CVE-2024-36884

CVE-2024-36884 — Linux kernel iommu/arm-smmu (nvidia_smmu_context_fault): The issue stems from using a void* where a struct arm_smmu_domain is required inside nvidia_smmu_context_fault(), which is also registered as an irq handler. Because iommu_domain is embedded at a non-zero offset, this cause...

CVE-2024-42253

CVE-2024-42253 affects the Linux kernel driver gpio/pca953x. The root cause is a race in pca953x_irq_bus_sync_unlock where the i2c_lock may not be held when setting the interrupt latch and mask, risking a miswrite to registers and potentially incorrect GPIO state during race conditions (observed ...

CVE-2024-43884

CVE-2024-43884 : In the Linux kernel, the Bluetooth MGMT path could dereference NULL in hci_conn_params_add() when pairing a device, due to a missing NULL check. This could crash the host. The fixed patch adds error handling in pair_device() to validate the NULL value before dereferencing. Connec...

CVE-2024-44964

CVE-2024-44964 affects the Linux kernel idpf driver. The issue arises during a soft reset when the second tagged commit rewrote vport/q_vector pointers and failed to restore backpointers, causing use-after-free (UAF) and memory leaks. The consequence is memory bloat, possible crashes, and “limbo”...

CVE-2024-47696

CVE-2024-47696 concerns the Linux kernel, specifically the RDMA/iwcm path. The root cause is a use‑after‑free during flushing of the iwcm_wq when it was created without the WQ_MEM_RECLAIM flag, which can break forward‑progress and lead to deadlock if a flush discovers the workqueue in a reclaimin...

CVE-2024-49862

The CVE-2024-49862 entry describes a Linux kernel vulnerability in powercap/intel_rapl: an off-by-one in get_rpi() on rp->priv->rpi, where the array can be rpi_msr or rpi_tpmi with NR_RAPL_PRIMITIVES elements. The incorrect comparison (>) could access beyond bounds, enabling local access...

CVE-2024-49936

CVE-2024-49936 concerns a use-after-free in the Linux kernel net/xen-netback path (xenvif_flush_hash) during an RCU iteration. The bug happens when kfree_rcu is invoked inside the RCU read-critcal section, causing an access to head->next after the entry is freed, leading to UAF. The mitigation...

CVE-2024-49983

CVE-2024-49983 : Linux kernel ext4 fix for double-free in ext4_ext_replay_update_ex(). The patch drops the temporary ppath and uses path directly, preventing freeing of path via ppath and ensuring the original path is updated on success. It also makes ext4_find_extent() update the path and propag...

CVE-2024-50015

CVE-2024-50015 affects the Linux kernel ext4 dax path. In ext4/dax, the loop in dax_iomap_rw() can copy data after the process is signalled and then update the inode size, causing written extents to exceed the inode size (e.g., 2M vs 4M) and fsck to report inconsistencies. The referenced fixes tr...

CVE-2024-50162

Public technical details for CVE-2024-50162 are not provided in the connected documents. The available material here repeats the initial summary without additional specifics. Monitor official advisories for updates and remediation when they become public.

CVE-2024-50191

Mode C: The CVE-2024-50191 entry concerns ext4 in the Linux kernel. The issue was that when a filesystem was mounted with errors=remount-ro, the kernel incorrectly set SB_RDONLY after errors, potentially confusing the filesystem freeze logic. The fix removes the SB_RDONLY modification and relies ...

CVE-2024-50197

CVE-2024-50197 : In the Linux kernel, the pinctrl: intel: platform path fixes a memory leak in the device_for_each_child_node() error path. The bug occurred because there was an early return in intel_platform_pinctrl_prepare_community() where fwnode_handle_put() was not called to drop a reference...

