CVE-2024-46673

CVE-2024-46673: In the Linux kernel, the aacraid SCSI driver could double-free aac_dev::queues during probe if aac_init_adapter() failed after initial allocation. The hardware-specific init path calls into aac_init_adapter(), which on error frees queues but does not clear the pointer, and the err...

CVE-2024-46722

CVE-2024-46722 is a Linux kernel vulnerability affecting the DRM AMDGPU driver where a read of mc_data[i-1] could go out of bounds. The connected Astra/DEBIAN/CBLMARINER advisories reference the same issue in the kernel and confirm a fix was applied in the AMDGPU/mc_data path to address the out-o...

CVE-2024-46800

CVE-2024-46800 affects the Linux kernel's netem (sch/netem) code. The issue is a use-after-free in netem_dequeue when enqueuing a packet to an inner qdisc that later returns __NET_XMIT_STOLEN; the packet is dropped but qdisc_tree_reduce_backlog() may not update the parent q.len, causing a use-aft...

CVE-2024-47748

CVE-2024-47748: Linux kernel vhost_vdpa code fixes an irq bypass producer token life-cycle bug. The token formerly registered in vhost_vdpa_setup_vq_irq() could outlive the eventfd_ctx, risking use-after-free when the eventfd is released. The patch binds the token lifecycle to VHOST_SET_VRING_CAL...

CVE-2024-49859

The CVE-2024-49859 vulnerability concerns the f2fs filesystem in the Linux kernel. It affects f2fs ioctl interfaces (notably f2fs_ioc_set_pin_file(), f2fs_move_file_range(), and f2fs_defragment_range()) where atomic_write status was not properly checked, creating a potential race condition. The i...

CVE-2024-50024

The CVE CVE-2024-50024 is a Linux kernel issue: an unsafe loop in a list was fixed when deleting a genetlink family, risking a crash if listeners remain. The change replaces the unsafe loop with a safe iteration because an element is removed inside the loop, addressing an Oops: Kernel access of b...

CVE-2024-50201

CVE-2024-50201 (Linux kernel, drm/radeon) : The IBM bulletin confirms a resolved vulnerability in the Linux kernel where the encoder->possible_clones bitmask could be incorrect for a Radeon encoder. The fix, described as “Include the encoder itself in its possible_clones bitmask,” addresses a ...

CVE-2024-53209

CVE-2024-53209 is discussed across multiple sources, with concrete kernel-level details. The Linux BNXT Ethernet driver (bnxt_en) fix addresses MTU changes while XDP is active:, ensure AGG rings configuration and rx_skb_func reflect the current MTU by calling bnxt_set_rx_skb_mode() inside bnxt_ch...

CVE-2025-21814

CVE-2025-21814 affects the Linux kernel PTP code: ioctl/sysfs handlers call the info->enable callback unconditionally, which can be NULL if the driver doesn’t implement it. Affected drivers include ptp_s390.c, ptp_vclock.c and ptp_mock.c. The fix replaces a missing callback with a dummy one to...

CVE-2014-8159

CVE-2014-8159 describes a flaw in the Linux kernel InfiniBand/RDMA subsystem where the uverbs interface used to register memory regions can be abused by a local user to access arbitrary physical memory, potentially crash the system or escalate privileges via /dev/infiniband/uverbsX. The initial e...

CVE-2017-7187

The CVE-2017-7187 issue affects the Linux kernel sg_ioctl in drivers/scsi/sg.c, where a large SG_NEXT_CMD_LEN ioctl can trigger a stack-based buffer overflow, leading to a DoS or potentially other impact via out-of-bounds writes in sg_write. Descriptions across connected sources (CNVD-2017-03858)...

CVE-2019-19076

CVE-2019-19076 concerns a memory leak in the Linux kernel function nfp_abm_u32_knode_replace() in drivers/net/ethernet/netronome/nfp/abm/cls.c, before version 5.3.6. The issue can allow a remote attacker to cause a denial of service via memory consumption. The upstream commit 78beef629fd9 was rev...

