CVE-2021-47378

CVE-2021-47378 affects the Linux kernel nvme-rdma code: destroying cm_id before destroying the qp can cause a use-after-free in RDMA error flow. The fix documented in multiple sources is to always destroy cm_id before destroying the qp, with qp subsequently destroyed in nvme_rdma_alloc_queue() af...

CVE-2022-2318

CVE-2022-2318 is a use-after-free vulnerability in the Linux kernel's Rose (net/rose/rose_timer.c) timer handler that can cause denial of service (crash) with local privileges. Connected advisories confirm the vulnerability affects Linux kernel releases and note fixed versions: Debian security ad...

CVE-2022-48866

CVE-2022-48866: In the Linux kernel HID thrustmaster driver, a slab-out-of-bounds read occurred in thrustmaster_probe() due to missing validation of actual endpoints in usb_host_interface::endpoint. The fix adds a validation check comparing the actual number of endpoints to the expected number an...

CVE-2022-49006

CVE-2022-49006 concerns Linux kernel tracing: when a dynamic event (e.g., a kprobe) is added and later removed, the event type number recycled after 65535 can cause the parsing logic for new events to misinterpret the binary blob. The vulnerability stems from reusing the former type number for a ...

CVE-2023-52867

CVE-2023-52867 affects the Linux kernel drm/radeon driver: a buffer overflow in the AFMT status buffer (afmt_status, size 6) can occur because afmt_idx is checked after access. The issue is resolved in kernel updates referenced by multiple advisories (e.g., Amazon Linux 2 ALAS-2025-2834 and Unity...

CVE-2024-26674

CVE-2024-26674 affects the Linux kernel x86/mm code, specifically a fixup path for get_user()/put_user(). In kernel builds >= 6.4 memory-error-injection can trigger a machine-check and panic due to a revert from _ASM_EXTABLE_UA() to a more generic fixup type. The issue arose when MCA handling ...

CVE-2024-35838

CVE-2024-35838 is a Linux kernel vulnerability affecting the wifi/mac80211 stack. The issue arises when a station is allocated and links are added but not immediately marked valid (e.g., during AP MLD connection); if the station is removed before those links are marked valid, the links can leak. ...

CVE-2024-35991

CVE-2024-35991: In the Linux kernel, idxd dmaengine code changed from a spinlock-protected event log workqueue to a mutex-protected approach to safely call drain_workqueue(). The root cause was calling drain_workqueue() while holding a spinlock, risking a Call Trace due to possible task reschedul...

CVE-2024-36025

CVE-2024-36025 is validated by connected MiracleLinux security advisory AXSA:2024-8783:27. Affected: Linux kernel scsi qla2xxx driver. Root cause: memory corruption from an off-by-one in qla_edif_app_getstats() where app_reply->elem[] (allocated for app_req.num_ports) could be overrun due to a...

CVE-2024-36270

CVE-2024-36270 : Linux kernel netfilter/tproxy vulnerability fixed. The bug caused a general protection fault / NULL pointer dereference in nf_tproxy_laddr4 when ip address handling hit a NULL device on the in_dev_rcu path. The corrigendum notes __in_dev_get_rcu() can return NULL and requires a N...

CVE-2024-36922

CVE-2024-36922 is grounded in the Linux kernel wifi stack: the iwlwifi driver could read txq->read_ptr without holding the lock, risking reading the same value twice and later reclaiming the same entry twice, triggering a WARN_ONCE. The vulnerability is resolved by reading txq->read_ptr und...

CVE-2024-36928

The CVE-2024-36928 issue affects the Linux kernel on s390/qeth: after the hsuid attribute is set for an IQD Layer3 device while the network interface is UP, the kernel may dereference a NULL napi function pointer, causing a kernel panic. Root cause described: modern qeth flow no longer calls dev_...

CVE-2024-39292

The CVE describes a race in the Linux kernel where registering a winch IRQ could occur before the winch is added to winch_handlers, risking a panic during winch_cleanup if the IRQ is scheduled for a freed winch. The confirmed fix, as detailed in connected advisories, is to add the winch to winch_...

