CVE-2024-53165

CVE-2024-53165 affects the Linux kernel and describes a use-after-free in the error handling path of sh: intc: register_intc_controller(). In the flawed path, the variable d is freed in the error handling without being removed from intc_list, which can lead to a use-after-free. The fix implemente...

CVE-2024-55916

The CVE-2024-55916 entry refers to a Linux kernel race where the KVP/VSS daemon may run before the VMBus ringbuffer is fully initialized. Concrete detail: a NULL pointer dereference can occur in hv_pkt_iter_first when the daemon opens / dev/vmbus/hv_kvp and registers before vmbus_open() completes...

CVE-2024-56677

CVE-2024-56677 (Linux kernel, powerpc fadump) : The issue arises during early init when CMA_MIN_ALIGNMENT_BYTES can be PAGE_SIZE because pageblock_order is not yet initialized. This bypasses the CMA memory alignment check in cma_init_reserved_mem(), allowing a potential misalignment that can trig...

CVE-2025-21699

CVE-2025-21699 affects the Linux kernel gfs2 subsystem. The issue arises when truncating an inode’s address space while flipping the GFS2_DIF_JDATA flag, because pages in the address space may use buffer_heads or iomap_folio_state structures and must not be mixed. The result is a condition that c...

CVE-2025-21934

CVE-2025-21934 : In the Linux kernel, the rapidio Rio driver had an API misusage where rio_add_net() could pathologically free resources when device_register() failed. The patch fixes this by using put_device() instead of kfree() and by nulling mport->net to avoid a use-after-free. Impact is l...

CVE-2025-38000

CVE-2025-38000 affects the Linux kernel HFSC scheduler qlen accounting: when enqueuing the first packet, hfsc_enqueue() previously used child qdisc peek() before updating sch->q.qlen and sch->qstats.backlog, which could trigger a dequeue and leave the HFSC class in an inconsistent state (po...

CVE-2014-9529

CVE-2014-9529: A race condition in Linux kernel key garbage collection (key_gc_unused_keys in security/keys/gc.c) up to 3.18.2 can enable local users to cause DoS or memory corruption during key garbage collection via keyctl. Connected advisory confirms kernel upstream fix and lists commit a3a878...

CVE-2014-9585

CVE-2014-9585 affects Linux kernels up to 3.18.2. The vdso_addr code in arch/x86/vdso/vma.c can misselect vDSO memory, enabling local users to bypass ASLR by guessing a PMD-end location. Exploitation details and patches/fixes are not provided in the connected documents; monitor advisories for rem...

CVE-2016-5244

CVE-2016-5244 affects the Linux kernel and involves the function rds_inc_info_copy in net/rds/recv.c not initializing a structure member. This can enable a remote attacker to read sensitive information from kernel stack memory by processing an RDS message, with impact described as kernel informat...

CVE-2017-15299

CVE-2017-15299 affects the Linux kernel KEYS subsystem: adding a key that already exists but is uninstantiated can cause a NULL pointer dereference, leading to a system crash (local DoS) or other impact. The issue is documented for kernels up to at least 4.13.7; remediation is to apply the kernel...

CVE-2019-19050

CVE-2019-19050 describes a memory leak in the Linux kernel’s crypto_reportstat() path (crypto/crypto_user_stat.c) that can cause a denial of service via memory consumption when crypto_reportstat_alg() fails, affected up to kernel 5.3.11. Connected Nessus advisories (Unity Linux UTSA-2026-003794 a...

CVE-2020-14304

CVE-2020-14304 describes a memory-disclosure flaw in the Linux kernel ethernet drivers, in how data is read from a device EEPROM. A local user can read uninitialized kernel memory, impacting confidentiality. The description notes a local-exploit vector and does not provide a patch or mitigation i...

CVE-2020-29534

CVE-2020-29534 affects the Linux kernel prior to 5.9.3. The io_uring subsystem takes a non-refcounted reference to the submitting process’ files_struct, which can lead to incorrect optimization of unshare_fd() during execve(), as CID-0f2122045b94 describes. This is a local vulnerability with pote...

