CVE-2024-56747

CVE-2024-56747 concerns the Linux kernel scsi/qedi memory leak. The vulnerable path occurs when the sb (shared memory) for qedi_sb_init is allocated but not freed if sb_init fails, leading to a memory leak. The fix adds dma_free_coherent() to release sb_virt, aligning with the handling in qedr_al...

CVE-2024-57793

CVE-2024-57793 pertains to the Linux kernel, affecting the COCO/TDX guest path (virt: tdx-guest). The issue occurs when set_memory_decrypted() fails in CoCo VMs, causing decrypted memory to be leaked and potentially shared with the page allocator. The description notes this as a resolved vulnerab...

CVE-2024-57809

Technical details about CVE-2024-57809 are not provided in the supplied documents. No affected products/versions or remediation steps are present. Monitor for vendor advisories for confirmation of impact and fixes.

CVE-2024-57887

CVE-2024-57887 : In the Linux kernel DRM path for adv7511/adv7533, a use-after-free occurs when a host_node pointer freed in adv7533_parse_dt() is later used by adv7533_attach_dsi(). The issue arises because of deallocating the node too early and reusing the same reference. The fix, as described ...

CVE-2024-57924

CVE-2024-57924 affects the Linux kernel and is described in multiple sources as a fix to “fs: relax assertions on failure to encode file handles.” The issue concerns exportfs_encode_fh and related paths used by filesystem code to encode file handles, with legacy users such as nfsd and name_to_han...

CVE-2024-58087

CVE-2024-58087 affects ksmbd in the Linux kernel and was resolved by incrementing the session reference count within the lookup lock to prevent a race with session expire. The vulnerability pertains to a racy session lookup/expire scenario in ksmbd, with impact described as high for confidentiali...

CVE-2025-21708

The CVE-2025-21708 issue affects the Linux kernel rtl8150 USB driver. It stems from wrong USB endpoint handling during URB submission. Mitigation in the current patch is to enable basic endpoint checking (bulk/interrupt endpoints) to reduce the risk, with cosmetic changes planned later. Exploit d...

CVE-2025-21791

CVE-2025-21791 affects the Linux kernel VRF path: l3mdev_l3_out() could be invoked without RCU protection, enabling a potential use-after-free. The root cause is missing rcu_read_lock()/rcu_read_unlock() around the call chain (raw_sendmsg -> ip_push_pending_frames -> ip_send_skb -> ip_lo...

CVE-2025-21898

CVE-2025-21898 (Linux kernel) : The vulnerability centers on ftrace calculation in function_stat_show(), where division-by-zero could occur during stddev computation. The fix introduces a check on the denominator expression x * (x - 1) * 1000, ensuring it does not produce zero before performing t...

CVE-2017-17975

CVE-2017-17975: Use-after-free in Linux kernel’s usbtv_probe (drivers/media/usb/usbtv/usbtv-core.c) up to kernel 4.14.10 can allow local attackers to trigger audio registration failure, potentially causing a denial of service (system crash) or other unspecified impact due to improper handling of ...

CVE-2018-8043

CVE-2018-8043 : The Linux kernel’s unimac_mdio_probe (drivers/net/phy/mdio-bcm-unimac.c) fails to validate certain resource states, enabling a local attacker to trigger a NULL pointer dereference and cause a denial of service. The issue affects kernel versions up to 4.15.8. Connected advisories (...

CVE-2021-47185

The Linux kernel contains a softlockup vulnerability in the tty_buffer component within the flush_to_ldisc function. The issue occurs on arm64 architecture when running the ltp/testcases/kernel/pty/pty04.c testcase. Specifically, when a sender process calls the write syscall to send data to a PTY...

CVE-2022-49708

CVE-2022-49708 affects the Linux kernel ext4 file system (mballoc allocator). The issue is triggered by a BUG_ON path in ext4_mb_use_inode_pa during disk space accounting, leading to a kernel crash when fsync/writeback paths exercise preallocation and inode pa blocks. Reproduction steps involve c...

