CVE-2025-21993

CVE-2025-21993 is a Linux kernel issue in iscsi_ibft: UBSAN shift-out-of-bounds warning in ibft_attr_show_nic() when performing iSCSI boot over IPv6. The bug arises because the IPv6 prefix length (64) makes a shift exponent negative while reading /sys/firmware/ibft/ethernetX/subnet-mask, which is...

CVE-2016-7914

The CVE-2016-7914 issue affects the Linux kernel prior to 4.5.3. The vulnerable component is assoc_array_insert_into_terminal_node in lib/assoc_array.c, which does not verify whether a slot is a leaf. This can allow a local user to read kernel memory or trigger a denial of service (invalid pointe...

CVE-2017-16646

CVE-2017-16646 affects the Linux kernel driver for USB DVB devices: specifically drivers/media/usb/dvb-usb/dib0700_devices.c, with the vulnerability present in kernels up to 4.13.11. A crafted USB device can trigger a local-denial-of-service (BUG and system crash) or possibly other unspecified im...

CVE-2017-5897

CVE-2017-5897 involves an out-of-bounds read in the Linux kernel’s IPv6 GRE handling (ip6_gre.c, ip6gre_err). Connected sources (Debian DSA-3791-1 and Cloud Foundry USN-3265-2) confirm the issue and note mitigation via kernel updates (e.g., Debian Jessie fix in linux 3.16.39-1+deb8u1; vendor advi...

CVE-2017-8831

The CVE-2017-8831 issue affects the Linux kernel, specifically the saa7164_bus_get function in drivers/media/pci/saa7164/saa7164-bus.c, with impact up to kernel version 4.11.5. It is a local, potentially privilege-escalating vulnerability described as a “double fetch” vulnerability caused by re-r...

CVE-2021-34866

The connected sources confirm CVE-2021-34866 affects Linux Kernel 5.14-rc3. Root cause: improper validation of user-supplied eBPF programs leading to a type confusion condition in the kernel’s eBPF handling. Impact: local privilege escalation and potential arbitrary code execution in kernel conte...

CVE-2021-38300

CVE-2021-38300 affects the Linux kernel on MIPS through arch/mips/net/bpf_jit.c, where the BPF JIT can emit incorrect machine code when transforming unprivileged cBPF programs. Root cause: conditional branches can exceed the 128 KB limit, enabling a local user to execute arbitrary code in kernel ...

CVE-2021-47497

The CVE-2021-47497 entry details a Linux kernel UBSAN issue in nvmem: when a cell’s nbits is a multiple of 8, the code does a shift GENMASK((cell->nbits%BITS_PER_BYTE) - 1, 0) which becomes a shift by 64 (or more) and is undefined. The fix adds a guard to ensure there are bits to mask before p...

CVE-2022-48939

CVE-2022-48939 refers to a Linux kernel issue where the BPF subsystem’s batch operations could cause soft lockups due to missing schedule points. The fix adds scheduling points in batch paths to prevent long hangs (e.g., kworker/1:1:27 blocked and hung RCUs). The root cause is that batch processi...

CVE-2022-49416

CVE-2022-49416 is present in the Linux kernel, tied to a use-after-free bug in wifi/mac80211 chanctx handling. The issue occurs in ieee80211_vif_use_reserved_context() when the new context’s replace_state is REPLACE_NONE and the old context is freed in ieee80211_vif_use_reserved_reassign(), after...

CVE-2022-49925

CVE-2022-49925 : In the Linux kernel, a null-pointer dereference can occur in RDMA/core during ib_core_cleanup due to an unhandled failure of roce_gid_mgmt_init() (gid_cache_wq may be allocated and then freed during cleanup when not allocated). This is reported as a KASAN null-ptr-deref and is tr...

CVE-2023-52796

CVE-2023-52796 affects the Linux kernel ipvlan subsystem. The issue is a stack-based overflow risk related to ipvlan_route_v6_outbound and the outbound path, exploited via crafted IPv6/ipv4 traffic, as reported by syzbot. The fix moves the flowi6 route-lookup struct into a non-inline helper and r...

