CVE-2023-52572

CVE-2023-52572 is confirmed in the provided connected documents. The vulnerability is a use-after-free (UAF) in the CIFS/SMB protocol handling inside the Linux kernel, specifically in cifs_demultiplex_thread() and related paths, which can lead to a UAF in smb2_is_network_name_deleted and downstre...

CVE-2023-52635

The CVE-2023-52635 entry concerns a Linux kernel devfreq timer race. Description: frequent governor switches (e.g., simple_ondemand and performance) on a devfreq device may race with timer cancellation and expiration, risking timer_list corruption when cancel_delayed_work_sync() is followed by ex...

CVE-2023-52813

CVE-2023-52813 : Linux kernel crypto: pcrypt fix hungtask for PADATA_RESET. The issue was a hung task in test_aead_vec_cfg caused by padata_do_parallel returning -EBUSY when pinst->flags included PADATA_RESET, preventing aead_request_complete() and leading to a hung wait. Connected sources des...

CVE-2024-22099

Technical details for CVE-2024-22099 are not publicly provided in the supplied documents. Monitor for updates.

CVE-2024-27415

CVE-2024-27415 : Linux kernel netfilter bridge multicast handling races between macvlan clones and conntrack nf_confirm, risking unconfirmed nf_conn entries for multicast/broadcast frames. The race occurs when a L2 multicast/broadcast packet is cloned and sent across bridge interfaces, with confi...

CVE-2024-35790

CVE-2024-35790 in the Linux kernel : The issue was in the DisplayPort/USB Type-C subsystem where sysfs nodes could be exposed before the driver finished setup, risking NULL pointer dereferences in hpd_show/pin_assignment_show due to dev_get_drvdata() returning NULL. The fix removes manual sysfs n...

CVE-2024-35888

CVE-2024-35888 affects the Linux kernel erspan/ip6erspan paths. The issue was that ip6erspan_rcv() and erspan_rcv() did not ensure erspan_base_hdr is present in the skb->head before reading the ver field, risking uninitialized access. The fix adds missing pskb_may_pull() checks to ensure the l...

CVE-2024-36000

The vulnerability CVE-2024-36000 is a Linux kernel issue where mm/hugetlb could miss acquiring hugetlb_lock during resv uncharge, particularly in a userfault context via UFFDIO_COPY. The root cause is locking criteria being overlooked in hugetlb_cgroup_uncharge_folio_rsvd(), which updates the cgr...

CVE-2024-36025

CVE-2024-36025 is validated by connected MiracleLinux security advisory AXSA:2024-8783:27. Affected: Linux kernel scsi qla2xxx driver. Root cause: memory corruption from an off-by-one in qla_edif_app_getstats() where app_reply->elem[] (allocated for app_req.num_ports) could be overrun due to a...

CVE-2024-36899

CVE-2024-36899 affects the Linux kernel gpiolib, specifically the cdev path usedwhen closing a GPIO chip device file. The issue is a use-after-free involving watched_lines: during gpio_chrdev_release(), watched_lines is freed with bitmap_free(), but lineinfo_changed_nb notifier chain unregistrati...

CVE-2024-36930

In CVE-2024-36930, the Linux kernel SPI subsystem spi_sync is affected. When a non-empty SPI queue is used and the same spi_message is reused, the complete callback remains set after context clear, causing a null pointer dereference during spi_finalize_current_message(). The provided connectivity...

CVE-2024-40940

The CVE-2024-40940 issue affects the Linux kernel mlx5 driver (net/mlx5). The root cause is in mlx5_lag_create_port_sel_table(): when a flow rule creation fails, the tainted pointer is deleted multiple times instead of using the correct flow rule pointers. The bug is fixed by using the correct fl...

CVE-2024-41066

CVE-2024-41066 affects the ibmvnic driver in the Linux kernel. The publicly documented fix addresses a memory-leak risk during transmit: the driver previously assigned skb pointers to tx_buff entries without verifying that the target address was unused/null. If free_map and tx_buff became out of ...

