CVE-2017-15274

CVE-2017-15274 affects the Linux kernel K ey Management subsystem: security/keys/keyctl.c fails to handle a NULL payload with a nonzero length, allowing local users to trigger a NULL pointer dereference and OOPS via crafted add_key or KEYCTL calls, resulting in DoS. The issue is chained to the ke...

CVE-2022-3176

CVE-2022-3176 describes a use-after-free in the Linux kernel’s io_uring subsystem. Signalfd_poll() and binder_poll() use a waitqueue whose lifetime is the current task, and the POLLFREE notification is sent to all waiters before the queue is freed, but io_uring poll does not handle POLLFREE. This...

CVE-2022-49753

CVE-2022-49753: In the Linux kernel, dmaengine_dma_chan_get() had a double increment of channel client_count for public channels, causing resources to be freed late or not at all. The issue manifested as a refcount underflow/use-after-free in kernel logs and was observed during repeated module lo...

CVE-2023-3106

CVE-2023-3106 is reported in Unity Linux advisories as a NULL pointer dereference in netlink_dump. The issue occurs when a Netlink socket receives a message (sendmsg) for XFRM_MSG_GETSA or XFRM_MSG_GETPOLICY with the DUMP flag set, potentially causing a denial of service. The description notes pr...

CVE-2023-3111

CVE-2023-3111 is a use-after-free in the Btrfs filesystem driver (fs/btrfs/relocation.c, function prepare_to_relocate). The flaw can be triggered by calling btrfs_ioctl_balance() before btrfs_ioctl_defrag(), leading to potential kernel memory corruption. Public documentation in connected advisori...

CVE-2023-52607

CVE-2023-52607 is a Linux kernel vulnerability affecting the powerpc architecture, where a null-pointer dereference could occur in pgtable_cache_add due to a potentially NULL kasprintf() return when memory allocation fails. The issue arises because kasprintf() can return NULL and the code did not...

CVE-2023-52621

CVE-2023-52621: In the Linux kernel, a fix was added to bpf map helpers (bpf_map_lookup_elem, bpf_map_update_elem, bpf_map_delete_elem) to check rcu_read_lock_trace_held() before use when running sleepable BPF programs. The vulnerability arises when sleepable BPF programs manipulate BPF maps unde...

CVE-2024-26670

CVE-2024-26670 : Linux kernel arm64 workaround for speculative unpriv load (Cortex-A520/A510 errata) fix. The patch ensures the TLBI+DSB sequence is executed after all explicit memory accesses and places it immediately before the ERET when pagetable isolation is disabled. It reworks the KPTI/eret...

CVE-2024-26708

CVE-2024-26708 affects the Linux kernel MPTCP subsystem. Description in provided docs: fastopen race between Fastopen and PM-trigger subflow shutdown can race; initial patch missed a state change before subflow_state_change callback. The fix copies all states reachable from TCP_FIN_WAIT1 to handl...

CVE-2024-35801

CVE-2024-35801 : Linux kernel x86/fpu vulnerability where per-CPU xfd_state could be out of sync with the MSR_IA32_XFD after CPU hotplug, causing XRSTOR to raise #NM and crash. The fix introduces xfd_set_state() to write xfd_state alongside MSR_IA32_XFD and updates all MSR_IA32_XFD writes to use ...

CVE-2024-35840

The CVE-2024-35840 issue affects the Linux kernel MPTCP path. In subflow_finish_connect(), four fields (backup, join_id, thmac, none) may contain garbage unless OPTION_MPTCP_MPJ_SYNACK is set in mptcp_parse_option(), which is the root cause. The fix enables OPTION_MPTCP_MPJ_SYNACK in mptcp_parse_...

CVE-2024-35973

CVE-2024-35973 affects the Linux kernel's geneve code path. The issue arises from incomplete header validation in geneve_xmit_skb, where skb->protocol handling could leave pskb_inet_may_pull() with an uninitialized or unexpected value, potentially triggering an uninit-value during transmission...

