CVE-2024-39276

A reference count leak exists in the Linux kernel 's ext4 filesystem component within the ext4_xattr_block_cache_find() function. The vulnerability occurs when ext4_sb_bread() returns -ENOMEM; in this scenario, the e_refcnt of the cache entry, which was incremented during __entry_find(), is not p...

CVE-2024-40906

The CVE-2024-40906 entry describes a Linux kernel vulnerability in the mlx5 driver where the health timer could continue after a failed teardown_hca during driver removal, risking a use-after-free that could trigger a page fault. The fix is to always stop the health monitor during driver removal,...

CVE-2024-40965

CVE-2024-40965 (Linux kernel: i2c/lpi2c): The provided documents confirm a fix for a deadlock scenario in i2c-lpi2c where repeated clk_get_rate() calls during transfers could lock the clk mutex and cause deadlock when a tlv320aic32x4 codec is added. The resolution caches the clock rate and uses a...

CVE-2024-41049

CVE-2024-41049: Linux kernel filelock: fix potential use-after-free in posix_lock_inode. The root cause was a race where a tracepoint pointer could be freed before the tracepoint fired, as the request pointer in trace_posix_lock_inode() was moved to a lock entry in an inode’s list and then freed ...

CVE-2024-42284

CVE-2024-42284 affects the Linux kernel Tipc UDP address handling. The vulnerability arises when tipc_udp_addr2str() returns 0 on error, allowing an invalid UDP media address to be treated as valid and potentially triggering a buffer overflow in tipc_media_addr_printf(). The fix commits return a ...

CVE-2024-46826

The CVE-2024-46826 issue is a concrete Linux kernel vulnerability where the ELF loader uses kernel.randomize_va_space twice, allowing potential inconsistency of the randomization value across an exec. The root cause is a double read of the sysctl value, which can change over time, potentially cau...

CVE-2024-47710

CVE-2024-47710 : Linux kernel vulnerability where destroying a sock_map with many buckets could trigger soft lockups. The fix adds a cond_resched() in sock_hash_free() to yield the CPU when needed, addressing repeated syzbot soft lockup reports. Affected component: sock_map/sock_hash_free in Linu...

CVE-2024-49569

The CVE-2024-49569 entry concerns the Linux kernel NVMe/RDMA path. Affected component: nvme_rdma admin queue handling. Root cause: admin_q is quiesced (quiesced admin_q) but not unquiesced before destroy when admin ctrl creation fails, causing pending admin requests to never drain. Impact: kernel...

CVE-2024-50251

CVE-2024-50251 is a Linux kernel netfilter nft_payload vulnerability. The issue arises when nft_payload sanitization of offset and length fails, allowing skb_checksum() to access beyond the sk_buff boundary if offset+length exceeds the skb length, triggering a BUG_ON(). Connected advisories confi...

CVE-2025-21636

CVE-2025-21636 is a Linux kernel vulnerability where the code path for sctp: sysctl: plpmtud_probe_interval used current->nsproxy, risking NULL dereference when the task exits. The fix replaces use of current->nsproxy with obtaining the necessary net pointer from table->data via containe...

CVE-2025-21926

CVE-2025-21926 affects the Linux kernel net: gso code path, specifically __udp_gso_segment. The destructor for the skb is removed before segmenting, but the socket reference is left intact. If the original skb is later orphaned, a kernel bug can trigger (skb_orphan crash in ip_rcv_core). The issu...

CVE-2025-21962

CVE-2025-21962 affects the Linux kernel CIFS mount option closetimeo, where user-provided closetimeo (u32) is converted to jiffies before validation, allowing an integer overflow. Connected sources (Astra Linux, ALAS AWS advisories, Debian/Red Hat references) confirm this as a kernel-level issue ...

CVE-2025-22036

CVE-2025-22036: In the Linux kernel exfat code, get_block can corrupt a stack when a buffer_head is allocated on the stack during racing reads (e.g., do_mpage_readpage). The fix ensures -EAGAIN is returned if a folio has no buffers when bh_read is invoked, so the caller can fallback to block_read...

