CVE-2023-52520

CVE-2023-52520 : Linux kernel platform/x86: think-lmi had a reference leak when a duplicate attribute is found by kset_find_obj(); a reference to the attribute could be leaked if not disposed with kobject_put. The fix moves the setting name validation into a separate function to avoid duplicating...

CVE-2023-52574

CVE-2023-52574 affects the Linux kernel where enslaving a VLAN device to a team device and changing the team device type from non-ether to ether can trigger a NULL pointer dereference in vlan_dev_hard_header via vlan->real_dev. Root cause: header_ops switching to vlan_header_ops for the team d...

CVE-2023-52661

The CVE-2023-52661 vulnerability concerns the Linux kernel DRM/TeGra module: rgb code path in tegra_dc_rgb_probe() lacked a clk_put() in error handling when clk_get_sys(..., pll_d2_out0) failed. The advisory items describe adding the missing clk_put and introducing a put_pll_d_out0 label to unwin...

CVE-2023-52697

CVE-2023-52697: Linux kernel ASoC/Intel sof_sdw_rt_sdca_jack_common issue fixes double put of headset codec device. The root cause was multiple codecs sharing the same dai name (e.g., rt712-sdca-aif1) causing sof_sdw_rt_sdca_jack_exit() to be invoked twice via mc_dailink_exit_loop(). The fix ensu...

CVE-2023-52698

CVE-2023-52698: The Linux kernel fix addresses a memory leak in netlbl_calipso_add_pass() when IPv6 is disabled at boot (ipv6.disable=1). In this scenario, netlbl_calipso_ops_register() may not be called and netlbl_calipso_ops_get() returns NULL, causing allocated doi_def memory in netlbl_calipso...

CVE-2023-52800

The Linux kernel contains a vulnerability in the ath11k wifi driver where the htt pktlog handling code, specifically the function ath11k_mac_get_ar_by_pdev_id(), was not correctly marked as a read-side critical section . Because the active pdevs are protected by RCU, this oversight could lead to ...

CVE-2024-26930

CVE-2024-26930 : In the Linux kernel, the SCSI/QLA2xxx double-free vulnerability occurs when ha->vp_map is freed twice (in qla2x00_mem_alloc and again in qla2x00_mem_free). The root cause is a use-after-free-like double free of ha->vp_map; the fix assigns NULL to vp_map and lets kfree handl...

CVE-2024-35969

Summary (CVE-2024-35969): A race in IPv6 handling in the Linux kernel between ipv6_get_ifaddr and ipv6_del_addr can cause use-after-free scenarios. When an entry is removed from inet6_addr_lst under RCU, ipv6_get_ifaddr may still return that entry and attempt to increment its reference, leading t...

CVE-2024-41055

CVE-2024-41055 : Linux kernel vulnerability in the mm subsystem where a NULL pointer dereference could occur in pfn_section_valid() due to a race with section_deactivate() and an insufficient READ_ONCE() around ms->usage. The fix adds a value check on ms->usage before dereferencing and reli...

CVE-2024-41093

CVE-2024-41093 – Linux kernel drm/amdgpu null framebuffer object fix : The vulnerability arises in the kernel’s DRM/amdgpu path where code could dereference a null framebuffer object when accessing state->fb->obj[0]. The patch changes the access to obtain the framebuffer object via drm_gem_...

CVE-2024-44958

CVE-2024-44958 – Linux kernel SMT scheduling fix : The issue was a balance error in sched_smt_present where, if cpuset_cpu_inactive() fails during cpu offline, sched_smt_present is decremented before sched_cpu_deactivate(), causing an unbalanced dec/inc pair. The patch increments sched_smt_presen...

CVE-2024-45025

CVE-2024-45025 affects the Linux kernel and relates to bitmap handling in the close_range path of file descriptor tables. The issue arises in copy_fd_bitmaps(), which copies words into full_fds_bits[] and may leave garbage in the last word if bits beyond the cutoff aren’t clear. The root cause is...

