CVE-2024-43828

CVE-2024-43828 : Linux kernel ext4 contains a fix for an infinite loop during fast_commit replay. The root cause was an uninitialized extent_status struct in ext4_ext_determine_insert_hole() calling ext4_es_find_extent_range() which returned early, leaving a garbage es and enabling an integer ove...

CVE-2024-43884

CVE-2024-43884 : In the Linux kernel, the Bluetooth MGMT path could dereference NULL in hci_conn_params_add() when pairing a device, due to a missing NULL check. This could crash the host. The fixed patch adds error handling in pair_device() to validate the NULL value before dereferencing. Connec...

CVE-2024-43910

CVE-2024-43910 affects the Linux kernel BPF verifier in the path that checks global function arguments. The fix adds a check_func_arg_reg_off() to validate arguments of types ARG_PTR_TO_DYNPTR | MEM_RDONLY, preventing out-of-bounds memory accesses when a modified CONST_PTR_TO_DYNPTR is passed to ...

CVE-2024-44964

CVE-2024-44964 affects the Linux kernel idpf driver. The issue arises during a soft reset when the second tagged commit rewrote vport/q_vector pointers and failed to restore backpointers, causing use-after-free (UAF) and memory leaks. The consequence is memory bloat, possible crashes, and “limbo”...

CVE-2024-49936

CVE-2024-49936 concerns a use-after-free in the Linux kernel net/xen-netback path (xenvif_flush_hash) during an RCU iteration. The bug happens when kfree_rcu is invoked inside the RCU read-critcal section, causing an access to head->next after the entry is freed, leading to UAF. The mitigation...

CVE-2024-49977

The CVE-2024-49977 entry concerns a Linux kernel vulnerability in the net: stmmac pathway where port_transmit_rate_kbps could be set to 0, passed to div_s64 when tc-cbs is disabled, causing a zero-division error. The connected Astra Linux and CIRCL sources reproduce the same description and fix d...

CVE-2024-50015

CVE-2024-50015 affects the Linux kernel ext4 dax path. In ext4/dax, the loop in dax_iomap_rw() can copy data after the process is signalled and then update the inode size, causing written extents to exceed the inode size (e.g., 2M vs 4M) and fsck to report inconsistencies. The referenced fixes tr...

CVE-2024-50028

CVE-2024-50028 affects the Linux kernel thermal subsystem. The flaw was that thermal_zone_get_by_id() could return a thermal zone object that could be freed while still in use by the caller, enabling a potential use-after-free scenario. The fix adds a reference to the thermal zone device via get_...

CVE-2024-50130

Summary: CVE-2024-50130 affects the Linux kernel, specifically the netfilter/bpf path. The issue arises when a BPF link is attached to a net namespace without taking a proper reference to the net namespace, allowing a use-after-free scenario during netns teardown. The bug manifests as a KASAN sla...

CVE-2024-50162

Public technical details for CVE-2024-50162 are not provided in the connected documents. The available material here repeats the initial summary without additional specifics. Monitor official advisories for updates and remediation when they become public.

CVE-2024-50189

CVE-2024-50189 affects the Linux kernel HID driver for amd_sfh and is resolved by switching to device-managed dmam_alloc_coherent. The change simplifies cleanup in probe() and error paths and provides stronger cleanup guarantees, which the documents say helps to prevent memory errors, page faults...

CVE-2024-53094

CVE-2024-53094 affects the Linux kernel RDMA/siw driver (InfiniBand) where siw_tcp_sendpages/siw_qp_tx.c processing can mishandle sendpage/MSG_SPLICE_PAGES, caused by insufficient input validation. The published fix adds a sendpage_ok() check to disable MSG_SPLICE_PAGES before entering the networ...

CVE-2024-53114

CVE-2024-53114 affects Linux kernel components related to x86 virtualization (VMLOAD/VMSAVE) on Zen4 client hardware. The vulnerability has been addressed in Root’s rootio-linux package for Ubuntu 22.04 (Root-OS-UBUNTU-2204-CVE-2024-53114) with multiple fixed versions available, and similarly pat...