CVE-2021-47671

The CVE-2021-47671 issue affects the Linux kernel can: etas_es58x driver. In es58x_rx_err_msg(), when can->do_set_mode() fails, the code previously returned and did not free the skb allocated by alloc_can_err_skb(), causing a memory leak. A patch was applied to remove the return in the error p...

CVE-2022-49365

The CVE-2022-49365 issue is an off-by-one error in the Linux kernel AMDGPU DMUB outbox1 low IRQ handling (dm_dmub_outbox1_low_irq), where a comparison against ARRAY_SIZE() allowed an out-of-bounds access. Public advisories confirm fixes have been applied in multiple distributions’ kernel branches...

CVE-2022-49583

CVE-2022-49583 affects the Linux kernel iavf driver. The vulnerability was caused by improper handling of dummy receive descriptors, leading to a memory leak where the previous receive buffer page wasn’t freed when a dummy descriptor was written by hardware. The fix updates iavf_get_rx_buffer to ...

CVE-2023-3338

CVE-2023-3338: A null pointer dereference in the Linux kernel DECnet protocol could allow remote crash of the system. Connected advisories confirm this affects Linux kernel DECnet with mitigation via status updates and removal of the DECnet protocol in the kernel; Debian/IBM entries note remediat...

CVE-2023-52690

CVE-2023-52690 is a Linux kernel vulnerability affecting powerpc/powernv where kasprintf() can return NULL on allocation failure and a null pointer check was missing in scom_debug_init_one(). The fix adds a null pointer check and ensures proper release of ent to avoid memory leaks. Connected advi...

CVE-2023-52749

CVE-2023-52749: In the Linux kernel, a race condition can cause a null pointer dereference during resume if a synchronous SPI transfer is active when suspending. The issue arises when a transfer context resumes after cur_msg was reset to NULL during suspend. Public details state a fix: ensure syn...

CVE-2023-52834

CVE-2023-52834 was resolved in the Linux kernel by addressing a DMA RX overflow in the alx/atl1c drivers. The fix replaces a custom allocator with a check on the allocated skb address and uses skb_reserve() to avoid the problematic 0x…fc0 address. The alx workaround was implemented first; the atl...

CVE-2024-26851

CVE-2024-26851 concerns the Linux kernel netfilter nf_conntrack_h323 path. The issue arises when decoding H.323 ras messages: an abnormal skb->data can cause the extension bitmap length to exceed 32, leading to a length-based shift that may become negative and trigger UBSAN reports. The workar...

CVE-2024-27052

CVE-2024-27052 affects the Linux kernel driver for rtl8xxxu (wifi) and is fixed by adding cancel_work_sync() in rtl8xxxu_stop() to prevent a potential use-after-free when the driver’s workqueue is still running after stop. The initial entry describes the issue and patch in general terms; connecte...

CVE-2024-35794

The CVE-2024-35794 entry concerns the Linux kernel issue where dm-raid could have the sync_thread not frozen during suspend. Root cause: a sequence of commits around md_stop_writes and MD_RECOVERY_FROZEN, where the flag does not by itself freeze the running sync_thread and stop_sync_thread() must...

CVE-2024-35898

CVE-2024-35898 affects the Linux kernel’s netfilter nft_tables flowtable type lookup. The issue is a data race where nft_unregister_flowtable_type() in nf_flow_inet_module_exit() can run concurrently with __nft_flowtable_type_get() in nf_tables_newflowtable(), and there was no protection while it...

CVE-2024-35908

CVE-2024-35908 (Linux kernel) : The issue arises in TLS handling within tls_sw_recvmsg where a psock reference is taken before tls_rx_reader_lock; if the lock fails, the reference isn’t released, causing a leak. The fix postpones taking the psock reference until after successful locking, ensuring...

