CVE-2024-50135

CVE-2024-50135 pertains to the Linux kernel nvme-pci driver. A race between reset and nvme_dev_disable() could corrupt dev->online_queues, causing invalid values to be passed to blk_mq_update_nr_hw_queues(). The Linux kernel advisory states the fix is to lock the shutdown_lock mutex before usi...

CVE-2024-57901

Mode C: Normal details found. CVE-2024-57901 affects the Linux kernel af_packet code. The bug was in vlan_get_protocol_dgram() interacting with MSG_PEEK, where the previous fix path touched skb data and could crash. The issue was addressed by reworking vlan_get_protocol_dgram() to avoid touching ...

CVE-2025-21867

CVE-2025-21867 concerns the Linux kernel’s BPF test_run path, where eth_skb_pkt_type() could read skb data without an Ethernet header if bpf_prog_test_run_xdp() passed an invalid user_data value. KMSAN reported a use-after-free in this path. The root cause is access to data that may not contain E...

CVE-2026-23268

CVE-2026-23268 is a Linux kernel AppArmor issue where an unprivileged local user can load, replace, and remove AppArmor profiles by abusing apparmorfs and passing a file descriptor to a privileged process. This enables a confused deputy attack, potentially letting the unprivileged user execute a ...

CVE-2016-10044

CVE-2016-10044 is supported by connected advisories: the Linux kernel up to version 4.7.7 contains a vulnerability in the aio_mount path. Specifically, the aio_mount function in fs/aio.c did not properly restrict execute access, enabling local users to bypass SELinux W^X policy and gain privilege...

CVE-2017-16536

CVE-2017-16536 affects the Linux kernel cx231xx USB card driver (cx231xx_usb_probe in drivers/media/usb/cx231xx/cx231xx-cards.c) up to version 4.13.11. The issue allows a local attacker to trigger a NULL pointer dereference leading to a denial of service or system crash via a crafted USB device. ...

CVE-2018-6555

CVE-2018-6555 is a Linux kernel local use-after-free via the irda_setsockopt path in irda/af_irda.c (and later in staging/irda), potentially causing memory corruption, denial of service, or a system crash. Affected trees reference IRDA socket usage as the attack vector. The vulnerability is addre...

CVE-2021-4023

CVE-2021-4023 affects the Linux kernel io-workqueue, with pre-5.15-rc1 kernels able to panic if an improper cancellation triggers new io-uring submissions during memory shortage. The flaw enables a local user with io-uring permissions to crash the system. Connected sources indicate patches/versio...

CVE-2021-47449

CVE-2021-47449 relates to the Linux kernel ice driver locking around the Tx timestamp tracker flush. The issue arises because a lock around the Tx timestamp tracker flow was introduced, and that lock is held during a call to ice_clear_phy_tstamp, which itself sends a PHY write command to firmware...

CVE-2022-49058

CVE-2022-49058 involves a buffer overflow in the Linux kernel CIFS implementation when handling symlinks. The root cause, per the provided description, is that Smatch flags the variable link_len as untrusted (coming from sscanf), which can lead to an out-of-bounds copy into dctx->buf. The fixe...

CVE-2022-49319

CVE-2022-49319 affects the Linux kernel, specifically iommu/arm-smmu-v3. The vulnerability is a NULL pointer dereference that occurs when platform_get_resource() returns NULL, due to a missing return-value check. Affected component/area: ARM SMMU platform resource handling in the IOMMU path. Impa...

CVE-2023-52501

The connected MiracleLinux advisory confirms CVE-2023-52501 affects the Linux kernel ring-buffer code. The issue occurs when iterating a live ring buffer: if the last event sits at the end of a page with only 4 bytes left, the event length check can misread the length (first 4 bytes, or the lengt...