CVE-2024-47718

CVE-2024-47718 affects the Linux kernel wireless stack (rtw88) used by the wifi subsystem. The issue arises in wifi: rtw88 where firmware loading requires two attempts (regular and wowlan). In rtw_wait_firmware_completion(), the code now always waits for both attempts; previously, if rtw_usb_intf...

CVE-2024-49885

CVE-2024-49885: Linux kernel mm/slub kmalloc redzone issue resolved. Root cause: orig_size handling treated wasted space as redzone and, with init_on_free=1, clears full object->size including metadata, causing check_object() to misclassify the object as redzone. Fix: clear the used area using...

CVE-2024-53066

CVE-2024-53066 describes a KMSAN warning in the Linux kernel’s NFS getattr decoding path. The issue arises from an uninitialized fattr->mdsthreshold field in decode_getfattr_attrs()/decode_attr_mdsthreshold(), which could trigger a KMSAN failure. The provided fix initializes fattr->mdsthres...

CVE-2024-53099

CVE-2024-53099 refers to a Linux kernel vulnerability in BPF: it checks the validity of link->type in bpf_link_show_fdinfo(), preventing out-of-bounds access when a new link type is added but not invoked via BPF_LINK_TYPE(). Affected: Linux kernel releases prior to the patched version; multipl...

CVE-2024-53118

CVE-2024-53118 (Linux kernel) has been addressed by fixing a memory leak in the vsock error queue. The issue occurred because kernel MSG_ZEROCOPY completion notifications in the error queue were left uncleaned when the socket was destroyed, leading to unreferenced objects and potential leaks. The...

CVE-2025-21761

CVE-2025-21761 affects the Linux kernel/Open vSwitch area. The root cause is that ovs_vport_cmd_fill_info() could be invoked without RTNL or RCU, risking a use-after-free. The fix adds RCU protection and uses dev_net_rcu() to prevent UAF. This is a kernel-level issue with potential impact describ...

CVE-2013-4563

CVE-2013-4563 applies to the Linux kernel UDP Fragmentation Offload (UFO) path. The udp6_ufo_fragment function in net/ipv6/udp_offload.c can mis-evaluate a size comparison before inserting a fragment header when UFO is enabled, enabling remote attackers to trigger a denial of service (panic) by s...

CVE-2016-5828

CVE-2016-5828 affects the Linux kernel on powerpc platforms (up to 4.6.3). The start_thread function mishandles transactional memory, allowing local users to cause a denial of service (invalid process state or TM Bad Thing exception, and system crash) by starting and suspending a transaction befo...

CVE-2017-16525

The CVE-2017-16525 entry affects the Linux kernel: usb_serial_console_disconnect in drivers/usb/serial/console.c allows local users to trigger a denial of service (use-after-free and system crash) via a crafted USB device, with impact on confidentiality/integrity/availability as per the advisory....

CVE-2017-16536

CVE-2017-16536 affects the Linux kernel cx231xx USB card driver (cx231xx_usb_probe in drivers/media/usb/cx231xx/cx231xx-cards.c) up to version 4.13.11. The issue allows a local attacker to trigger a NULL pointer dereference leading to a denial of service or system crash via a crafted USB device. ...

CVE-2021-38202

CVE-2021-38202 affects the Linux kernel before 5.13.4, where fs/nfsd/trace.h can allow remote attackers to trigger a denial-of-service via an out-of-bounds read in strlen when the trace event framework is used for nfsd. The vulnerability is triggered by NFS traffic sent over the network. A fix wa...

CVE-2022-49010

CVE-2022-49010 (Linux kernel) has concrete technical details in connected advisories. The issue arises in hwmon coretemp handling: if coretemp_add_core() fails, pdata->core_data[indx] may already be NULL and freed, and passing that to sysfs_remove_group() could crash. The fix is to check for N...

CVE-2022-49328

CVE-2022-49328 is a vulnerability in the Linux kernel mt76 driver where a use-after-free can occur in mt76_txq_schedule due to an unprotected wcid pointer (non-RCU). The issue is addressed by guarding the mtxq->wcid with an rcu_lock between mt76_txq_schedule and sta_info_alloc/free, per the re...