CVE-2024-39488

The CVE-2024-39488 issue is a Linux kernel arm64 bug related to end padding of bug_entry structures. When CONFIG_DEBUG_BUGVERBOSE=n, final bug_table entries in modules may lack trailing padding, causing the last entry to be ignored and potentially leading to an unexpected kernel panic during modu...

CVE-2024-39502

CVE-2024-39502 : Linux kernel vulnerability in the Ionic driver where use-after-free can occur in netif_napi_del handling. If multiple TX/RX queues are configured (e.g., 4) but only 3 are used, ionic_qcq_enable may call napi_enable() for a queue that was unregistered by netif_napi_del(), since ne...

CVE-2024-41082

CVE-2024-41082 : The Linux kernel nvme-fabrics issue can exhaust admin_q tags when many nvme commands are issued, causing a reconnect/update failure and potential kernel hang after a reset/timeouts. The connected MiracleLinux/Nessus entry notes a mitigation by letting reg_read32()/reg_read64()/re...

CVE-2024-42292

The CVE-2024-42292 entry is active and has concrete technical details: in the Linux kernel, kobject_uevent had an OOB memory access due to incorrect size calculation in zap_modalias_env(); the fix corrects the size used by memmove. The vulnerability affects kernel code path handling MODALIAS with...

CVE-2024-43882

CVE-2024-43882 is a Linux kernel race Condition (ToCToU) in exec path: permission checks for a file are done at do_filp_open(), but the metadata (mode/UID/GID) used later in execve() can be changed before execution, enabling potential root privilege escalation. The issue is exploitable in scenari...

CVE-2024-49862

The CVE-2024-49862 entry describes a Linux kernel vulnerability in powercap/intel_rapl: an off-by-one in get_rpi() on rp->priv->rpi, where the array can be rpi_msr or rpi_tpmi with NR_RAPL_PRIMITIVES elements. The incorrect comparison (>) could access beyond bounds, enabling local access...

CVE-2024-50099

CVE-2024-50099 concerns the Linux kernel arm64 uprobes for LDR (literal) and LDRSW (literal). The two functions, simulate_ldr_literal() and simulate_ldrsw_literal(), were originally written for kprobes and use plain C memory accesses. When uprobes were added, these were reused unmodified, but the...

CVE-2024-50162

CVE-2024-50162 : In the Linux kernel, the bugJohn path is in BPF devmap redirects. After a redirect via BPF_MAP_TYPE_DEVMAP, the RX queue (rxq) pointer isn’t set in the post-redirect BPF program, causing a NULL pointer dereference when code accesses pkt->ingress_ifindex (as shown by the crash ...

CVE-2024-50186

CVE-2024-50186 : Linux kernel vulnerability in net: explicitly clear the sk pointer when pf->create fails. Root cause: some pf->create implementations do not NULL the freed sk object in error paths, leaving a dangling pointer and enabling Use-After-Free. Fix: explicitly NULL the sk pointer ...

CVE-2024-50278

The CVE-2024-50278 vulnerability affects the Linux kernel’s dm-cache (device-mapper) component. It can cause an out-of-bounds access in the dirty-bitset when the fast device is expanded before the first resume of the cache table, due to the first-resume size check not being performed. Reproductio...

CVE-2024-53052

Mode C: CVE-2024-53052 affects the Linux kernel io_uring rw path. The issue was a missing IOCB_NOWAIT handling for O_DIRECT start_write, causing a deadlock with the filesystem freezer when a write blocks on kiocb_start_write() while the mount is being frozen. The fix makes the io_uring side honor...

CVE-2024-53070

CVE-2024-53070 affects the Linux kernel USB subsystem (dwc3). The issue occurs when a device is already runtime suspended and the system suspends, leading to a crash if device registers are accessed. The fix reorders suspend sequence by moving the dwc3_enable_susphy() call to the top of the suspe...

