CVE-2024-44970

CVE-2024-44970 relates to the Linux kernel mlx5e SHAMPO driver. When a Work Queue Entry (WQE) has all strides consumed, it is unlinked from the WQ list. The issue allowed receiving CQEs with 0 consumed strides for the same WQE after it was fully consumed and unlinked, triggering an extra unlink t...

CVE-2024-50106

CVE-2024-50106 covers a race in NFS vnode handling in Linux kernels where laundromat may revoke a delegation while another thread frees the associated stateid, causing a use-after-free in nfsd_breaker_owns_lease and a KASAN warning. The cited patch adds coordination between laundromat and FREE_ST...

CVE-2024-50236

CVE-2024-50236 affects the Linux kernel’s ath10k wireless stack. It describes a memory leak in management TX where MSDU context memory was allocated but not freed on TX completion, with similar leaks in the cleanup path. The fix frees the memory during completion/cleanup and protects the mgmt_tx ...

CVE-2024-57901

Technical details for CVE-2024-57901 are not provided in the connected documents. The initial description notes the af_packet vlan_get_protocol_dgram() fix but does not specify affected product/version, exploitability, or remediation beyond generic update guidance. Monitor for updates.

CVE-2024-57979

The CVE-2024-57979 entry is supported by connected documents detailing a Linux kernel use-after-free in pps during device teardown. The root cause is described as pps_device_destruct() freeing the pps_device immediately after cdev_del(), while fops from previously opened cdevs may still be callab...

CVE-2025-21658

Technical details beyond the summary are not provided in the supplied documents; no affected products, versions, or fixes are enumerated here. Monitor for updates.

CVE-2025-21693

In the Linux kernel CVE-2025-21693, the zswap path could UAF resources if the original per-CPU acomp_ctx is still in use when a CPU hotplug occurs, because preemption/migration isn’t disabled during the operation. The defect affects mm/zswap: the code retrieves acomp_ctx on the current CPU at ope...

CVE-2025-21760

CVE-2025-21760: Linux kernel vulnerability in NDISC code. The issue arises because ndisc_send_skb() could be called without RTNL or RCU held, risking use-after-free. The fix adds acquiring rcu_read_lock() earlier to enable use of dev_net_rcu() and prevent UAF. Connected docs also reference relate...

CVE-2025-21865

CVE-2025-21865 : In the Linux kernel, a list corruption scenario in gtp_net_exit_batch_rtnl() could trigger double dellink() on the same device when netns cleanup traverses multiple namespaces. The root cause is a for_each_netdev() loop that conflicts with existing netns destruction, enabling a p...

CVE-2018-1065

The CVE-2018-1065 entry affects the Linux kernel netfilter subsystem up to version 4.15.7. A rule blob containing a jump without a user-defined chain can be exploited by local users with CAP_NET_RAW or CAP_NET_ADMIN to trigger a NULL pointer dereference, causing denial of service. Affected code p...

CVE-2018-7995

CVE-2018-7995 describes a race condition in Linux kernel’s store_int_with_restart() (arch/x86/kernel/cpu/mcheck/mce.c) up to version 4.15.7. This flaw lets a local attacker with root access to write to /sys/devices/system/machinecheck/machinecheck/check_interval and trigger a denial of service/pa...

CVE-2021-47383

CVE-2021-47383 : In the Linux kernel, the tty imageblit out-of-bounds access is caused when an ioctl FBIOPUT_VSCREENINFO with only xres, yres, and bits_per_pixel is sent and the struct matches the previous ioctl. This leaves fb_var_screeninfo incomplete, causing updatescrollmode() to compute a wr...

CVE-2022-3635

CVE-2022-3635 affects the Linux Kernel. The vulnerability is in the function tst_timer of drivers/atm/idt77252.c (IPsec component). It enables a use-after-free condition. A patch is recommended to fix the issue. The provided documents confirm the root cause and the vulnerable file/function, and d...

