CVE-2024-44944

CVE-2024-44944: In the Linux kernel netfilter ctnetlink delete-expectation path, the code fails to call nf_expect_get_id() to compute the expectation ID, causing the least-significant-bit of the expectation object address to be leaked to userspace. This is fixed by introducing a call to nf_expect...

CVE-2024-49994

CVE-2024-49994 : A Linux kernel vulnerability in the block layer (BLKSECDISCARD) is resolved. The flaw arises from an integer overflow in the discard path, causing a near-infinite loop inside blkdev_issue_secure_erase() when a crafted 64-bit range (e.g., r = {512, 18446744073709551104}) is passed...

CVE-2024-50080

Technical details for CVE-2024-50080 are not publicly provided in the connected documents. The initial description summarizes the vulnerability, but no vendor/product/version specifics are disclosed here. Monitor for official advisories or patches.

CVE-2024-53113

CVE-2024-53113 (Linux kernel) : A NULL pointer de-reference can occur in alloc_pages_bulk_noprof when a task is migrated between cpusets with cpuset enabled; ac.preferred_zoneref may become NULL during zonelist traversal, leading to a crash. The fixes introduce a NULL pointer check on preferred_z...

CVE-2024-56647

CVE-2024-56647: In the Linux kernel, icmp host relookup can trigger ip_rt_bug when ARP/link conditions and xfrm are involved. The fix skips icmp relookup for locally generated packets (e.g., ICMP errors) to avoid dst->out being ip_rt_bug on loopback and similar scenarios. Reproduced scenario s...

CVE-2025-21667

CVE-2025-21667 : Linux kernel vulnerability where on 32-bit builds iomap_write_delalloc_scan() used a 32-bit position due to folio_next_index() returning an unsigned long, truncating 64-bit offsets and potentially causing an infinite loop during writes to XFS. Connected documents confirm the root...

CVE-2025-21693

In the Linux kernel CVE-2025-21693, the zswap path could UAF resources if the original per-CPU acomp_ctx is still in use when a CPU hotplug occurs, because preemption/migration isn’t disabled during the operation. The defect affects mm/zswap: the code retrieves acomp_ctx on the current CPU at ope...

CVE-2025-38352

CVE-2025-38352: In the Linux kernel, a TOCTOU race affects posix-cpu-timers between handle_posix_cpu_timers() and posix_cpu_timer_del() when an exiting non-autoreaping task runs from IRQ. The fix adds a tsk->exit_state check into run_posix_cpu_timers() to prevent misdetection of timer->it.c...

CVE-2013-4563

CVE-2013-4563 applies to the Linux kernel UDP Fragmentation Offload (UFO) path. The udp6_ufo_fragment function in net/ipv6/udp_offload.c can mis-evaluate a size comparison before inserting a fragment header when UFO is enabled, enabling remote attackers to trigger a denial of service (panic) by s...

CVE-2014-9584

CVE-2014-9584 affects the Linux kernel where the function parse_rock_ridge_inode_internal in fs/isofs/rock.c does not validate a length value in the ER System Use Field, enabling local users to obtain sensitive kernel memory via a crafted iso9660 image. This vulnerability exists in kernels before...

CVE-2019-14763

CVE-2019-14763 affects the Linux kernel prior to 4.16.4, where a double-locking error in drivers/usb/dwc3/gadget.c may deadlock with f_hid. Exploitation context from connected Nessus advisories links CVE-2019-14763 to kernel fixes (4.16.4) and security advisories (e.g., USN/EulerOS entries). The ...

CVE-2021-28691

Summary (CVE-2021-28691) In the Linux kernel Xen hypervisor integration, xen-netback may suffer a use-after-free when tearing down the backend. The root cause is that the RX task thread can be freed if the frontend triggers a thread stop during backend teardown, leading to a stale pointer being u...

CVE-2021-38202

CVE-2021-38202 affects the Linux kernel before 5.13.4, where fs/nfsd/trace.h can allow remote attackers to trigger a denial-of-service via an out-of-bounds read in strlen when the trace event framework is used for nfsd. The vulnerability is triggered by NFS traffic sent over the network. A fix wa...