CVE-2021-47103

CVE-2021-47103 is a Linux kernel vulnerability in the inet path where sk->sk_rx_dst was protected by RCU without proper documentation and ordering of dst_release and pointer clearing. The issue arose in tcp_v4_do_rcv/tcp_v6_do_rcv and related demux logic, creating potential use-after-free scen...

CVE-2022-49133

The CVE-2022-49133 issue affects the Linux kernel DRM/AMDKFD component where svm range restore work deadlocks during process exit. The fix moves flush of svm_range_restore_work to kfd_process_wq_release and makes svm_range_restore_work take a task mm reference to prevent deadlock when the last us...

CVE-2022-49275

CVE-2022-49275 affects the Linux kernel CAN subsystem (m_can). The issue is a use-after-free in can_tx_handler() related to skb handling when can_put_echo_skb() clones and frees skb. The fix moves can_put_echo_skb() for m_can 3.0.x to occur directly before hardware xmit, aligning with the 3.1.x b...

CVE-2022-49316

CVE-2022-49316 affects the Linux kernel’s NFSv4 layout management. The issue arises when performing layoutget as part of an open() compound: locks for the layoutget are held across multiple RPC calls, which can trigger recalls and deadlock. The connected advisories (EulerOS/Unity/Nessus OSS) conf...

CVE-2022-49429

CVE-2022-49429 affects the Linux kernel’s RDMA/hfi1 subsystem. When the hfi1 module is loaded with SDMA disabled (HFI1_CAP_SDMA off), a call to hfi1_write_iter() can dereference a NULL pointer, causing a kernel panic through the I/O path (sdma_select_user_engine → hfi1_user_sdma_process_request →...

CVE-2023-47233

CVE-2023-47233: Linux kernel brcm80211/brcmfmac use-after-free in brcmf_cfg80211_detach during USB hotplug unplug. Root cause: escan_timeout_worker accesses cfg after brcmf_cfg80211_detach frees it. Fix: cancel the escan timeout timer and cancel the worker in brcmf_cfg80211_detach before freeing ...

CVE-2023-52775

CVE-2023-52775 is a Linux kernel vulnerability affecting net/smc where a Decline message could cross or collide in SMC-R, causing data corruption during Redis/SRC testing. A patch doubles the client timeout to 2x the server value to prevent cross‑timeout conflicts; remediation is upgrading to a k...

CVE-2024-26661

Public technical details for CVE-2024-26661 are not provided in the connected documents; monitor for updates from vendors/advisories.

CVE-2024-26691

CVE-2024-26691 affects Linux kernel KVM for arm64. The circular locking arises when pkvm_create_hyp_vm() acquires kvm->lock while kvm_vcpu_ioctl() holds vcpu->mutex. The fix is to protect the hyp VM handle with config_lock (instead of keeping the vcpu->mutex under kvm->lock), mitigati...

CVE-2024-26700

CV E-2024-26700 is a Linux kernel issue: drm/amd/display had a fix to prevent MST null-pointer dereference on RV platforms. The crash trace shows a NULL pointer dereference in drm_dp_atomic_find_time_slots during DP MST time-slot calculation, leading to a kernel oops. Affected code path involves ...

CVE-2024-27431

Technical details (affected products, impact, exploit info, and remediation specifics) are not publicly provided in the supplied documents. Monitor for official updates and vendor advisories for CVE-2024-27431.

CVE-2024-31076

CVE-2024-31076: Linux kernel CPU hotplug vector leak in genirq/cpuhotplug (x86/vector). Root cause: when interrupt affinity is reconfigured via procfs, old APIC vectors aren’t reclaimed if the old CPU goes offline before the next trigger on the new CPU, leaving apicd->prev_vector in vector_mat...

CVE-2024-36000

The vulnerability CVE-2024-36000 is a Linux kernel issue where mm/hugetlb could miss acquiring hugetlb_lock during resv uncharge, particularly in a userfault context via UFFDIO_COPY. The root cause is locking criteria being overlooked in hugetlb_cgroup_uncharge_folio_rsvd(), which updates the cgr...