CVE-2024-35959

CVE-2024-35959 is an Linux kernel issue fixed in the mlx5e path. The fix addresses a cleanup flow: when mlx5e_priv_init() fails, mlx5e_priv_init’s cleanup calls mlx5e_selq_cleanup, which previously could lead to a misordered lock usage. The cleanup calls mlx5e_selq_apply() that assumes priv->s...

CVE-2024-36017

The CVE-2024-36017 entry is valid and has concrete details in connected sources. The vulnerability is in the Linux kernel rtnetlink path: nested IFLA_VF_VLAN_LIST attributes are assumed to be struct ifla_vf_vlan_info (size 14 bytes). Validation used NLA_HDRLEN (4 bytes), enabling a too-small attr...

CVE-2024-36882

CVE-2024-36882 is a Linux kernel vulnerability in the memory management subsystem: mm/page_cache_ra_order() could reclaim file-backed pages in a way that may deadlock, resolved by using memalloc_nofs_save() in the readahead path (commit f2c817bed58d). The issue was observed during readahead and p...

CVE-2024-36944

CVE-2024-36944 affects the Linux kernel. The issue arises from reverting the commit that simplified drm/qxl_fence_wait, which created a possible circular locking dependency between console_owner and the worker pool locking. Reverting the commit allows VMs to boot to completion but may reintroduce...

CVE-2024-40931

CVE-2024-40931 (Linux kernel) : Affected component is the kernel’s mptcp code. The issue arose when a Subflow key snd_una remained uninitialized on connect due to a sequencing bug (snd_nxt and write_seq initialization order). The root cause is triggered by syzkaller’s retransmit path after fallba...

CVE-2024-41095

CVE-2024-41095 concerns the Linux kernel's DRM Nouveau driver. The root cause is a NULL pointer dereference in nv17_tv_get_ld_modes() when drm_mode_duplicate() fails and its return value is assigned to mode without checking for NULL. The patch adds a guard to prevent the NULL pointer dereference ...

CVE-2024-42253

CVE-2024-42253 – Linux kernel GPIO (pca953x) race The vulnerability is in the pca953x GPIO driver: a race can occur between irq_bus_sync_unlock() and an irq, when a request races against irq_bus_sync_unlock() on i.MX8MP platforms. The fix requires that i2c_lock is held when setting the interrupt ...

CVE-2024-46723

CVE-2024-46723 is a Linux kernel vulnerability involving the DRM AMDGPU driver: a ucode out-of-bounds read warning that could occur when reading the ucode array. Connected advisories across vendors (Astla/Astra Linux, CIRCL, Debian LTS advisories, Amazon Linux ALAS entries, and Red Hat references...

CVE-2024-47659

CVE-2024-47659 - Linux kernel Smack labeling flaw (tcp/ipv4) Unity/Ten able advisories summarize a kernel issue in Smack where the label of incoming tcp/ipv4 connections is mirrored from the initiator, causing return packets to be labeled with the initiator’s CIPSO label. This results in two conc...

CVE-2024-49949

CVE-2024-49949 is a Linux kernel vulnerability in net: qdisc_pkt_len_init() under UFO where crafted GSO can underflow hdr_len and skb->len, risking a kernel crash in fq_codel. Fixes were applied via patches after commits that added sanity checks in virtio_net_hdr_to_skb and counting transport ...

CVE-2024-50115

CVE-2024-50115 is a Linux kernel vulnerability affecting KVM nSVM where loading PDPTEs from memory incorrectly handles nCR3[4:0]. The issue can cause an out-of-bounds read if a target page is at the end of a memslot, due to not enforcing 32-byte alignment when PAE paging is used. The root cause i...

CVE-2024-50163

The CVE-2024-50163 entry documents a Linux kernel fix for bpf redirect flag overlap: the internal UAPI bpf_redirect flags were sharing the same ri->flags values for SKB and XDP paths, causing a crash under certain redirect use. The patch makes bpf_redirect_info stack-allocated per path, avoids...

CVE-2024-53094

The CVE-2024-53094 entry concerns the Linux kernel, specifically the RDMA/siw path. The connected document UNPATCHED_CVE_2024_53094.NASL provides concrete technical details: when running ISER over SIW, an initiator observes a warning from skb_splice_from_iter() about a slab page being used in sen...

