CVE-2024-27022

CVE-2024-27022: Linux kernel race in fork where child VMAs may be linked before full initialization. Root cause involves vma locking around hugetlb/vma handling; fix defers linking of vma until initialized. Debian security advisory DSA-5680-1 notes the fix in kernel 6.1.90-1 for bookworm. No expl...

CVE-2024-35823

CVE-2024-35823: Linux kernel vt buffer corruption when deleting characters has been fixed. Root cause: overlapping buffers in VT text handling; solution: replace memcpy() with memmove() (same approach as VGA text buffer fix). Affected component: vt in the Linux kernel. Remediation: upgrade to a k...

CVE-2024-35865

CVE-2024-35865 (Linux kernel) : The smb client was fixed to prevent a use-after-free in smb2_is_valid_oplock_break() by skipping sessions that are tearing down (status SES_EXITING). This mitigates a potential UAF during Oplock break validation. The description notes the vulnerability is resolved ...

CVE-2024-35884

The CVE-2024-35884 vulnerability is in the Linux kernel UDP GRO handling for tunneled packets. When rx-udp-gro-forwarding is enabled, GRO can be applied to UDP packets that land in a tunnel, causing various issues due to mismatched geneve/frag_list handling. The issue manifested as incorrect GSO ...

CVE-2024-41041

Technical details about CVE-2024-41041 are not publicly provided in the connected documents. No specific affected products/versions or remediation are listed here. Monitor official advisories and vendor/public sources for updates.

CVE-2024-41097

CVE-2024-41097 concerns the Linux kernel USB ATM cxacru driver. The issue stemmed from incomplete endpoint checking during cxacru_bind(), which could cause wrong endpoint types to be used when submitting URBs. The patch adds verification that required endpoint types are present for both IN and OU...

CVE-2024-46864

CVE-2024-46864 is a Linux kernel vulnerability affecting x86/hyperv where a new cpuhp state handling caused the VP assist page not to be reset during kexec, leading to VP memory corruption and a possible panic. The root cause: cpuhp_setup_state() returns 0 for non-online/dyn states, and hv_machin...

CVE-2024-47713

CVE-2024-47713 is a Linux kernel vulnerability in wifi/mac80211: two-phase skb reclamation is needed in ieee80211_do_stop to ensure work is done with interrupts enabled. The patch moves the actual skb work outside the IRQ-disabled region to avoid warning and potential issues when backtracing thro...

CVE-2024-49928

The CVE CVE-2024-49928 affects the Linux kernel wifi: rtW89 driver, where reading TX power FW elements could read past the valid memory due to the loop expression causing an extra copy. The issue is mitigated by moving the entry copy into the loop body, preventing out-of-bounds access. The fix is...

CVE-2024-50101

CVE-2024-50101 : Linux kernel vulnerability in iommu/vt-d where domain_context_clear() incorrectly called pci_for_each_dma_alias() for non-PCI devices. Root cause: misusing pci_for_each_dma_alias() on non-PCI devices, risking kernel hangs or other unexpected behavior. Fix: only call pci_for_each_...

CVE-2024-56599

CVE-2024-56599 records a Linux kernel vulnerability in the wifi/ath10k SDIO path where rmmod ath10k could panic if CONFIG_INIT_ON_FREE_DEFAULT_ON is enabled. The root cause is a NULL-pointer path involving destroying the sdio workqueue before ath10k_core_destroy frees the wiphy/cfg80211 device, l...

CVE-2024-57885

CVE-2024-57885: In the Linux kernel, a kmemleak print operation could emit a "sleeping function called from invalid context" warning when /sys/kernel/debug/kmemleak is read under specific conditions (CONFIG_PREEMPT_RT=y, SELinux as LSM, kptr_restrict=1, kmemleak buffer non-empty). The issue arise...