CVE-2021-4093

CVE-2021-4093 : A flaw in the KVM AMD SEV-ES code allows a malicious VM using SEV-ES to trigger out-of-bounds reads/writes in the host kernel via a VMGEXIT with a string I/O instruction (e.g., outs/ins) using exit reason SVM_EXIT_IOIO. This can crash the host or enable a guest-to-host escape. Aff...

CVE-2021-47383

CVE-2021-47383 : In the Linux kernel, the tty imageblit out-of-bounds access is caused when an ioctl FBIOPUT_VSCREENINFO with only xres, yres, and bits_per_pixel is sent and the struct matches the previous ioctl. This leaves fb_var_screeninfo incomplete, causing updatescrollmode() to compute a wr...

CVE-2021-47497

The CVE-2021-47497 entry details a Linux kernel UBSAN issue in nvmem: when a cell’s nbits is a multiple of 8, the code does a shift GENMASK((cell->nbits%BITS_PER_BYTE) - 1, 0) which becomes a shift by 64 (or more) and is undefined. The fix adds a guard to ensure there are bits to mask before p...

CVE-2021-47560

The CVE-2021-47560 issue affects the Linux kernel mlxsw: spectrum driver. When processing port up/down events from device firmware, the driver failed to bail out for CPU port 0 (local port 0), which exists but lacks a netdev, risking a NULL pointer dereference on netif_carrier_{on,off}(). The emb...

CVE-2022-24122

CVE-2022-24122 affects the Linux kernel in versions 5.14–5.16.4 when unprivileged user namespaces are enabled. The issue is a use‑after‑free in the ucounts object that can outlive its namespace, enabling a local privilege escalation. The vulnerability is described in kernel/ucount.c and is docume...

CVE-2023-52513

The CVE-2023-52513 entry maps to a Linux kernel RDMA/siw issue where a NULL listener dereference in siw_cm_work_handler() could crash when an immediate MPA request failed. The fix unlinks the listening endpoint, cancels the useless MPA timeout, and suppresses scheduling a TCP socket read in sk_da...

CVE-2024-36968

CVE-2024-36968 (Linux kernel) : A Bluetooth L2CAP issue in the kernel could cause div-by-zero and integer overflow due to hdev->le_mtu potentially being out of range. The fix moves MTU validation from hci_dev to hci_conn, halting connection setup when MTU is invalid, and adds validation in rea...

CVE-2024-38618

CVE-2024-38618 affects the Linux kernel: ALSA timer start tick time had no lower bound, enabling very small values (e.g., 1 tick at 1ns) that could trigger an unexpected RCU stall by repeatedly queuing expire updates. The connected docs describe the fix as a patch adding a sanity check for the ti...

CVE-2024-40958

CVE-2024-40958 relates to the Linux kernel: get_net_ns() may perform a refcount increment on a net namespace with zero refcount, triggering a use-after-free warning and potential kernel panic. The root cause is an addition on 0 refcount via get_net_ns(), surfaced during operations like netns swit...

CVE-2024-40967

CVE-2024-40967 affects the Linux kernel serial: imx subsystem. The root cause is a potential deadlock while waiting for USR2_TXDC in transmitter empty handling. The patch introduces a timeout of at most 1 second; if the timeout occurs, the driver ignores the transmitter state and continues optimi...

CVE-2024-40995

CVE-2024-40995 affects the Linux kernel net/sched: act_api where repeated adds of actions with the same index could hang by causing an infinite loop in tcf_idr_check_alloc. The fix returns -EAGAIN to prevent the loop while preserving documented behavior. Syzbot reported tasks blocked waiting on r...

CVE-2024-41056

CVE-2024-41056 is a Linux kernel vulnerability in the firmware cs_dsp code. The issue was a potential overrun when parsing V1 wmfw file name fields stored as fixed-size, NUL-terminated strings. The fix replaces strlen() with strnlen() for the algorithm and coefficient name strings to guard agains...

