CVE-2022-2380

CVE-2022-2380 concerns the Silicon Motion SM712 framebuffer driver in the Linux kernel. The issue is an out-of-bounds memory access in drivers/video/fbdev/sm712fb.c:smtcfb_read(), which could allow a locally authenticated attacker to crash the kernel. The description and linked advisories consist...

CVE-2022-27950

CVE-2022-27950 : A memory leak exists in Linux kernel drivers/hid/hid-elo.c for a hid_parse error condition, affecting kernels before 5.16.11. Exploitation details are not provided in the documents. A fix is in kernel 5.16.11 (and later). Recommendation: upgrade to a version containing the patch ...

CVE-2022-4128

CVE-2022-4128 is a NULL pointer dereference in the Linux kernel’s MPTCP implementation during subflow traversal at disconnect time. The issue can be triggered by a local user and may crash the host, resulting in a denial-of-service condition. The connected vulnerability listings (including Miracl...

CVE-2022-48804

CVE-2022-48804 is resolved in the Linux kernel’s vt_ioctl/vt_setactivate path. The vulnerability stems from an array_index_nospec handling that could allow a transient integer underflow when an out-of-bounds value is decremented after zero, specifically affecting vsa.console handling. The descrip...

CVE-2023-52840

CVE-2023-52840 is a Linux kernel flaw in the synaptics-rmi4 driver where a use-after-free occurs in rmi_unregister_function() due to a premature dereference after put_device() calls rmi_release_function(). The fix moves the put_device() call to the end, preventing the subsequent access (fn->nu...

CVE-2023-52869

Technical details (affected product/version, root cause, and fix) are not provided in the Connected documents. Please consult the original advisories or vendor notices for CVE-2023-52869 to obtain concrete technical information and remediation guidance.

CVE-2024-26689

CVE-2024-26689 affects the Linux kernel via the Ceph subsystem: in fs/ceph/caps.c, encode_cap_msg() previously could perform a use-after-free due to a race between refcount increment and free in arg->xattr_buf handling. The race around ceph_buffer_get/ceph_buffer_put(ci->i_xattrs.blob) allo...

CVE-2024-26719

CVE-2024-26719 involves the Linux kernel nouveau subsystem. The vulnerability description confirms a deadlock between fctx lock and the irq lock. The fix described offloads the processing from the IRQ handler into a workqueue, breaking the deadlock by moving fence uevents work to a separate threa...

CVE-2024-35845

CVE-2024-35845 : In the Linux kernel, the wifi iwlwifi dbg-tlv path (iwl_fw_ini_debug_info_tlv) could be used to trigger a denial-of-service through an improperly terminated string. The root cause is a missing NUL termination, which could be exploited remotely (network) and yields a CRITICAL impa...

CVE-2024-35884

CVE-2024-35884 is a Linux kernel vulnerability in UDP GRO handling. When rx-udp-gro-forwarding is enabled, UDP packets may be GROed in transit and land in a tunnel, causing issues such as corrupted packets or kernel crashes (geneve path example). The root cause is that udp_gro_receive/udp4/udp6_g...

CVE-2024-35913

CVE-2024-35913 affects the Linux kernel’s wifi driver: the iwlwifi/mvm code incorrectly selects the mac_id vs link_id in struct iwl_mvm_session_prot_notif depending on the SESSION_PROTECTION_NOTIF version, triggering kernel warnings in time-event.c. The issue has a concrete fix in the referenced ...

CVE-2024-38573

In CVE-2024-38573, the Linux kernel CPUS frequency framework (cppc_cpufreq) fixes a possible NULL dereference. cppc_cpufreq_get_rate() and hisi_cppc_cpufreq_get_rate() could observe a NULL policy from cpufreq_cpu_get() under certain conditions. The fix adds a NULL return check to prevent derefere...

CVE-2024-39488

The CVE-2024-39488 issue is a Linux kernel arm64 bug related to end padding of bug_entry structures. When CONFIG_DEBUG_BUGVERBOSE=n, final bug_table entries in modules may lack trailing padding, causing the last entry to be ignored and potentially leading to an unexpected kernel panic during modu...

