CVE-2024-26802

The CVE-2024-26802 entry concerns a Linux kernel issue in the stmmac driver where destroy_workqueue() drains the queue but does not clear the workqueue pointer, risking NULL pointer dereference/panic when resuming a suspended driver. Connected docs (Astra Linux bulletin and related IBM/CIRCL refe...

CVE-2024-26903

CVE-2024-26903 (Linux kernel) : Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security. Root cause: after RFCOMM/L2CAP disconnect, the code could dereference a released l2cap_conn, leading to a null pointer access when calling hci_conn_security. Impact per CVSS: Medium (5.5) with high ava...

CVE-2024-27434

CVE-2024-27434 : In the Linux kernel, the wifi driver iwlwifi/mvm incorrectly set the MFP flag for GTK, which could crash the firmware when an AP uses TKIP with MFPC. The patch ensures GTK is not marked with MFP, mitigating the issue. CVSS v3.1 base score 5.5 (LOCAL, LOW attack complexity, LOW pr...

CVE-2024-35810

CVE-2024-35810 : In the Linux kernel, a fix addresses a vulnerability in drm/vmwgfx where the lifetime of bo cursor memory could be mishandled during cleanup while an atomic update is active. The kernel previously allowed cleanup to invalidate memory acquired during the atomic update, potentially...

CVE-2024-36028

CVE-2024-36028: Linux kernel mm/hugetlb vulnerability fixed. The issue caused DEBUG_LOCKS_WARN_ON(1) during dissolve_free_hugetlb_folio(), leading to a kernel warning and panic. Connected sources attribute the root cause to a field packing problem where folio.deferred is unioned with folio._huget...

CVE-2024-36941

CVE-2024-36941 is a Linux kernel vulnerability affecting the wifi nl80211 path. The issue is a NULL pointer dereference that could occur if parsing of the coalescing rule fails and the code dereferences NULL when freeing resources. The connected IBM advisory confirms the linux kernel fix for this...

CVE-2024-36950

CVE-2024-36950 is a Linux kernel vulnerability resolved in the FireWire OHCI driver. The issue occurred in the interrupt handler when a bus reset interrupt could be unmasked and cause a freeze if the bus reset was not yet serviced. The fix masks bus reset interrupts in the IRQ handler and unmasks...

CVE-2024-38559

CVE-2024-38559: In the Linux kernel, the qedf SCSI path copies a userspace buffer without guaranteeing a NUL terminator, risking an OOB read in kstrtouint. The fix uses memdup_user_nul instead of memdup_user. Affected: kernel SCSI qedf path; Root cause: missing termination of the copied buffer. R...

CVE-2024-40941

CVE-2024-40941 is disclosed in MiracleLinux advisories for kernel-4.18.x (e.g., 4.18.0-553.22.1.el8_10) and related AXSA advisories. The issue in wifi: iwlwifi: mvm causes reading past the mfuart notification when the firmware claims more data than available. The advisory states the overflow is m...

CVE-2024-40978

CVE-2024-40978 affects the Linux kernel, specifically a qedi/scsi path vulnerability. The root cause is qedi_dbg_do_not_recover_cmd_read() calling sprintf() on a __user pointer, which can crash the kernel. The fix uses a small local stack buffer for sprintf() and then copies with simple_read_from...

CVE-2024-41049

CVE-2024-41049: Linux kernel filelock: fix potential use-after-free in posix_lock_inode. The root cause was a race where a tracepoint pointer could be freed before the tracepoint fired, as the request pointer in trace_posix_lock_inode() was moved to a lock entry in an inode’s list and then freed ...

CVE-2024-41092

CVE-2024-41092: Linux kernel drm/i915/gt had a potential use-after-free in fence revocation. Root cause: race between revocation of fence registers and completion callbacks, with vma->fence->active idleness not guaranteed before vma eviction. The fix is to wait for idleness of vma->fence...