CVE-2024-44987

Summary of CVE-2024-44987 (Linux kernel) : A use-after-free in ip6_send_skb() was reported by syzbot. After ip6_local_out() returns, dereferencing rt could occur without holding rcu_read_lock(), enabling a slab-use-after-free as shown in the kasan trace net/ipv6/ip6_output.c:1964. The issue is mi...

CVE-2024-46695

CVE-2024-46695 affects the Linux kernel; the root cause is a permissions bypass in the SELinux/Smack ininode_setsecctx hook. The bug allowed a privileged user (root) on an NFS client to change security labels on files on an NFS export with root squash enabled, due to incomplete permission checks ...

CVE-2024-46819

CVE-2024-46819: In the Linux kernel, the drm/amdgpu path for nbio_v7_4 could dereference an obj when ras_manager.obj is null, causing a warning and potential data leakage through NBIO data. The issue has been resolved in the cited update. The description notes a fix to avoid printing NBIO error d...

CVE-2024-47692

CVE-2024-47692 : Linux kernel NFS server (nfsd) vulnerability where namelen can be 0 if main.sqlite is corrupted, causing memdup_user() to return ZERO_SIZE_PTR and leading to NULL pointer dereference when accessing name.data in nfs4_client_to_reclaim(). The issue is resolved by adding a namelen v...

CVE-2024-49933

CVE-2024-49933 is a Linux kernel issue related to blk_iocost where UBSAN detected shift-out-of-bounds in ioc_forgive_debts() (shift exponent 80 on a 64-bit type). The connected Astra Linux bulletin confirms the same vulnerability and describes the concrete out-of-bounds shifts in block/blk-iocost...

CVE-2024-50008

Technical details about CVE-2024-50008 are not publicly provided in the connected documents. The initial description mentions a Linux kernel fix related to mwifiex, but no concrete affected products/versions/root cause or remediation are given here. Monitor for updates.

CVE-2024-50117

CVE-2024-50117 affects the Linux kernel DRM/AMDGPU path (ATIF ACPI method). The vulnerability stems from bad data returned by BIOS ACPI ATIF calls, which could cause a NULL pointer dereference in the caller when amdgpu_atif_query_backlight_caps processes the result. The issue was resolved by guar...

CVE-2024-50262

CVE-2024-50262 – Linux kernel trie_get_next_key() out-of-bounds write Root cause: trie_get_next_key() allocates a node stack with size trie->max_prefixlen but writes trie->max_prefixlen+1 nodes when the path is full, leading to an out-of-bounds write. This can occur for tries with max_prefi...

CVE-2024-53072

CVE-2024-53072 affects the Linux kernel, specifically the platform/x86/amd/pmc component. The issue arises when STB is requested via amd_pmc enable_stb=1 and S2D_PHYS_ADDR_LOW/HIGH return 0, indicating STB is inaccessible. This causes ioremap warnings in arch/x86/mm/ioremap.c and can lead to kern...

CVE-2024-56688

CVE-2024-56688 (Linux kernel) : The vulnerability concerns sunrpc transport timeout handling. The fix resolves an issue where, during a transport reset, transport->sock can be set to NULL but xs_tcp_set_socket_timeouts() could still dereference it in xs_tcp_send_request(), potentially leading ...

CVE-2024-56729

CVE-2024-56729 concerns the Linux kernel’s SMB/CIFS path. The vulnerability arises from not initializing cfid->tcon before performing network operations, which can cause a leak of a tcon reference when a lease-break races with opening a cached directory. The described root cause is that cached...

CVE-2025-21959

CVE-2025-21959 affects the Linux kernel netfilter nf_conncount code. The issue arises from not initializing fields cpu and jiffies32 in struct nf_conncount_tuple during insertion (insert_tree()), after prior fixes added cpu/jiffies32 in nf_conncount_add() but count_tree() path remained uninitiali...