CVE-2024-53117

CVE-2024-53117 (Linux kernel) : The vulnerability affects virtio/vsock in the Linux kernel. The root cause was a missing kfree_skb() in error handling for MSG_ZEROCOPY paths, which could cause memory leaks. The fix adds the missing kfree_skb() to prevent leaks when MSG_ZEROCOPY encounters errors....

CVE-2024-53126

In CVE-2024-53126, the Linux kernel fixes a UB bug in vdpa/solidrun code where a string placed on the stack in psnet_open_pf_bar() and snet_open_vf_bar() could be used after the stack frame disappeared. The string is not copied by pcim_iomap_regions() or its callees, leading to undefined behavior...

CVE-2024-53138

CVE-2024-53138 is tied to the Linux kernel’s net/mlx5e: kTLS path. The connected documents describe a root cause in page reference counting: the kTLS TX path mixes get_page() and page_ref_inc(), while the release path uses only put_page(). When pages from large folios are involved, get_page() ref...

CVE-2024-56663

CVE-2024-56663 describes a Linux kernel vulnerability in wifi nl80211 where NL80211_ATTR_MLO_LINK_ID could be misvalidated due to an off-by-one error in the attribute range. The issue manifests as a potential out-of-bounds access (demonstrated by a KASAN wild-memory-access bug in ieee80211_tx_con...

CVE-2025-21708

The CVE-2025-21708 issue affects the Linux kernel rtl8150 USB driver. It stems from wrong USB endpoint handling during URB submission. Mitigation in the current patch is to enable basic endpoint checking (bulk/interrupt endpoints) to reduce the risk, with cosmetic changes planned later. Exploit d...

CVE-2025-21806

CVE-2025-21806 : Linux kernel vulnerability in net.core.dev_weight where setting dev_weight to 0 can cause NAPI backlog processing to misbehave and napi to be re-polled repeatedly, potentially triggering a stall until softirq timeout. Reproducing issue: sysctl -w net.core.dev_weight=0 followed by...

CVE-2025-21848

The CVE-2025-21848 issue affects the Linux kernel where nfp_bpf_cmsg_alloc() fails to check the return value of nfp_app_ctrl_msg_alloc(), leading to a NULL pointer dereference. The connected sources confirm this root cause and indicate a patch was added to perform the necessary check to prevent t...

CVE-2025-37797

CVE-2025-37797 affects the Linux kernel HFSC qdisc. A Use-After-Free can occur in hfsc_change_class() when handling certain child qdiscs (e.g., netem, codel) due to a time-of-check/time-of-use race: hfsc_change_class() may add a class to vttree after qdisc_peek_len() potentially clears the queue....

CVE-2015-0569

CVE-2015-0569 is a heap-based buffer overflow in the WLAN private wireless extensions IOCTL path (wlan_hdd_wext.c) of the Linux kernel 3.x–4.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices. The vulnerability allows a local attacker to escalate privileges via ...

CVE-2016-7914

The CVE-2016-7914 issue affects the Linux kernel prior to 4.5.3. The vulnerable component is assoc_array_insert_into_terminal_node in lib/assoc_array.c, which does not verify whether a slot is a leaf. This can allow a local user to read kernel memory or trigger a denial of service (invalid pointe...

CVE-2017-7294

The CVE-2017-7294 issue affects the Linux kernel up to 4.10.6, specifically vmwgfx vmw_surface_define_ioctl() in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c. A crafted ioctl to /dev/dri/renderD* can trigger an integer overflow and out-of-bounds write, causing denial of service (system hang/crash) and...

CVE-2017-7487

The CVE-2017-7487 issue is in the Linux kernel net/ipx/af_ipx.c ipxitf_ioctl: reference count mishandling causes a use-after-free via a failed SIOCGIFADDR on an IPX interface, enabling local denial of service. Evidence in connected Nessus advisories confirms the vulnerability and that it affects ...