CVE-2024-42077

CVE-2024-42077 - OCFS2 DIO credit handling in Linux kernel : The vulnerability arises when ocfs2_dio_end_io_write() underestimates required transaction credits during large or multi-extents I/O, risking exhaustion of transaction credits and triggering a kernel panic via OCFS2 abort logic. The roo...

CVE-2024-44944

CVE-2024-44944: In the Linux kernel netfilter ctnetlink delete-expectation path, the code fails to call nf_expect_get_id() to compute the expectation ID, causing the least-significant-bit of the expectation object address to be leaked to userspace. This is fixed by introducing a call to nf_expect...

CVE-2024-49948

CVE-2024-49948 : In the Linux kernel, the vulnerability stems from insufficient sanity checks in net/core qdisc handling together with virtio_net_hdr_to_skb() parsing. A crafted GSO packet (80 bytes total: 20 IPv4 + 60 TCP + small GSO size) could be misclassified, making skb->len appear larger...

CVE-2024-49989

CVE-2024-49989: In the Linux kernel, the drm/amd/display path fixes a double-free when unloading the amdgpu module. The issue arises during cleanup of display encoders for flexible/inflexible endpoints, potentially freeing the same object twice during amdgpu driver unload. Connected advisories (A...

CVE-2024-50121

CVE-2024-50121 affects the Linux kernel component nfsd, specifically the race where nfsd_shrinker_work may be cancelled in nfs4_state_shutdown_net without waiting for the shrinker to exit. This can cause warnings and use-after-free scenarios when unhashing and destroying nfsd clients during net s...

CVE-2024-50135

CVE-2024-50135 pertains to the Linux kernel nvme-pci driver. A race between reset and nvme_dev_disable() could corrupt dev->online_queues, causing invalid values to be passed to blk_mq_update_nr_hw_queues(). The Linux kernel advisory states the fix is to lock the shutdown_lock mutex before usi...

CVE-2024-53060

CVE-2024-53060 (Linux kernel) affects drm/amdgpu: fixes a NULL pointer dereference when ATIF is not supported. The kernel may dereference buffer.pointer (obj) if acpi_evaluate_object() returns AE_NOT_FOUND, so the fix adds a bailout when AE_NOT_FOUND occurs to prevent NULL dereference. The Note i...

CVE-2024-53097

CVE-2024-53097 affects the Linux kernel mm/krealloc path. Connected sources confirm a patch for mm: krealloc: Fix MTE false alarm in __do_krealloc, addressing a false KASAN/MTE slab-out-of-bounds error triggered when zeroing spare memory in __do_krealloc. Root cause: memory tagging mismatch due t...

CVE-2024-56729

CVE-2024-56729 concerns the Linux kernel’s SMB/CIFS path. The vulnerability arises from not initializing cfid->tcon before performing network operations, which can cause a leak of a tcon reference when a lease-break races with opening a cached directory. The described root cause is that cached...

CVE-2024-58007

CVE-2024-58007 affects the Linux kernel in the soc: qcom: socinfo path, specifically on MSM8916 devices where the sysfs serial_number is constant. The root cause is an out-of-bounds read of the serial_num field in the socinfo structure due to checking the start offset instead of the end when vali...

CVE-2024-58083

CVE-2024-58083 affects the Linux kernel KVM: the target vCPU was not reliably verified online before clamping the index in kvm_get_vcpu(). If the index is bad, nospec clamping could return vCPU0, leading to a use‑after‑free when vCPU0 is dereferenced. The issue is mitigated by ensuring vCPU0 is o...

CVE-2025-21673

CVE-2025-21673 affects the Linux kernel SMB CIFS client. The issue is a double free of TCP_Server_Info::hostname in cifs_put_tcp_session() when a cifsd thread reconnects to multiple DFS targets during shutdown. This can allow a memory release/use-after-free scenario leading to a crash (reported a...