CVE-2024-38612

CVE-2024-38612 affects the Linux kernel; the flaw is in the ipv6 SR (seg6) unregister path. The error path in seg6_init() can skip genl_unregister_family() if CONFIG_IPV6_SEG6_LWTUNNEL is not defined and seg6_hmac_init() fails, due to a changed cleanup path (unregister_pernet_subsys() replaced by...

CVE-2024-39473

CVE-2024-39473 affects the Linux kernel ASoC: SOF ipc4-topology. The issue occurs when a process module lacks the base config extension: the same input format is applied to all inputs and process->base_config_ext becomes NULL, allowing a NULL dereference under specific topology/sequences. This...

CVE-2024-40972

CVE-2024-40972 : In the Linux kernel, the ext4_xattr_set_entry() path creates new EA inodes while holding the external xattr block’s buffer lock, nesting allocation locks and risking deadlock. The fix moves EA inode allocation out of ext4_xattr_set_entry() to the callers, preventing lock nesting....

CVE-2024-41044

CVE-2024-41044 : Linux kernel PPP handling vulnerability. The issue arises in ppp_async_encode() which assumes LCP packets have valid body (codes 1–7). An attacker could craft a claim-as-LCP packet that is actually malformed, enabling a local denial-of-service. The fix adds ppp_check_packet() to ...

CVE-2024-41077

Concretely, CVE-2024-41077 affects the Linux kernel null_blk path. The issue arises from an insufficient validation of the block size: the size must be between 512 and PAGE_SIZE and must be a power of two. The faulty check allowed an invalid bs (e.g., 1536) to be accepted, which could cause a nul...

CVE-2024-42073

The CVE-2024-42073 issue is in the Linux kernel mlxsw spectrum_buffers path. The Shared Buffer Status Register (SBSR) payloads used by two operations were built with absolute port numbers rather than numbers relative to the first port of the port_page, causing memory corruption on Spectrum-4 syst...

CVE-2024-42271

CVE-2024-42271 affects the Linux kernel’s IUCV subsystem. The issue is a use-after-free in iucv_sock_close() and iucv_sever_path() caused by a race on severing the path, with iucv_path_sever being called from both process and bh contexts. Without atomic compare-and-swap, a window may exist where ...

CVE-2024-42322

CVE-2024-42322 (Linux kernel) : A vulnerability in the IPVS path (net/netfilter/ipvs/ip_vs_ctl.c) arises from dereferencing a pointer named “pe” in ip_vs_add_service. The fix uses the pointer directly (use pe directly) to resolve a sparse-warnings issue and prevent a potential dereference issue. ...

CVE-2024-43842

CVE-2024-43842 : In the Linux kernel wifi driver rtw89, a bounds check bug in rtw89_sta_info_get_iter() occurs when comparing status->he_gi to the array size, but rate->he_gi is used as the index. This copy-paste mistake can lead to out-of-bounds access if rate->he_gi != status->he_gi...

CVE-2024-43871

CVE-2024-43871 (Linux kernel) is resolved by fixing a memory leakage in the devres path when using driver API devm_free_percpu to free memory allocated by devm_alloc_percpu. The root cause was that devm_free_percpu() called devres_destroy(), which could leak memory; the patch uses devres_release(...

CVE-2024-47737

CVE-2024-47737 is a Linux kernel vulnerability in NFSD where, when xdr_reserve_space returns NULL due to insufficient buffer, a missing cache_put after a successful cache_get can occur if idmap_lookup triggers lookup_fn. This can create a mismatch in the nfsd cache handling. The CVE has a CVSSv3....

CVE-2024-49894

CVE-2024-49894 : Linux kernel DRM/AMD display degamma translation had an index-out-of-bounds in cm_helper_translate_curve_to_degamma_hw_format when i exceeded TRANSFER_FUNC_POINTS. A bounds check was added to ensure i stays within transfer function points; otherwise the function returns an error....

CVE-2024-50195

The CVE-2024-50195 entry is supported by connected documents showing a Linux kernel fix for posix-clock: missing timespec64 range check in pc_clock_settime(). The root cause was that timespec64_valid() only validates the structure, not the value range, so pc_clock_settime() now performs a strict ...