CVE-2024-43900

CVE-2024-43900 affects the Linux kernel’s media: xc2028 path. A worker thread can dereference a freed dvb_frontend object after tuner_probe() allocates a tuner and module removal frees the dvb_frontend, leading to a use-after-free in load_firmware_cb() triggered by request_firmware_work_func. The...

CVE-2024-49875

CVE-2024-49875: Linux kernel fix where EBADMSG during nfsd buffered readdir and ext4 checksum path could trigger a non-standard nfserrno warning; fix maps EBADMSG to nfserr_io to avoid the warning. Affects nfsd and ext4_readdir on Linux 5.x; remediation patch added in stable releases (kernel comm...

CVE-2024-49878

Technical details about CVE-2024-49878 are not publicly provided in the supplied documents. The initial description notes a Linux kernel resource-tree issue with CXL memory affecting region_intersects() and onlining memory; monitor for official patch releases and advisories.

CVE-2024-49938

Linux kernel CVE-2024-49938 affects the ath9k_htc wifi driver. The issue arises from skb_trim() being used on an uninitialised skb length in error paths, leading to an invalid urb reset before resubmission. The patch switches to __skb_set_length(skb, 0) (which already calls skb_reset_tail_pointer...

CVE-2024-49973

CVE-2024-49973 concerns the Linux kernel’s rtl8169/RTL8125 NIC path. The issue arises from RTL8125 adding tally counter fields, which may be DMAed to unallocated memory if the tally counter area isn’t large enough. The described fix is to ensure the allocated memory region can hold all tally coun...

CVE-2024-53059

Technical details (affected products, root cause, impact, fixes) for CVE-2024-53059 are not provided in the supplied connected documents. Monitor for updates from upstream advisories.

CVE-2024-53063

CVE-2024-53063: Linux kernel DVB minor management (dvbdev) allowed potential OOM via a static minor-tracker when CONFIG_DVB_DYNAMIC_MINORS is unset and device/register calls para-mismatch occurred. The patch adds explicit boundary guards in dvb_register_device and dvb_device_open to prevent out-o...

CVE-2024-53136

CVE-2024-53136 relates to the Linux kernel mm/shmem issue: reverting a previous fix for data-race in shmem_getattr() that could deadlock when accessing tmpfs over NFS. Public details indicate the change targeted the shmem_getattr() path (mm: shmem) and mentions the deadlock scenario, with remedia...

CVE-2024-53139

The CVE-2024-53139 entry concerns the Linux kernel SCTP stack. A fix for a possible use-after-free in sctp_v6_available() is described, prompted by a lockdep warning showing sctp_v6_available() calling dev_get_by_index_rcu() and ipv6_chk_addr() without holding RCU. The description notes a stack t...

CVE-2024-53217

The connected Astra Linux advisory and the CVE entry both describe a Linux kernel vulnerability: NFSD: Prevent NULL dereference in nfsd4_process_cb_update() where __nfsd4_find_backchannel() may leave @ses NULL and setup_callback_client() dereferences it, causing a segfault. The issue is resolved ...

CVE-2024-56603

CVE-2024-56603 affects the Linux kernel in the net/af_can path. On error in can_create(), the code frees the allocated sk object, but sock_init_data() had already attached it to the sock, leaving a dangling sk pointer and introducing a potential use‑after‑free. The connected advisories confirm a ...

CVE-2024-56604

Summary (CVE-2024-56604): In the Linux kernel, Bluetooth RFCOMM can leave a dangling sk pointer in rfcomm_sock_alloc() when rfcomm_dlc_alloc() fails, leading to a use-after-free. The root cause is bt_sock_alloc() attaching the sk to the sock object and the code path not clearing the pointer on fa...

CVE-2024-56615

CVE-2024-56615 affects the Linux kernel and concerns BPF maps (devmap/xskmap) where an index used to access map entries could be a signed int, causing out-of-bounds writes. The fix changes the index type from int to u32 for both map element access and the iterator used during dev_map_free() to pr...