CVE-2024-40931

CVE-2024-40931 (Linux kernel) : Affected component is the kernel’s mptcp code. The issue arose when a Subflow key snd_una remained uninitialized on connect due to a sequencing bug (snd_nxt and write_seq initialization order). The root cause is triggered by syzkaller’s retransmit path after fallba...

CVE-2024-41041

CVE-2024-41041 (Linux kernel UDP) : The issue arises in the UDP path where SOCK_RCU_FREE is checked too early in udp_v4_early_demux() and sk_lookup() and the flag is set after inserting the socket into the hash table, creating a small race with udp_lib_get_port() during RCU grace periods. The doc...

CVE-2024-41097

CVE-2024-41097 concerns the Linux kernel USB ATM cxacru driver. The issue stemmed from incomplete endpoint checking during cxacru_bind(), which could cause wrong endpoint types to be used when submitting URBs. The patch adds verification that required endpoint types are present for both IN and OU...

CVE-2024-44960

The CVE-2024-44960 entry concerns a Linux kernel issue in usb gadget core where a descriptor may be unset, causing a null pointer panic. The resolution involves ensuring the descriptor is set before inspecting maxpacket, addressing cases where an endpoint for the current speed is not properly con...

CVE-2024-46750

CVE-2024-46750 affects the Linux kernel PCI subsystem. The issue is caused by a missing bridge lock in the PCI bus reset path, allowing unlocked secondary bus resets via pci_reset_bus(), while pci_bus_lock() already locks other parts. The fix adds pci_dev_lock() for the upstream bridge (and for @...

CVE-2024-46787

CVE-2024-46787 relates to the Linux kernel memory-management path, specifically userfaultfd.c: mfill_atomic() and the pmd_trans_huge() checks. The patch series fixes three race-related incorrect assessments of PMDs, addressing races that could trigger BUG_ON() or misinterpretation of huge PMDs as...

CVE-2024-47698

CVE-2024-47698 (Linux kernel) affects DVB frontends rtl2830/rtl2832 in the media/dvb-frontends subsystem. The issue is an out-of-bounds write in the pid_filter logic for rtl2832, caused by not enforcing the maximum index on bit manipulations (dev->filters is 32-bit; indices must be 0–31). The ...

CVE-2024-49927

The CVE-2024-49927 entry concerns the Linux kernel x86 IO-APIC code. The connected Astra Linux security bulletin details the vulnerability as: a failure to allocate an irq_pin_list could cause a kernel panic with the message “IO-APIC: failed to add irq-pin,” due to a panicky legacy IO/APIC path d...

CVE-2024-49946

CVE-2024-49946 affects the Linux kernel PPP stack. The issue arises in ppp_channel_bridge_input() when packets are backlogged to a socket owned by a user process and the code path can call sk_backlog_rcv()/__release_sock()/release_sock() in process context. This creates an inconsistent lock state...

CVE-2024-50099

The CVE-2024-50099 entry is supported by connected documents showing concrete Linux kernel details. Affected component: arm64 probes in the Linux kernel. Root cause: simulate_ldr_literal() and simulate_ldrsw_literal() relied on plain C memory accesses, which have no extable entries and can fault;...

CVE-2024-50128

The CVE-2024-50128 issue is a Linux kernel net/wwan vulnerability: a global out-of-bounds read caused by wwan_rtnl_link_ops assigning a bigger maxtype when parsing netlink attributes. The root cause, per nla_parse_nested_deprecated guidance, is using an undersized IFLA_WWAN_MAX size during parsin...

CVE-2024-50261

Mode C CVE-2024-50261 (macsec use-after-free) affects the Linux kernel’s macsec offload path. The issue stems from metadata_dst being freed prematurely in macsec_free_netdev() while a packet is still using it. The fix replaces metadata_dst freeing with dst_release() so that metadata_dst is not fr...

