CVE-2024-40940

The CVE-2024-40940 issue affects the Linux kernel mlx5 driver (net/mlx5). The root cause is in mlx5_lag_create_port_sel_table(): when a flow rule creation fails, the tainted pointer is deleted multiple times instead of using the correct flow rule pointers. The bug is fixed by using the correct fl...

CVE-2024-40984

CVE-2024-40984 affects the Linux kernel’s ACPICA handling where a revert of the commit that avoided Info: mapping multiple BARs leads to a NULL pointer deference when a read/write spans across page boundaries. The description confirms the issue and fix involves mapping the entire length across re...

CVE-2024-43888

CVE-2024-43888 pertains to the Linux kernel memory-control path. The advisory fixes a use-after-free in mm/list_lru for memory cgroups: mem_cgroup_from_slab_obj() must be called under RCU protection (rcu_read_lock) or with appropriate locks; without it, a memcg could be freed while still used. Th...

CVE-2024-43889

CVE-2024-43889 affects the Linux kernel: a not easily reproducible divide-by-0 panic in padata_mt_helper() can occur at boot due to ps->chunk_size being 0 when min_chunk is 0. The fix ensures chunk_size is at least 1 regardless of input parameters, preventing the divide-by-zero panic. Connecte...

CVE-2024-46857

CVE-2024-46857 is a Linux kernel vulnerability in net/mlx5 where bridge mode attribute operations crash when numvfs=0 (NULL pointer dereference in mlx5_add_flow_rules). Affected: Linux kernel with mlx5_core/eswitch code. Root cause: bridge mode operations attempted while no VFs exist trigger a NU...

CVE-2024-46864

CVE-2024-46864 is a Linux kernel vulnerability affecting x86/hyperv where a new cpuhp state handling caused the VP assist page not to be reset during kexec, leading to VP memory corruption and a possible panic. The root cause: cpuhp_setup_state() returns 0 for non-online/dyn states, and hv_machin...

CVE-2024-47659

The CVE-2024-47659 issue is supported by connected advisories (Unity Linux UTSA entries) detailing a kernel-level Smack labeling bug for TCP/IPv4. The vulnerability caused return packets to be labeled with the initiator’s CIPSO label, enabling a labeled peer to write to another label without prop...

CVE-2024-47692

CVE-2024-47692 : Linux kernel NFS server (nfsd) vulnerability where namelen can be 0 if main.sqlite is corrupted, causing memdup_user() to return ZERO_SIZE_PTR and leading to NULL pointer dereference when accessing name.data in nfs4_client_to_reclaim(). The issue is resolved by adding a namelen v...

CVE-2024-49889

CVE-2024-49889: Linux kernel ext4 uses-after-free in ext4_ext_show_leaf() and related ext4 extents handling. The issue arises when EXT_DEBUG is defined and a saved path pointer may be freed during extent handling, leading to use-after-free in ext4_ext_show_leaf() or during ext4_ext_handle unwritt...

CVE-2024-49933

CVE-2024-49933 is a Linux kernel issue related to blk_iocost where UBSAN detected shift-out-of-bounds in ioc_forgive_debts() (shift exponent 80 on a 64-bit type). The connected Astra Linux bulletin confirms the same vulnerability and describes the concrete out-of-bounds shifts in block/blk-iocost...

CVE-2024-49937

CVE-2024-49937 relates to the Linux kernel wifi stack (cfg80211) where starting CAC in non-AP modes could leave chandef.chan as NULL, triggering a CPU warning. Root cause: incorrect Chandef handling when CAC starts in certain modes. Impact: local attacker could potentially observe instability fro...

CVE-2024-57807

CVE-2024-57807 is tied to the Linux kernel's SCSI megaraid_sas driver. The issue is a potential deadlock caused by a circular locking dependency between instance->reset_mutex and shost->scan_mutex, which could occur during lock ordering. The confirmed fix temporarily releases the reset_mute...