CVE-2025-37823

CVE-2025-37823: In Linux kernel net_sched hfsc, there is a potential use-after-free (UAF) in hfsc_dequeue() that has been fixed. The patch adds safety guards around hfsc_dequeue() to prevent UAF, addressing a vulnerability in the hfsc class handling. The description notes no reliable reproducer p...

CVE-2014-7970

CVE-2014-7970 is described in connected Lenovo advisories as a Linux kernel vulnerability where pivot_root() could be misused to trigger a local denial of service (mount-tree loop) via dot-path arguments. Lenovo’s advisory for PowerKVM lists affected product: PowerKVM v3.1, and states the issue i...

CVE-2016-4569

CVE-2016-4569 (Linux kernel) : The snd_timer_user_params function in sound/core/timer.c reportedly does not initialize a certain data structure in kernel versions up to 4.6, enabling a local attacker to leak information from kernel stack memory via the ALSA timer interface. This is an information...

CVE-2022-1974

CVE-2022-1974 describes a use-after-free in the Linux kernel NFC core due to a race between kobject creation and deletion. The vulnerability permits a local attacker with CAP_NET_ADMIN to leak kernel information. The description and references indicate this is tied to the Linux NFC subsystem and ...

CVE-2023-23039

CVE-2023-23039 : In the Linux kernel (up to 6.2.0-rc2), the race condition in drivers/tty/vcc.c between vcc_open() and vcc_remove() can cause a use-after-free when a physically proximate attacker removes a VCC device while open() is invoked. This yields a potential impact on integrity and availab...

CVE-2023-3106

CVE-2023-3106 is reported in Unity Linux advisories as a NULL pointer dereference in netlink_dump. The issue occurs when a Netlink socket receives a message (sendmsg) for XFRM_MSG_GETSA or XFRM_MSG_GETPOLICY with the DUMP flag set, potentially causing a denial of service. The description notes pr...

CVE-2023-32269

The CVE-2023-32269 issue is a use-after-free in the Linux kernel (before 6.1.11) in net/netrom/af_netrom.c where accept is allowed for a connected AF_NETROM socket. Exploitation requires netrom routing to be configured or CAP_NET_ADMIN. This vulnerability can lead to local privilege/escalation im...

CVE-2023-52760

CVE-2023-52760 (Linux kernel, gfs2): The vulnerability is caused by a slab-use-after-free in gfs2_qd_dealloc, where in gfs2_put_super() the quota cleanup must occur via gfs2_quota_cleanup() regardless of withdrawal status. If cleanup is delayed (rcu callback) and gfs2_sbd is freed before all gfs2...

CVE-2024-35973

The Linux kernel contains a vulnerability in the geneve tunnel helper where pskb_inet_may_pull() fails to perform proper header validation because it relies on skb->protocol instead of skb_protocol(skb, true). This allows an uninitialized value to be triggered in geneve_xmit() when a VLAN tag ...

CVE-2024-38632

CVE-2024-38632 : Linux kernel vulnerability in vfio/pci memory leak when vfio_irq_ctx_alloc() fails could leak the 'name' memory during vfio_intx_enable(). The issue is resolved in kernel updates per Unity Linux UTSA-2026-005048 (OS kernel patch block). Affected: vfio/pci in the Linux kernel; Roo...

CVE-2024-42240

CVE-2024-42240: Linux kernel x86/bhi vulnerability where, when BHI mitigation is enabled, an entry_SYSENTER_compat() sequence could trigger a #DB handler warning due to the TF single-step bit handling. The fix changes the order to clear the TF flag before or after clearing branch history as appro...

CVE-2024-46771

CVE-2024-46771 : In the Linux kernel, the can:bcm module leaked a proc entry when a bound BCM socket was unregistered. The repro flow creates a BCM connect(), registers a proc entry, then unregisters the bound netdev and attempts a second connect(), which can allocate a new proc entry with the sa...