CVE-2024-53117

CVE-2024-53117 (Linux kernel) : The vulnerability affects virtio/vsock in the Linux kernel. The root cause was a missing kfree_skb() in error handling for MSG_ZEROCOPY paths, which could cause memory leaks. The fix adds the missing kfree_skb() to prevent leaks when MSG_ZEROCOPY encounters errors....

CVE-2024-53126

In CVE-2024-53126, the Linux kernel fixes a UB bug in vdpa/solidrun code where a string placed on the stack in psnet_open_pf_bar() and snet_open_vf_bar() could be used after the stack frame disappeared. The string is not copied by pcim_iomap_regions() or its callees, leading to undefined behavior...

CVE-2024-53138

Mode C: Normal (details provided) Affected software: Linux kernel, net/mlx5e kTLS path (mlx5e_ktls_tx_handle_resync_dump_comp).Root cause: The kTLS tx handling code increments page references with a mix of get_page() and page_ref_inc(), while the release path uses put_page() only. This creates a ...

CVE-2024-53165

CVE-2024-53165 affects the Linux kernel and describes a use-after-free in the error handling path of sh: intc: register_intc_controller(). In the flawed path, the variable d is freed in the error handling without being removed from intc_list, which can lead to a use-after-free. The fix implemente...

CVE-2024-56778

CVE-2024-56778 affects the Linux kernel DRM STI driver. The root cause is that sti_hqvdp_atomic_check could dereference an error pointer because the return value of drm_atomic_get_crtc_state() was not checked, risking invalid pointer use and potential instability. The vulnerability is limited to ...

CVE-2024-57902

CVE-2024-57902 affects the Linux kernel; the issue was in af_packet's vlan_get_tci() where MSG_PEEK handling could crash a skb during packet reception. The patch reworks vlan_get_tci() to avoid touching the skb entirely and makes skb a const argument. This mitigates the crash by ensuring that vla...

CVE-2024-58069

CVE-2024-58069 affects the Linux kernel RTC driver for PCF85063. The issue arises when an nvmem client uses a buffer smaller than 4 bytes while regmap_read assumes an unsigned int-sized destination, potentially causing an out-of-bounds write. The documented fix is to use an intermediary unsigned ...

CVE-2024-58090

CVE-2024-58090 affects the Linux kernel: sched/core commit fixes a long-standing issue where rescheduling could be triggered with interrupts disabled during kexec-based reboot paths. The root cause involved a wakeup in a syscore_suspend()/resume path that set NEED_RESCHED, leading to cond_resched...

CVE-2025-21898

CVE-2025-21898 (Linux kernel) : The vulnerability centers on ftrace calculation in function_stat_show(), where division-by-zero could occur during stddev computation. The fix introduces a check on the denominator expression x * (x - 1) * 1000, ensuring it does not produce zero before performing t...

CVE-2025-21922

CVE-2025-21922 concerns a Linux kernel PPP driver issue where a 2-byte header used by socket filter/BPF is not fully initialized, triggering a KMSAN “uninit-value” warning. The root cause, as described, is that only the first byte of the direction indicator is initialized while the second byte re...

CVE-2025-21963

CVE-2025-21963 (Linux kernel, CIFS) : The issue is a local integer overflow in the acdirmax mount option handling. User-supplied acdirmax (u32) is meant to have an upper bound, but the value is converted from seconds to jiffies before validation, enabling an integer overflow. The CVE entry notes ...

CVE-2010-2962

The CVE-2010-2962 issue affects the Intel i915 DRM GEM in the Linux kernel prior to 2.6.36. It arises from insufficient validation of pointers to memory blocks in i915_gem.c, enabling local users to write to kernel memory via crafted ioctl usage (pwrite/pread) and potentially gain privileges.