CVE-2024-50215

CVE-2024-50215 : The issue is in the Linux kernel nvmet-auth path. The controller key cb ctrl->dh_key could be reused after being freed in nvmet_destroy_auth() due to not nulling the pointer after kfree_sensitive. The fix, as cited in the connected Astra Linux/IBM/NVD entries, is to assign dh_...

CVE-2024-50287

CVE-2024-50287: Linux kernel vulnerability fixed in media: v4l2-tpg where division by zero could occur during buffer rescale when scaled_width is zero. The patch adds WARN_ON_ONCE() and returns early to avoid precalculation.

CVE-2024-53085

CVE-2024-53085 (Linux kernel) describes a race in TPM handling during suspend/read paths. The fix locks the TPM chip before checking chip flags in both tpm_pm_suspend() and tpm_hwrng_read(), and relocates TPM_CHIP_FLAG_SUSPENDED checking inside tpm_get_random() so the lock is considered when the ...

CVE-2024-53105

CVE-2024-53105 is a Linux kernel vulnerability in the memory allocator path. The issue was caused by not clearing the mlocked flag during page freeing, which could lead to a bad page state during free_pages_prepare. The fixed code moves the mlocked flag clearance into free_pages_prepare() within ...

CVE-2024-53215

CVE-2024-53215 concerns the Linux kernel RcRPC/RDMA path (svcrdma) where percpu_counter destruction was mishandled during svc_rdma_proc_init()/svc_rdma_proc_cleanup(). If register_sysctl() returns NULL, percpu counters initialized in svc_rdma_proc_init() may not be destroyed, and on hotplug CPU e...

CVE-2024-56641

CVE-2024-56641 affects the Linux kernel (net/smc). The issue occurs when closing an SMC LGR connection: canceling close_work happens before it's initialized, triggering a WARN_ON in __flush_work. The fix is to initialize close_work before establishing the connection (as noted in the advisory). Re...

CVE-2024-56747

CVE-2024-56747 concerns the Linux kernel scsi/qedi memory leak. The vulnerable path occurs when the sb (shared memory) for qedi_sb_init is allocated but not freed if sb_init fails, leading to a memory leak. The fix adds dma_free_coherent() to release sb_virt, aligning with the handling in qedr_al...

CVE-2024-57809

Technical details about CVE-2024-57809 are not provided in the supplied documents. No affected products/versions or remediation steps are present. Monitor for vendor advisories for confirmation of impact and fixes.

CVE-2024-57892

CVE-2024-57892 relates to the Linux kernel OCFS2 quota handling. The issue is a slab-use-after-free when remounting an ocfs2 filesystem as read-only and a quota_getnextquota syscall is used. The root cause is a dangling dqi_priv pointer that is freed during remount but not cleared, combined with ...

CVE-2024-57902

CVE-2024-57902 affects the Linux kernel; the issue was in af_packet's vlan_get_tci() where MSG_PEEK handling could crash a skb during packet reception. The patch reworks vlan_get_tci() to avoid touching the skb entirely and makes skb a const argument. This mitigates the crash by ensuring that vla...

CVE-2024-58055

Mode C: The connected Astra Linux bulletin corroborates the CVE-2024-58055 issue in the Linux kernel USB gadget f_tcm: the bug is a double-free caused by freeing the command before the sense/status completion. The fix is a kernel patch that prevents premature command free; the advisory notes the ...

CVE-2025-21637

CVE-2025-21637 affects the Linux kernel SCTP sysctl path for udp_port. The issue arises from using current->nsproxy via the net structure, risking NULL nsproxy (e.g., when the current task is exiting) and potentially triggering a fault. The fix described in the sources relies on obtaining net ...

CVE-2025-21948

CVE-2025-21948 is a Linux kernel issue affecting HID appleir. The report describes a NULL pointer dereference in input_event() triggered by malformed AppleIR reports, leading to a crash if a NULL input_dev is encountered. The fix adds a guard: check the HID_CLAIMED_INPUT flag and exit the event h...