CVE-2024-53099

CVE-2024-53099 refers to a Linux kernel vulnerability in BPF: it checks the validity of link->type in bpf_link_show_fdinfo(), preventing out-of-bounds access when a new link type is added but not invoked via BPF_LINK_TYPE(). Affected: Linux kernel releases prior to the patched version; multipl...

CVE-2024-53114

CVE-2024-53114 affects Linux kernel components related to x86 virtualization (VMLOAD/VMSAVE) on Zen4 client hardware. The vulnerability has been addressed in Root’s rootio-linux package for Ubuntu 22.04 (Root-OS-UBUNTU-2204-CVE-2024-53114) with multiple fixed versions available, and similarly pat...

CVE-2024-53165

CVE-2024-53165 affects the Linux kernel and describes a use-after-free in the error handling path of sh: intc: register_intc_controller(). In the flawed path, the variable d is freed in the error handling without being removed from intc_list, which can lead to a use-after-free. The fix implemente...

CVE-2024-56654

CVE-2024-56654 affects the Linux kernel Bluetooth stack. The flaw arises from using rcu_read_(un)lock inside list_for_each_entry_rcu, which is unsafe because entries dereferenced under RCU must be obtained via rcu_dereference(). The advisory states this is not legal and describes a patch that fix...

CVE-2024-57973

CVE-2024-57973 : In the Linux kernel, an integer wrap could occur on 32-bit systems while computing the length for a reply (gl->tot_len + sizeof(struct cpl_pass_accept_req) + sizeof(struct rss_header)), from user-controlled data via process_responses(). The issue affects the rdma/cxgb4 path an...

CVE-2024-58007

CVE-2024-58007 affects the Linux kernel in the soc: qcom: socinfo path, specifically on MSM8916 devices where the sysfs serial_number is constant. The root cause is an out-of-bounds read of the serial_num field in the socinfo structure due to checking the start offset instead of the end when vali...

CVE-2025-21791

CVE-2025-21791 affects the Linux kernel VRF path: l3mdev_l3_out() could be invoked without RCU protection, enabling a potential use-after-free. The root cause is missing rcu_read_lock()/rcu_read_unlock() around the call chain (raw_sendmsg -> ip_push_pending_frames -> ip_send_skb -> ip_lo...

CVE-2025-21898

CVE-2025-21898 (Linux kernel) : The vulnerability centers on ftrace calculation in function_stat_show(), where division-by-zero could occur during stddev computation. The fix introduces a check on the denominator expression x * (x - 1) * 1000, ensuring it does not produce zero before performing t...

CVE-2025-21922

CVE-2025-21922 concerns a Linux kernel PPP driver issue where a 2-byte header used by socket filter/BPF is not fully initialized, triggering a KMSAN “uninit-value” warning. The root cause, as described, is that only the first byte of the direction indicator is initialized while the second byte re...

CVE-2025-21928

CVE-2025-21928 : In the Linux kernel HID intel-ish-hid driver, a use-after-free issue in ishtp_hid_remove() can occur, leading to a random crash minutes after the driver is removed. The root cause is improper memory handling where the code frees driver_data inside the loop that destroys HID devic...

CVE-2025-21934

CVE-2025-21934 : In the Linux kernel, the rapidio Rio driver had an API misusage where rio_add_net() could pathologically free resources when device_register() failed. The patch fixes this by using put_device() instead of kfree() and by nulling mport->net to avoid a use-after-free. Impact is l...

CVE-2025-21996

The CVE-2025-21996 entry concerns the Linux kernel, specifically drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse(). The root cause is that, when a user-space command stream via ioctl to radeon_vce_cs_parse() begins with an encode (case 0x03000001), the function may call radeon_vce...

CVE-2025-37833

CVE-2025-37833 affects the Linux kernel NIC driver net/niu, where an MSIX ENTRY_DATA read-before-write on an msix entry can trigger a fatal trap. The fix ensures niu_try_msix() does not cause a trap on SPARC and adds a workaround flag PCI_DEV_FLAGS_MSIX_TOUCH_ENTRY_DATA_FIRST on the pci_dev to pr...

