CVE-2025-21658

Technical details beyond the summary are not provided in the supplied documents; no affected products, versions, or fixes are enumerated here. Monitor for updates.

CVE-2015-7515

CVE-2015-7515 affects the Linux kernel (pre-4.4) due to improper validation in the aiptek_probe path of drivers/input/tablet/aiptek.c. A physically proximate user can cause a NULL pointer dereference and system crash via a crafted USB device that lacks endpoints, leading to denial of service. The...

CVE-2017-17975

CVE-2017-17975: Use-after-free in Linux kernel’s usbtv_probe (drivers/media/usb/usbtv/usbtv-core.c) up to kernel 4.14.10 can allow local attackers to trigger audio registration failure, potentially causing a denial of service (system crash) or other unspecified impact due to improper handling of ...

CVE-2018-10901

CVE-2018-10901 affects the Linux kernel’s KVM virtualization subsystem. The VMX path fails to restore the guest GDT.LIMIT to the host value, setting it to 64KB instead. This can allow a host userspace process to corrupt GDT entries (notably per-cpu variables), enabling local privilege escalation....

CVE-2019-19079

CVE-2019-19079: A memory leak in the qrtr_tun_write_iter() function (net/qrtr/tun.c) of the Linux kernel before 5.3 allows a remote attacker to trigger memory consumption and Denial of Service. The issue is documented in multiple advisories (e.g., Unity Linux UTSA advisories) as affecting kernels...

CVE-2021-47118

CVE-2021-47118: In the Linux kernel, cad_pid is initialized without taking a reference to the init task’s pid. When cad_pid is later updated via sysctl, the old pid may be put without a corresponding get, risking a use-after-free of the init task’s struct pid. The connected MiracleLinux advisory ...

CVE-2022-48804

CVE-2022-48804 is resolved in the Linux kernel’s vt_ioctl/vt_setactivate path. The vulnerability stems from an array_index_nospec handling that could allow a transient integer underflow when an out-of-bounds value is decremented after zero, specifically affecting vsa.console handling. The descrip...

CVE-2022-49451

Summary: CVE-2022-49451 affects the Linux kernel firmware: arm_scmi base protocol enumeration of SCMI protocols. The vulnerability arises when validating the number of returned protocols via BASE_DISCOVER_LIST_PROTOCOLS, where a sum of unsigned integers could overflow, allowing the check to be si...

CVE-2022-49700

CVE-2022-49700 is a Linux kernel SLUB allocator bug: the fastpath in slab_alloc_node() can race with slab deactivation, allowing a mismatch where c->slab/c->freelist become inconsistent and can lead to a use-after-free or a page freeing while it still contains slab objects. The issue is tie...

CVE-2023-52632

CVE-2023-52632 describes a Linux kernel lockdep warning in drm/amdkfd where a potential circular locking dependency can occur between srcu and a work-queue based lock. The provided details show a chain: srcu -> info->lock#2 -> (work_completion) svms->deferred_list_work, with the risk ...

CVE-2023-52634

Summary (CVE-2023-52634) : In the Linux kernel, the DRM/AMD display driver had a logic issue in the disable_otg_wa path that could cause a system hang during HDMI mode switches due to simultaneous FIFO/HPO state changes. The root cause was that enabling/disabling FIFO could affect multiple regist...

CVE-2023-52662

CVE-2023-52662 is a Linux kernel issue. The vulnerability is a memleak in drm/vmwgfx: vmw_gmrid_man_get_node. If ida_alloc_max fails, resources allocated before may not be freed, including memory allocated by kmalloc and ttm_resource_init. The connected Azure Linux Nessus entries reference the sa...

CVE-2023-52672

CVE-2023-52672 affects the Linux kernel pipe handling code. A regression in pipe resizing caused writers to deadlock when a pipe was full during a resize because wakeups on pipe->wr_wait could occur before pipe->max_usage was updated. The fix changes the sequence: set max_usage (and nr_acco...