CVE-2025-21727

CVE-2025-21727 : Linux kernel issue in padata_reorder causing a use-after-free in padata_find_next under certain race conditions. The provided connected documents confirm a KASAN UAF scenario when a parallel padata_reorder/serial flow frees Pd too early and later calls padata_find_next. The remed...

CVE-2025-21782

CVE-2025-21782 — Linux kernel: orangefs: fix a slab-out-of-bounds in orangefs_debug_write. A syzbot report described slab-out-of-bounds Read in orangefs_debug_write; patch was tested and applied to fix the issue. The vulnerability is tied to the OrangeFS write path and is addressed by kernel fixe...

CVE-2021-47560

The CVE-2021-47560 issue affects the Linux kernel mlxsw: spectrum driver. When processing port up/down events from device firmware, the driver failed to bail out for CPU port 0 (local port 0), which exists but lacks a netdev, risking a NULL pointer dereference on netif_carrier_{on,off}(). The emb...

CVE-2022-3107

CVE-2022-3107 affects the Linux kernel (up to 5.16-rc6) and is triggered in the netvsc driver (drivers/net/hyperv/netvsc_drv.c) where netvsc_get_ethtool_stats does not properly check the return value of kvmalloc_array(), leading to a NULL pointer dereference. The connected TencentOS/TSSA advisory...

CVE-2022-48943

CVE-2022-48943: In the Linux kernel KVM x86/mmu code, a bug in asynchronous page-fault (APF) handling could cause a guest to hang by confusing a valid token with a zero value, potentially delaying or losing READY events. The fix ensures the APF token is non-zero, preventing misinterpretation of t...

CVE-2022-49322

The CVE-2022-49322 issue affects the Linux kernel in PREEMPT_RT builds when bootparams include trace_event=initcall:initcall_start tp_printk=1. In this scenario, output_printk() triggers a sleepable rt-spinlock usage via rt_spin_lock, causing a sleeping function to be called from an invalid conte...

CVE-2022-49451

CVE-2022-49451 affects the Linux kernel firmware: arm_scmi, base protocol enumeration. The vulnerability stems from improper validation when enumerating SCMI protocols with BASE_DISCOVER_LIST_PROTOCOLS: the check used a sum of unsigned integers that could overflow, allowing bypass of the check if...

CVE-2023-52760

CVE-2023-52760 (Linux kernel, gfs2): The vulnerability is caused by a slab-use-after-free in gfs2_qd_dealloc, where in gfs2_put_super() the quota cleanup must occur via gfs2_quota_cleanup() regardless of withdrawal status. If cleanup is delayed (rcu callback) and gfs2_sbd is freed before all gfs2...

CVE-2024-23850

CVE-2024-23850 affects the Linux kernel (through 6.7.1) in btrfs_get_root_ref (fs/btrfs/disk-io.c): subvolumes can be read too soon after their root item is inserted during subvolume creation, leading to an assertion failure and crash. Connected advisories confirm this issue across multiple Linux...

CVE-2024-26689

CVE-2024-26689 affects the Linux kernel via the Ceph subsystem: in fs/ceph/caps.c, encode_cap_msg() previously could perform a use-after-free due to a race between refcount increment and free in arg->xattr_buf handling. The race around ceph_buffer_get/ceph_buffer_put(ci->i_xattrs.blob) allo...

CVE-2024-26830

CVE-2024-26830 relates to the i40e driver in the Linux kernel. It fixes a condition where an untrusted VF could remove the administratively set primary MAC address of the VF, which PF can set. The vulnerability occurs when a VF is created, its MAC is set administratively, and the VF is later brou...

CVE-2024-35924

CVE-2024-35924 affects the Linux kernel USB Type-C UCSI driver (ucsi_read_message_in). Between UCSI 1.2 and 2.0, MESSAGE_IN size increased from 16 to 256, which could enable overflowing reads on older systems. The bug is mitigated by a mechanism that uses the UCSI version to truncate read sizes f...

