CVE-2024-36880

CVE-2024-36880 details (from provided documents): In the Linux kernel, a Bluetooth subsystem issue in the qca firmware parsing was resolved by adding missing sanity checks for firmware files before download, to prevent memory access violations beyond the allocated vmalloc buffer. This vulnerabili...

CVE-2024-36922

CVE-2024-36922 affects the Linux kernel’s iwlwifi driver (iwl_txq_reclaim) where txq->read_ptr could be read without holding the lock, allowing a race that can reclaim the same entry twice and trigger a WARN_ONCE, potentially causing a service disruption. The issue is fixed by reading txq->...

CVE-2024-36932

CVE-2024-36932 pertains to the Linux kernel, where a use-after-free can occur in thermal_debugfs after cdev removal. The root cause is that thermal_debug_cdev_remove() runs without holding cdev->lock, potentially freeing the thermal_debugfs object while thermal_debug_cdev_state_update() may st...

CVE-2024-38559

CVE-2024-38559: In the Linux kernel, the qedf SCSI path copies a userspace buffer without guaranteeing a NUL terminator, risking an OOB read in kstrtouint. The fix uses memdup_user_nul instead of memdup_user. Affected: kernel SCSI qedf path; Root cause: missing termination of the copied buffer. R...

CVE-2024-38570

CVE-2024-38570 affects the Linux kernel GFS2/glock handling during DLM lockspace release on unmount. The issue was that glocks not intended to be unlocked could be freed and the lockspace released, while asynchronous callbacks (asb/bast) remained active, risking access to deallocated objects. The...

CVE-2024-40924

CVE-2024-40924 (Linux kernel) resolved by making the DPT object in drm/i915/dpt unshrinkable. In some scenarios the DPT object could be shrunk while its associated framebuffer remained, leaving a stale entry in the vm->bound_list. When the kernel attempted to rewrite PTEs using a stale CPU map...

CVE-2024-41005

CVE-2024-41005 involves a race in the Linux kernel netpoll code. The issue stems from netpoll_owner_active reading napi->poll_owner non-atomically to determine lock ownership, allowing a data race between net_rx_action and netpoll_send_skb. The fix replaces the non-atomic check with an atomic ...

CVE-2024-41065

The CVE-2024-41065 issue is in the Linux kernel’s powerpc/pseries code related to usercopy hardening. When CONFIG_HARDENED_USERCOPY is enabled, reading the dispatch log from /sys/kernel/debug/powerpc/dtl/cpu-* could trigger a kernel BUG in usercopy (mm/usercopy.c). The root cause involves copying...

CVE-2024-46722

CVE-2024-46722 is a Linux kernel vulnerability affecting the DRM AMDGPU driver where a read of mc_data[i-1] could go out of bounds. The connected Astra/DEBIAN/CBLMARINER advisories reference the same issue in the kernel and confirm a fix was applied in the AMDGPU/mc_data path to address the out-o...

CVE-2024-46871

The CVE-2024-46871 entry concerns the Linux kernel's DRM/AMD display component. It fixes an incorrect definition for AMDGPU_DMUB_NOTIFICATION_MAX, where the enum dmub_notification_type was actually exposing 6 types instead of 5. The undercount could lead to out-of-bounds access when allocating th...

CVE-2024-47757

CVE-2024-47757 affects Linux kernel nilfs2. The issue is a potential out-of-bounds memory access in nilfs_btree_check_delete() when the root node has no entries, leading to memory access outside the block buffer while retrieving the maximum key. The root cause is degeneration-to-direct-mmapping c...

CVE-2024-49934

CVE-2024-49934 concerns the Linux kernel vulnerability in the fs/inode path where dump_mapping() could access invalid dentry.d_name.name, potentially causing a crash during hot-remove of a memory device (e.g., hugetlb). The connected documents describe the root cause as unsafe filename retrieval ...