CVE-2022-49492

The CVE-2022-49492 issue affects the Linux kernel nvme-pci path. In nvme_alloc_admin_tags, admin_q can be set to an error (e.g., -ENOMEM) and, after returning, the flow may quiesce a non-existent admin queue, leading to a bad NULL pointer dereference. The vulnerability is a local issue with HIGH ...

CVE-2023-26607

CVE-2023-26607 affects the Linux kernel, with an out-of-bounds read in ntfs_attr_find (fs/ntfs/attrib.c) reported for kernel 6.0.8. The connected documents confirm the issue and align on the impacted component and root cause, but do not provide a vendor/product patch version or explicit remediati...

CVE-2023-52676

CVE-2023-52676 is a Linux kernel ZONE-bpf verifier issue: the risk was caused by stack bound checks being performed in 32-bit arithmetic, with offsets that can reach u32, risking overflow of int-based arithmetic. The patch relocates the relevant calculations to 64-bit domain and tightens/stabiliz...

CVE-2023-52762

CVE-2023-52762 — Linux kernel virtio-blk overflow in max DMA size Root cause: In virtio-blk, an implicit conversion from size_t to u32 occurs when assigning (u32)max_size = (size_t)virtio_max_dma_size(vdev); If virtio_max_dma_size(vdev) returns a value larger than U32_MAX, the cast to u32 yields ...

CVE-2023-52775

CVE-2023-52775 is a Linux kernel vulnerability affecting net/smc where a Decline message could cross or collide in SMC-R, causing data corruption during Redis/SRC testing. A patch doubles the client timeout to 2x the server value to prevent cross‑timeout conflicts; remediation is upgrading to a k...

CVE-2023-52791

CVE-2023-52791 affects the Linux kernel i2c core: Run atomic i2c xfer when !preemptible to ensure atomicity during restart sequences, preventing voluntary context switches within RCU read-side critical sections. The fix, tied to preemption handling (switching to !preemptible()), aligns with pre-v...

CVE-2023-52840

CVE-2023-52840 is a Linux kernel flaw in the synaptics-rmi4 driver where a use-after-free occurs in rmi_unregister_function() due to a premature dereference after put_device() calls rmi_release_function(). The fix moves the put_device() call to the end, preventing the subsequent access (fn->nu...

CVE-2023-52920

CVE-2023-52920 concerns the Linux kernel BPF verifier: it fixes a defect that allowed spill/fill of non-r10 registers to stack to be tracked in precision mode. The change introduces per-instruction flags (spi and stack frame info) into the history and uses the instruction history for reliable bac...

CVE-2024-26661

A vulnerability exists in the Linux kernel within the drm/amd/display component. The issue is caused by a missing NULL check for the timing generator in the dcn21_set_pipe() function, where the code relies on the caller to ensure pipe_ctx->stream_res.tg is not NULL. Exploiting this pointer man...

CVE-2024-26691

CVE-2024-26691 affects Linux kernel KVM for arm64. The circular locking arises when pkvm_create_hyp_vm() acquires kvm->lock while kvm_vcpu_ioctl() holds vcpu->mutex. The fix is to protect the hyp VM handle with config_lock (instead of keeping the vcpu->mutex under kvm->lock), mitigati...

CVE-2024-26698

Linux kernel hv_netvsc is affected by a race between netvsc_probe and netvsc_remove. The root cause is napi_disable being invoked on non-enabled subchannels, causing hung behavior during device removal due to an infinite msleep in napi_disable. The fix (commit ac5047671758) disables NAPI before c...

CVE-2024-26739

CVE-2024-26739 affects the Linux kernel net/sched component (act_mirred) where overriding the skb return value after routing could lead to Use-After-Free if tcf_mirred_forward() had been called. The fix moves the retval override to the error path that actually requires it, preventing UaF when the...