CVE-2025-21925

CVE-2025-21925 : In the Linux kernel, a vulnerability was fixed where skb_get() could be used before dev_queue_xmit() when a shared skb is processed (e.g., with IFF_TX_SKB_SHARING). The documented exploit path involves syzbot crashing a host via the llc_sap_action_send_test_c path, with the e1000...

CVE-2025-21991

The CVE-2025-21991 issue affects the Linux kernel’s AMD microcode loader for x86. It could trigger an out-of-bounds access when iterating NUMA nodes with empty or CPU-less nodes, potentially accessing cpu_data beyond its bounds during a microcode update. The root cause is that load_microcode_amd(...

CVE-2025-22121

CVE-2025-22121 – Linux kernel ext4 xattr check bypass (out-of-bounds read) What’s affected: Linux kernel ext4 filesystem code, specifically ext4_xattr_inode_dec_ref_all() and related xattr handling paths that can read beyond allocated buffers when inodes contain xattrs. What’s the issue: A read o...

CVE-2016-6136

CVE-2016-6136 is a Linux kernel race condition in audit_log_single_execve_arg (auditsc.c) that can allow a local user to bypass character-set restrictions or disrupt system-call auditing via a double-fetch flaw. Connected advisories confirm multiple vendors map this CVE to Linux kernel fixes; rem...

CVE-2016-7911

CVE-2016-7911: Race condition in get_task_ioprio in block/ioprio.c of the Linux kernel allows local privilege escalation or use-after-free leading to DoS. A crafted ioprio_get system call can trigger the issue. This vulnerability was addressed by kernel patching in the 4.6.6 release; updating to ...

CVE-2016-7916

CVE-2016-7916 is a Linux kernel local privilege disclosure affecting the environ_read path in fs/proc/base.c. The race condition between environment-variable copying and process setup allows a local user to read sensitive data from kernel memory by accessing a /proc/*/environ file during the setu...

CVE-2017-14156

Summary: CVE-2017-14156 affects the Linux kernel up to 4.12.10. The atyfb_ioctl function in drivers/video/fbdev/aty/atyfb_base.c does not initialize a certain data structure, allowing local attackers to read padding bytes from kernel stack memory and disclose sensitive information. Impact: inform...

CVE-2017-18204

CVE-2017-18204 affects the Linux kernel via ocfs2_setattr in fs/ocfs2/file.c, exploitable by local users to cause a denial-of-service (deadlock) when using DIO. The vulnerability exists in kernel versions before 4.14.2; Ubuntu advisories (USN 3617-3 and related) and Unity Linux advisories referen...

CVE-2017-7495

CVE-2017-7495 affects the Linux kernel’s ext4 inode handling (inode.c) in data=ordered mode, where a mishandled needs-flushing-before-commit list leaks sensitive data from other users’ files under opportunistic conditions. The cited sources specify this is a local vulnerability: an attacker with ...

CVE-2021-47001

CVE-2021-47001 (Linux kernel) is a local‑vector vulnerability in the rpcrdma/ xPRTRDMA path where after reconnect the reply handler opens the cwnd before rpcrdma_post_recvs() has posted enough Receive WRs, causing an RNR and immediate loss of the new connection. Root cause: race between cwnd upda...

CVE-2022-48672

CVE-2022-48672 is a Linux kernel issue in the device-tree flattening path: in unflatten_dt_nodes(), an off-by-one error can overflow the nps[] buffer due to an unfixed depth check in the loop. The problem was fixed by commit 78c44d910d3e, in which the depth handling during unflattening was correc...

CVE-2022-49010

CVE-2022-49010 (Linux kernel) has concrete technical details in connected advisories. The issue arises in hwmon coretemp handling: if coretemp_add_core() fails, pdata->core_data[indx] may already be NULL and freed, and passing that to sysfs_remove_group() could crash. The fix is to check for N...

CVE-2022-49207

CVE-2022-49207 is a Linux kernel vulnerability in the bpf/sockmap path (sk_psock_queue_msg memleak). The issue occurs when tcp_bpf_sendmsg runs during tear down, causing memory charged by sk_mem_charge to remain outstanding as messages are queued, potentially leading to memory leaks. The provided...