CVE-2025-21715

CVE-2025-21715 is reported in the Astra Linux bulletin as a Linux kernel issue affecting the davicom net driver. The root cause is a use-after-free (UAF) of the netdev private data stored in the dm object inside dm9000_drv_remove. The code can dereference dm after free_netdev() has been called, l...

CVE-2025-21772

CVE-2025-21772 involves the Linux kernel partition probing path (mac partition handling). The fix addresses processing of bogus partition tables by: (1) using put_dev_sector() for the bailout when a bad partoffset occurs, after a successful read_part_sector(); (2) rejecting partition tables that ...

CVE-2025-21782

CVE-2025-21782 — Linux kernel: orangefs: fix a slab-out-of-bounds in orangefs_debug_write. A syzbot report described slab-out-of-bounds Read in orangefs_debug_write; patch was tested and applied to fix the issue. The vulnerability is tied to the OrangeFS write path and is addressed by kernel fixe...

CVE-2025-21821

CVE-2025-21821 affects the Linux kernel; specifically the fbdev/omap framebuffer code. The issue arises when using touchscreen with framebuffer, causing a crash (scheduling while atomic) in the driver path related to LCD DMA. The provided advisory notes the root cause is tied to IRQ handling for ...

CVE-2025-21887

In CVE-2025-21887, the Linux kernel overlayfs (ovl) had a use-after-free in ovl_dentry_remote/ovl_dentry_update_reval caused by calling dput(upper) before upper is no longer safe to use; the fix moves dput(upper) to after its final use in ovl_link_up, preventing the UAF. The issue is addressed in...

CVE-2015-2925

The vulnerability CVE-2015-2925 affects the Linux kernel prior to 4.2.4, specifically the prepend_path function in fs/dcache.c. It allows a local attacker to bypass container protections by renaming a directory inside a bind mount, enabling a double-chroot-style escape. The impact is enabling pri...

CVE-2016-0723

CVE-2016-0723 is a Linux kernel race condition in the tty_ioctl handler (drivers/tty/tty_io.c) that can allow a local attacker to obtain memory content or trigger a denial of service by manipulating a TIOCGETD call during a TIOCSETD operation. The initial description states the flaw exists in ker...

CVE-2018-11506

CVE-2018-11506 affects the Linux kernel’s sr_do_ioctl (drivers/scsi/sr_ioctl.c) through version 4.16.12. The issue arises because sense buffers at the CDROM layer and SCSI layer use different sizes, enabling a local attacker to trigger a stack-based buffer overflow via CDROMREADMODE2 ioctl, poten...

CVE-2021-47384

CVE-2021-47384 affects Linux kernel hwmon drivers (notably w83793, and related subcomponents) with a NULL pointer dereference risk when reading a temp value, caused by an unnecessary field and an obsolete lm75[] array. The fix removes the unused lm75[] and adjusts driver subclient detection (devm...

CVE-2022-1198

CVE-2022-1198 is a Linux kernel use-after-free in drivers/net/hamradio/6pack.c (AX.25/6pack driver). A local attacker could crash the kernel or potentially escalate privileges by simulating an AX.25 device from user space. Public connected sources confirm the flaw and that patches exist in update...

CVE-2022-1973

CVE-2022-1973 describes a use-after-free in the Linux kernel NTFS3 filesystem, specifically in the log_replay path (fs/ntfs3/fslog.c). It allows a local attacker to crash the system and may lead to kernel information leakage. The connected Astra Linux note corroborates the same description of the...

CVE-2022-2905

CVE-2022-2905 is an out-of-bounds memory read in the Linux kernel’s BPF subsystem, exploitable by a local user via bpf_tail_call with a map key larger than max_entries. The Debian LTS advisory DLA-3173-1 (linux-5.10) lists CVE-2022-2905 among others and notes that an update to linux-5.10-149-2~de...

CVE-2022-47518

CVE-2022-47518 affects the Linux kernel before 6.0.11, specifically the WILC1000 wireless driver (drivers/net/wireless/microchip/wilc1000/cfg80211.c). The issue is missing validation of the number of channels, which can trigger a heap-based buffer overflow when copying the list of operating chann...