CVE-2025-37738

CVE-2025-37738 details from Connected docs show a Linux kernel ext4 vulnerability: ext4_xattr_inode_dec_ref_all may read past the end while processing xattrs, leading to a slab-use-after-free as reported by KASAN. The fix makes ext4_xattr handling ignore xattrs entries beyond the end, preventing ...

CVE-2014-8133

CVE-2014-8133 affects the Linux kernel TLS implementation (arch/x86/kernel/tls.c) up to version 3.18.1. A local attacker can exploit a crafted application that uses set_thread_area and subsequently reads a 16‑bit value to bypass the espfix protection and, in turn, bypass ASLR. The description con...

CVE-2016-9604

CVE-2016-9604 affects the Linux kernel prior to 4.11-rc8. A local attacker who can join the kernel session keyring can access internal keyrings (e.g., .dns_resolver, .builtin_trusted_keys) and bypass module signature verification by adding a self-generated public key to the keyring, enabling loca...

CVE-2016-9806

CVE-2016-9806 describes a race condition in the Linux kernel netlink_dump function (net/netlink/af_netlink.c) that can be triggered by local users via craftedsendmsg calls, leading to a double-free and potentially other impacts. Public advisories from MiracleLinux, Unity Linux, and Oracle Linux d...

CVE-2017-6264

CVE-2017-6264 is an elevation-of-privilege vulnerability in the NVIDIA GPU driver used on Android, specifically within the gm20b_clk_throt_set_cdev_state path. An out-of-bounds memory read can be used as a function pointer, potentially allowing a local attacker to execute arbitrary code in kernel...

CVE-2018-18386

The CVE-2018-18386 issue affects the Linux kernel up to version 4.14.10, in drivers/tty/n_tty.c, where an EXTPROC vs ICANON confusion in TIOCINQ allows local attackers with access to pseudo terminals to hang or block further use of any PTY. The root cause is a terminal/TTY handling inconsistency,...

CVE-2022-49080

CVE-2022-49080 affects the Linux kernel mempolicy path, where allocating mpol_new and leaking it can occur if a restart loop drops sp->lock before refcnt is initialized. The issue arises in shared_policy_replace when mempolicy is updated on a shared shmem file under concurrent access, potentia...

CVE-2022-49323

CVE-2022-49323 affects the Linux kernel IOMMU ARM-SMMU code. The issue is a possible null pointer dereference in arm_smmu_device_probe() when resource retrieval returns NULL, which could occur when using the resource pointer before it is validated. The fix rearranges resource handling by deferrin...

CVE-2023-3355

CVE-2023-3355 affects the Linux kernel’s MSM GPU driver, specifically the code path in drivers/gpu/drm/msm/msm_gem_submit.c (submit_lookup_cmds). The vulnerability arises from a NULL pointer dereference due to an missing validation of kmalloc() return value, enabling a local user to crash the sys...

CVE-2023-52635

The CVE-2023-52635 entry concerns a Linux kernel devfreq timer race. Description: frequent governor switches (e.g., simple_ondemand and performance) on a devfreq device may race with timer cancellation and expiration, risking timer_list corruption when cancel_delayed_work_sync() is followed by ex...

CVE-2023-52643

CVE-2023-52643: Linux kernel iio subsystem memleak in iio_device_register_sysfs_group on failure to free iio_dev_opaque->chan_attr_group.attrs. The MiracleLinux AXSA advisory confirms the patch and remediation via updated kernel, with no exploitation details provided. Upgrade to a kernel versi...

CVE-2024-24855

CVE-2024-24855 describes a race condition in the Linux kernel’s SCSI lpfc_unregister_fcf_rescan() function that can cause a NULL pointer dereference, potentially leading to a kernel panic or denial of service. The vulnerability is tied to the kernel’s SCSI device driver (lpfc) and is referenced a...

CVE-2024-26712

CVE-2024-26712 is a Linux kernel flaw where page alignment in kasan_init_region could make an address (va) invalid during initial page block setup, enabling memory overwrites when k_start is not page-aligned. The issue stems from k_cur being computed before memblock_alloc and using block + k_cur ...