CVE-2024-49968

CVE-2024-49968 (from Miracle Linux AXSA advisory) concerns Linux kernel ext4. The vulnerability occurs when mounting an ext4 filesystem that does not have the casefold feature while the default hash version is DX_HASH_SIPHASH; in this scenario the mount operation exits, effectively preventing mou...

CVE-2024-50101

CVE-2024-50101 occurs in the Linux kernel iommu/vt-d code where domain_context_clear() incorrectly called pci_for_each_dma_alias() for non‑PCI devices, potentially causing kernel hangs. The fix adds a check to only call pci_for_each_dma_alias() for PCI devices and calls domain_context_clear_one()...

CVE-2024-50148

CVE-2024-50148 affects the Linux kernel Bluetooth bnep, where proto_unregister could wild-memory-access due to bnep_init() ignoring bnep_sock_init()’s return value. The fix is to propagate bnep_sock_init()’s return value in bnep_exit(), preventing cleanup of resources on module removal from leavi...

CVE-2024-50234

CVE-2024-50234 : A Linux kernel vulnerability affecting Wi‑Fi stack in the iwl4965/iwlegacy path where on resume from hibernation a stale interrupt could be re-enabled, causing a race between resume startup and queued shutdown work and potentially a system hang. The fix, implemented in the kernel...

CVE-2024-53203

CVE-2024-53203 is a Linux kernel issue: a potential array underflow in usb: typec ucsi_ccg_sync_control() could be triggered when the user controls the command via debugfs, if con_index is zero leading to an access of ucsi.connector[con_index-1]. The vulnerability is resolved in the Linux kernel;...

CVE-2024-55916

The CVE-2024-55916 entry refers to a Linux kernel race where the KVP/VSS daemon may run before the VMBus ringbuffer is fully initialized. Concrete detail: a NULL pointer dereference can occur in hv_pkt_iter_first when the daemon opens / dev/vmbus/hv_kvp and registers before vmbus_open() completes...

CVE-2024-56751

Summary (CVE-2024-56751): A Linux kernel IPv6 issue involving releasing a nexthop on device removal. The vulnerability is tied to a hang in the pmtu self-test when removing a network device, caused by a stale or lingering nexthop/dst reference that prevents proper cleanup. The root cause is descr...

CVE-2024-57879

CVE-2024-57879 affects the Linux kernel Bluetooth stack (ISO) where the hdev device reference may not be released at the end of iso_listen_bis due to hci_get_route returning while still holding the device. The root cause is not releasing hdev with hci_dev_put on all code paths, including error ex...

CVE-2025-21697

The CVE-2025-21697 issue affects the Linux kernel’s DRM/V3D component. The root cause is failure to reset the job pointer to NULL after a job completes, which can cause a warning during driver unload, implying the job may still be active. The documented remediation is to assign the job pointer to...

CVE-2025-21699

CVE-2025-21699 is a Linux kernel issue in the gfs2 component. The flaw arises when truncating an inode’s address space while flipping the GFS2_DIF_JDATA flag; depending on the flag, the pages in the address space are managed either by buffer heads or by iomap_folio_state structs, and the memory m...

CVE-2025-21762

Summary (CVE‑2025‑21762) The Linux kernel fixed a vulnerability in arp_xmit() where arp_xmit() could be called without RTNL or RCU protection, creating a potential use‑after‑free (UAF) scenario. The remediation uses RCU protection to guard arp_xmit() and prevent UAF. The issue is documented in th...

CVE-2025-21821

CVE-2025-21821 affects the Linux kernel; specifically the fbdev/omap framebuffer code. The issue arises when using touchscreen with framebuffer, causing a crash (scheduling while atomic) in the driver path related to LCD DMA. The provided advisory notes the root cause is tied to IRQ handling for ...

CVE-2025-39735

CVE-2025-39735 affects the Linux kernel's JFS: a slab-out-of-bounds read in ea_get() can occur when processing extended attributes. The root cause is an overflow during clamping of ea_size against EALIST_SIZE(ea_buf->xattr) due to int upper-bound handling, causing a negative size to be used in...