CVE-2014-9585

CVE-2014-9585 affects Linux kernels up to 3.18.2. The vdso_addr code in arch/x86/vdso/vma.c can misselect vDSO memory, enabling local users to bypass ASLR by guessing a PMD-end location. Exploitation details and patches/fixes are not provided in the connected documents; monitor advisories for rem...

CVE-2015-3339

CVE-2015-3339 affects the Linux kernel (before 3.19.6) and stems from a race condition between chown and execve when changing the owner of a setuid binary to root. An unprivileged local user could exploit the window where ownership is updated but the setuid bit is not yet stripped to gain root pr...

CVE-2016-2117

CVE-2016-2117 affects the Atheros L2 ethernet driver (atl2) in the Linux kernel up to version 4.5.2. The root cause is incorrect enablement of scatter/gather I/O, which can allow a remote attacker to read packet data and potentially obtain sensitive kernel memory information. Public documents fro...

CVE-2017-17975

CVE-2017-17975: Use-after-free in Linux kernel’s usbtv_probe (drivers/media/usb/usbtv/usbtv-core.c) up to kernel 4.14.10 can allow local attackers to trigger audio registration failure, potentially causing a denial of service (system crash) or other unspecified impact due to improper handling of ...

CVE-2018-14617

CVE-2018-14617 affects the Linux kernel up to 4.17.10. A NULL pointer dereference and panic occur in hfsplus_lookup() when opening a file in an HFS+ filesystem with malformed catalog data mounted read-only without a metadata directory, potentially causing a kernel panic. Connected Nessus entry co...

CVE-2019-18885

CVE-2019-18885 affects the Linux kernel (fs/btrfs/volumes.c) with a NULL pointer dereference in btrfs_verify_dev_extents when processing a crafted btrfs image. Root cause: fs_devices->devices is mishandled in find_device, enabling NULL dereferences in btrfs_verify_dev_extents. Impact per publi...

CVE-2019-19076

CVE-2019-19076 concerns a memory leak in the Linux kernel function nfp_abm_u32_knode_replace() in drivers/net/ethernet/netronome/nfp/abm/cls.c, before version 5.3.6. The issue can allow a remote attacker to cause a denial of service via memory consumption. The upstream commit 78beef629fd9 was rev...

CVE-2021-30178

The CVE-2021-30178 issue is a Linux kernel vulnerability affecting arch/x86/kvm/hyperv.c: synic_get can dereference a NULL pointer under certain accesses to the SynIC Hyper-V context, potentially enabling information leakage via KVM_GET_DEBUGREGS on 32-bit systems. Concrete fix is referenced in c...

CVE-2021-47373

CVE-2021-47373 is tied to the Linux kernel bug in irqchip/gic-v3-its where an off-by-one error occurs in vpe freeing when its_vpe_init() fails. The root cause is an incorrect count of VPEs to free in its_vpe_irq_domain_alloc; the fix passes the number allocated (the loop index) to the free operat...

CVE-2022-49356

CVE-2022-49356 affects the Linux kernel SUNRPC RDMA path. The vulnerability arises when svc_rdma_build_writes() can walk past the end of a Write chunk’s segment array, enabling a potential out-of-bounds condition. The issue was detected with KASAN and is addressed by a fix in the write path (net/...

CVE-2022-49726

CVE-2022-49726 concerns the Linux kernel clocksource for Hyper-V. The issue arises from exporting an __init-annotated hv_init_clocksource() symbol, while the __init code may be freed after initialization, making the symbol potentially invalid for modules. The vulnerability can lead to a kernel pa...

CVE-2023-3338

CVE-2023-3338: A null pointer dereference in the Linux kernel DECnet protocol could allow remote crash of the system. Connected advisories confirm this affects Linux kernel DECnet with mitigation via status updates and removal of the DECnet protocol in the kernel; Debian/IBM entries note remediat...

CVE-2023-4385

CVE-2023-4385 : Linux kernel JFS NULL pointer dereference in dbFree (fs/jfs/jfs_dmap.c) may allow local privilege or system crash due to missing sanity check. Connected entries reference the same issue and point to a fixing commit in the kernel source (commit 0d4837fdb796f99369cf7691d33de1b856bca...