CVE-2025-21961

CVE-2025-21961 (Linux kernel BNXT driver): A miscalculated truesize in the bnxt_xdp_build_skb path when mb-xdp is used with XDP_PASS causes an incorrect skb_truesize to be recorded, since skb_shared_info is wiped by napi_build_skb() and the code may reuse a stale sinfo->nr_frags. This is fixed...

CVE-2025-23150

CVE-2025-23150 affects the Linux kernel ext4 filesystem. The issue stems from an off-by-one error in do_split that can cause out-of-bounds access in ext4_insert_dentry, leading to a use-after-free condition (as detected via Syzkaller). The problem can occur during directory entry creation paths t...

CVE-2025-37756

CVE-2025-37756 relates to the Linux kernel TLS stack. The vulnerability arises from allowing a TLS socket disconnect, which can trigger unexpected corner cases in the TLS receive path. The fix is a kernel patch that explicitly disallows disconnect in net/tls, reducing the risk of abusive disconne...

CVE-2016-7914

The CVE-2016-7914 issue affects the Linux kernel prior to 4.5.3. The vulnerable component is assoc_array_insert_into_terminal_node in lib/assoc_array.c, which does not verify whether a slot is a leaf. This can allow a local user to read kernel memory or trigger a denial of service (invalid pointe...

CVE-2016-7916

CVE-2016-7916 is a Linux kernel local privilege disclosure affecting the environ_read path in fs/proc/base.c. The race condition between environment-variable copying and process setup allows a local user to read sensitive data from kernel memory by accessing a /proc/*/environ file during the setu...

CVE-2017-18204

CVE-2017-18204 affects the Linux kernel via ocfs2_setattr in fs/ocfs2/file.c, exploitable by local users to cause a denial-of-service (deadlock) when using DIO. The vulnerability exists in kernel versions before 4.14.2; Ubuntu advisories (USN 3617-3 and related) and Unity Linux advisories referen...

CVE-2017-7294

The CVE-2017-7294 issue affects the Linux kernel up to 4.10.6, specifically vmwgfx vmw_surface_define_ioctl() in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c. A crafted ioctl to /dev/dri/renderD* can trigger an integer overflow and out-of-bounds write, causing denial of service (system hang/crash) and...

CVE-2019-19050

CVE-2019-19050 describes a memory leak in the Linux kernel’s crypto_reportstat() path (crypto/crypto_user_stat.c) that can cause a denial of service via memory consumption when crypto_reportstat_alg() fails, affected up to kernel 5.3.11. Connected Nessus advisories (Unity Linux UTSA-2026-003794 a...

CVE-2022-49642

CVE-2022-49642 concerns the Linux kernel: the Synopsys DWC Ethernet driver (net: stmmac: dwc-qos) on Tegra194 can crash the system when the split header feature is enabled, due to an unexpected buffer length that can overflow the total buffer length calculation. NVIDIA feedback indicates split he...

CVE-2022-49726

CVE-2022-49726 concerns the Linux kernel clocksource for Hyper-V. The issue arises from exporting an __init-annotated hv_init_clocksource() symbol, while the __init code may be freed after initialization, making the symbol potentially invalid for modules. The vulnerability can lead to a kernel pa...

CVE-2023-30772

CVE-2023-30772 is a Linux kernel race condition leading to a use-after-free in drivers/power/supply/da9150-charger.c when a nearby attacker unplugs a device. The issue affects kernels prior to 6.2.9; security advisories from Astra Linux and Debian Mageia indicate this vulnerability, with fixes co...

CVE-2023-3338

CVE-2023-3338: A null pointer dereference in the Linux kernel DECnet protocol could allow remote crash of the system. Connected advisories confirm this affects Linux kernel DECnet with mitigation via status updates and removal of the DECnet protocol in the kernel; Debian/IBM entries note remediat...