CVE-2012-6701

CVE-2012-6701 : An integer overflow in fs/aio.c of the Linux kernel before 3.4.1 allows local users to trigger a denial of service (and possibly other impact) via a large AIO iovec. Public sources describe exploitation locally and indicate a fix was applied in 3.4.1 (Linux kernel changelog refere...

CVE-2014-3917

CVE-2014-3917 affects the Linux kernel up to 3.14.5, specifically kernel/auditsc.c when CONFIG_AUDITSYSCALL is enabled with certain syscall rules. Local users can obtain sensitive single-bit values from kernel memory or trigger a denial of service (OOPS) by using a large syscall number. Exploitat...

CVE-2017-16538

CVE-2017-16538 refers to a vulnerability in the Linux kernel (drivers/media/usb/dvb-usb-v2/lmedm04.c) up to version 4.13.11. A local user can cause a denial of service (general protection fault and system crash) or potentially other impact by plugging a crafted USB device. The root cause is a mis...

CVE-2019-19079

CVE-2019-19079: A memory leak in the qrtr_tun_write_iter() function (net/qrtr/tun.c) of the Linux kernel before 5.3 allows a remote attacker to trigger memory consumption and Denial of Service. The issue is documented in multiple advisories (e.g., Unity Linux UTSA advisories) as affecting kernels...

CVE-2021-38203

CVE-2021-38203 affects the btrfs component in the Linux kernel, with the issue present in versions before 5.13.4. The root cause is a race condition during allocations of new system chunks when space is scarce in space_info, which can lead to a denial-of-service (deadlock) for local attackers. Pu...

CVE-2021-47185

CVE-2021-47185 is addressed by a Linux kernel fix for a soft lockup in tty_buffer/flush_to_ldisc. In ARM64 when running the ltp pty04 test, a write race between a sender and the flush_to_ldisc workqueue on different cores could cause a long loop and a softlockup in flush_to_ldisc. The patch adds ...

CVE-2022-49291

The CVE-2022-49291 entry describes a Linux kernel flaw in ALSA: pcm where concurrent hw_params and hw_free ioctls could trigger a use-after-free. The fix introduces a dedicated mutex (runtime->buffer_mutex) and applies it to both hw_params and hw_free code paths, with small reordering (mmap_co...

CVE-2022-49349

CVE-2022-49349 is a Linux kernel vulnerability in the ext4 filesystem where a use-after-free occurs in ext4_rename_dir_prepare. The issue arises during ext4 directory block reads when a directory entry with an invalid rec_len can lead to a stale parent reference being used, enabling a use-after-f...

CVE-2022-49604

CVE-2022-49604 is a Linux kernel vulnerability involving a data race in the sysctl_ip_fwd_use_pmtu path. The issue occurs when reading the sysctl while it can be modified concurrently, creating a race condition that can lead to inconsistent reads. The documented fix is to guard readers with READ_...

CVE-2023-52574

CVE-2023-52574 affects the Linux kernel where enslaving a VLAN device to a team device and changing the team device type from non-ether to ether can trigger a NULL pointer dereference in vlan_dev_hard_header via vlan->real_dev. Root cause: header_ops switching to vlan_header_ops for the team d...

CVE-2023-52634

Summary (CVE-2023-52634) : In the Linux kernel, the DRM/AMD display driver had a logic issue in the disable_otg_wa path that could cause a system hang during HDMI mode switches due to simultaneous FIFO/HPO state changes. The root cause was that enabling/disabling FIFO could affect multiple regist...

CVE-2023-52791

CVE-2023-52791 affects the Linux kernel i2c core: Run atomic i2c xfer when !preemptible to ensure atomicity during restart sequences, preventing voluntary context switches within RCU read-side critical sections. The fix, tied to preemption handling (switching to !preemptible()), aligns with pre-v...