CVE-2024-36481

CVE-2024-36481 affects the Linux kernel tracing/btf parsing: btf_find_struct_member() may return NULL or an ERR_PTR, but parse_btf_field() only checked NULL before. The fix uses IS_ERR() and propagates the error up the stack. Affected component is the kernel’s tracing probes; impact is a local vu...

CVE-2024-40923

CVE-2024-40923 – Linux kernel vmxnet3 issue . When vmxnet3_rq_create() fails to allocate memory for rq->data_ring.base, the subsequent vmxnet3_rq_destroy_all_rxdataring path does not reset rq->data_ring.desc_size for the data ring that failed. This can cause the hypervisor to reference that...

CVE-2024-41040

The CVE-2024-41040 issue is a Linux kernel net/sched use-after-free (UAF) in tcf_ct_flow_table_process_conn when resolving a clash. It is evidenced by KASAN reports of slab-use-after-free and is addressed by the fix that retrieves the conntrack entry from skb again after confirming conntrack. Con...

CVE-2024-41049

CVE-2024-41049: Linux kernel filelock: fix potential use-after-free in posix_lock_inode. The root cause was a race where a tracepoint pointer could be freed before the tracepoint fired, as the request pointer in trace_posix_lock_inode() was moved to a lock entry in an inode’s list and then freed ...

CVE-2024-41056

CVE-2024-41056 concerns the Linux kernel firmware path: cs_dsp fixes a potential overrun in V1 wmfw file name fields. The underlying issue is that algorithm and coefficient name strings live in fixed-size, NUL-terminated arrays and strlen could overruns when the NUL terminator is missing. The pat...

CVE-2024-47698

CVE-2024-47698 (Linux kernel) affects DVB frontends rtl2830/rtl2832 in the media/dvb-frontends subsystem. The issue is an out-of-bounds write in the pid_filter logic for rtl2832, caused by not enforcing the maximum index on bit manipulations (dev->filters is 32-bit; indices must be 0–31). The ...

CVE-2024-47701

CVE-2024-47701 : Linux kernel ext4 fault where an inlined directory lookup could access out-of-bounds when system.data xattr changes beneath the filesystem, causing a KASAN UAF. The issue arises if e_value_offs is modified underneath due to block-device changes, leading to invalid reads during ex...

CVE-2024-49875

CVE-2024-49875 affects the Linux kernel. Affected component: nfsd path within the kernel’s VFS stack handling EBADMSG from ext4 readdir leading to a warning and non-standard errno. The fixed behavior maps EBADMSG to nfserr_io to avoid the warning, alleviating the -EBADMSG warning/ERR_PTR(-EFSBADC...

CVE-2024-49928

The CVE CVE-2024-49928 affects the Linux kernel wifi: rtW89 driver, where reading TX power FW elements could read past the valid memory due to the loop expression causing an extra copy. The issue is mitigated by moving the entry copy into the loop body, preventing out-of-bounds access. The fix is...

CVE-2024-49937

CVE-2024-49937 relates to the Linux kernel wifi stack (cfg80211) where starting CAC in non-AP modes could leave chandef.chan as NULL, triggering a CPU warning. Root cause: incorrect Chandef handling when CAC starts in certain modes. Impact: local attacker could potentially observe instability fro...

CVE-2024-53059

Technical details (affected products, root cause, impact, fixes) for CVE-2024-53059 are not provided in the supplied connected documents. Monitor for updates from upstream advisories.

CVE-2024-56619

CVE-2024-56619 — Linux kernel nilfs2 . A potential out-of-bounds memory access in nilfs_find_entry() when an inode’s i_size is large/corrupted. Root cause: i_size upper 32 bits were lost due to a local variable type, causing underflow in end-address calculation. Fix: replace the offending local v...

CVE-2024-56761

The CVE-2024-56761 issue affects the Linux kernel’s x86/fred handling of WFE state during missing-ENDBRANCH #CPs. Indirect branches can set IBT to WAIT_FOR_ENDBRANCH, leaving WFE asserted across the boundary. When an inappropriate instruction is decoded with WFE set, a #CP fault can occur. The ad...