CVE-2024-50080

Technical details for CVE-2024-50080 are not publicly provided in the connected documents. The initial description summarizes the vulnerability, but no vendor/product/version specifics are disclosed here. Monitor for official advisories or patches.

CVE-2024-53056

CVE-2024-53056 affects the Linux kernel in the drm/mediatek component, specifically the mtk_crtc_destroy() NULL-dereference risk caused by cleanup behavior when mtk_crtc_create() fails to obtain a channel via mbox_request_channel(). The issue arises because, if the call to mbox_request_channel() ...

CVE-2024-53097

CVE-2024-53097 affects the Linux kernel mm/krealloc path. Connected sources confirm a patch for mm: krealloc: Fix MTE false alarm in __do_krealloc, addressing a false KASAN/MTE slab-out-of-bounds error triggered when zeroing spare memory in __do_krealloc. Root cause: memory tagging mismatch due t...

CVE-2024-56608

CVE-2024-56608 affects the Linux kernel in the AMD display driver (drm/amd/display) where dcn21_link_encoder_create could perform an out-of-bounds access on the link_enc_hpd_regs array. The connected TencentOS NASL notes the issue is present in kernels prior to 5.15.182.1-1 and that a patch updat...

CVE-2024-57980

Summary of CVE-2024-57980 (Linux kernel) : The vulnerability is in the media: uvcvideo path where, if uvc_status_init() fails to allocate the int_urb, the code frees dev->status but does not set it to NULL. This leads to a double-free in uvc_status_cleanup() when the memory is freed again. The...

CVE-2025-21667

CVE-2025-21667 : Linux kernel vulnerability where on 32-bit builds iomap_write_delalloc_scan() used a 32-bit position due to folio_next_index() returning an unsigned long, truncating 64-bit offsets and potentially causing an infinite loop during writes to XFS. Connected documents confirm the root...

CVE-2025-21673

CVE-2025-21673 affects the Linux kernel SMB CIFS client. The issue is a double free of TCP_Server_Info::hostname in cifs_put_tcp_session() when a cifsd thread reconnects to multiple DFS targets during shutdown. This can allow a memory release/use-after-free scenario leading to a crash (reported a...

CVE-2025-21859

CVE-2025-21859 affects the Linux kernel USB gadget f_midi path; a deadlock occurs when a lock is acquired twice in a re-entrant f_midi_transmit. The fix is to schedule the inner f_midi_transmit via a high-priority work queue using queue_work() from the completion handler. Patched commits are refe...

CVE-2025-21959

CVE-2025-21959 affects the Linux kernel nf_conncount under netfilter. The vulnerability stems from incomplete initialization of nf_conncount_tuple in the insert_tree path: cpu and jiffies32 fields are initialized during nf_conncount_add() but not in the corresponding insert_tree() allocation, aft...

CVE-2025-22056

The CVE-2025-22056 issue affects the Linux kernel nft_tunnel handling of NFTA_TUNNEL_KEY_OPTS_GENEVE attributes, where the parse/dump logic performed type conversions before pointer arithmetic, causing a slab-out-of-bounds write. The fix is to perform pointer addition using char* units and correc...

CVE-2010-2521

CVE-2010-2521 affects the Linux kernel NFS server (fs/nfsd/nfs4xdr.c) prior to 2.6.34-rc6. The issue is due to multiple buffer overflows in the XDR implementation, exploitable via a crafted NFSv4 WRITE request, impacting the read_buf and nfsd4_decode_compound paths. Consequences include denial of...

CVE-2014-4943

CVE-2014-4943 affects the Linux kernel up to 3.15.6, specifically the PPPoL2TP feature in net/l2tp/l2tp_ppp.c. The vulnerability arises from data-structure differences between an l2tp socket and an inet socket, enabling local privilege escalation. Public details in connected sources include PoC/e...

CVE-2016-10200

CVE-2016-10200 describes a race condition in the Linux kernel’s L2TPv3 IP Encapsulation feature that can allow a local user to escalate privileges or cause a denial of service via repeated bind() calls without correctly checking SOCK_ZAPPED status. The issue affects Linux kernels prior to 4.8.14,...