CVE-2024-0639

CVE-2024-0639 is a denial-of-service vulnerability in Linux kernel SCTP: a deadlock in sctp_auto_asconf_init (net/sctp/socket.c) can be triggered by guests with local privileges, potentially crashing the system. Some connected advisories (Unity Linux UTSA-2026-001762 and Red Hat/SUSE notes) indic...

CVE-2024-23851

CVE-2024-23851 affects the Linux kernel; the issue is in copy_params() in drivers/md/dm-ioctl.c (up to 6.7.1) where it may allocate more than INT_MAX bytes due to a missing param_kernel->data_size check, leading to a crash. Several connected advisories note a patched kernel is available; apply...

CVE-2024-26700

CV E-2024-26700 is a Linux kernel issue: drm/amd/display had a fix to prevent MST null-pointer dereference on RV platforms. The crash trace shows a NULL pointer dereference in drm_dp_atomic_find_time_slots during DP MST time-slot calculation, leading to a kernel oops. Affected code path involves ...

CVE-2024-26767

CVE-2024-26767 targets the Linux kernel’s drm/amd/display path. The issue stemmed from integer type widening in a loop condition and a missing null check, risking infinite loops and dereferencing NULL. The entry is fixed in the kernel (drm/amd/display: fixed integer types and null check locations...

CVE-2024-26883

CVE-2024-26883 : In the Linux kernel, a vulnerability was fixed that affects 32-bit architectures in the stackmap handling used by BPF. The overflow risk arises when roundup_pow_of_two() is used to compute the number of hash buckets, as a 32‑bit left shift can overflow and cause undefined behavio...

CVE-2024-36921

CVE-2024-36921 security issue in Linux kernel wifi: iwlwifi (MVM) guarded against invalid STA ID on removal to prevent out-of-bounds accesses in iwl_mvm_mld_rm_sta_id. The vulnerability could occur during error handling if a station ID is invalid, risking memory corruption. The Microsoft Security...

CVE-2024-40927

CVE-2024-40927 : Linux kernel xhci TD clearing for multiple streams is fixed. When an endpoint has >1 in-flight TDs across streams and is stopped, the driver now defers processing of additional TDs and issues a Set TR Dequeue Pointer for each, by deferring subsequent TDs until the first is pro...

CVE-2024-40945

CVE-2024-40945 : In the Linux kernel, iommu_sva_bind_device() should return a SVA bond handle or an ERR_PTR on error. Some drivers (idxd/uacce) previously only checked for IS_ERR(), which could lead to a NULL pointer dereference if NULL was returned in error paths. The public advisories indicate ...

CVE-2024-40984

CVE-2024-40984 affects the Linux kernel’s ACPICA handling where a revert of the commit that avoided Info: mapping multiple BARs leads to a NULL pointer deference when a read/write spans across page boundaries. The description confirms the issue and fix involves mapping the entire length across re...

CVE-2024-43853

Technical details for CVE-2024-43853 are not publicly available in the provided documents. The materials summarize the UAF in proc_cpuset_show() but do not specify affected products, versions, or patches beyond kernel/cgroup references; monitor for updates.

CVE-2024-46695

The CVE-2024-46695 issue affects the Linux kernel’s SELinux/SMACK security-inode path. Root on an NFS client could bypass inode security checks and change labels on files on an export with root_squash due to insufficient permissions checks in __vfs_setsecctx. The root cause is that nfsd_setattr()...

CVE-2024-46858

CVE-2024-46858 in the Linux kernel fixes a local UAF race in mptcp_pm_del_add_timer. Two paths can access mptcp_pm_del_add_timer concurrently (CPU1 in PM code path vs CPU2 in netlink/ip stack path), leading to use-after-free when a timer entry is freed after leaving the critical region. The patch...

CVE-2024-47692

CVE-2024-47692 : Linux kernel NFS server (nfsd) vulnerability where namelen can be 0 if main.sqlite is corrupted, causing memdup_user() to return ZERO_SIZE_PTR and leading to NULL pointer dereference when accessing name.data in nfs4_client_to_reclaim(). The issue is resolved by adding a namelen v...