CVE-2024-26828

CVE-2024-26828 is a Linux kernel issue in the CIFS SMB client: parse_server_interfaces() incorrectly compares bytes_left/size with mixed signed/unsigned types (ssize_t vs size_t), causing a loop to continue when remaining bytes become negative, enabling a buffer underflow. The advisories describe...

CVE-2024-26851

CVE-2024-26851: Linux kernel nf_conntrack_h323 decoding bug fixed. UBSAN reported negative/out-of-bounds shifts when decoding Ras messages due to abnormal skb->data; patch adds protection to keep extension bitmap length

CVE-2024-27053

The Linux kernel contains a vulnerability in the wifi: wilc1000 driver where an RCU pointer is dereferenced outside of an RCU critical section during the connect path. This issue occurs when parsing target BSS parameters, specifically triggering a suspicious RCU usage warning when lockdep is enab...

CVE-2024-35872

Summary: CVE-2024-35872 affects the Linux kernel mm/secretmem feature. The issue arose because folios for secretmem could be added to batches without the LRU flag, making folio_is_secretmem() unreliable and enabling a local attacker to trigger GUP-fast on secretmem folios. The fix removes the unr...

CVE-2024-36880

CVE-2024-36880 details (from provided documents): In the Linux kernel, a Bluetooth subsystem issue in the qca firmware parsing was resolved by adding missing sanity checks for firmware files before download, to prevent memory access violations beyond the allocated vmalloc buffer. This vulnerabili...

CVE-2024-36884

CVE-2024-36884 — Linux kernel iommu/arm-smmu (nvidia_smmu_context_fault): The issue stems from using a void* where a struct arm_smmu_domain is required inside nvidia_smmu_context_fault(), which is also registered as an irq handler. Because iommu_domain is embedded at a non-zero offset, this cause...

CVE-2024-36889

CVE-2024-36889 concerns the Linux kernel’s MPTCP code. The issue arises when a client falls back to TCP during connect, and snd_nxt is not initialized yet; an incoming ACK could copy that uninitialized value into snd_una. If the MPTCP worker then re-injects data, it may trigger a cleanup using a ...

CVE-2024-46722

CVE-2024-46722 is a Linux kernel vulnerability affecting the DRM AMDGPU driver where a read of mc_data[i-1] could go out of bounds. The connected Astra/DEBIAN/CBLMARINER advisories reference the same issue in the kernel and confirm a fix was applied in the AMDGPU/mc_data path to address the out-o...

CVE-2024-47670

This CVE (CVE-2024-47670) affects the Linux kernel OCFS2 subsystem. The vulnerability arises from insufficient bounds checking in ocfs2_xattr_find_entry(), allowing potential out-of-bounds memory access while scanning for a match in OCFS2 extended attributes. The advisory states that a paranoia c...

CVE-2024-47713

CVE-2024-47713 is a Linux kernel vulnerability in wifi/mac80211: two-phase skb reclamation is needed in ieee80211_do_stop to ensure work is done with interrupts enabled. The patch moves the actual skb work outside the IRQ-disabled region to avoid warning and potential issues when backtracing thro...

CVE-2024-47719

CVE-2024-47719 (Linux kernel) concerns iommufd:ALIGN() overflow during iova allocation, which can corrupt the selected area range. The fix caps the automatic alignment to the huge page size to prevent fragmentation/space waste and Overflow, per the advisory. Affected component: iommufd/io_pagetab...

CVE-2024-47723

CVE-2024-47723 affects the Linux kernel’s JFS subsystem, causing an out-of-bounds access in functions that manage the AG bitmap. The issue arises in dbNextAG() when bmp->db_numag can be greater or equal to MAXAG due to a polluted image, and in diAlloc() when agno may be greater or equal to MAX...

CVE-2024-47739

CVE-2024-47739 concerns the Linux kernel padata subsystem. The vulnerability arises when submitting more than 2^32 padata objects to padata_do_serial, where the sorting of overflowed seq_nr values can cause a newly overflowed entry to be placed before existing ones, leading to a deadlock in the s...