CVE-2025-21727

CVE-2025-21727 : Linux kernel issue in padata_reorder causing a use-after-free in padata_find_next under certain race conditions. The provided connected documents confirm a KASAN UAF scenario when a parallel padata_reorder/serial flow frees Pd too early and later calls padata_find_next. The remed...

CVE-2024-42068

In the Linux kernel, CVE-2024-42068 is tied to bpf: Take return from set_memory_ro() into account with bpf_prog_lock_ro(). set_memory_ro() may fail, leaving memory unprotected; the issue is mitigated by ensuring the return value is checked and treated as an error. This detail is noted in related ...

CVE-2024-45005

CVE-2024-45005 affects the Linux kernel KVM on s390. The issue is a validity interception in the SIE path when gisa is disabled, caused by passing an uninitialized gisa origin to virt_to_phys() and then writing it into the gisa designation. The fix returns 0 in kvm_s390_get_gisa_desc() if origin ...

CVE-2024-46783

CVE-2024-46783 : Linux kernel vulnerability in tcp_bpf_sendmsg() where corking in psock->cork could cause the last flushing to send a sk_msg larger than the current message, making ‘copied’ negative in tcp_bpf_send_verdict() and triggering a kernel BUG (net/socket.c:733). Connected Astra Linux...

CVE-2024-47701

CVE-2024-47701 : Linux kernel ext4 fault where an inlined directory lookup could access out-of-bounds when system.data xattr changes beneath the filesystem, causing a KASAN UAF. The issue arises if e_value_offs is modified underneath due to block-device changes, leading to invalid reads during ex...

CVE-2024-47705

The CVE CVE-2024-47705 (block: fix potential invalid pointer dereference in blk_add_partition) is resolved in the Linux kernel. The issue occurred when blk_add_partition() changed error handling from a single IS_ERR(part) test to handle -ENXIO separately, which unintentionally allowed a path wher...

CVE-2024-49939

The CVE-2024-49939 entry concerns the Linux kernel wifi driver rtw89 (rtw89_wow_resume and ieee80211_reconfig flow). When SER L2 occurs during WoWLAN resume, the add-interface path can run twice due to a failed rtw89_wow_resume(), leading to a second list_add and a kernel panic. The available sou...

CVE-2024-50009

The CVE-2024-50009 issue affects the Linux kernel’s cpufreq/amd-pstate path where cpufreq_cpu_get may return NULL, risking a NULL-dereference. The fix adds a proper return value check and aborts on error. Affects local/privilege-limited scenarios (per CVSS: LOCAL, LOW/LOW for user and privileges,...

CVE-2024-50028

CVE-2024-50028 affects the Linux kernel thermal subsystem. The flaw was that thermal_zone_get_by_id() could return a thermal zone object that could be freed while still in use by the caller, enabling a potential use-after-free scenario. The fix adds a reference to the thermal zone device via get_...

CVE-2024-50093

Summary: CVE-2024-50093 relates to the Linux kernel where the processor_thermal/intel int340x driver emitted a warning during module unload due to an unnecessary second pci_disable_device() call after enabling a PCI device with pcim_device_enable(). The connected Astra Linux and Debian Debian-LTS...

CVE-2024-50202

CVE-2024-50202 (nilfs2) is a Linux kernel issue where nilfs_find_entry() ignored errors loading a directory folio/page, allowing corrupted images with large i_size to trigger repeated error messages and a task hang in vcs_open(). The root cause is error suppression when nilfs_get_folio() fails; t...

CVE-2024-53052

Mode C: CVE-2024-53052 affects the Linux kernel io_uring rw path. The issue was a missing IOCB_NOWAIT handling for O_DIRECT start_write, causing a deadlock with the filesystem freezer when a write blocks on kiocb_start_write() while the mount is being frozen. The fix makes the io_uring side honor...