CVE-2023-52757

CVE-2023-52757 : Linux kernel SMB client deadlock fix. The issue arose when releasing mids under server->mid_lock could lead to a deadlock with cifs_tcp_ses_lock and smb2_find_smb_tcon if mids were released without proper references. The patch removes an unnecessary spinlock in release_mid() c...

CVE-2023-52803

The CVE-2023-52803 entry corresponds to a Linux kernel vulnerability: SUNRPC RPC client dereferenced freed pipefs dentries due to a mismatch of the current and original pipefs superblock during cleanup, potentially freeing dentries of the previously released pipefs. The issue occurs when a pipefs...

CVE-2024-22099

Technical details for CVE-2024-22099 are not publicly provided in the supplied documents. Monitor for updates.

CVE-2024-26769

Technical details about CVE-2024-26769 are not publicly provided in the supplied documents. The connected entries mention CVE-2024-26769 among other CVEs but do not specify affected products, versions, impact, or fixes. Action: monitor for updates.

CVE-2024-35869

CVE-2024-35869 is a Linux kernel vulnerability in the SMB/CIFS client code path. The issue arises from failing to properly refcount all child objects when traversing DFS referrals, DFS mount failover, or sessions, risking a use-after-free of session-related references. The flaw is tied to maintai...

CVE-2024-36481

CVE-2024-36481 affects the Linux kernel tracing/btf parsing: btf_find_struct_member() may return NULL or an ERR_PTR, but parse_btf_field() only checked NULL before. The fix uses IS_ERR() and propagates the error up the stack. Affected component is the kernel’s tracing probes; impact is a local vu...

CVE-2024-38598

CVE-2024-38598 — Linux kernel (md/raid10) softlockup during resync Technical details from the provided documents indicate that the issue arises in the md bitmap synchronization path for raid10 during lvextend/lvchange --syncaction, leading to a soft lockup (CPU 3) due to a logic error in md_bitma...

CVE-2024-41023

CVE-2024-41023 — Linux kernel vulnerability in sched/deadline: a task_struct reference leak occurs when a timer is canceled before expiration after start_dl_timer() increments the refcount. The leak happens because the timer callback is supposed to decrement the reference count, but an early-canc...

CVE-2024-42284

CVE-2024-42284: In the Linux kernel, tipc_udp_addr2str() must return non-zero on error to avoid a buffer overflow in tipc_media_addr_printf(). The fix is to return 1 for an invalid UDP media address. Public docs in connected advisories (ALAS2KERNEL / ALAS2KERNEL-5.4/5.10 entries) confirm the issu...

CVE-2024-44947

CVE-2024-44947 is a Linux kernel information-leak vulnerability in the fuse subsystem. The issue arises from fuse_notify_store() not enabling page zeroing like fuse_do_readpage(), causing beyond-EOF page contents to remain uninitialized and potentially be exposed to userspace via mmap when init-o...

CVE-2024-44970

CVE-2024-44970 (Linux kernel) affects mlx5e SHAMPO where, after consuming all strides in a WQE, an unlink could be executed again, corrupting the WQ list. The root cause is an extra unlink for a 0-sized consumed stride after a WQE is fully consumed and unlinked. The connected documents confirm a ...

CVE-2024-46857

CVE-2024-46857 is a Linux kernel vulnerability in net/mlx5 where bridge mode attribute operations crash when numvfs=0 (NULL pointer dereference in mlx5_add_flow_rules). Affected: Linux kernel with mlx5_core/eswitch code. Root cause: bridge mode operations attempted while no VFs exist trigger a NU...

CVE-2024-49882

CVE-2024-49882 : In the Linux kernel’s ext4 code, a double free/UAF issue was fixed in ext4_ext_try_to_merge_up() where path[1].p_bh could be freed twice if not NULL after release. The problem manifested as a warning “brelse a buffer twice” during writeback when ext4 extents were merged and buffe...