CVE-2024-53100

CVE-2024-53100: Linux kernel nvme-tcp fix for a race between queue_lock usage in nvme_tcp_get_address() and destruction in nvme_tcp_free_queue(). The commit 76d54bf20cdc adds a mutex_lock for queue->queue_lock, but this can race with mutex_destroy(), triggering a WARN during error recovery. A ...

CVE-2024-53105

CVE-2024-53105 is a Linux kernel vulnerability in the memory allocator path. The issue was caused by not clearing the mlocked flag during page freeing, which could lead to a bad page state during free_pages_prepare. The fixed code moves the mlocked flag clearance into free_pages_prepare() within ...

CVE-2024-53133

CVE-2024-53133 concerns the Linux kernel DRM/AMD display driver. The vulnerability arises when a dml allocation fails, causing the current state’s dml contexts to become invalid. Subsequent calls to dc_state_copy_internal could shallow-copy these invalid pointers, and releasing the new state coul...

CVE-2024-53157

CVE-2024-53157 affects the Linux kernel with a flaw in firmware/arm_scpi DVFS handling: when the SCPI firmware returns an OPP count of zero, the kernel may dereference a NULL pointer during dvfs recalculation, causing a crash (kernel oops) as shown in the trace. The issue arises from dvfs_info.op...

CVE-2024-53681

CVE-2024-53681 : In the Linux kernel nvmet subsystem, the code path nvmet_root_discovery_nqn_store mishandled the subsysnqn string as a fixed-size buffer even though it is allocated to the string size. The root cause is buffer overrun risk when the subsysnqn is longer than the old buffer. The fix...

CVE-2024-56718

CVE-2024-56718 affects the Linux kernel’s net/smc path where a link-down work item could run after the LGR object was freed, potentially crashing the kernel due to list corruption in the workqueue path. The description in multiple sources confirms the root cause: scheduling link-down work before ...

CVE-2024-56778

CVE-2024-56778 affects the Linux kernel DRM STI driver. The root cause is that sti_hqvdp_atomic_check could dereference an error pointer because the return value of drm_atomic_get_crtc_state() was not checked, risking invalid pointer use and potential instability. The vulnerability is limited to ...

CVE-2024-57900

CVE-2024-57900 is a Linux kernel vulnerability affecting the ila subsystem. A race in ila_add_mapping() can occur with concurrent ILA_CMD_ADD commands, observed as KASAN slab-use-after-free traces. The provided fix adds a mutex to ensure at most one thread calls nf_register_net_hooks(), preventin...

CVE-2025-21731

Root-cause: Linux kernel NBD subsystem UAF when reconnecting after a disconnect. Exploitation path involves grabbing nbd_config, disconnecting, reconfiguring, and a final workqueue-triggered use-after-free of nbd_config. A fix is implemented by clearing NBD_RT_BOUND in nbd_genl_disconnect(), caus...

CVE-2009-3547

CVE-2009-3547 refers to multiple race conditions in fs/pipe.c of the Linux kernel before 2.6.32-rc6. The flaws can allow local users to cause a denial of service (NULL pointer dereference and system crash) or gain privileges by opening an anonymous pipe via a /proc/*/fd/ pathname. A fix is availa...

CVE-2015-0571

CVE-2015-0571 is a local privilege-escalation in the WLAN driver for the Linux kernel as used in Qualcomm QuIC Android contributions (MSM devices and related products). The issue arises from the driver’s lack of authorization checks for private SET IOCTL calls, allowing a crafted application to g...

CVE-2015-3339

CVE-2015-3339 affects the Linux kernel (before 3.19.6) and stems from a race condition between chown and execve when changing the owner of a setuid binary to root. An unprivileged local user could exploit the window where ownership is updated but the setuid bit is not yet stripped to gain root pr...

CVE-2017-16525

The CVE-2017-16525 entry affects the Linux kernel: usb_serial_console_disconnect in drivers/usb/serial/console.c allows local users to trigger a denial of service (use-after-free and system crash) via a crafted USB device, with impact on confidentiality/integrity/availability as per the advisory....

