CVE-2009-3547

CVE-2009-3547 refers to multiple race conditions in fs/pipe.c of the Linux kernel before 2.6.32-rc6. The flaws can allow local users to cause a denial of service (NULL pointer dereference and system crash) or gain privileges by opening an anonymous pipe via a /proc/*/fd/ pathname. A fix is availa...

CVE-2016-5244

CVE-2016-5244 affects the Linux kernel and involves the function rds_inc_info_copy in net/rds/recv.c not initializing a structure member. This can enable a remote attacker to read sensitive information from kernel stack memory by processing an RDS message, with impact described as kernel informat...

CVE-2016-7911

CVE-2016-7911: Race condition in get_task_ioprio in block/ioprio.c of the Linux kernel allows local privilege escalation or use-after-free leading to DoS. A crafted ioprio_get system call can trigger the issue. This vulnerability was addressed by kernel patching in the 4.6.6 release; updating to ...

CVE-2018-11506

CVE-2018-11506 affects the Linux kernel’s sr_do_ioctl (drivers/scsi/sr_ioctl.c) through version 4.16.12. The issue arises because sense buffers at the CDROM layer and SCSI layer use different sizes, enabling a local attacker to trigger a stack-based buffer overflow via CDROMREADMODE2 ioctl, poten...

CVE-2021-47118

CVE-2021-47118: In the Linux kernel, cad_pid is initialized without taking a reference to the init task’s pid. When cad_pid is later updated via sysctl, the old pid may be put without a corresponding get, risking a use-after-free of the init task’s struct pid. The connected MiracleLinux advisory ...

CVE-2022-49401

CVE-2022-49401 pertains to the Linux kernel, where a fault in mm/page_owner handling was fixed: current->comm[] is not guaranteed to be a proper string, and using strlcpy(s1, s2, l) may call strlen(s2) and trigger out-of-bounds access. The fix replaces strlcpy with strscpy() in mm/page_owner.c...

CVE-2023-3338

CVE-2023-3338: A null pointer dereference in the Linux kernel DECnet protocol could allow remote crash of the system. Connected advisories confirm this affects Linux kernel DECnet with mitigation via status updates and removal of the DECnet protocol in the kernel; Debian/IBM entries note remediat...

CVE-2023-52749

CVE-2023-52749: In the Linux kernel, a race condition can cause a null pointer dereference during resume if a synchronous SPI transfer is active when suspending. The issue arises when a transfer context resumes after cur_msg was reset to NULL during suspend. Public details state a fix: ensure syn...

CVE-2023-52798

CVE-2023-52798 concerns the Linux kernel’s ath11k wifi DFS radar event handling. The fix marks the DFS radar event locking code (calling ath11k_mac_get_ar_by_pdev_id()) as an RCU read-side critical section to prevent potential use-after-free in active pdev protection. Document notes indicate comp...

CVE-2023-52833

CVE-2023-52833 affects the Linux kernel Bluetooth stack (btusb). The fix, described as adding a NULL check for date->evt_skb in btusb_mtk_hci_wmt_sync, addresses a crash caused by NULL pointer dereferences in Bluetooth shutdown/write paths. The provided crash trace shows a kernel NULL pointer ...

CVE-2024-0564

CVE-2024-0564 concerns the Linux kernel memory deduplication mechanism (KSM) where the max page sharing setting can enable a side channel leakage of a victim’s page when an attacker and victim share a host. The connected OSV entries confirm patches in Rootio-Linux packages for Debian/Ubuntu (Root...

CVE-2024-26835

CVE-2024-26835 affects the Linux kernel nf_tables (netfilter). When memory pressure causes hook registration to fail, a table can be marked active with no registered hooks, and on table/base chain deletion nf_tables may unregister hooks again, causing a core warn. The connected documents confirm ...

CVE-2024-27018

CVE-2024-27018 affects the Linux kernel br_netfilter component. The issue arises when a bridge device is in promiscuous mode, causing certain bridge-tapped packets to bypass conntrack input handling; a patch resets the conntrack state for these packets. The crash/reply trace and warnings (br_nf_l...