CVE-2022-49604

CVE-2022-49604 is a Linux kernel vulnerability involving a data race in the sysctl_ip_fwd_use_pmtu path. The issue occurs when reading the sysctl while it can be modified concurrently, creating a race condition that can lead to inconsistent reads. The documented fix is to guard readers with READ_...

CVE-2022-49653

The CVE refers to a Linux kernel i2c piix4 EFCH MMIO memory leak introduced by EFCH MMIO support. The root cause was release_resource() not freeing memory, causing leak; the fix uses release_mem_region() to free memory and restore symmetry between legacy and MMIO paths. Affected component: Linux ...

CVE-2023-4010

CVE-2023-4010 reports a denial-of-service in the Linux kernel USB Host Controller Driver (framework) specifically in usb_giveback_urb. The description indicates a logic error in the goto-condition can cause the function to loop indefinitely when presented with a malformed descriptor, leading to D...

CVE-2023-4015

CVE-2023-4015 describes a use-after-free in the Linux kernel nf_tables component of netfilter, enabling local privilege escalation. The issue arises when building a nftables rule: deactivating immediate expressions in nft_immediate_deactivate() can unbind a chain and deactivate objects that are l...

CVE-2023-52574

CVE-2023-52574 : In the Linux kernel, a NULL pointer dereference can occur in vlan_dev_hard_header when a VLAN device is enslaved to a team device and the team device type changes from non-ether to ether. The underlying issue is that header_ops can incorrectly switch to vlan_header_ops for the no...

CVE-2023-52813

CVE-2023-52813 : Linux kernel crypto: pcrypt fix hungtask for PADATA_RESET. The issue was a hung task in test_aead_vec_cfg caused by padata_do_parallel returning -EBUSY when pinst->flags included PADATA_RESET, preventing aead_request_complete() and leading to a hung wait. Connected sources des...

CVE-2024-26689

CVE-2024-26689 affects the Linux kernel via the Ceph subsystem: in fs/ceph/caps.c, encode_cap_msg() previously could perform a use-after-free due to a race between refcount increment and free in arg->xattr_buf handling. The race around ceph_buffer_get/ceph_buffer_put(ci->i_xattrs.blob) allo...

CVE-2024-26719

CVE-2024-26719 involves the Linux kernel nouveau subsystem. The vulnerability description confirms a deadlock between fctx lock and the irq lock. The fix described offloads the processing from the IRQ handler into a workqueue, breaking the deadlock by moving fence uevents work to a separate threa...

CVE-2024-26761

CVE-2024-26761 : Linux kernel fix in the cxl/pci HDM setup to prevent a system hang when the DVSEC CXL range is not found in a CFMWS window. If the Host Physical Address (HPA) is not a System Physical Address (SPA), the CXL range may not map to a CFMWS window, causing the HDM decoder to be disabl...

CVE-2024-26883

CVE-2024-26883 : In the Linux kernel, a vulnerability was fixed that affects 32-bit architectures in the stackmap handling used by BPF. The overflow risk arises when roundup_pow_of_two() is used to compute the number of hash buckets, as a 32‑bit left shift can overflow and cause undefined behavio...

CVE-2024-35893

CVE-2024-35893 relates to a Linux kernel net/sched kernel-infoleak via act_skbmod. The issue was that tcf_skbmod_dump() copied four bytes from kernel stack to user space because struct tc_skbmod has a four‑byte hole. The fix clears the structure before filling fields to prevent uninitialized data...

CVE-2024-35899

Technical details for CVE-2024-35899 are not publicly available in the provided documents. Monitor for updates from official advisories; no product/vendor/impact specifics can be inferred from the supplied material.

CVE-2024-35957

The CVE-2024-35957 vuln in the Linux kernel/IOMMU VT-d path arises from probing code that tracked all probed devices in an rbtree by source ID, assuming uniqueness that VT-d does not guarantee. The fix, per the linked advisories, is to only track devices that have PCI ATS capabilities in the iomm...