CVE-2024-53061

CVE-2024-53061 affects the Linux kernel media: s5p-jpeg path, where the current logic allowed a word to be less than 2, risking buffer overflows. The fix adds extra checks to prevent small-word underflow and buffer overflows, as reported by the patch notes. Additionally, an unused assignment (wor...

CVE-2024-56587

CVE-2024-56587: In the Linux kernel, a NULL pointer dereference can occur in the LEDs class when brightness_show() accesses led->cdev attributes without proper synchronization. The issue arises during inter-process interaction when a HID device creates a led and a subsequent access from anothe...

CVE-2024-56591

CVE-2024-56591 affects the Linux kernel Bluetooth subsystem, specifically hci_conn. The issue stems from using cancel_delayed_work_sync, which cancels ongoing work but may allow new work and can lead to the object being freed in hci_conn. The vendor advisories describe the root cause as related t...

CVE-2024-56667

CVE-2024-56667 affects the Linux kernel DRM/i915 driver. The root cause is a NULL pointer dereference in drm_info() when the intel_context structure contains NULL, leading to a crash. The issue has been mitigated by a fix cherry-picked from commit 754302a5bc1bd8fd3b7d85c168b0a1af6d4bba4d. The vul...

CVE-2024-57793

CVE-2024-57793 pertains to the Linux kernel, affecting the COCO/TDX guest path (virt: tdx-guest). The issue occurs when set_memory_decrypted() fails in CoCo VMs, causing decrypted memory to be leaked and potentially shared with the page allocator. The description notes this as a resolved vulnerab...

CVE-2024-57949

Summary: CVE-2024-57949 affects the Linux kernel’s irqchip/gic-v3-its path. The vulnerability arises when its_irq_set_vcpu_affinity() is called inside a nested interrupt-disabled region; the prior sequence used raw_spin_lock_irqsave() to disable interrupts, then left a guard that could re-enable ...

CVE-2025-21731

Root-cause: Linux kernel NBD subsystem UAF when reconnecting after a disconnect. Exploitation path involves grabbing nbd_config, disconnecting, reconfiguring, and a final workqueue-triggered use-after-free of nbd_config. A fix is implemented by clearing NBD_RT_BOUND in nbd_genl_disconnect(), caus...

CVE-2025-21963

CVE-2025-21963 (Linux kernel, CIFS) : The issue is a local integer overflow in the acdirmax mount option handling. User-supplied acdirmax (u32) is meant to have an upper bound, but the value is converted from seconds to jiffies before validation, enabling an integer overflow. The CVE entry notes ...

CVE-2025-37823

CVE-2025-37823: In Linux kernel net_sched hfsc, there is a potential use-after-free (UAF) in hfsc_dequeue() that has been fixed. The patch adds safety guards around hfsc_dequeue() to prevent UAF, addressing a vulnerability in the hfsc class handling. The description notes no reliable reproducer p...

CVE-2013-0871

CVE-2013-0871 refers to a race condition in the Linux kernel’s ptrace implementation (PTRACE_SETREGS) that could allow a local user to gain privileges. The issue is in kernels prior to 3.7.5, with the ChangeLog for 3.7.5 documenting the fix. Affected component: Linux kernel (pre-3.7.5); root caus...

CVE-2015-0571

CVE-2015-0571 is a local privilege-escalation in the WLAN driver for the Linux kernel as used in Qualcomm QuIC Android contributions (MSM devices and related products). The issue arises from the driver’s lack of authorization checks for private SET IOCTL calls, allowing a crafted application to g...

CVE-2017-7487

The CVE-2017-7487 issue is in the Linux kernel net/ipx/af_ipx.c ipxitf_ioctl: reference count mishandling causes a use-after-free via a failed SIOCGIFADDR on an IPX interface, enabling local denial of service. Evidence in connected Nessus advisories confirms the vulnerability and that it affects ...

CVE-2018-12896

CVE-2018-12896 affects the Linux kernel up to version 4.17.3, specifically the POSIX timers path (kernel/time/posix-timers.c). An integer overflow in the overrun accounting is caused by the timer overrun values being computed with int-based accounting, which can exceed INT_MAX depending on interv...