CVE-2025-21699

CVE-2025-21699 is a Linux kernel issue in the gfs2 component. The flaw arises when truncating an inode’s address space while flipping the GFS2_DIF_JDATA flag; depending on the flag, the pages in the address space are managed either by buffer heads or by iomap_folio_state structs, and the memory m...

CVE-2025-37797

CVE-2025-37797 affects the Linux kernel HFSC qdisc. A Use-After-Free can occur in hfsc_change_class() when handling certain child qdiscs (e.g., netem, codel) due to a time-of-check/time-of-use race: hfsc_change_class() may add a class to vttree after qdisc_peek_len() potentially clears the queue....

CVE-2017-6346

CVE-2017-6346 affects the Linux kernel net/packet/af_packet.c, describing a race condition in the PACKET_FANOUT fanout path that can cause a use-after-free in multithreaded user apps. The connected sources confirm this is a local vulnerability with potential denial of service and possible unspeci...

CVE-2018-1065

The CVE-2018-1065 entry affects the Linux kernel netfilter subsystem up to version 4.15.7. A rule blob containing a jump without a user-defined chain can be exploited by local users with CAP_NET_RAW or CAP_NET_ADMIN to trigger a NULL pointer dereference, causing denial of service. Affected code p...

CVE-2018-12233

CVE-2018-12233 is a memory-corruption flaw in the Linux kernel’s JFS implementation (fs/jfs/xattr.c) that can be triggered by calling setxattr twice with two different extended attribute names on the same file. The issue stems from an incorrect kmalloc leading to slab-out-of-bounds in jfs_xattr a...

CVE-2021-38300

CVE-2021-38300 affects the Linux kernel on MIPS through arch/mips/net/bpf_jit.c, where the BPF JIT can emit incorrect machine code when transforming unprivileged cBPF programs. Root cause: conditional branches can exceed the 128 KB limit, enabling a local user to execute arbitrary code in kernel ...

CVE-2021-47449

The Linux kernel 's ice driver is vulnerable to a potential deadlock due to improper locking during the Tx timestamp tracking cleanup process. Specifically, a lock is held while calling ice_clear_phy_tstamp , which requires a mutex to send a PHY write command to the firmware; if this mutex sleeps...

CVE-2022-49133

The CVE-2022-49133 issue affects the Linux kernel DRM/AMDKFD component where svm range restore work deadlocks during process exit. The fix moves flush of svm_range_restore_work to kfd_process_wq_release and makes svm_range_restore_work take a task mm reference to prevent deadlock when the last us...

CVE-2022-49319

CVE-2022-49319 affects the Linux kernel, specifically iommu/arm-smmu-v3. The vulnerability is a NULL pointer dereference that occurs when platform_get_resource() returns NULL, due to a missing return-value check. Affected component/area: ARM SMMU platform resource handling in the IOMMU path. Impa...

CVE-2022-49636

CVE-2022-49636 affects the Linux kernel VLAN code, specifically a memory leak in vlan_newlink/vlan_changelink paths. The issue arises when a memory allocation fails in vlan_changelink() after prior allocations succeed; memory allocated for egress priority/vlan_dev structures may remain referenced...

CVE-2022-49925

CVE-2022-49925 : In the Linux kernel, a null-pointer dereference can occur in RDMA/core during ib_core_cleanup due to an unhandled failure of roce_gid_mgmt_init() (gid_cache_wq may be allocated and then freed during cleanup when not allocated). This is reported as a KASAN null-ptr-deref and is tr...

CVE-2023-38426

The CVE-2023-38426 issue affects the Linux kernel prior to 6.3.4, specifically ksmbd’s SMB2 path where an out-of-bounds read occurs in smb2_find_context_vals if create_context’s name_len exceeds the tag length. Public references (kernel commit and ChangeLog-6.3.4) confirm the vulnerability contex...