CVE-2024-49948

CVE-2024-49948 : In the Linux kernel, the vulnerability stems from insufficient sanity checks in net/core qdisc handling together with virtio_net_hdr_to_skb() parsing. A crafted GSO packet (80 bytes total: 20 IPv4 + 60 TCP + small GSO size) could be misclassified, making skb->len appear larger...

CVE-2024-50036

CVE-2024-50036 is a Linux kernel vulnerability where dst_entries_add() uses per-CPU data that can be freed during netns dismantle, making dst_entries_destroy() race with dst_release() and potentially causing a use-after-free. The issue arises because the count of dsts must be decremented earlier,...

CVE-2024-53208

CVE-2024-53208 is a slab-use-after-free in Bluetooth MGMT set_powered_sync in the Linux kernel. Noise in the Miracle/SUSE advisories confirms the issue and lists it among fixed items in kernel live patches for SLES SLE 15 SPx. Remediation: upgrade/apply the kernel live patch referenced in SUSE/SO...

CVE-2025-21919

CVE-2025-21919 (Linux kernel sched/fair): A memory-corruption issue was fixed in child_cfs_rq_on_list. The prev pointer used in converting to a cfs_rq could originate from rq->leaf_cfs_rq_list, making container_of incorrect and risking memory fault or garbage reads. The patch adds a guard: aft...

CVE-2025-21969

CVE-2025-21969 is a Linux kernel vulnerability in the Bluetooth stack (L2CAP). The issue is a slab-use-after-free in l2cap_send_cmd when the hci sync path releases l2cap_conn but a worker still references it. The root cause is a race between the hci receive data work queue and the l2cap_conn life...

CVE-2014-9322

CVE-2014-9322 affects the Linux kernel pre-3.17.5 where arch/x86/kernel/entry_64.S mishandles faults on the Stack Segment (SS) during IRET, allowing a local user to escalate privileges by accessing a GS Base address from the wrong space. Public PoC/exploitation (BadIRET) exists, illustrating loca...

CVE-2015-3331

CVE-2015-3331 affects the Linux kernel up to 3.19.2, where __driver_rfc4106_decrypt in arch/x86/crypto/aesni-intel_glue.c mishandles memory locations for encrypted data, enabling a context-dependent attacker to trigger a buffer overflow via a crypto API call (e.g., with a libkcapi test program us...

CVE-2022-47520

The CVE-2022-47520 entry concerns Linux kernel before 6.0.11. It stems from missing offset validation in drivers/net/wireless/microchip/wilc1000/hif.c of the WILC1000 wireless driver, allowing an out-of-bounds read while parsing an RSN information element from a Netlink packet. Impact is high for...

CVE-2023-52751

CVE-2023-52751 : In the Linux kernel CIFS (smb2_query_info_compound), a race between open_cached_dir() and cached_dir_lease_break() can trigger a use-after-free in the cache entry for a newly created directory handle. The issue arises as the code drops the last reference to the new cfid while a l...

CVE-2024-26767

CVE-2024-26767 targets the Linux kernel’s drm/amd/display path. The issue stemmed from integer type widening in a loop condition and a missing null check, risking infinite loops and dereferencing NULL. The entry is fixed in the kernel (drm/amd/display: fixed integer types and null check locations...

CVE-2024-26830

Summary (CVE-2024-26830): In the Linux kernel i40e SR-IOV path, when a PF administratively sets a VF MAC and the VF is brought down, the VF’s primary MAC could be removed or zeroed if the VF is untrusted. This is caused by how MAC filters and primary MAC state are handled on VF down. The vulnerab...

CVE-2024-27059

CVE-2024-27059 refers to a Linux kernel vulnerability in the usb-storage isd200 sub-driver. The issue arises from using ATA ID values HEADS and SECTORS to derive cylinder/head for READ/WRITE CDBs; division/modulus by zero could occur if either value is 0. The fix blocks binding to devices with AT...