CVE-2022-1204

CVE-2022-1204 is a use-after-free flaw in the Linux kernel’s Amateur Radio AX.25 protocol handling that can allow a local attacker to crash the system. Connected advisories confirm this is a kernel-level issue, with public reports across multiple distributions (Debian, Mageia, Mariner, etc.). Aff...

CVE-2022-48619

CVE-2022-48619 : A local Linux kernel vulnerability in drivers/input/input.c (input_set_capability) can panic the kernel when an event code falls outside the bitmap. Affected: Linux kernel versions before 5.17.10. Root cause: mishandling in input_set_capability for out-of-bitmap event codes. Impa...

CVE-2022-48866

CVE-2022-48866: In the Linux kernel HID thrustmaster driver, a slab-out-of-bounds read occurred in thrustmaster_probe() due to missing validation of actual endpoints in usb_host_interface::endpoint. The fix adds a validation check comparing the actual number of endpoints to the expected number an...

CVE-2022-49006

CVE-2022-49006 concerns Linux kernel tracing: when a dynamic event (e.g., a kprobe) is added and later removed, the event type number recycled after 65535 can cause the parsing logic for new events to misinterpret the binary blob. The vulnerability stems from reusing the former type number for a ...

CVE-2022-49639

CVE-2022-49639 refers to a Linux kernel issue in the cipso subsystem where sysctl read operations could race with concurrent writes. The root cause is missing synchronization while reading cipso sysctl variables, and the fix is to add READ_ONCE() to prevent data races. Public documents in the con...

CVE-2023-22995

CVE-2023-22995 affects the Linux kernel’s DesignWare USB3 for Qualcomm SoCs driver (dwc3_qcom_acpi_register_core). The connected ENISA/OSV advisory notes an error-path handling defect where platform_device_put and kfree calls are omitted, leaving cleanup incomplete during device registration. Thi...

CVE-2023-52676

CVE-2023-52676 is a Linux kernel ZONE-bpf verifier issue: the risk was caused by stack bound checks being performed in 32-bit arithmetic, with offsets that can reach u32, risking overflow of int-based arithmetic. The patch relocates the relevant calculations to 64-bit domain and tightens/stabiliz...

CVE-2023-52806

CVE-2023-52806 concerns the Linux kernel ALSA hda subsystem. The description in the initial document notes a possible NULL pointer dereference when an AudioDSP stream is assigned, specifically when a COUPLED stream is inadvertently accepted despite drivers using HOST or LINK types. The connected ...

CVE-2023-52926

CVE-2023-52926 is a Linux kernel vulnerability where IORING_OP_READ does not fully consume the provided buffer list when read returns a negative value (except -EAGAIN/-EIOCBQUEUED). This can cause a use-after-free when the completion io_rw_done runs in a different context. The issue is documented...

CVE-2024-26884

CVE-2024-26884 is a Linux kernel vulnerability in the BPF hashtab overflow check on 32-bit architectures. The hashtab code uses roundup_pow_of_two() to determine hash bucket count and performs an overflow check by testing the result against 0. On 32-bit arches, the roundup operation itself can ov...

CVE-2024-26949

CVE-2024-26949 affects the Linux kernel AMDGPU power management path. The vulnerability is a NULL pointer dereference in drm/amdgpu/pm when obtaining the power limit, caused by powerplay_table initialization being skipped in SR-IOV scenarios. A fix ensures default lower/upper OD values are set if...

CVE-2024-35870

CVE-2024-35870: In the Linux kernel, smb2_reconnect_server() can UAF a session being torn down by another thread, leading to a crash (general protection fault) when a session is in an inconsistent state. The root cause is a race where a session could be accessed after __cifs_put_smb_ses() begins ...