CVE-2024-36010

CVE-2024-36010: Linux kernel igb driver fix for string truncation warnings in igb_set_fw_version. The patch expands the adapter->fw_version buffer (using kasprintf then falling back to snprintf) to avoid -Wformat-truncation warnings in igb_main.c and prevents NULL dereference by not exposing a...

CVE-2024-36030

CVE-2024-36030 refers to a Linux kernel vulnerability in the octeontx2-af driver where a double free could occur in rvu_npc_freemem() due to an extra free of memory previously released (npc_mcam_rsrcs_deinit() freed mcam->counters.bmap). The fix, as noted in the connected documents, was to del...

CVE-2024-36903

CVE-2024-36903 is a Linux kernel vulnerability related to potential uninitialized value access in IPv6 processing. The cited fix targets __ip6_make_skb() in the IPv6 path by mirroring the IPv4 correction: it now validates FLOWI_FLAG_KNOWN_NH on fl6->flowi6_flags instead of testing HDRINCL on t...

CVE-2024-39292

The CVE-2024-39292 issue concerns the Linux kernel UML subsystem. The vulnerability arises in the winch handling path: registering a winch IRQ can race with the winch being added to the winch_handlers list, potentially allowing an interrupt to occur before the winch is tracked, which could lead t...

CVE-2024-42269

CVE-2024-42269 (Linux kernel) : A local DoS via NULL pointer dereference in ip6table_nat_table_init() was resolved. The root cause: ip6table_nat_table_init() accessed net->gen->ptr[...] before per-network entry was allocated. The fix: call register_pernet_subsys() before xt_register_templat...

CVE-2024-42276

Technical details for CVE-2024-42276 are not provided in the connected documents. The initial description notes a Linux kernel nvme-pci fix, but no product/vendor/version specifics are disclosed here. Monitor for updates.

CVE-2024-42305

CVE-2024-42305 affects the Linux kernel ext4, where a dir-indexing edge case could trigger out-of-bounds access during directory entry splitting when the first two entries are not dot/dotdot. The description and connected material explain that make_indexed_dir() assumed the first two dirents are ...

CVE-2024-43826

CVE-2024-43826 : In the Linux kernel, the nfs trace points can expose a safety issue in nfs_folio_length when folio locking or NULL ->f_mapping checks are missing, risking kernel crashes under certain NFS trace configurations (e.g., xfstests generic/065). The root cause is unsafe handling of f...

CVE-2024-43910

CVE-2024-43910 affects the Linux kernel BPF verifier in the path that checks global function arguments. The fix adds a check_func_arg_reg_off() to validate arguments of types ARG_PTR_TO_DYNPTR | MEM_RDONLY, preventing out-of-bounds memory accesses when a modified CONST_PTR_TO_DYNPTR is passed to ...

CVE-2024-45016

The CVE-2024-45016 issue affects the Linux kernel netem queueing path. A regression in netem_enqueue() (introduced by commit 5845f706388a) caused NET_XMIT_SUCCESS to be returned for a duplicated packet even when the packet was not enqueued, incrementing the parent qdisc’s qlen and potentially ski...

CVE-2024-46828

CVE-2024-46828 affects the Linux kernel schedulers, specifically the cake qdisc’s host-fairness logic. A hash-collision interaction could trigger an unintended decrement of per-host bulk-flow counters when a flow’s state changes, and when host fairness is enabled this could wrap a per-host counte...

CVE-2024-47723

CVE-2024-47723 affects the Linux kernel’s JFS subsystem, causing an out-of-bounds access in functions that manage the AG bitmap. The issue arises in dbNextAG() when bmp->db_numag can be greater or equal to MAXAG due to a polluted image, and in diAlloc() when agno may be greater or equal to MAX...

CVE-2024-50051

CVE-2024-50051 (Linux kernel) affects the mpc52xx SPI driver. The issue arises when a module is removed while a scheduled work item (ms->work) is still alive, because ms is freed via spi_unregister_controller but the work item may still be executed, enabling a use-after-free scenario. The fix ...