CVE-2016-2847

CVE-2016-2847 affects the Linux kernel, where fs/pipe.c does not cap unread data in pipes, enabling local users to cause memory exhaustion and a denial of service. The description and connected sources confirm the vulnerability lies in the per-user pipe data handling and that the risk is local Do...

CVE-2017-7187

The CVE-2017-7187 issue affects the Linux kernel sg_ioctl in drivers/scsi/sg.c, where a large SG_NEXT_CMD_LEN ioctl can trigger a stack-based buffer overflow, leading to a DoS or potentially other impact via out-of-bounds writes in sg_write. Descriptions across connected sources (CNVD-2017-03858)...

CVE-2022-1198

CVE-2022-1198 is a Linux kernel use-after-free in drivers/net/hamradio/6pack.c (AX.25/6pack driver). A local attacker could crash the kernel or potentially escalate privileges by simulating an AX.25 device from user space. Public connected sources confirm the flaw and that patches exist in update...

CVE-2022-2905

CVE-2022-2905 is an out-of-bounds memory read in the Linux kernel’s BPF subsystem, exploitable by a local user via bpf_tail_call with a map key larger than max_entries. The Debian LTS advisory DLA-3173-1 (linux-5.10) lists CVE-2022-2905 among others and notes that an update to linux-5.10-149-2~de...

CVE-2022-48943

CVE-2022-48943: In the Linux kernel KVM x86/mmu code, a bug in asynchronous page-fault (APF) handling could cause a guest to hang by confusing a valid token with a zero value, potentially delaying or losing READY events. The fix ensures the APF token is non-zero, preventing misinterpretation of t...

CVE-2022-49322

The CVE-2022-49322 issue affects the Linux kernel in PREEMPT_RT builds when bootparams include trace_event=initcall:initcall_start tp_printk=1. In this scenario, output_printk() triggers a sleepable rt-spinlock usage via rt_spin_lock, causing a sleeping function to be called from an invalid conte...

CVE-2022-49416

CVE-2022-49416 is present in the Linux kernel, tied to a use-after-free bug in wifi/mac80211 chanctx handling. The issue occurs in ieee80211_vif_use_reserved_context() when the new context’s replace_state is REPLACE_NONE and the old context is freed in ieee80211_vif_use_reserved_reassign(), after...

CVE-2022-49700

CVE-2022-49700 is a Linux kernel SLUB allocator bug: the fastpath in slab_alloc_node() can race with slab deactivation, allowing a mismatch where c->slab/c->freelist become inconsistent and can lead to a use-after-free or a page freeing while it still contains slab objects. The issue is tie...

CVE-2023-52520

CVE-2023-52520 : Linux kernel platform/x86: think-lmi had a reference leak when a duplicate attribute is found by kset_find_obj(); a reference to the attribute could be leaked if not disposed with kobject_put. The fix moves the setting name validation into a separate function to avoid duplicating...

CVE-2023-52626

CVE-2023-52626 (Linux kernel) affects net/mlx5e: fix an operation precedence bug in port timestamping napi_poll context, where indirection (*) has lower precedence than postfix ++, causing an out-of-bounds read after increment. The fix dereferences before increment, preventing the read. CVSS 3.1 ...

CVE-2023-52686

CVE-2023-52686 involves a Linux kernel vulnerability where a null pointer check is missing in powerpc/powernv opal_event_init() and kasprintf() can return NULL on allocation failure. Exploitation could lead to a denial of service via NULL pointer dereference; this has been addressed with a kernel...

CVE-2023-52696

CVE-2023-52696: In the Linux kernel, powerpc/powernv: add a null pointer check in opal_powercap_init(); kasprintf() can return NULL on allocation failure. Connected advisories note this vulnerability is resolved, with Nessus entries describing Azure Linux 3.0 kernel security update and Unity Linu...

CVE-2023-52811

In CVE-2023-52811, the Linux kernel ibmvfc driver fix removes a BUG_ON when an event pool is empty and instead returns NULL from ibmvfc_get_event(). All call sites were updated to check for NULL and handle the failure or recovery path. This prevents a potential junk pointer path and kernel crash ...