CVE-2023-52696

CVE-2023-52696: In the Linux kernel, powerpc/powernv: add a null pointer check in opal_powercap_init(); kasprintf() can return NULL on allocation failure. Connected advisories note this vulnerability is resolved, with Nessus entries describing Azure Linux 3.0 kernel security update and Unity Linu...

CVE-2023-52973

The CVE-2023-52973 issue affects the Linux kernel’s vc_screen path (vt/vc_screen.c). Root cause: a use-after-free of vc_data after console_unlock() in vcs_read(), where the vc_data pointer was loaded inside the loop, allowing a UAF in vcs_size(). The bug was fixed by moving the vc_data load to th...

CVE-2024-26930

CVE-2024-26930 : In the Linux kernel, the SCSI/QLA2xxx double-free vulnerability occurs when ha->vp_map is freed twice (in qla2x00_mem_alloc and again in qla2x00_mem_free). The root cause is a use-after-free-like double free of ha->vp_map; the fix assigns NULL to vp_map and lets kfree handl...

CVE-2024-35843

CVE-2024-35843 concerns the Linux kernel IOMMU VT-d I/O page fault path. The vulnerability stemmed from how the faulting device was located: the code previously used pci_get_domain_bus_and_slot() to find the PCI device, which could permit a use-after-free scenario if the device was released by th...

CVE-2024-35872

CVE-2024-35872 — Linux kernel mm/secretmem vulnerability : The issue arises from the folio_is_secretmem() check that relied on secretmem folios having the LRU flag. Folios can be in a batch without LRU set, or lose the LRU flag temporarily, making the check unreliable and allowing GUP-fast to gra...

CVE-2024-35963

CVE-2024-35963: In the Linux kernel, the Bluetooth subsystem (hci_sock) was fixed for not validating user input passed to setsockopt. The fix validates input length before copying data, mitigating a potential improper input handling vector in Bluetooth setsockopt. The vulnerability is described i...

CVE-2024-38558

CVE-2024-38558 concerns the Linux kernel's net/openvswitch handling of ICMPv6 in the OVS_PACKET_CMD_EXECUTE path. The root cause is a misuse of a shared IPv6 field between Neighbor Discovery (ND) state and conntrack original tuple (ct_orig) during packet-key parsing. When parsing ICMPv6, the code...

CVE-2024-38608

CVE-2024-38608 – Linux kernel net/mlx5e: Fix netif state handling Root cause: In mlx5e_suspend, resources are freed only if netif_device_present() is true. During mlx5e_resume, netif state is changed (via mlx5e_nic_enable) only if reg_state == NETREG_REGISTERED. If netdev is not registered, the r...

CVE-2024-38615

CVE-2024-38615 : A Linux kernel cpufreq vulnerability was resolved. The issue centers on the cpufreq exit() callback which is now optional; code must not call exit() without validating the pointer first, and freq_table must be cleared even if the exit() callback is absent. The connected Astra Lin...

CVE-2024-39507

CVE-2024-39507 is a Linux kernel issue affecting the net/hns3 driver. The vulnerability stems from a race between link-status change handling and the RoCE driver: when the NIC reports a link status change, the RoCE driver may be uninitialized, leading to a kernel crash. The fix introduces a check...

CVE-2024-40904

CVE-2024-40904 affects the Linux kernel USB: class: cdc-wdm driver. The issue was a CPU soft lockup caused by excessive log messages from the interrupt URB handling, exacerbated by immediate resubmission of URBs with -EPROTO status and verbose kernel logging. The fix replaces two verbose dev_err(...

CVE-2024-40977

CVE-2024-40977 is described in connected MiracleLinux advisory as a Linux kernel fix for the wifi: mt76: mt7921s: fix potential hung tasks during chip recovery. The root cause is a deadlock during chip recovery where kernel worker reset_work waits for stat_worker which itself waits for the same l...