CVE-2024-53091

CVE-2024-53091 —The issue in the Linux kernel concerns TLS handling in sockmap with vsock and AF_UNIX sockets. The fix adds an IS_ICSK check to tls_sw_has_ctx_tx/rx because these socket types do not use inet_connection_sock, so tls_get_ctx could otherwise return an invalid pointer and trigger a p...

CVE-2025-21920

CVE-2025-21920 (Linux kernel VLAN subtype): The issue occurs when creating VLAN devices on non-Ethernet underlying devices, which can trigger an out-of-bounds read by dev_mc_add due to __dev_mc_add using dev->addr_len as the multicast length. The underlying cause is not enforcing the underlyin...

CVE-2017-12188

CVE-2017-12188 affects arch/x86/kvm/mmu.c in the Linux kernel up to 4.13.5 where nested virtualization can mis-traverse guest page tables, enabling L1 guests to run arbitrary host code or trigger host denial of service. Connected advisories ( MiracleLinux AXSA-2018-2625, Unity Linux UTSA advisori...

CVE-2020-35499

CVE-2020-35499 describes a NULL pointer dereference in Linux kernel versions prior to 5.11 due to a missing sanity check in sco_sock_getsockopt (net/bluetooth/sco.c) when using BT_SNDMTU/BT_RCVMTU for SCO sockets. The issue allows a local attacker with elevated privileges to crash the system or l...

CVE-2022-2978

CVE-2022-2978 – NILFS use-after-free in Linux kernel : A local attacker could trigger a use-after-free in nilfs_mdt_destroy via security_inode_alloc, potentially crashing the system or enabling privilege escalation. This vulnerability is tied to the NILFS filesystem in the Linux kernel. The conne...

CVE-2022-33742

Summary: CVE-2022-33742 is tied to Linux Block and Network PV frontends leaking data due to sharing memory regions without zeroing and because grant-table granularity may expose data within the same 4K page as data shared with a backend. This is described alongside related CVEs (CVE-2022-26365, C...

CVE-2022-49376

CVE-2022-49376 affects the Linux kernel SCSI subsystem (sd driver). The issue arises when sd_probe() hits an early error before sdkp->device is initialized, leading to a NULL pointer dereference inside sd_is_zoned() due to an unintended call to sd_zbc_release_disk(). The fix removes the sd_zbc...

CVE-2023-1670

CVE-2023-1670 is a Linux kernel issue affecting the Xircom 16-bit PCMCIA (PC-card) Ethernet driver, where a use-after-free in the xirc2ps_cs network driver can allow a local attacker to crash the system or potentially escalate privileges. The vulnerability is described in the initial CVE entry as...

CVE-2023-1990

CVE-2023-1990 describes a use-after-free in ndlc_remove() within Linux kernel’s drivers/nfc/st-nci/ndlc.c, enabling a local attacker to crash the system due to a race condition. The Astra Linux advisory (and Debian advisories with CVE lists) corroborate the same flaw in the Linux kernel. The prov...

CVE-2023-52637

CVE-2023-52637 refers to a Linux kernel vulnerability in the j1939 subsystem where a use-after-free (UAF) could occur due to modification of jsk->filters while receiving packets and during setsockopt(SO_J1939_FILTER). The fix adds locking on jsk->sk to prevent UAF and stabilize access to fi...

CVE-2023-7042

CVE-2023-7042 affects the Linux kernel in the ath10k wireless driver: a null pointer dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev() can lead to a denial of service. Connected advisories confirm the issue is mitigated by updating to patched kernels (examples: Debian security notices list...

CVE-2024-27056

CVE-2024-27056 affects the Linux kernel wifi: iwlwifi mvm. The issue arises on resume: the TX queue for the offloading TID may not have been allocated if no packets were sent on TID 0, causing a crash when the code tries to sync the write pointer. The fix is to ensure the offloading TID queue exi...

CVE-2024-35789

CVE-2024-35789 – Linux kernel : Vulnerability in wifi/mac80211 VLAN handling where on moving a station out of a VLAN and deleting the VLAN, the fast_rx entry could still point to the VLAN netdev, enabling a use-after-free. The fixed behavior is to immediately call ieee80211_check_fast_rx after VL...