CVE-2024-50164

The CVE-2024-50164 entry covers a Linux kernel BPF verifier regression where MEM_UNINIT was overloaded to mean both “buffer need not be initialized” and “buffer will be written to.” This allowed a BPF program to write to read-only maps (e.g., .rodata) when the buffer size was not a fixed constant...

CVE-2024-50197

CVE-2024-50197 : In the Linux kernel, the pinctrl: intel: platform path fixes a memory leak in the device_for_each_child_node() error path. The bug occurred because there was an early return in intel_platform_pinctrl_prepare_community() where fwnode_handle_put() was not called to drop a reference...

CVE-2024-50235

The CVE affects the Linux kernel wifi stack, specifically the cfg80211 path. The root cause is not clearing wdev->cqm_config on free during unregister, which enables a double-free if the same wdev/netdev is re-registered in another network namespace and destroyed later. The documented impact i...

CVE-2024-53101

CVE-2024-53101 concerns the Linux kernel: a fix for an uninitialized value in from_kuid/from_kgid was applied. The issue arose when ocfs2_setattr() referenced attr->ia_mode, ia_uid, and ia_gid in a trace point even if ATTR_MODE/ATTR_UID/ATTR_GID weren’t set. The patch initializes all fields of...

CVE-2024-53114

CVE-2024-53114 affects Linux kernel components related to x86 virtualization (VMLOAD/VMSAVE) on Zen4 client hardware. The vulnerability has been addressed in Root’s rootio-linux package for Ubuntu 22.04 (Root-OS-UBUNTU-2204-CVE-2024-53114) with multiple fixed versions available, and similarly pat...

CVE-2024-53126

In CVE-2024-53126, the Linux kernel fixes a UB bug in vdpa/solidrun code where a string placed on the stack in psnet_open_pf_bar() and snet_open_vf_bar() could be used after the stack frame disappeared. The string is not copied by pcim_iomap_regions() or its callees, leading to undefined behavior...

CVE-2024-53155

CVE-2024-53155 relates to the Linux kernel OCFS2: a fix for an uninitialized value in ocfs2_file_read_iter() caused by a kiocb ‘private’ field possibly being uninitialized when passed from the block layer. The accompanying kernel log shows KMSAN reports and a stack trace ending in ocfs2_file_read...

CVE-2024-53165

CVE-2024-53165 affects the Linux kernel and describes a use-after-free in the error handling path of sh: intc: register_intc_controller(). In the flawed path, the variable d is freed in the error handling without being removed from intc_list, which can lead to a use-after-free. The fix implemente...

CVE-2024-53185

CVE-2024-53185 : In the Linux kernel, the SMB client could dereference a NULL pointer in crypto_aead_setkey() when negotiating encryption over SMB2/SMB3, due to @server->cipher_type not being set for SMB3.02. The fix adds a check to smb3_crypto_aead_allocate() and ensures cipher_type is set fo...

CVE-2024-53216

CVE-2024-53216 (Linux kernel) : The vulnerability exists in nfsd’s handling of svc_expkey/svc_export release. When the last reference to cache_head can drop to zero in c_show/e_show, svc_export_put and expkey_put may free ex_uuid, after which access to ex_uuid can occur (use-after-free). An rcu_r...

CVE-2024-56662

CVE-2024-56662 affects the Linux kernel’s ACPI-NFIT path. The vulnerability is a vmalloc-out-of-bounds read in acpi_nfit_ctl, triggered when cmd_to_func accesses call_pkg->nd_reserved2 without validating that the buffer is sized as a struct nd_cmd_pkg. The root cause is a missing bounds check ...

CVE-2024-56774

CVE-2024-56774: Linux kernel vulnerability in btrfs_search_slot() where a NULL extent-tree root could cause a null-pointer dereference during scrub when the root is NULL. The issue is fixed by adding a sanity check for the btrfs root before usage. Affected component: btrfs within the Linux kernel...