CVE-2023-52637

CVE-2023-52637 refers to a Linux kernel vulnerability in the j1939 subsystem where a use-after-free (UAF) could occur due to modification of jsk->filters while receiving packets and during setsockopt(SO_J1939_FILTER). The fix adds locking on jsk->sk to prevent UAF and stabilize access to fi...

CVE-2023-52730

CVE-2023-52730 concerns the Linux kernel mmc_sdio subsystem. The issue arises when sdio_add_func() or sdio_init_func() fail: resources may not be released because the sdio function isn’t present to trigger of_node_put() or put_device(). The patch changes logic so that sdio_func_present() only gat...

CVE-2024-24858

CVE-2024-24858 describes a race condition in the Linux kernel's Bluetooth code (net/bluetooth) specifically in {conn,adv}_{min,max}_interval_set() that can cause I2cap connection or broadcast abnormalities, potentially leading to a denial of service. The Astra Linux security bulletin also referen...

CVE-2024-26670

CVE-2024-26670 : Linux kernel arm64 workaround for speculative unpriv load (Cortex-A520/A510 errata) fix. The patch ensures the TLBI+DSB sequence is executed after all explicit memory accesses and places it immediately before the ERET when pagetable isolation is disabled. It reworks the KPTI/eret...

CVE-2024-26899

CVE-2024-26899 — Linux kernel deadlock fix details : Affected component is the block layer in the Linux kernel. The issue arises when bd_link_disk_holder() uses the global open_mutex to guard the creation of a symlink between a holding disk and a slave bdev during driver initialization/modificati...

CVE-2024-35840

The CVE-2024-35840 issue affects the Linux kernel MPTCP path. In subflow_finish_connect(), four fields (backup, join_id, thmac, none) may contain garbage unless OPTION_MPTCP_MPJ_SYNACK is set in mptcp_parse_option(), which is the root cause. The fix enables OPTION_MPTCP_MPJ_SYNACK in mptcp_parse_...

CVE-2024-36968

The CVE-2024-36968 entry concerns the Linux kernel Bluetooth L2CAP path. Concrete details across connected docs show: the vulnerability arises in l2cap_le_flowctl_init() where MTU validation could fail, allowing division by zero and an integer overflow when hdev->le_mtu is out of the valid ran...

CVE-2024-39291

CVE-2024-39291 (Linux kernel) affects the amdgpu path in gfx_v9_4_3.c. The vulnerable code path is gfx_v9_4_3_init_microcode() and related rlc/mec microcode init, where the ucode_prefix buffer was too small, risking truncation when writing strings like amdgpu/%s_rlc.bin or amdgpu/%s_mec.bin with ...

CVE-2024-41044

CVE-2024-41044 : Linux kernel PPP handling vulnerability. The issue arises in ppp_async_encode() which assumes LCP packets have valid body (codes 1–7). An attacker could craft a claim-as-LCP packet that is actually malformed, enabling a local denial-of-service. The fix adds ppp_check_packet() to ...

CVE-2024-41077

Concretely, CVE-2024-41077 affects the Linux kernel null_blk path. The issue arises from an insufficient validation of the block size: the size must be between 512 and PAGE_SIZE and must be a power of two. The faulty check allowed an invalid bs (e.g., 1536) to be accepted, which could cause a nul...

CVE-2024-42302

CVE-2024-42302 : The Linux kernel fixed a use-after-free in PCI/DPC when a DPC event occurs concurrently with hot-removal on the same PCIe hierarchy. The underlying issue was that pci_bridge_wait_for_secondary_bus() did not hold a reference to the child pci_dev during a DPC event, allowing concur...

CVE-2024-43842

CVE-2024-43842 : In the Linux kernel wifi driver rtw89, a bounds check bug in rtw89_sta_info_get_iter() occurs when comparing status->he_gi to the array size, but rate->he_gi is used as the index. This copy-paste mistake can lead to out-of-bounds access if rate->he_gi != status->he_gi...

CVE-2024-46713

CVE-2024-46713 affects the Linux kernel perf/aux path. The root cause was that event->mmap_mutex alone was insufficient to serialize the AUX buffer, enabling race conditions. The fix adds a per-RB mutex to fully serialize AUX buffer access and corrects the previous lock order issue where perf_...