CVE-2024-36896

The CVE entry CVE-2024-36896 concerns a Linux kernel USB core fix: usb_hub_to_struct_hub() can return NULL when the hub for a port is concurrently removed, and a dereference occurs before a NULL check. The patch removes an unnecessary dereference and adds a NULL check for hub (hub == NULL) to pre...

CVE-2024-36974

The CVE-2024-36974 issue affects the Linux kernel net/sched taprio: if a TCA_TAPRIO_ATTR_PRIOMAP attribute is provided, taprio_parse_mqprio_opt() must validate it; otherwise, a second taprio_change() with crafted mqprio attributes can cause kernel problems after a first, valid call sets dev->n...

CVE-2024-38579

CVE-2024-38579 : Linux kernel vulnerability in crypto: bcm where spu2_dump_omd() increments ptr by ciph_key_len instead of hash_iv_len, risking buffer overrun. Root cause: incorrect pointer arithmetic in bcm cryptographic path. Affects the kernel crypto module, potential memory safety impact. Fix...

CVE-2024-38600

CVE-2024-38600 affects the Linux kernel ALSA subsystems. In snd_card_disconnect(), the patch fixes a deadlock that occurs when a callback deletes a kctl during disconnection for a suspended device. The root cause is the sequence: set card->shutdown, call callbacks, then sync power_ref_sleep wa...

CVE-2024-40912

CVE-2024-40912 – Linux kernel (wifi/mac80211) deadlock fix. The issue arises in ieee80211_sta_ps_deliver_wakeup() where sta->ps_lock is taken with a non-IRQL-safe spin_lock(), allowing softirq to run on the same CPU and contend with ieee80211_tx_h_unicast_ps_buf(), creating a deadlock (RCU sta...

CVE-2024-41093

CVE-2024-41093 – Linux kernel drm/amdgpu null framebuffer object fix : The vulnerability arises in the kernel’s DRM/amdgpu path where code could dereference a null framebuffer object when accessing state->fb->obj[0]. The patch changes the access to obtain the framebuffer object via drm_gem_...

CVE-2024-42270

Technical details (affected product/version, exploit, and patch) for CVE-2024-42270 are not provided in the supplied documents. Monitor official advisories and CVE records for updates from kernel maintainers and CVE databases.

CVE-2024-49889

CVE-2024-49889: Linux kernel ext4 uses-after-free in ext4_ext_show_leaf() and related ext4 extents handling. The issue arises when EXT_DEBUG is defined and a saved path pointer may be freed during extent handling, leading to use-after-free in ext4_ext_show_leaf() or during ext4_ext_handle unwritt...

CVE-2024-49930

In CVE-2024-49930, the Linux kernel vulnerability concerns the ath11k Wi-Fi driver. The hal_reo_error array in ath11k_soc_dp_stats is sized to DP_REO_DST_RING_MAX, but ath11k_dp_process_rx() indexed this array using the SRNG REO destination ring ID, which is not a normal ring ID and led to out-of...

CVE-2024-50006

CVE-2024-50006 (Linux kernel): Affects ext4 with an i_data_sem unlock order issue during ext4_ind_migrate() causing a potential deadlock in jbd2_log_wait_commit when EXT4_IOC_MIGRATE is used with O_SYNC. The deadlock occurs if EXT4_IOC_MIGRATE races with write(2) and CONFIG_PROVE_LOCKING is enabl...

CVE-2024-53227

CVE-2024-53227 concerns a Linux kernel use-after-free in bfad_im_module_exit() triggered by a double release path. The issue occurs when bfad_init() calls bfad_im_module_init() and on error path executes ext: bfad_im_module_exit(); followed by a second fc_release_transport, causing a use-after-fr...

CVE-2024-57938

CVE-2024-57938 affects the Linux kernel net/sctp code; an overflow in sctp_association_init() can occur when max_autoclose is set to UINT_MAX. Patch fixes the overflow; no exploit details are provided in the documents.

CVE-2025-21636

CVE-2025-21636 is a Linux kernel vulnerability where the code path for sctp: sysctl: plpmtud_probe_interval used current->nsproxy, risking NULL dereference when the task exits. The fix replaces use of current->nsproxy with obtaining the necessary net pointer from table->data via containe...