CVE-2023-52632

CVE-2023-52632 describes a Linux kernel lockdep warning in drm/amdkfd where a potential circular locking dependency can occur between srcu and a work-queue based lock. The provided details show a chain: srcu -> info->lock#2 -> (work_completion) svms->deferred_list_work, with the risk ...

CVE-2024-26674

CVE-2024-26674 affects the Linux kernel x86/mm code, specifically a fixup path for get_user()/put_user(). In kernel builds >= 6.4 memory-error-injection can trigger a machine-check and panic due to a revert from _ASM_EXTABLE_UA() to a more generic fixup type. The issue arose when MCA handling ...

CVE-2024-26853

CVE-2024-26853 affects the Linux kernel igc XDP path. When a frame cannot be transmitted via XDP_REDIRECT (e.g., full queue), the frame must be freed, but calling xdp_return_frame_rx_napi inside igc_xdp_xmit can cause memory corruption. The fix (as per the description) is to break on the first no...

CVE-2024-27016

The connected Astra Linux advisory and the CVE entry confirm CVE-2024-27016 affects the Linux kernel netfilter flowtable component, specifically in PPPoE header handling. The root cause is insufficient space to access the PPPoE protocol field; the fix validates the header once before the flowtabl...

CVE-2024-35913

CVE-2024-35913 affects the Linux kernel’s wifi driver: the iwlwifi/mvm code incorrectly selects the mac_id vs link_id in struct iwl_mvm_session_prot_notif depending on the SESSION_PROTECTION_NOTIF version, triggering kernel warnings in time-event.c. The issue has a concrete fix in the referenced ...

CVE-2024-36929

CVE-2024-36929 concerns the Linux kernel, specifically a vulnerability in net: core handling of GSO fraglist SKBs. The root cause is that SKB_GSO_FRAGLIST skbs must not be linearized; if skb_copy or skb_copy_expand processes such skbs, it can lead to invalid state. The documented fix is to return...

CVE-2024-36972

CVE-2024-36972 : In the Linux kernel, a race between __unix_gc() and queue_oob() can occur for unix sockets if MSG_OOB is queued while unix_sk(sk)->oob_skb is being garbage-collected. The code previously touched oob_skb without holding the sk_receive_queue lock, allowing a concurrent update to...

CVE-2024-38553

CVE-2024-38553 affects the Linux kernel net/fec driver by removing the .ndo_poll_controller implementation to avoid deadlocks. The root cause is that netpoll runs in an atomic context and disable_irq() (which may sleep) is invoked via the .ndo_poll_controller interface in sungem; fec_poll_control...

CVE-2024-38564

CVE-2024-38564 addresses a Linux kernel flaw where BPF_LINK_CREATE did not enforce the correct attach type for BPF_PROG_TYPE_CGROUP_SKB, allowing a cgroup_skb program to be attached to inappropriate hooks. The issue is resolved by adding missing attach_type enforcement in link_create, with bpf_pr...

CVE-2024-38573

The Linux kernel is vulnerable to a null pointer dereference in the cppc_cpufreq component. The issue stems from the functions cppc_cpufreq_get_rate() and hisi_cppc_cpufreq_get_rate() being callable from various locations with different parameters, which can cause cpufreq_cpu_get() to return null...

CVE-2024-38588

Summary of CVE-2024-38588 (Linux kernel) : A use-after-free in ftrace_location was reported by KASAN and fixed. The race occurs when ftrace_location accesses ftrace pages of a module that is being freed during module unloading (ftrace_release_mod). The root cause is a window where ftrace_location...

CVE-2024-41041

CVE-2024-41041 (Linux kernel UDP) : The issue arises in the UDP path where SOCK_RCU_FREE is checked too early in udp_v4_early_demux() and sk_lookup() and the flag is set after inserting the socket into the hash table, creating a small race with udp_lib_get_port() during RCU grace periods. The doc...