CVE-2024-50195

CVE-2024-50195 is documented in the provided sources as a fix to the Linux kernel posix-clock path. The issue was caused by a missing timespec64 check in pc_clock_settime(), with the fix adding a strict validation (timespec64_valid_strict) of tv_sec and tv_nsec before calling ptp->info->set...

CVE-2024-53113

CVE-2024-53113 (Linux kernel) : A NULL pointer de-reference can occur in alloc_pages_bulk_noprof when a task is migrated between cpusets with cpuset enabled; ac.preferred_zoneref may become NULL during zonelist traversal, leading to a crash. The fixes introduce a NULL pointer check on preferred_z...

CVE-2024-56608

CVE-2024-56608 affects the Linux kernel in the AMD display driver (drm/amd/display) where dcn21_link_encoder_create could perform an out-of-bounds access on the link_enc_hpd_regs array. The connected TencentOS NASL notes the issue is present in kernels prior to 5.15.182.1-1 and that a patch updat...

CVE-2025-22121

CVE-2025-22121 – Linux kernel ext4 xattr check bypass (out-of-bounds read) What’s affected: Linux kernel ext4 filesystem code, specifically ext4_xattr_inode_dec_ref_all() and related xattr handling paths that can read beyond allocated buffers when inodes contain xattrs. What’s the issue: A read o...

CVE-2025-37838

CVE-2025-37838 affects the Linux kernel HSI ssi_protocol: a use-after-free can occur due to a race between ssi_protocol_probe() binding ssi->work to ssip_xmit_work() and ssi_protocol_remove() freeing ssi via kfree(ssi) while the work is still potentially in use. The connected Azure Linux 3.0 a...

CVE-2011-1833

The CVE-2011-1833 issue affects the Linux kernel’s eCryptfs subsystem, specifically the ecryptfs_mount path (fs/ecryptfs/main.c). A race condition during mounting with a mismatched uid could let a local attacker bypass file permissions. This vulnerability is present in kernel versions before 3.1....

CVE-2015-8964

The CVE-2015-8964 entry relates to the Linux kernel prior to 4.5, where the tty_set_termios_ldisc() function in drivers/tty/tty_ldisc.c can allow local users to read a tty data structure and disclose kernel memory. Evidence in connected documents confirms the affected component (tty_ldisc.c), the...

CVE-2016-8658

CVE-2016-8658: Stack-based buffer overflow in brcmf_cfg80211_start_ap (Linux kernel, brcmfmac cfg80211) before 4.7.5. Exploitation path involves sending a Netlink command with a long SSID Information Element, enabling a local attacker to trigger a denial-of-service (system crash) or potentially o...

CVE-2017-14340

CVE-2017-14340 affects the Linux kernel prior to 4.13.2. The XFS_IS_REALTIME_INODE macro in fs/xfs/xfs_linux.h does not verify that a filesystem has a realtime device, enabling a local user to trigger a NULL pointer dereference and OOPS when setting the RHINHERIT flag on a directory. The issue re...

CVE-2017-5897

CVE-2017-5897 involves an out-of-bounds read in the Linux kernel’s IPv6 GRE handling (ip6_gre.c, ip6gre_err). Connected sources (Debian DSA-3791-1 and Cloud Foundry USN-3265-2) confirm the issue and note mitigation via kernel updates (e.g., Debian Jessie fix in linux 3.16.39-1+deb8u1; vendor advi...

CVE-2018-12233

CVE-2018-12233 is a memory-corruption flaw in the Linux kernel’s JFS implementation (fs/jfs/xattr.c) that can be triggered by calling setxattr twice with two different extended attribute names on the same file. The issue stems from an incorrect kmalloc leading to slab-out-of-bounds in jfs_xattr a...

CVE-2019-12615

CVE-2019-12615 affects the Linux kernel (SPARC) in get_vdev_port_node_info in arch/sparc/kernel/mdesc.c prior to/through version 5.1.6, due to an unchecked kstrdup_const of node_info->vdev_port.name that can trigger a NULL pointer dereference and system crash. This is a DoS vulnerability as de...