CVE-2024-35790

CVE-2024-35790 in the Linux kernel : The issue was in the DisplayPort/USB Type-C subsystem where sysfs nodes could be exposed before the driver finished setup, risking NULL pointer dereferences in hpd_show/pin_assignment_show due to dev_get_drvdata() returning NULL. The fix removes manual sysfs n...

CVE-2024-35822

The connected documents confirm CVE-2024-35822 affects the Linux kernel USB gadget mass storage path (usb_udc) where a thread may disable an endpoint while the main thread queues a request. Root cause: a warning in usb_ep_queue() was triggered instead of a functional failure. Fix: replacing WARN_...

CVE-2024-35861

CVE-2024-35861: Linux kernel CIFS client vulnerability fixed by skipping sessions that are tearing down (status SES_EXITING) to avoid a use-after-free in cifs_signal_cifsd_for_reconnect(). The root cause was a potential UAF when reconnecting CIFS sessions. The patch prevents dereferencing freed o...

CVE-2024-35888

Technical details of CVE-2024-35888 are not provided in the supplied documents. Please monitor for updates from official advisories; additional specifics (affected products, impact, and fixes) are not disclosed here.

CVE-2024-35924

In CVE-2024-35924, the Linux kernel fixes a UCSI (usb: typec) read-size overflow for legacy UCSI v1.2. The change truncates read size using the UCSI version to prevent overflowing MESSAGE_IN (size increased from 16 to 256 bytes between v1.2 and v2.0). The fix is described in the CVE entry and ups...

CVE-2024-36933

CVE-2024-36933: In the Linux kernel, the nsh_gso_segment() path could mishandle outer headers when NSH encapsulates other protocols, leading to outer header corruption after GSO segmentation. The fix restores the outer header position by computing outer header placement relative to the inner head...

CVE-2024-42077

CVE-2024-42077 - OCFS2 DIO credit handling in Linux kernel : The vulnerability arises when ocfs2_dio_end_io_write() underestimates required transaction credits during large or multi-extents I/O, risking exhaustion of transaction credits and triggering a kernel panic via OCFS2 abort logic. The roo...

CVE-2024-44934

CVE-2024-44934 — Linux kernel net: bridge: mcast: wait for previous gc cycles when removing port . Syzkaller triggered a use-after-free during port removal because old multicast garbage collection cycles may still be running when a port is freed. The fix is to ensure all prior garbage-collection ...

CVE-2024-44944

CVE-2024-44944: In the Linux kernel netfilter ctnetlink delete-expectation path, the code fails to call nf_expect_get_id() to compute the expectation ID, causing the least-significant-bit of the expectation object address to be leaked to userspace. This is fixed by introducing a call to nf_expect...

CVE-2024-49950

CVE-2024-49950 affects the Linux kernel Bluetooth L2CAP implementation (l2cap_connect), with a slab-use-after-free/KASAN issue reported in l2cap_connect.constprop.0. Connected advisories (Unity Linux UTSA-2026-005148, Azure Linux CVE advisory, MiracleLinux AXSA:2025-10392) confirm the fix has bee...

CVE-2024-49994

CVE-2024-49994 : A Linux kernel vulnerability in the block layer (BLKSECDISCARD) is resolved. The flaw arises from an integer overflow in the discard path, causing a near-infinite loop inside blkdev_issue_secure_erase() when a crafted 64-bit range (e.g., r = {512, 18446744073709551104}) is passed...

CVE-2024-50080

Technical details for CVE-2024-50080 are not publicly provided in the connected documents. The initial description summarizes the vulnerability, but no vendor/product/version specifics are disclosed here. Monitor for official advisories or patches.

CVE-2024-53113

CVE-2024-53113 (Linux kernel) : A NULL pointer de-reference can occur in alloc_pages_bulk_noprof when a task is migrated between cpusets with cpuset enabled; ac.preferred_zoneref may become NULL during zonelist traversal, leading to a crash. The fixes introduce a NULL pointer check on preferred_z...