CVE-2019-15223

CVE-2019-15223 affects the Linux kernel up to version 5.1.7 where a NULL pointer dereference can be triggered by a malicious USB device in the sound/usb/line6/driver.c driver. This is a local physical attack vector through USB, potentially causing a kernel crash by dereferencing a NULL pointer. T...

CVE-2019-19071

CVE-2019-19071 is a DoS vulnerability in the RSI 91x WiFi driver of the Linux kernel, caused by a memory leak in rsi_send_beacon() that can be triggered when rsi_prepare_beacon() fails. The issue affects the Linux kernel up to version 5.3.11 and is reported in the RSI_91x wireless driver (drivers...

CVE-2022-4842

CVE-2022-4842 concerns a NULL dereference in the Linux kernel NTFS3 driver’s attr_punch_hole() function. The flaw is described as a NULL pointer dereference that can be triggered locally by a user, leading to a system crash. The vulnerability is discussed in multiple sources (e.g., Astra Linux se...

CVE-2022-48939

CVE-2022-48939 refers to a Linux kernel issue where the BPF subsystem’s batch operations could cause soft lockups due to missing schedule points. The fix adds scheduling points in batch paths to prevent long hangs (e.g., kworker/1:1:27 blocked and hung RCUs). The root cause is that batch processi...

CVE-2022-49322

The CVE-2022-49322 issue affects the Linux kernel in PREEMPT_RT builds when bootparams include trace_event=initcall:initcall_start tp_printk=1. In this scenario, output_printk() triggers a sleepable rt-spinlock usage via rt_spin_lock, causing a sleeping function to be called from an invalid conte...

CVE-2022-49639

CVE-2022-49639 refers to a Linux kernel issue in the cipso subsystem where sysctl read operations could race with concurrent writes. The root cause is missing synchronization while reading cipso sysctl variables, and the fix is to add READ_ONCE() to prevent data races. Public documents in the con...

CVE-2023-30772

CVE-2023-30772 is a Linux kernel race condition leading to a use-after-free in drivers/power/supply/da9150-charger.c when a nearby attacker unplugs a device. The issue affects kernels prior to 6.2.9; security advisories from Astra Linux and Debian Mageia indicate this vulnerability, with fixes co...

CVE-2023-3777

CVE-2023-3777 is a use-after-free in Linux kernel nf_tables (netfilter). When nf_tables_delrule() flushes table rules, it may release objects if the chain is bound, enabling local privilege escalation. Mitigation: upgrade past commit 6eaf41e87a223ae6f8e7a28d6e78384ad7e407f8 (Linux kernel versions...

CVE-2023-38426

The CVE-2023-38426 issue affects the Linux kernel prior to 6.3.4, specifically ksmbd’s SMB2 path where an out-of-bounds read occurs in smb2_find_context_vals if create_context’s name_len exceeds the tag length. Public references (kernel commit and ChangeLog-6.3.4) confirm the vulnerability contex...

CVE-2023-52661

The CVE-2023-52661 vulnerability concerns the Linux kernel DRM/TeGra module: rgb code path in tegra_dc_rgb_probe() lacked a clk_put() in error handling when clk_get_sys(..., pll_d2_out0) failed. The advisory items describe adding the missing clk_put and introducing a put_pll_d_out0 label to unwin...

CVE-2023-52697

CVE-2023-52697: Linux kernel ASoC/Intel sof_sdw_rt_sdca_jack_common issue fixes double put of headset codec device. The root cause was multiple codecs sharing the same dai name (e.g., rt712-sdca-aif1) causing sof_sdw_rt_sdca_jack_exit() to be invoked twice via mc_dailink_exit_loop(). The fix ensu...

CVE-2023-52833

CVE-2023-52833 affects the Linux kernel Bluetooth stack (btusb). The fix, described as adding a NULL check for date->evt_skb in btusb_mtk_hci_wmt_sync, addresses a crash caused by NULL pointer dereferences in Bluetooth shutdown/write paths. The provided crash trace shows a kernel NULL pointer ...