CVE-2022-29156

The CVE-2022-29156 issue is a Linux kernel vulnerability: a double free in drivers/infiniband/ulp/rtrs/rtrs-clt.c (rtrs_clt_dev_release) present in kernels before 5.16.12. This is a local-attackable condition with high impact on confidentiality, integrity, and availability as reflected by CVSS. R...

CVE-2022-3107

CVE-2022-3107 affects the Linux kernel (up to 5.16-rc6) and is triggered in the netvsc driver (drivers/net/hyperv/netvsc_drv.c) where netvsc_get_ethtool_stats does not properly check the return value of kvmalloc_array(), leading to a NULL pointer dereference. The connected TencentOS/TSSA advisory...

CVE-2022-45888

CVE-2022-45888 affects the Linux kernel up to 6.0.9, specifically the xillybus/xillyusb.c driver, where a race condition and use-after-free can occur during physical removal of a USB device. Connected advisories confirm fixes in later kernel releases (e.g., Debian 6.1.x: 6.1.119-1~deb11u1; SUSE a...

CVE-2022-4696

CVE-2022-4696 is a use-after-free in the Linux kernel’s io_uring subsystem (IORING_OP_SPLICE). If IO_WQ_WORK_FILES is missing, a path including current->nsproxy can lead to reference counter mismanagement and a UAF. Affected component: io_uring/splice paths in kernel 5.10.x. Impact is local: p...

CVE-2022-49273

CVE-2022-49273: In the Linux kernel rtc/pl031 code, clearing the RTC_FEATURE_ALARM bit was performed before ldata->rtc is allocated, risking a null pointer dereference when there is no interrupt line. The fix is to clear RTC_FEATURE_ALARM after the rtc device is allocated. Public advisories (S...

CVE-2022-49376

CVE-2022-49376 affects the Linux kernel SCSI subsystem (sd driver). The issue arises when sd_probe() hits an early error before sdkp->device is initialized, leading to a NULL pointer dereference inside sd_is_zoned() due to an unintended call to sd_zbc_release_disk(). The fix removes the sd_zbc...

CVE-2023-3106

CVE-2023-3106 is reported in Unity Linux advisories as a NULL pointer dereference in netlink_dump. The issue occurs when a Netlink socket receives a message (sendmsg) for XFRM_MSG_GETSA or XFRM_MSG_GETPOLICY with the DUMP flag set, potentially causing a denial of service. The description notes pr...

CVE-2023-52621

CVE-2023-52621: In the Linux kernel, a fix was added to bpf map helpers (bpf_map_lookup_elem, bpf_map_update_elem, bpf_map_delete_elem) to check rcu_read_lock_trace_held() before use when running sleepable BPF programs. The vulnerability arises when sleepable BPF programs manipulate BPF maps unde...

CVE-2023-52751

CVE-2023-52751 : In the Linux kernel CIFS (smb2_query_info_compound), a race between open_cached_dir() and cached_dir_lease_break() can trigger a use-after-free in the cache entry for a newly created directory handle. The issue arises as the code drops the last reference to the new cfid while a l...

CVE-2024-26708

CVE-2024-26708 affects the Linux kernel MPTCP subsystem. Description in provided docs: fastopen race between Fastopen and PM-trigger subflow shutdown can race; initial patch missed a state change before subflow_state_change callback. The fix copies all states reachable from TCP_FIN_WAIT1 to handl...

CVE-2024-35861

CVE-2024-35861: In the Linux kernel, smb client code (cifs) was fixed to address a potential use-after-free in cifs_signal_cifsd_for_reconnect(). The patch adds a skip for sessions that are tearing down (status == SES_EXITING) to avoid a UAF. The description indicates this fixes a use-after-free ...

CVE-2024-35960

The CVE-2024-35960 entry concerns a Linux kernel mlx5 flow rule handling bug. Affected component is net/mlx5 rules in the flow table; the root cause was that add_rule_fg could attach a newly created rule to the tree only when its refcount was 1, while create_flow_handle could reference an existin...