CVE-2024-41005

CVE-2024-41005 involves a race in the Linux kernel netpoll code. The issue stems from netpoll_owner_active reading napi->poll_owner non-atomically to determine lock ownership, allowing a data race between net_rx_action and netpoll_send_skb. The fix replaces the non-atomic check with an atomic ...

CVE-2024-46725

CVE-2024-46725 refers to a Linux kernel vulnerability where the drm/amdgpu path could trigger an out-of-bounds write warning. The connected Astra Linux bulletin confirms the issue as a kernel-level flaw and notes the fix was to validate the ring type value to prevent the OOB write. The vulnerabil...

CVE-2024-49856

CVE-2024-49856 — Linux kernel, x86 SGX: deadlock in SGX NUMA node search. When the current node lacks an EPC section and other EPCs are exhausted, the loop searching for a remote EPC page can deadlock, causing a soft lockup. The root cause is that nid_of_current is not set in sgx_numa_mask, so ni...

CVE-2024-49934

CVE-2024-49934: Linux kernel fault in fs/inode dump_mapping() when dumping mappings can access an invalid dentry.d_name.name during memory hot-remove, causing a crash. The advisory explains the root cause and notes a safer approach to retrieve the filename without relying on %pd, acknowledging th...

CVE-2024-49959

CVE-2024-49959 (Linux kernel) : The issue occurs in journaling code (jbd2). During journal space waits, __jbd2_log_wait_for_space() may call jbd2_cleanup_journal_tail() to reclaim space; if an error happens inside that cleanup (e.g., EIO) the function could keep waiting instead of stopping, poten...

CVE-2024-49987

The CVE-2024-49987 issue affects the Linux kernel bpftool component. When netfilter has no entry to display, qsort is called with a NULL pointer and size 0, triggering undefined behavior as UBSan reports. The root cause is a NULL pointer passed to qsort; the advisory notes that the C standard gui...

CVE-2024-50029

CVE-2024-50029 refers to a Linux kernel bug in Bluetooth handling. The issue is a use-after-free in hci_enhanced_setup_sync where the ACL connection can be destroyed while a cmd_sync is pending, leading to a KASAN slab-use-after-free in hci_enhanced_setup_sync. The description includes a trace sh...

CVE-2024-50148

CVE-2024-50148 affects the Linux kernel Bluetooth bnep, where proto_unregister could wild-memory-access due to bnep_init() ignoring bnep_sock_init()’s return value. The fix is to propagate bnep_sock_init()’s return value in bnep_exit(), preventing cleanup of resources on module removal from leavi...

CVE-2024-50192

CVE-2024-50192: Linux kernel irqchip/gic-v4 vulnerability fixed by adding a vmapp_count check to prevent a VMOVP on a dying VPE. A small window could allow userspace to force a VPE affinity change while unmapped but the doorbell interrupt remains visible in /proc/irq/. The fix unifies vmapp_count...

CVE-2024-53066

CVE-2024-53066 concerns a Linux kernel issue where a KMSAN warning could arise from decoding NFS attributes. The warning is an uninitialized value in decode_getfattr_attrs() triggered during attribute decoding, linked to the field mdsthreshold in fattr not being initialized before it is used by d...

CVE-2024-53118

CVE-2024-53118 (Linux kernel) has been addressed by fixing a memory leak in the vsock error queue. The issue occurred because kernel MSG_ZEROCOPY completion notifications in the error queue were left uncleaned when the socket was destroyed, leading to unreferenced objects and potential leaks. The...

CVE-2024-53203

CVE-2024-53203 is a Linux kernel issue: a potential array underflow in usb: typec ucsi_ccg_sync_control() could be triggered when the user controls the command via debugfs, if con_index is zero leading to an access of ucsi.connector[con_index-1]. The vulnerability is resolved in the Linux kernel;...