CVE-2022-48943

CVE-2022-48943: In the Linux kernel KVM x86/mmu code, a bug in asynchronous page-fault (APF) handling could cause a guest to hang by confusing a valid token with a zero value, potentially delaying or losing READY events. The fix ensures the APF token is non-zero, preventing misinterpretation of t...

CVE-2023-26607

CVE-2023-26607 affects the Linux kernel, with an out-of-bounds read in ntfs_attr_find (fs/ntfs/attrib.c) reported for kernel 6.0.8. The connected documents confirm the issue and align on the impacted component and root cause, but do not provide a vendor/product patch version or explicit remediati...

CVE-2023-4385

CVE-2023-4385 : Linux kernel JFS NULL pointer dereference in dbFree (fs/jfs/jfs_dmap.c) may allow local privilege or system crash due to missing sanity check. Connected entries reference the same issue and point to a fixing commit in the kernel source (commit 0d4837fdb796f99369cf7691d33de1b856bca...

CVE-2024-27415

CVE-2024-27415 affects Linux kernel netfilter/bridge. Root cause: nf_confirm and conntrack race when multicast/broadcast frames clone, causing a shared nf_conn entry to be referenced twice before confirmation. Result: a multicast flow can lead to a clone skb’s nfct being unconfirmed and race agai...

CVE-2024-36955

In CVE-2024-36955, the Linux kernel ALSA: hda: intel-sdw-acpi code had a path using device_get_named_child_node() that could leak a reference if fwnode_handle_put() was not called on the returned fwnode handle. The described fix adds a call to fwnode_handle_put() to prevent a leaked reference, ad...

CVE-2024-40927

CVE-2024-40927 : Linux kernel xhci TD clearing for multiple streams is fixed. When an endpoint has >1 in-flight TDs across streams and is stopped, the driver now defers processing of additional TDs and issues a Set TR Dequeue Pointer for each, by deferring subsequent TDs until the first is pro...

CVE-2024-41063

In CVE-2024-41063, the Linux kernel Bluetooth stack (hci_core) fixes a deadlock when unregistering a device. The root cause involves hci_unregister_dev() racing with hci_error_reset() and hdev->req_workqueue/destroy_workqueue(), where pending work items may still be running during destroy. The...

CVE-2024-41065

The CVE-2024-41065 issue is in the Linux kernel’s powerpc/pseries code related to usercopy hardening. When CONFIG_HARDENED_USERCOPY is enabled, reading the dispatch log from /sys/kernel/debug/powerpc/dtl/cpu-* could trigger a kernel BUG in usercopy (mm/usercopy.c). The root cause involves copying...

CVE-2024-43817

The CVE CVE-2024-43817 describes a Linux kernel vulnerability in the virtio_net path: two missing checks in virtio_net_hdr_to_skb() can trigger a crash. The issues arise when after skb_segment the buffer remains non-linear (nr_frags != 0) and SKBTX_SHARED_FRAG is not set, preventing __skb_lineari...

CVE-2024-46771

CVE-2024-46771 (Linux kernel, can: bcm): A proc entry is created per BCM socket on connect and is leaked when the bound netdev is unregistered, due to bcm_notify/bcm_proc_read handling. Reproducer uses connect to vxcan1, unregisters dev, and a second connect attempts to allocate a proc entry with...

CVE-2024-47141

CVE-2024-47141 affects the Linux kernel pinctrl/pinmux path. When two processes (A and B) concurrently call pinctrl_select_state() for the same pin, the code may dereference desc->mux_owner as NULL due to a race between updates to desc->mux_usecount and desc->mux_owner. The advisory stat...

CVE-2024-47739

CVE-2024-47739 is a Linux kernel vulnerability in the padata serialization path. When more than 2^32 padata objects are submitted to padata_do_serial, the sorting of overflowed seq_nr values can place new objects before existing ones, causing a deadlock in the serialization process because padata...