CVE-2023-45898

Summary (CVE-2023-45898): The vulnerability lies in the Linux kernel prior to 6.5.4, where an es1 use-after-free in the ext4 extents_status path (fs/ext4/extents_status.c) related to ext4_es_insert_extent can lead to a local privilege escalation or kernel integrity/availability impact as describe...

CVE-2024-22099

Technical details for CVE-2024-22099 are not publicly provided in the supplied documents. Monitor for updates.

CVE-2024-23850

CVE-2024-23850 affects the Linux kernel (through 6.7.1) in btrfs_get_root_ref (fs/btrfs/disk-io.c): subvolumes can be read too soon after their root item is inserted during subvolume creation, leading to an assertion failure and crash. Connected advisories confirm this issue across multiple Linux...

CVE-2024-26743

Technical details about CVE-2024-26743 are not provided in the supplied documents. Please monitor vendor advisories for affected products, impact, and fixes.

CVE-2024-31076

CVE-2024-31076: Linux kernel CPU hotplug vector leak in genirq/cpuhotplug (x86/vector). Root cause: when interrupt affinity is reconfigured via procfs, old APIC vectors aren’t reclaimed if the old CPU goes offline before the next trigger on the new CPU, leaving apicd->prev_vector in vector_mat...

CVE-2024-35831

CVE-2024-35831 (Linux kernel io_uring issue) : The vulnerability arises in the error path of __io_uaddr_map where, after pinning pages, the error handler may not release the pinned pages if the function fails. This can occur under memory fragmentation and results in improper cleanup. The base CVS...

CVE-2024-35852

CVE-2024-35852 : In the Linux kernel (mlxsw spectrum_acl_tcam), a memory leak can occur when rehash work is canceled while pending, as hints allocated for the migration may remain referenced. The fix frees the associated hints when a pending rehash work is canceled. Connected advisories reference...

CVE-2024-35957

The CVE-2024-35957 vuln in the Linux kernel/IOMMU VT-d path arises from probing code that tracked all probed devices in an rbtree by source ID, assuming uniqueness that VT-d does not guarantee. The fix, per the linked advisories, is to only track devices that have PCI ATS capabilities in the iomm...

CVE-2024-36481

CVE-2024-36481 affects the Linux kernel tracing/btf parsing: btf_find_struct_member() may return NULL or an ERR_PTR, but parse_btf_field() only checked NULL before. The fix uses IS_ERR() and propagates the error up the stack. Affected component is the kernel’s tracing probes; impact is a local vu...

CVE-2024-42077

CVE-2024-42077 - OCFS2 DIO credit handling in Linux kernel : The vulnerability arises when ocfs2_dio_end_io_write() underestimates required transaction credits during large or multi-extents I/O, risking exhaustion of transaction credits and triggering a kernel panic via OCFS2 abort logic. The roo...

CVE-2024-42291

CVE-2024-42291 (Linux kernel, ice driver) : The vulnerability arises from a per-VF limit on FDIR filters. A malicious or misbehaving VF could request more than the soft limit, exhausting resources and impacting other VFs. The fix adds an equivalent per-VF cap in the ice driver to mirror the iAVF ...

CVE-2024-43882

CVE-2024-43882 is a Linux kernel race Condition (ToCToU) in exec path: permission checks for a file are done at do_filp_open(), but the metadata (mode/UID/GID) used later in execve() can be changed before execution, enabling potential root privilege escalation. The issue is exploitable in scenari...

CVE-2024-49878

Technical details about CVE-2024-49878 are not publicly provided in the supplied documents. The initial description notes a Linux kernel resource-tree issue with CXL memory affecting region_intersects() and onlining memory; monitor for official patch releases and advisories.

CVE-2024-49929

CVE-2024-49929 affects the Linux kernel wifi: iwlwifi (MVM) code. The vulnerability stems from iwl_mvm_sta_from_mac80211 potentially dereferencing a NULL ieee80211_sta when sta is NULL, leading to a NULL pointer dereference in iwl_mvm_tx_skb_sta() and iwl_mvm_tx_mpdu(). The fix is to validate the...