CVE-2024-49889

CVE-2024-49889: Linux kernel ext4 uses-after-free in ext4_ext_show_leaf() and related ext4 extents handling. The issue arises when EXT_DEBUG is defined and a saved path pointer may be freed during extent handling, leading to use-after-free in ext4_ext_show_leaf() or during ext4_ext_handle unwritt...

CVE-2024-49930

In CVE-2024-49930, the Linux kernel vulnerability concerns the ath11k Wi-Fi driver. The hal_reo_error array in ath11k_soc_dp_stats is sized to DP_REO_DST_RING_MAX, but ath11k_dp_process_rx() indexed this array using the SRNG REO destination ring ID, which is not a normal ring ID and led to out-of...

CVE-2024-50008

Technical details about CVE-2024-50008 are not publicly provided in the connected documents. The initial description mentions a Linux kernel fix related to mwifiex, but no concrete affected products/versions/root cause or remediation are given here. Monitor for updates.

CVE-2024-50024

CVE-2024-50024 pertains to the Linux kernel. The issue is an unsafe loop on a kernel linked list used when deleting a genetlink family that may still have listeners. The result could be an Oops—kernel access of a bad area—potentially crashing the kernel. The root cause is iteration with element r...

CVE-2024-50117

CVE-2024-50117 is a Linux kernel issue affecting the DRM/AMD amdgpu ACPI ATIF path. The vulnerability arises when BIOS returns malformed data for the ATIF ACPI method, which can trigger a NULL pointer dereference in the caller. A guard was added in the AMdgpu ATIF handling (amdgpu_atif_query_back...

CVE-2024-50142

CVE-2024-50142 is a Linux kernel vulnerability where the xfrm selector validation can mishandle SA prefix lengths when sel.family is AF_UNSPEC. The root cause: an SA with AF_UNSPEC and prefixlen_s=128, combined with later assignment of AF_INET, led verify_newsa_info to validate prefix lengths wit...

CVE-2024-50262

CVE-2024-50262 – Linux kernel trie_get_next_key() out-of-bounds write Root cause: trie_get_next_key() allocates a node stack with size trie->max_prefixlen but writes trie->max_prefixlen+1 nodes when the path is full, leading to an out-of-bounds write. This can occur for tries with max_prefi...

CVE-2024-50279

CVE-2024-50279 affects the Linux kernel dm-cache component. The issue is an index/bounds bug in bitset iteration when shrinking the fast device, which caused an out-of-bounds access to the dirty bitset. The vulnerability is triggered during resize operations (as described in the reproduce steps a...

CVE-2024-56761

The CVE-2024-56761 issue affects the Linux kernel’s x86/fred handling of WFE state during missing-ENDBRANCH #CPs. Indirect branches can set IBT to WAIT_FOR_ENDBRANCH, leaving WFE asserted across the boundary. When an inappropriate instruction is decoded with WFE set, a #CP fault can occur. The ad...

CVE-2024-57807

CVE-2024-57807 is tied to the Linux kernel's SCSI megaraid_sas driver. The issue is a potential deadlock caused by a circular locking dependency between instance->reset_mutex and shost->scan_mutex, which could occur during lock ordering. The confirmed fix temporarily releases the reset_mute...

CVE-2024-57938

CVE-2024-57938 affects the Linux kernel net/sctp code; an overflow in sctp_association_init() can occur when max_autoclose is set to UINT_MAX. Patch fixes the overflow; no exploit details are provided in the documents.

CVE-2025-21753

The CVE-2025-21753 entry concerns a use-after-free in the Linux kernel’s btrfs join_transaction path. Root cause: when joining the current (possibly aborted) transaction, the code reads the transaction’s aborted field after releasing fs_info->trans_lock and without holding an extra reference, ...