CVE-2023-52889

CVE-2023-52889 affects the Linux kernel, via apparmor: Fix null pointer deref when receiving skb during sock creation. The issue occurs when ICMP packets with secmark are received while an ICMP raw socket is being created; SK_CTX(sk)->label may not be set yet, causing a NULL pointer dereferenc...

CVE-2024-35991

CVE-2024-35991: In the Linux kernel, idxd dmaengine code changed from a spinlock-protected event log workqueue to a mutex-protected approach to safely call drain_workqueue(). The root cause was calling drain_workqueue() while holding a spinlock, risking a Call Trace due to possible task reschedul...

CVE-2024-36017

The CVE-2024-36017 entry is valid and has concrete details in connected sources. The vulnerability is in the Linux kernel rtnetlink path: nested IFLA_VF_VLAN_LIST attributes are assumed to be struct ifla_vf_vlan_info (size 14 bytes). Validation used NLA_HDRLEN (4 bytes), enabling a too-small attr...

CVE-2024-38662

CVE-2024-38662 affects the Linux kernel (BPF) where deletion from sockmap/sockhash is allowed only if the program was previously allowed to update that map. The issue arises when a BPF program attached to a tracepoint performs map_delete on these maps, triggering a locking-rule violation. The ver...

CVE-2024-40903

The CVE-2024-40903 issue affects the Linux kernel in the USB Type-C Power Delivery path. Specifically, a use-after-free could occur in tcpm_register_source_caps when new (potentially invalid) source capabilities are advertised, existing source caps are unregistered, and an error occurs in usb_pow...

CVE-2024-40904

CVE-2024-40904 affects the Linux kernel USB: class: cdc-wdm driver. The issue was a CPU soft lockup caused by excessive log messages from the interrupt URB handling, exacerbated by immediate resubmission of URBs with -EPROTO status and verbose kernel logging. The fix replaces two verbose dev_err(...

CVE-2024-42232

Based on the connected advisories, CVE-2024-42232 is a race condition in the Linux kernel’s libceph code (ceph_monc_stop) where delayed_work() handling can race with mon_fault() and finish_hunting(), potentially leading to use-after-free scenarios on monc and related objects. The documented fix r...

CVE-2024-42276

Technical details for CVE-2024-42276 are not provided in the connected documents. The initial description notes a Linux kernel nvme-pci fix, but no product/vendor/version specifics are disclosed here. Monitor for updates.

CVE-2024-46770

CVE-2024-46770 applies to the Linux kernel; the issue arises in the PF reset flow where netif_device_attach/detach handling allows ethtool callbacks during reset to dereference deleted resources. Root cause: ethtool coalesce access during reset can hit a NULL dereference when the driver resources...

CVE-2024-46821

CVE-2024-46821 (Linux kernel, drm/amd/pm) affects the Linux kernel’s AMD power management code where a negative clk_index/clk_idex was used as an index into pptable->DpmDescriptor, leading to a negative array index read. The issue is resolved by a fix that prevents using negative values as an ...

CVE-2024-49927

The CVE-2024-49927 entry concerns the Linux kernel x86 IO-APIC code. The connected Astra Linux security bulletin details the vulnerability as: a failure to allocate an irq_pin_list could cause a kernel panic with the message “IO-APIC: failed to add irq-pin,” due to a panicky legacy IO/APIC path d...

CVE-2024-50164

The CVE-2024-50164 entry covers a Linux kernel BPF verifier regression where MEM_UNINIT was overloaded to mean both “buffer need not be initialized” and “buffer will be written to.” This allowed a BPF program to write to read-only maps (e.g., .rodata) when the buffer size was not a fixed constant...