CVE-2024-36005

CVE-2024-36005 is reported in the Astra Linux security bulletin as a Linux kernel vulnerability affecting nf_tables: the kernel could unregister an already unregistered nethook due to mishandling the table dormant flag on netdev release events. The issue is described with the same reproduction tr...

CVE-2024-38544

CVE-2024-38544 (Linux kernel, RDMA/rxe driver) : In rxe_comp_queue_pkt(), an incoming response skb is enqueued to resp_pkts and then a decision is made to run the completer inline or schedule it. The skb is then dereferenced to increment the hw counter, which can segfault if the completer task is...

CVE-2024-38553

CVE-2024-38553 affects the Linux kernel net/fec driver by removing the .ndo_poll_controller implementation to avoid deadlocks. The root cause is that netpoll runs in an atomic context and disable_irq() (which may sleep) is invoked via the .ndo_poll_controller interface in sungem; fec_poll_control...

CVE-2024-38605

CVE-2024-38605 : In the Linux kernel, the ALSA core code fixed a NULL module pointer handling during snd_card initialization. The patch moves the assignment of card->module outside the MODULE check to ensure the driver’s module reference is correctly tracked when the core is built-in but the c...

CVE-2024-40903

The CVE-2024-40903 issue affects the Linux kernel in the USB Type-C Power Delivery path. Specifically, a use-after-free could occur in tcpm_register_source_caps when new (potentially invalid) source capabilities are advertised, existing source caps are unregistered, and an error occurs in usb_pow...

CVE-2024-41062

CVE-2024-41062 concerns the Linux kernel Bluetooth L2CAP path where a race can occur between sock_close releasing a socket and hci_rx_work accessing it. The root cause is a lack of lock protection around the socket during the transition, potentially allowing hci_rx_work to touch a freed sock. The...

CVE-2024-42152

The CVE affects the Linux kernel NVMe over Fabrics NVMET subsystem. The issue is a race where nvmet_sq_destroy can see an allocated sq->ctrl during qp establishment but may drop the final reference to ctrl because sq->ctrl was captured in a local variable before the live reference was obtai...

CVE-2024-42276

Technical details for CVE-2024-42276 are not provided in the connected documents. The initial description notes a Linux kernel nvme-pci fix, but no product/vendor/version specifics are disclosed here. Monitor for updates.

CVE-2024-42321

CVE-2024-42321 affects the Linux kernel, specifically the net: flow_dissector path. The issue arises from a splat triggered by __skb_flow_dissect in flow_dissector.c, linked to __skb_get_hash() usage by nftables tracing. Upstream fixes introduce DEBUG_NET_WARN_ON_ONCE and align with the patch d1d...

CVE-2024-45010

CVE-2024-45010 – Linux kernel (mptcp: pm: only mark 'subflow' endp as available) The vulnerability is in the MPTCP path management where removing a 'signal' endpoint could incorrectly decrement local_addr_used for subflow endpoints. The fix ensures local_addr_used is decremented only when an ID i...

CVE-2024-45016

The CVE-2024-45016 issue affects the Linux kernel netem queueing path. A regression in netem_enqueue() (introduced by commit 5845f706388a) caused NET_XMIT_SUCCESS to be returned for a duplicated packet even when the packet was not enqueued, incrementing the parent qdisc’s qlen and potentially ski...

CVE-2024-46759

CVE-2024-46759 : Linux kernel hwmon: adc128d818 underflow when writing limit attributes. The issue stemmed from DIV_ROUND_CLOSEST() after kstrtol() allowing large negative values (e.g., -9223372036854775808) to underflow. The patch reorders clamp_val() and DIV_ROUND_CLOSEST() to fix the underflow...

CVE-2024-47697

CVE-2024-47697: Linux kernel dvb-frontends rtl2830 had an out-of-bounds write via rtl2830_pid_filter due to a boundary check allowing index 32. The patch updates the boundary to index >= 32 (instead of index > 32) and enforces that dev->filters, a 32-bit bitmap, uses set_bit/clear_bit on...