CVE-2017-2596

CVE-2017-2596 affects the Linux kernel’s KVM VMX handling. The nested_vmx_check_vmptr function in arch/x86/kvm/vmx.c through kernel 4.9.8 incorrectly emulates the VMXON instruction, enabling a local L1 guest user to cause host memory exhaustion and a denial of service by abusing mishandled page r...

CVE-2019-19039

CVE-2019-19039 is a Linux kernel vulnerability affecting btrfs: the function __btrfs_free_extent in fs/btrfs/extent-tree.c may trigger a path in btrfs_print_leaf during an ENOENT case, enabling a local attacker to obtain potentially sensitive information about register values via dmesg. The descr...

CVE-2022-32981

CVE-2022-32981 : Linux kernel up to 5.18.3 on powerpc 32-bit platforms contains a buffer overflow in ptrace PEEKUSER/POKEUSER when accessing floating point registers. The issue is described as a local‑level vulnerability in the kernel’s ptrace access path. The provided documents do not specify af...

CVE-2023-1670

CVE-2023-1670 is a Linux kernel issue affecting the Xircom 16-bit PCMCIA (PC-card) Ethernet driver, where a use-after-free in the xirc2ps_cs network driver can allow a local attacker to crash the system or potentially escalate privileges. The vulnerability is described in the initial CVE entry as...

CVE-2024-27415

CVE-2024-27415 : Linux kernel netfilter bridge multicast handling races between macvlan clones and conntrack nf_confirm, risking unconfirmed nf_conn entries for multicast/broadcast frames. The race occurs when a L2 multicast/broadcast packet is cloned and sent across bridge interfaces, with confi...

CVE-2024-35880

CVE-2024-35880 relates to Linux kernel io_uring/kbuf handling. The issue occurs when mmap is involved: the kernel may dereference an io_buffer_list or unregister it while in use, leading to potential use-after-free or similar hazards. The description states the fix was to ensure the kbuf lookup k...

CVE-2024-36950

CVE-2024-36950 is a Linux kernel vulnerability resolved in the FireWire OHCI driver. The issue occurred in the interrupt handler when a bus reset interrupt could be unmasked and cause a freeze if the bus reset was not yet serviced. The fix masks bus reset interrupts in the IRQ handler and unmasks...

CVE-2024-39497

CVE-2024-39497: In the Linux kernel, drm/shmem-helper fix for a BUG_ON() triggered by mmap(PROT_WRITE, MAP_PRIVATE) in drm_gem_shmem_mmap. The issue arose from a missing check for copy-on-write (COW) mappings, which could lead to a kernel panic at vmf_insert_pfn_prot when a VMA has VM_PFNMAP and ...

CVE-2024-41062

CVE-2024-41062 concerns the Linux kernel Bluetooth L2CAP path where a race can occur between sock_close releasing a socket and hci_rx_work accessing it. The root cause is a lack of lock protection around the socket during the transition, potentially allowing hci_rx_work to touch a freed sock. The...

CVE-2024-41077

Concretely, CVE-2024-41077 affects the Linux kernel null_blk path. The issue arises from an insufficient validation of the block size: the size must be between 512 and PAGE_SIZE and must be a power of two. The faulty check allowed an invalid bs (e.g., 1536) to be accepted, which could cause a nul...

CVE-2024-42094

CVE-2024-42094 affects the Linux kernel where CONFIG_CPUMASK_OFFSTACK=y caused explicit cpumask var allocation on the stack in net/iucv to risk stack overflow. The fix is to use the *cpumask_var API(s) to allocate cpumask variables in a config-neutral way, leaving allocation strategy to CONFIG_CP...

CVE-2024-44970

CVE-2024-44970 relates to the Linux kernel mlx5e SHAMPO driver. When a Work Queue Entry (WQE) has all strides consumed, it is unlinked from the WQ list. The issue allowed receiving CQEs with 0 consumed strides for the same WQE after it was fully consumed and unlinked, triggering an extra unlink t...