CVE-2024-35960

The CVE-2024-35960 entry concerns a Linux kernel mlx5 flow rule handling bug. Affected component is net/mlx5 rules in the flow table; the root cause was that add_rule_fg could attach a newly created rule to the tree only when its refcount was 1, while create_flow_handle could reference an existin...

CVE-2024-35978

CVE-2024-35978 details (Grounded in provided docs): Linux kernel Bluetooth stack has a memory leak in hci_req_sync_complete() where previous sync state is not freed before reassigning a new one. The Astra Linux security bulletin confirms the same Linux kernel vulnerability with the same fix acros...

CVE-2024-36006

CVE-2024-36006 affects the Linux kernel mlxsw spectrum_acl_tcam code. The root cause is incorrect list usage: both vchunk_migrate_all and vregion_rehash paths call list_first_entry() without ensuring the lists are non-empty, triggering warnings. The connected Astra Linux bulletin confirms the sam...

CVE-2024-36481

CVE-2024-36481 affects the Linux kernel tracing/btf parsing: btf_find_struct_member() may return NULL or an ERR_PTR, but parse_btf_field() only checked NULL before. The fix uses IS_ERR() and propagates the error up the stack. Affected component is the kernel’s tracing probes; impact is a local vu...

CVE-2024-36939

CVE-2024-36939 affects the Linux kernel nfs subsystem. Root cause: rpc_proc_register() errors in init_nfs_fs() could be ignored, causing nfs_net_exit() to run during netns destruction and trigger warning paths. The issue was addressed by properly handling the rpc_proc_register() error in nfs_net_...

CVE-2024-38596

CVE-2024-38596 is a Linux kernel vulnerability in af_unix data races between unix_release_sock/unix_stream_sendmsg. The races occur because sk_shutdown is written atomically by unix_release_sock() (WRITE_ONCE) but read non‑atomically by unix_stream_sendmsg(), triggering a KCSAN data race (BUG: KC...

CVE-2024-39276

CVE-2024-39276: Linux kernel ext4 mb_cache_entry e_refcnt leak fixed. In ext4_xattr_block_cache_find(), on failure from ext4_sb_bread() returning -ENOMEM, the ce’s e_refcnt could leak, triggering mb_cache_destroy(). Quick fix: call mb_cache_entry_put() on the -ENOMEM error path. Connected Astra L...

CVE-2024-39487

CVE-2024-39487 affects the Linux kernel bonding code, specifically the option handling in bond_option_arp_ip_targets_set. The root cause is an out-of-bounds read when newval->string is empty, causing a read of the byte after the string during in4_pton/strlen flow. The report shows a KASAN slab...

CVE-2024-41001

CVE-2024-41001: In the Linux kernel, io_uring/sqpoll may leak audit memory during connect handling due to path conditions in prep/issue auditing; a blanket NOP before SQPOLL mitigates this. The issue, rated CVSSv3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, is locally exploitable and impacts availabi...

CVE-2024-41060

CVE-2024-41060 (Linux kernel, DRM/Radeon) has a concrete patch: the code now checks bo_va->bo for NULL before dereferencing, preventing a NULL dereference when radeon_vm_clear_freed can clear bo_va->bo. The vulnerability arises from dereferencing bo_va->bo after a potential clear, enabli...

CVE-2024-44946

CVE-2024-44946 affects the Linux kernel kcm subsystem (kcm_sendmsg). The issue was a use-after-free/race: while MSG_MORE skb construction was in progress, another thread could touch it, leading to a double-free in kcm_release() when the skb remained in the write queue. The fix serialises kcm_send...

CVE-2024-44970

CVE-2024-44970 (Linux kernel) affects mlx5e SHAMPO where, after consuming all strides in a WQE, an unlink could be executed again, corrupting the WQ list. The root cause is an extra unlink for a 0-sized consumed stride after a WQE is fully consumed and unlinked. The connected documents confirm a ...