CVE-2025-21728

CVE-2025-21728: Linux kernel vulnerability where BPF programs in non-preemptible contexts calling bpf_send_signal() can sleep, causing issues. The fix changes irqs_disabled() to !preemptible(). Affects kernels with BPF support; CVSSv3.1 base 5.5 (LOCAL, LOW privileges, NONE user interaction, HIGH...

CVE-2025-21731

Root-cause: Linux kernel NBD subsystem UAF when reconnecting after a disconnect. Exploitation path involves grabbing nbd_config, disconnecting, reconfiguring, and a final workqueue-triggered use-after-free of nbd_config. A fix is implemented by clearing NBD_RT_BOUND in nbd_genl_disconnect(), caus...

CVE-2025-22002

CVE-2025-22002 concerns the Linux kernel netfs code path: if a filesystem does not implement invalidate_cache, a write-to-cache failure can trigger a NULL pointer dereference in netfs_write_collection_worker, leading to a kernel crash. The provided documents confirm the root cause as a missing NU...

CVE-2025-22089

The CVE-2025-22089 issue concerns the Linux kernel RDMA/core subsystem where hw_counters could be exposed outside the init net namespace due to an incorrect container_of() cast in hw_stat_device_show(), which led to memory corruption when users read /sys/class/infiniband/mlx4_0/hw_counters from a...

CVE-2025-23146

The CVE-2025-23146 issue affects the Linux kernel mfd: ene-kb3930 driver, where a NULL pointer dereference could occur because off_gpios may be NULL. The kb3930_probe() lacked a NULL check, fixed in the resolved update (similar to backlight: hx8357 NULL pointer fix). Impact is local, with potenti...

CVE-2010-3858

CVE-2010-3858 is a Linux kernel vulnerability described in MiracleLinux advisories as affecting fs/exec.c with CONFIG_STACK_GROWSDOWN. On 64-bit platforms, for 32-bit applications, the setup_arg_pages function does not properly constrain stack usage of arguments and environment, enabling local us...

CVE-2016-4482

CVE-2016-4482 : The Linux kernel before 4.7 has a flaw in the proc_connectinfo handling. The proc_connectinfo function in drivers/usb/core/devio.c does not initialize a data structure, enabling local users to read sensitive data from kernel stack memory via a crafted USBDEVFS_CONNECTINFO ioctl. T...

CVE-2021-47018

CVE-2021-47018 – Mode C (details available) Affected software: Linux kernel on PPC64 (powerpc/64). Issue: PPC64 fixmap area was defined at the top of the address space or just below KASAN, which is not valid for PPC64. The fix implements using the top of the I/O space for the fixmap area, with a ...

CVE-2021-47505

CVE-2021-47505 in the Linux kernel: use-after-free when polling signalfd or binder fds with aio poll due to POLLFREE not being handled. The PATCH by Ramji Jiyani fixes aio_poll_wake() handling POLLFREE and avoids deadlock by ensuring waitqueue freeing is RCU-delayed, aligning with eventpoll behav...

CVE-2022-27950

CVE-2022-27950 : A memory leak exists in Linux kernel drivers/hid/hid-elo.c for a hid_parse error condition, affecting kernels before 5.16.11. Exploitation details are not provided in the documents. A fix is in kernel 5.16.11 (and later). Recommendation: upgrade to a version containing the patch ...

CVE-2022-44034

The CVE-2022-44034 issue affects the Linux kernel (through 6.0.6) in the PCMCIA driver path, specifically drivers/char/pcmcia/scr24x_cs.c, where a race between scr24x_open() and scr24x_remove() can cause a use-after-free if a physically proximate attacker removes a PCMCIA device while open() is i...

CVE-2022-49006

CVE-2022-49006 concerns Linux kernel tracing: when a dynamic event (e.g., a kprobe) is added and later removed, the event type number recycled after 65535 can cause the parsing logic for new events to misinterpret the binary blob. The vulnerability stems from reusing the former type number for a ...