CVE-2023-52697

CVE-2023-52697: Linux kernel ASoC/Intel sof_sdw_rt_sdca_jack_common issue fixes double put of headset codec device. The root cause was multiple codecs sharing the same dai name (e.g., rt712-sdca-aif1) causing sof_sdw_rt_sdca_jack_exit() to be invoked twice via mc_dailink_exit_loop(). The fix ensu...

CVE-2024-27016

The connected Astra Linux advisory and the CVE entry confirm CVE-2024-27016 affects the Linux kernel netfilter flowtable component, specifically in PPPoE header handling. The root cause is insufficient space to access the PPPoE protocol field; the fix validates the header once before the flowtabl...

CVE-2024-35838

CVE-2024-35838 is a Linux kernel vulnerability affecting the wifi/mac80211 stack. The issue arises when a station is allocated and links are added but not immediately marked valid (e.g., during AP MLD connection); if the station is removed before those links are marked valid, the links can leak. ...

CVE-2024-36889

CVE-2024-36889 concerns the Linux kernel’s MPTCP code. The issue arises when a client falls back to TCP during connect, and snd_nxt is not initialized yet; an incoming ACK could copy that uninitialized value into snd_una. If the MPTCP worker then re-injects data, it may trigger a cleanup using a ...

CVE-2024-38588

Summary of CVE-2024-38588 (Linux kernel) : A use-after-free in ftrace_location was reported by KASAN and fixed. The race occurs when ftrace_location accesses ftrace pages of a module that is being freed during module unloading (ftrace_release_mod). The root cause is a window where ftrace_location...

CVE-2024-39292

The CVE-2024-39292 issue concerns the Linux kernel UML subsystem. The vulnerability arises in the winch handling path: registering a winch IRQ can race with the winch being added to the winch_handlers list, potentially allowing an interrupt to occur before the winch is tracked, which could lead t...

CVE-2024-40913

Technical details for CVE-2024-40913 are not provided in the supplied documents. Monitor for updates from vendors/advisories.

CVE-2024-41040

The CVE-2024-41040 issue is a Linux kernel net/sched use-after-free (UAF) in tcf_ct_flow_table_process_conn when resolving a clash. It is evidenced by KASAN reports of slab-use-after-free and is addressed by the fix that retrieves the conntrack entry from skb again after confirming conntrack. Con...

CVE-2024-41082

CVE-2024-41082 : The Linux kernel nvme-fabrics issue can exhaust admin_q tags when many nvme commands are issued, causing a reconnect/update failure and potential kernel hang after a reset/timeouts. The connected MiracleLinux/Nessus entry notes a mitigation by letting reg_read32()/reg_read64()/re...

CVE-2024-42068

In the Linux kernel, CVE-2024-42068 is tied to bpf: Take return from set_memory_ro() into account with bpf_prog_lock_ro(). set_memory_ro() may fail, leaving memory unprotected; the issue is mitigated by ensuring the return value is checked and treated as an error. This detail is noted in related ...

CVE-2024-43914

CVE-2024-43914 : In the Linux kernel md/raid5 code, the issue arises when --revert-reshape is used during a reshape; updating the raid from 5 to 4 disks while a reshape position is still set caused a mismatch where the old reshape position influenced writepos checks, triggering a panic. The fix c...

CVE-2024-45005

CVE-2024-45005 affects the Linux kernel KVM on s390. The issue is a validity interception in the SIE path when gisa is disabled, caused by passing an uninitialized gisa origin to virt_to_phys() and then writing it into the gisa designation. The fix returns 0 in kvm_s390_get_gisa_desc() if origin ...

CVE-2024-46783

CVE-2024-46783 : Linux kernel vulnerability in tcp_bpf_sendmsg() where corking in psock->cork could cause the last flushing to send a sk_msg larger than the current message, making ‘copied’ negative in tcp_bpf_send_verdict() and triggering a kernel BUG (net/socket.c:733). Connected Astra Linux...