CVE-2024-50259

CVE-2024-50259 affects the Linux kernel via the netdevsim component. The issue is caused by missing a trailing NUL after copy_from_user() in nsim_nexthop_bucket_activity_write(), which could affect string handling in that function. A fix adds the trailing zero to ensure proper operation. The CVE ...

CVE-2024-53079

CVE-2024-53079 affects the Linux kernel’s memory management (mm/thp) with a fix for the deferred split unqueue naming and locking. The description details races in THP deferred split queues under load, causing list_del corruptions and “Bad page state” issues, linked to changes around 6.8 (mTHP), ...

CVE-2024-53157

CVE-2024-53157 affects the Linux kernel with a flaw in firmware/arm_scpi DVFS handling: when the SCPI firmware returns an OPP count of zero, the kernel may dereference a NULL pointer during dvfs recalculation, causing a crash (kernel oops) as shown in the trace. The issue arises from dvfs_info.op...

CVE-2024-53170

CVE-2024-53170 is a Linux kernel block subsystem UAF issue: the flush-rq mapping may not be cleared during scsi probe due to blk_queue_init_done()/del_gendisk interaction, allowing a use‑after‑free in blk_mq_find_and_get_req during tag handling. Connected advisories/documentation confirm this vul...

CVE-2024-53681

CVE-2024-53681 : In the Linux kernel nvmet subsystem, the code path nvmet_root_discovery_nqn_store mishandled the subsysnqn string as a fixed-size buffer even though it is allocated to the string size. The root cause is buffer overrun risk when the subsysnqn is longer than the old buffer. The fix...

CVE-2024-56544

CVE-2024-56544 details a kernel fix where the udmabuf folios array was changed from kmalloc to kvmalloc_array to support larger allocations. Under PAGE_SIZE=4096, MAX_PAGE_ORDER=10 (4MB memory limit for kmalloc), an udmabuf larger than 4MB could fail with a warning and NULL return. The patch enab...

CVE-2024-56591

CVE-2024-56591 affects the Linux kernel Bluetooth subsystem, specifically hci_conn. The issue stems from using cancel_delayed_work_sync, which cancels ongoing work but may allow new work and can lead to the object being freed in hci_conn. The vendor advisories describe the root cause as related t...

CVE-2024-56627

The CVE-2024-56627 issue affects the Linux kernel ksmbd component, specifically ksmbd_vfs_stream_read. A client-supplied negative offset could trigger an out-of-bounds read from the stream_buf when the ksmbd.conf setting vfs objects = streams_xattr is used. The vulnerability originates in the ker...

CVE-2024-56772

The CVE-2024-56772 entry describes a use-after-free in Linux kernel kunit: in kunit_debugfs_create_suite(), if alloc_string_stream() fails during kunit_suite_for_each_test_case(), suite->log has already been assigned and the error path frees the stream but does not NULL the pointer. This leads...

CVE-2024-56774

CVE-2024-56774: Linux kernel vulnerability in btrfs_search_slot() where a NULL extent-tree root could cause a null-pointer dereference during scrub when the root is NULL. The issue is fixed by adding a sanity check for the btrfs root before usage. Affected component: btrfs within the Linux kernel...

CVE-2024-58090

CVE-2024-58090 affects the Linux kernel: sched/core commit fixes a long-standing issue where rescheduling could be triggered with interrupts disabled during kexec-based reboot paths. The root cause involved a wakeup in a syscore_suspend()/resume path that set NEED_RESCHED, leading to cond_resched...

CVE-2025-21681

Open vSwitch issue CVE-2025-21681 in the Linux kernel caused a lockup in skb_tx_hash when a netdev is unregistering with carrier reported as ON. The root cause was a loop in skb_tx_hash that could spin when dev->real_num_tx_queues goes to zero, especially for devices that report carrier state ...

CVE-2025-21839

CVE-2025-21839 concerns the Linux kernel KVM DR6 handling. The core issue is that DR6 value loading was handled differently from DR0–DR3, with the guest DR6 value being loaded inside the core vcpu_run loop for KVM_DEBUGREG_BP_ENABLED, and saved on VM-Exit outside the loop. This could allow a gues...