CVE-2025-21665

The CVE-2025-21665 issue is a Linux kernel bug where 64-bit offsets were truncated to 32 bits in folio_seek_hole_data() on 32-bit kernels, potentially causing an infinite loop when writing to XFS. Several connected advisories document the fix across distributions (e.g., Debian, Amazon Linux 2/ALA...

CVE-2025-21692

Summary: CVE-2025-21692 affects the Linux kernel net/sched ETS Qdisc, where ets_class_from_arg() can index an out-of-bounds ets_class when clid is 0, leading to an Out-Of-Bounds condition and potential local privilege escalation. The vulnerability is demonstrated in the provided trace and is link...

CVE-2025-21926

CVE-2025-21926 : In the Linux kernel, the net: gso: fix ownership in __udp_gso_segment vulnerability is resolved. The bug occurs when __udp_gso_segment removes the skb destructor while keeping the socket reference intact, risking a skb_orphan-triggered kernel BUG with OpenVSwitch sequences (OVS_A...

CVE-2025-22010

CVE-2025-22010 affects the Linux kernel’s RDMA/hns: fixes a soft lockup during BT page loop when allocating very large buffers (e.g., MR > 100GB). The vulnerable path occurs in hns_roce_hw_v2: hem_list_alloc_mid_bt, hns_roce_hem_list_request, hns_roce_mtr_create, alloc_mr_pbl, and hns_roce_reg...

CVE-2025-37838

CVE-2025-37838 affects the Linux kernel HSI ssi_protocol: a use-after-free can occur due to a race between ssi_protocol_probe() binding ssi->work to ssip_xmit_work() and ssi_protocol_remove() freeing ssi via kfree(ssi) while the work is still potentially in use. The connected Azure Linux 3.0 a...

CVE-2016-2117

CVE-2016-2117 affects the Atheros L2 ethernet driver (atl2) in the Linux kernel up to version 4.5.2. The root cause is incorrect enablement of scatter/gather I/O, which can allow a remote attacker to read packet data and potentially obtain sensitive kernel memory information. Public documents fro...

CVE-2016-3841

CVE-2016-3841 affects the Linux kernel IPv6 stack before 4.3.3. A crafted sendmsg can mishandle options data, allowing local users to gain privileges or cause a denial of service via a use-after-free leading to a system crash. Public documents (e.g., MiracleLinux AXSA-2016-1135:09 and Unity Linux...

CVE-2021-3411

CVE-2021-3411 describes a memory access violation in the Linux kernel prior to 5.10, caused by a padding int3 check during linking. The flaw can affect data confidentiality, integrity, and system availability. A Nessus Unity Linux advisory references this vulnerability (UTSA-2026-004638) and reit...

CVE-2023-52520

CVE-2023-52520 : Linux kernel platform/x86: think-lmi had a reference leak when a duplicate attribute is found by kset_find_obj(); a reference to the attribute could be leaked if not disposed with kobject_put. The fix moves the setting name validation into a separate function to avoid duplicating...

CVE-2023-52811

In CVE-2023-52811, the Linux kernel ibmvfc driver fix removes a BUG_ON when an event pool is empty and instead returns NULL from ibmvfc_get_event(). All call sites were updated to check for NULL and handle the failure or recovery path. This prevents a potential junk pointer path and kernel crash ...

CVE-2024-26629

CVE-2024-26629: Linux kernel nfsd: fix RELEASE_LOCKOWNER. Connected advisories document a patch correcting a test on so_count in nfsd4_release_lockowner(), which could transiently report locks held and cause NFS4 errors. The fix reverts to check_for_locks() (made to not sleep) and prevents false ...

CVE-2024-26698

Linux kernel hv_netvsc is affected by a race between netvsc_probe and netvsc_remove. The root cause is napi_disable being invoked on non-enabled subchannels, causing hung behavior during device removal due to an infinite msleep in napi_disable. The fix (commit ac5047671758) disables NAPI before c...