CVE-2023-52819

CVE-2023-52819 is resolved in the Linux kernel. The vulnerability was in drm/amd where UBSAN reported an array-index-out-of-bounds for Polaris/Tonga in pptable structs using flexible array sizes; the fix switches to using flexible arrays to avoid out-of-bounds access. Impact is local (CVSS: AV:L,...

CVE-2023-53033

Summary (CVE-2023-53033): The Linux kernel netfilter NFT payload code incorrectly handles VLAN header bit extraction due to arithmetic that adds, not subtracts, the VLAN header size when computing the copy length for double-tagged packets. This could permit out-of-bounds handling in VLAN header p...

CVE-2024-26651

CVE-2024-26651 concerns a Linux kernel issue where a missing check in usbnet_get_endpoints could fail to propagate an error, potentially enabling a local impact as described in the advisory. The vulnerability is tied to the usbnet_endpoints handling path, with the described fix being to add a che...

CVE-2024-26698

Linux kernel hv_netvsc is affected by a race between netvsc_probe and netvsc_remove. The root cause is napi_disable being invoked on non-enabled subchannels, causing hung behavior during device removal due to an infinite msleep in napi_disable. The fix (commit ac5047671758) disables NAPI before c...

CVE-2024-35893

CVE-2024-35893 relates to a Linux kernel net/sched kernel-infoleak via act_skbmod. The issue was that tcf_skbmod_dump() copied four bytes from kernel stack to user space because struct tc_skbmod has a four‑byte hole. The fix clears the structure before filling fields to prevent uninitialized data...

CVE-2024-35899

CVE-2024-35899 affects the Linux kernel nf_tables (netfilter). The issue is a race where the destroy workqueue may run after exit_net has released resources, risking use-after-free of a nf_tables set during module removal. The provided trace shows KASAN slab-use-after-free in nf_tables_trans_dest...

CVE-2024-36025

CVE-2024-36025 is validated by connected MiracleLinux security advisory AXSA:2024-8783:27. Affected: Linux kernel scsi qla2xxx driver. Root cause: memory corruption from an off-by-one in qla_edif_app_getstats() where app_reply->elem[] (allocated for app_req.num_ports) could be overrun due to a...

CVE-2024-36270

CVE-2024-36270 : Linux kernel netfilter/tproxy vulnerability fixed. The bug caused a general protection fault / NULL pointer dereference in nf_tproxy_laddr4 when ip address handling hit a NULL device on the in_dev_rcu path. The corrigendum notes __in_dev_get_rcu() can return NULL and requires a N...

CVE-2024-40929

CVE-2024-40929 : Linux kernel vulnerability in wifi/iwlwifi/mvm where the ssids pointer could be accessed when n_ssids is 0, causing an out-of-bounds read. The fix adds a check for n_ssids before dereferencing the ssids pointer. Documented impact per CVE: LOCAL access with LOW privileges required...

CVE-2024-41092

CVE-2024-41092: Linux kernel drm/i915/gt had a potential use-after-free in fence revocation. Root cause: race between revocation of fence registers and completion callbacks, with vma->fence->active idleness not guaranteed before vma eviction. The fix is to wait for idleness of vma->fence...

CVE-2024-42238

CVE-2024-42238 : In the Linux kernel, the vulnerability in firmware CS_DSP handling was resolved. The issue allowed processing to overrun when a block header exceeded remaining data, due to prior behavior in cs_dsp_load()/cs_dsp_load_coeff() which would loop until enough data remained instead of ...

CVE-2024-43817

The CVE CVE-2024-43817 describes a Linux kernel vulnerability in the virtio_net path: two missing checks in virtio_net_hdr_to_skb() can trigger a crash. The issues arise when after skb_segment the buffer remains non-linear (nr_frags != 0) and SKBTX_SHARED_FRAG is not set, preventing __skb_lineari...