CVE-2024-36002

Linux kernel CVE-2024-36002 details a crash in dpll_pin_on_pin_register/dpll_pin_on_pin_unregister when a pin is registered with multiple parent pins on the same dpll device. A crash trace occurs during ice driver removal (ICE/ice_dpll_deinit_pins). The fix adds a cookie-like parent pointer when ...

CVE-2024-36880

CVE-2024-36880 details (from provided documents): In the Linux kernel, a Bluetooth subsystem issue in the qca firmware parsing was resolved by adding missing sanity checks for firmware files before download, to prevent memory access violations beyond the allocated vmalloc buffer. This vulnerabili...

CVE-2024-38662

CVE-2024-38662 affects the Linux kernel (BPF) where deletion from sockmap/sockhash is allowed only if the program was previously allowed to update that map. The issue arises when a BPF program attached to a tracepoint performs map_delete on these maps, triggering a locking-rule violation. The ver...

CVE-2024-44938

CVE-2024-44938 relates to the Linux kernel JFS code. The issue is a shift-out-of-bounds in dbDiscardAG when BLKSTOL2() returns 0 while seeking the next smaller log2 block, which can yield a negative shift exponent. The patch resolves this by exiting the loop when a negative shift is encountered. ...

CVE-2024-46750

CVE-2024-46750 (Linux kernel) : The vulnerability arises from missing bridge locking in PCI subsystem, specifically the bridge itself not being locked when resetting the bus. The fix adds the bridge lock path by acquiring pci_dev_lock() for the upstream bridge’s bridge self (in pci_reset_function...

CVE-2024-46826

The CVE-2024-46826 issue is a concrete Linux kernel vulnerability where the ELF loader uses kernel.randomize_va_space twice, allowing potential inconsistency of the randomization value across an exec. The root cause is a double read of the sysctl value, which can change over time, potentially cau...

CVE-2024-49929

CVE-2024-49929 affects the Linux kernel wifi: iwlwifi (MVM) code. The vulnerability stems from iwl_mvm_sta_from_mac80211 potentially dereferencing a NULL ieee80211_sta when sta is NULL, leading to a NULL pointer dereference in iwl_mvm_tx_skb_sta() and iwl_mvm_tx_mpdu(). The fix is to validate the...

CVE-2024-49977

The CVE-2024-49977 entry concerns a Linux kernel vulnerability in the net: stmmac pathway where port_transmit_rate_kbps could be set to 0, passed to div_s64 when tc-cbs is disabled, causing a zero-division error. The connected Astra Linux and CIRCL sources reproduce the same description and fix d...

CVE-2024-53099

CVE-2024-53099 refers to a Linux kernel vulnerability in BPF: it checks the validity of link->type in bpf_link_show_fdinfo(), preventing out-of-bounds access when a new link type is added but not invoked via BPF_LINK_TYPE(). Affected: Linux kernel releases prior to the patched version; multipl...

CVE-2024-53165

CVE-2024-53165 affects the Linux kernel and describes a use-after-free in the error handling path of sh: intc: register_intc_controller(). In the flawed path, the variable d is freed in the error handling without being removed from intc_list, which can lead to a use-after-free. The fix implemente...

CVE-2024-53239

CVE-2024-53239 relates to the Linux kernel ALSA 6fire driver. The vulnerability arises when resources are released immediately after usb6fire_chip_abort(), while the card object may still be in use (the code calls snd_card_free_when_closed()). This can lead to a use-after-free scenario. The docum...

CVE-2024-56677

CVE-2024-56677 (Linux kernel, powerpc fadump) : The issue arises during early init when CMA_MIN_ALIGNMENT_BYTES can be PAGE_SIZE because pageblock_order is not yet initialized. This bypasses the CMA memory alignment check in cma_init_reserved_mem(), allowing a potential misalignment that can trig...