CVE-2024-53213

CVE-2024-53213 – Linux kernel (LAN78xx USB Ethernet driver) Connected sources confirm a concrete issue in lan78xx where a buffer allocated in lan78xx_probe() was freed twice: once via usb_free_urb(dev->urb_intr) with URB_FREE_BUFFER and again by kfree(buf). The root cause is the double free st...

CVE-2024-56606

CVE-2024-56606 concerns the Linux kernel vulnerability in af_packet where, after sock_init_data() allocates a sk object and attaches it to a sock, packet_create() on error frees the sk but leaves a dangling sk pointer in the sock. This can enable a use-after-free if other code reuses that pointer...

CVE-2024-56619

CVE-2024-56619 — Linux kernel nilfs2 . A potential out-of-bounds memory access in nilfs_find_entry() when an inode’s i_size is large/corrupted. Root cause: i_size upper 32 bits were lost due to a local variable type, causing underflow in end-address calculation. Fix: replace the offending local v...

CVE-2024-58069

CVE-2024-58069 affects the Linux kernel RTC driver for PCF85063. The issue arises when an nvmem client uses a buffer smaller than 4 bytes while regmap_read assumes an unsigned int-sized destination, potentially causing an out-of-bounds write. The documented fix is to use an intermediary unsigned ...

CVE-2025-21753

The CVE-2025-21753 entry concerns a use-after-free in the Linux kernel’s btrfs join_transaction path. Root cause: when joining the current (possibly aborted) transaction, the code reads the transaction’s aborted field after releasing fs_info->trans_lock and without holding an extra reference, ...

CVE-2025-21928

CVE-2025-21928 : In the Linux kernel HID intel-ish-hid driver, a use-after-free issue in ishtp_hid_remove() can occur, leading to a random crash minutes after the driver is removed. The root cause is improper memory handling where the code frees driver_data inside the loop that destroys HID devic...

CVE-2025-39735

CVE-2025-39735 affects the Linux kernel's JFS: a slab-out-of-bounds read in ea_get() can occur when processing extended attributes. The root cause is an overflow during clamping of ea_size against EALIST_SIZE(ea_buf->xattr) due to int upper-bound handling, causing a negative size to be used in...

CVE-2014-3122

CVE-2014-3122 affects the Linux kernel local memory-management path. The advisory centers on the try_to_unmap_cluster function in mm/rmap.c, where the code path did not consistently lock pages, enabling a local user to trigger a memory-usage pattern that can force removal of page-table mappings a...

CVE-2015-8816

CVE-2015-8816 affects the Linux kernel prior to 4.3.5, where hub_activate in drivers/usb/core/hub.c mishandles hub-interface data. Physically proximate attackers can unplug a USB hub to trigger invalid memory access and a system crash (DoS); impact may be unspecified otherwise. A fixed version ex...

CVE-2016-4482

CVE-2016-4482 : The Linux kernel before 4.7 has a flaw in the proc_connectinfo handling. The proc_connectinfo function in drivers/usb/core/devio.c does not initialize a data structure, enabling local users to read sensitive data from kernel stack memory via a crafted USBDEVFS_CONNECTINFO ioctl. T...

CVE-2016-4485

The CVE-2016-4485 issue affects the Linux kernel (net/llc/af_llc.c): the llc_cmsg_rcv path does not initialize a data structure, enabling a local attacker to read kernel stack memory and obtain sensitive information. Public references in connected documents indicate this vulnerability existed in ...

CVE-2017-16994

The CVE-2017-16994 vulnerability affects the Linux kernel’s walk_hugetlb_range function in mm/pagewalk.c, where holes in hugetlb ranges are mishandled. This allows a local attacker to obtain sensitive information from uninitialized kernel memory via a crafted mincore() call. Public sources attrib...

CVE-2017-6346

CVE-2017-6346 affects the Linux kernel net/packet/af_packet.c, describing a race condition in the PACKET_FANOUT fanout path that can cause a use-after-free in multithreaded user apps. The connected sources confirm this is a local vulnerability with potential denial of service and possible unspeci...