CVE-2024-50117

CVE-2024-50117 is a Linux kernel issue affecting the DRM/AMD amdgpu ACPI ATIF path. The vulnerability arises when BIOS returns malformed data for the ATIF ACPI method, which can trigger a NULL pointer dereference in the caller. A guard was added in the AMdgpu ATIF handling (amdgpu_atif_query_back...

CVE-2024-50142

CVE-2024-50142 is a Linux kernel vulnerability where the xfrm selector validation can mishandle SA prefix lengths when sel.family is AF_UNSPEC. The root cause: an SA with AF_UNSPEC and prefixlen_s=128, combined with later assignment of AF_INET, led verify_newsa_info to validate prefix lengths wit...

CVE-2024-53060

CVE-2024-53060 (Linux kernel) affects drm/amdgpu: fixes a NULL pointer dereference when ATIF is not supported. The kernel may dereference buffer.pointer (obj) if acpi_evaluate_object() returns AE_NOT_FOUND, so the fix adds a bailout when AE_NOT_FOUND occurs to prevent NULL dereference. The Note i...

CVE-2024-53139

The CVE-2024-53139 entry concerns the Linux kernel SCTP stack. A fix for a possible use-after-free in sctp_v6_available() is described, prompted by a lockdep warning showing sctp_v6_available() calling dev_get_by_index_rcu() and ipv6_chk_addr() without holding RCU. The description notes a stack t...

CVE-2024-53203

CVE-2024-53203 is a Linux kernel issue: a potential array underflow in usb: typec ucsi_ccg_sync_control() could be triggered when the user controls the command via debugfs, if con_index is zero leading to an access of ucsi.connector[con_index-1]. The vulnerability is resolved in the Linux kernel;...

CVE-2024-53232

CVE-2024-53232 refers to a Linux kernel vulnerability in the IOMMU code for s390, where during surprise hot-unplug of a PCI device, attaching the default domain could fail and lead to a NULL domain pointer and a use-after-free. The fix introduces a blocking domain to handle devices that were alre...

CVE-2024-56603

CVE-2024-56603 affects the Linux kernel in the net/af_can path. On error in can_create(), the code frees the allocated sk object, but sock_init_data() had already attached it to the sock, leaving a dangling sk pointer and introducing a potential use‑after‑free. The connected advisories confirm a ...

CVE-2024-56650

CVE-2024-56650 - Linux kernel netfilter x_tables led_tg_check() . The connected documents confirm a fix in the Linux kernel addressing an issue where an invalid LED ID check could lead to a recallable problem during ID processing. The root cause, as described, is insufficient validation of an ID ...

CVE-2025-21665

The CVE-2025-21665 issue is a Linux kernel bug where 64-bit offsets were truncated to 32 bits in folio_seek_hole_data() on 32-bit kernels, potentially causing an infinite loop when writing to XFS. Several connected advisories document the fix across distributions (e.g., Debian, Amazon Linux 2/ALA...

CVE-2025-21782

CVE-2025-21782 — Linux kernel: orangefs: fix a slab-out-of-bounds in orangefs_debug_write. A syzbot report described slab-out-of-bounds Read in orangefs_debug_write; patch was tested and applied to fix the issue. The vulnerability is tied to the OrangeFS write path and is addressed by kernel fixe...

CVE-2025-21846

CVE-2025-21846 (Linux kernel) : The acct(2) path could trigger a NULL dereference when writing to a file that triggers an internal lookup (e.g., /sys/power/resume) after the task has exited. The fix reorganizes the code so the final write executes from a workqueue while preserving the caller’s cr...

CVE-2025-21961

CVE-2025-21961 (Linux kernel BNXT driver): A miscalculated truesize in the bnxt_xdp_build_skb path when mb-xdp is used with XDP_PASS causes an incorrect skb_truesize to be recorded, since skb_shared_info is wiped by napi_build_skb() and the code may reuse a stale sinfo->nr_frags. This is fixed...