE-2024-35958 (Linux kernel, net: ena) fixes an incorrect descriptor free behavior in ENA TX queues. There are two queue types: (1) TX packets from the network stack and (2) TX packets redirected/forwarded by XDP. The bug caused ena_free_tx_bufs() to free descriptors assuming the first category,...

CVE-2024-35960

The CVE-2024-35960 entry concerns a Linux kernel mlx5 flow rule handling bug. Affected component is net/mlx5 rules in the flow table; the root cause was that add_rule_fg could attach a newly created rule to the tree only when its refcount was 1, while create_flow_handle could reference an existin...

CVE-2024-38632

CVE-2024-38632 : Linux kernel vulnerability in vfio/pci memory leak when vfio_irq_ctx_alloc() fails could leak the 'name' memory during vfio_intx_enable(). The issue is resolved in kernel updates per Unity Linux UTSA-2026-005048 (OS kernel patch block). Affected: vfio/pci in the Linux kernel; Roo...

CVE-2024-41038

CVE-2024-41038 affects the Linux kernel firmware path for cs_dsp handling of V2 WMFW headers. The issue stems from variable-length strings in the V2 algorithm header, which can shift field positions and header length, creating a risk that some fields may overflow the available firmware data buffe...

CVE-2024-42228

CVE-2024-42228 : Linux kernel vulnerability involving the AMDGPU driver. The issue arises from using an uninitialized value (*size) when calling amdgpu_vce_cs_reloc, which can lead to arbitrary code execution or denial of service via a crafted relocation path. The fix initializes the size prior t...

CVE-2024-50186

CVE-2024-50186 : Linux kernel vulnerability in net: explicitly clear the sk pointer when pf->create fails. Root cause: some pf->create implementations do not NULL the freed sk object in error paths, leaving a dangling pointer and enabling Use-After-Free. Fix: explicitly NULL the sk pointer ...

CVE-2024-53120

CVE-2024-53120 concerns the Linux kernel net/mlx5e offload code (mlx5_core). In the error path of mlx5_tc_ct_entry_add_rule(), if ct_rule_add() returns an error, zone_rule->attr is used uninitialized, causing a NULL pointer dereference. The fix uses attr (with the required pointer value) inste...

CVE-2024-56757

CVE-2024-56757 affects the Linux kernel btusb Mediatek driver; root cause is not releasing the special USB ISO data interface before unregistering the HCI device on USB disconnect, risking kernel panic. A fix has been implemented in the kernel (references to commits in stable trees); impact is lo...

CVE-2025-21658

Technical details beyond the summary are not provided in the supplied documents; no affected products, versions, or fixes are enumerated here. Monitor for updates.

CVE-2025-22004

The CVE-2025-22004 issue is in the Linux kernel’s ATM driver (net: atm) where the skb is freed during lec_send(), risking use-after-free. The fix saves the skb length before calling the send() operation to prevent freeing the length-dependent data, and is reflected in kernel security advisories r...

CVE-2025-38350

CVE-2025-38350 affects the Linux kernel net/sched HFSC and other classful qdiscs. The issue arises when a child qdisc becomes empty during enqueue/dequeue interactions, potentially leading to a use-after-free on stale class pointers after backlog/backlog accounting. The known fix changes the back...

CVE-2016-10044

CVE-2016-10044 is supported by connected advisories: the Linux kernel up to version 4.7.7 contains a vulnerability in the aio_mount path. Specifically, the aio_mount function in fs/aio.c did not properly restrict execute access, enabling local users to bypass SELinux W^X policy and gain privilege...

CVE-2016-7097

CVE-2016-7097 is a Linux kernel vulnerability in which the setgid bit was not cleared during setxattr, allowing local users to gain group privileges if a setgid executable exists with restricted execute permissions. The issue is reported across the Linux filesystem/ACL handling and was addressed ...

CVE-2016-7425

CVE-2016-7425 affects the Linux kernel component arcmsr_iop_message_xfer in drivers/scsi/arcmsr/arcmsr_hba.c. The vulnerability arises because a length field is not properly restricted, enabling a local user to trigger a heap-based buffer overflow via the ARCMSR_MESSAGE_WRITE_WQBUFFER control cod...

CVE-2016-9806

CVE-2016-9806 describes a race condition in the Linux kernel netlink_dump function (net/netlink/af_netlink.c) that can be triggered by local users via craftedsendmsg calls, leading to a double-free and potentially other impacts. Public advisories from MiracleLinux, Unity Linux, and Oracle Linux d...

CVE-2018-16276

CVE-2018-16276 concerns the Linux kernel, specifically the yurex_read function in drivers/usb/misc/yurex.c. The issue is a bounds-check vulnerability that could allow a local attacker with access to the system to crash the kernel or potentially escalate privileges. Affected code path is in the US...

CVE-2019-19039

CVE-2019-19039 is a Linux kernel vulnerability affecting btrfs: the function __btrfs_free_extent in fs/btrfs/extent-tree.c may trigger a path in btrfs_print_leaf during an ENOENT case, enabling a local attacker to obtain potentially sensitive information about register values via dmesg. The descr...

CVE-2019-19318

The CVE-2019-19318 issue affects Linux kernel 5.3.11. Root cause: mounting a crafted btrfs image twice can trigger a use-after-free in rwsem_down_write_slowpath because rwsem_can_spin_on_owner’s rwsem_owner_flags returns an already freed pointer. Documented impact per sources indicates an availab...

CVE-2019-20806

CVE-2019-20806 affects the Linux kernel up to version 5.1 (i.e., before 5.2). The issue is a NULL pointer dereference in tw5864_handle_frame() (drivers/media/pci/tw5864/tw5864-video.c) that can lead to denial of service. The connected Nessus advisories reiterate the same root cause and state affe...

CVE-2021-4090

CVE-2021-4090 : A Linux kernel NFSD out-of-bounds write in nfsd4_decode_bitmap4 (fs/nfsd/nfs4xdr.c) can be triggered by a missing sanity check, allowing a local privileged user to access out-of-bounds memory and threaten system integrity and confidentiality. Multiple connected sources confirm the...

CVE-2021-47432

CVE-2021-47432 relates to the Linux kernel. The vulnerability occurs in lib/generic-radix-tree.c: overflow in the peek() path when inode numbers are spread across the 64-bit inode space, triggering corner-case integer overflows in radix-tree usage. The connected Miracl e/MIRACLE_LINUX AXSA adviso...

CVE-2022-48695

CVE-2022-48695 is a Linux kernel vulnerability in the scsi: mpt3sas driver that results in a use-after-free (refcount_t underflow) observed during controller reset. The issue is fixed in the kernel by the referenced commits listed in the connected sources. The vulnerability is described as a loca...

CVE-2022-49287

CVE-2022-49287 concerns a Linux kernel refcount issue in tpm_chip handling that can trigger a use-after-free when interacting with TPM devices. The description details a sequence where a TPM command is written to /dev/tpmrm after unloading tpm_tis_spi, causing a refcount warning: refcount_t: addi...

CVE-2024-26826

CVE-2024-26826 (Linux kernel, MPTCP) : The issue occurs when a subflow becomes stale in MPTCP; the data re-injection step incorrectly uses a TCP-specific helper on an MPTCP socket, making the RTX queue check for any unacked data unreliable and potentially causing improper re-injection of mptcp-le...