CVE-2025-23150

CVE-2025-23150 affects the Linux kernel ext4 filesystem. The issue stems from an off-by-one error in do_split that can cause out-of-bounds access in ext4_insert_dentry, leading to a use-after-free condition (as detected via Syzkaller). The problem can occur during directory entry creation paths t...

CVE-2025-37756

CVE-2025-37756 relates to the Linux kernel TLS stack. The vulnerability arises from allowing a TLS socket disconnect, which can trigger unexpected corner cases in the TLS receive path. The fix is a kernel patch that explicitly disallows disconnect in net/tls, reducing the risk of abusive disconne...

CVE-2025-37833

CVE-2025-37833 affects the Linux kernel NIC driver net/niu, where an MSIX ENTRY_DATA read-before-write on an msix entry can trigger a fatal trap. The fix ensures niu_try_msix() does not cause a trap on SPARC and adds a workaround flag PCI_DEV_FLAGS_MSIX_TOUCH_ENTRY_DATA_FIRST on the pci_dev to pr...

CVE-2015-8964

The CVE-2015-8964 entry relates to the Linux kernel prior to 4.5, where the tty_set_termios_ldisc() function in drivers/tty/tty_ldisc.c can allow local users to read a tty data structure and disclose kernel memory. Evidence in connected documents confirms the affected component (tty_ldisc.c), the...

CVE-2018-12233

CVE-2018-12233 is a memory-corruption flaw in the Linux kernel’s JFS implementation (fs/jfs/xattr.c) that can be triggered by calling setxattr twice with two different extended attribute names on the same file. The issue stems from an incorrect kmalloc leading to slab-out-of-bounds in jfs_xattr a...

CVE-2018-18386

The CVE-2018-18386 issue affects the Linux kernel up to version 4.14.10, in drivers/tty/n_tty.c, where an EXTPROC vs ICANON confusion in TIOCINQ allows local attackers with access to pseudo terminals to hang or block further use of any PTY. The root cause is a terminal/TTY handling inconsistency,...

CVE-2019-14763

CVE-2019-14763 affects the Linux kernel prior to 4.16.4, where a double-locking error in drivers/usb/dwc3/gadget.c may deadlock with f_hid. Exploitation context from connected Nessus advisories links CVE-2019-14763 to kernel fixes (4.16.4) and security advisories (e.g., USN/EulerOS entries). The ...

CVE-2021-47449

CVE-2021-47449 relates to the Linux kernel ice driver locking around the Tx timestamp tracker flush. The issue arises because a lock around the Tx timestamp tracker flow was introduced, and that lock is held during a call to ice_clear_phy_tstamp, which itself sends a PHY write command to firmware...

CVE-2022-48992

CVE-2022-48992 pertains to the Linux kernel: the ASoC subsystem (soc-pcm) BE reparenting path had a NULL pointer dereference risk exposed during fuzzing. The root cause is a missing NULL check in the dpcm_be_reparent API, which could lead to kernel NULL pointer dereference. The fix adds an explic...

CVE-2022-49636

CVE-2022-49636 affects the Linux kernel VLAN code, specifically a memory leak in vlan_newlink/vlan_changelink paths. The issue arises when a memory allocation fails in vlan_changelink() after prior allocations succeed; memory allocated for egress priority/vlan_dev structures may remain referenced...

CVE-2023-52501

The connected MiracleLinux advisory confirms CVE-2023-52501 affects the Linux kernel ring-buffer code. The issue occurs when iterating a live ring buffer: if the last event sits at the end of a page with only 4 bytes left, the event length check can misread the length (first 4 bytes, or the lengt...

CVE-2023-52784

CVE-2023-52784 concerns the Linux kernel bonding subsystem. The issue arises when a lapbether device is created on a bonding device with no members, and adding a non-ARPHRD_ETHER member forces the bonding master to change type, potentially leading to misuse of devices. The documented fix is to ca...

CVE-2023-7042

CVE-2023-7042 affects the Linux kernel in the ath10k wireless driver: a null pointer dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev() can lead to a denial of service. Connected advisories confirm the issue is mitigated by updating to patched kernels (examples: Debian security notices list...