CVE-2025-21864

CVE-2025-21864 affects the Linux kernel TCP path. The issue arises when netns are deleted and an skb defers free, leaving a lingering reference to an xfrm_state via the secpath attached to the skb. The kernel previously dropped dst but not the secpath; the fix drops the secpath in the TCP receive...

CVE-2025-22089

The CVE-2025-22089 issue concerns the Linux kernel RDMA/core subsystem where hw_counters could be exposed outside the init net namespace due to an incorrect container_of() cast in hw_stat_device_show(), which led to memory corruption when users read /sys/class/infiniband/mlx4_0/hw_counters from a...

CVE-2025-37796

CVE-2025-37796 affects the Linux kernel wifi driver for at76c50x. The root cause is a use-after-free in at76_disconnect: after freeing the priv object (via ieee80211_free_hw) the code accesses the freed object’s udev field to manage the USB device, which can also cause a memory leak. The issue is...

CVE-2013-1059

CVE-2013-1059 affects the Linux kernel (net/ceph/auth_none.c) through version 3.10. A remote attacker can trigger a denial of service via an auth_reply message that leads to a NULL pointer dereference and system crash; the content implies possible other impact. In the connected Nessus entries for...

CVE-2014-7841

CVE-2014-7841 affects the Linux kernel SCTP implementation (net/sctp/sm_make_chunk.c) with ASCONF enabled. A malformed INIT chunk can trigger a NULL pointer dereference, causing a system crash (DoS). Affected: kernel versions before 3.17.4; fix: upgrade to 3.17.4 or later (kernel changelog confir...

CVE-2015-7799

The CVE-2015-7799 issue affects the Linux kernel, specifically slhc_init in drivers/net/slip/slhc.c, up to version 4.2.3. The vulnerability arises because the function does not validate certain slot numbers, allowing a local user to trigger a denial of service via a crafted PPPIOCSMAXCID ioctl ca...

CVE-2019-19079

CVE-2019-19079: A memory leak in the qrtr_tun_write_iter() function (net/qrtr/tun.c) of the Linux kernel before 5.3 allows a remote attacker to trigger memory consumption and Denial of Service. The issue is documented in multiple advisories (e.g., Unity Linux UTSA advisories) as affecting kernels...

CVE-2021-47118

CVE-2021-47118: In the Linux kernel, cad_pid is initialized without taking a reference to the init task’s pid. When cad_pid is later updated via sysctl, the old pid may be put without a corresponding get, risking a use-after-free of the init task’s struct pid. The connected MiracleLinux advisory ...

CVE-2021-47505

CVE-2021-47505 in the Linux kernel: use-after-free when polling signalfd or binder fds with aio poll due to POLLFREE not being handled. The PATCH by Ramji Jiyani fixes aio_poll_wake() handling POLLFREE and avoids deadlock by ensuring waitqueue freeing is RCU-delayed, aligning with eventpoll behav...

CVE-2022-49034

CVE-2022-49034 relates to a Linux kernel issue where, when CONFIG_CPUMASK_OFFSTACK and CONFIG_DEBUG_PER_CPU_MAPS are enabled, cpu_max_bits_warn() emits a runtime warning while reading /proc/cpuinfo due to iterating CPUs with NR_CPUS. The patch fixes the warning by iterating up to nr_cpu_ids (runt...

CVE-2022-49236

A use-after-free (UAF) vulnerability exists in the Linux kernel bpf component due to a race condition between btf_try_get_module and load_module. The issue arises because a module's BTF ID can be published to userspace and the BPF verifier while the module is still being initialized. If do_init_m...

CVE-2023-4385

CVE-2023-4385 : Linux kernel JFS NULL pointer dereference in dbFree (fs/jfs/jfs_dmap.c) may allow local privilege or system crash due to missing sanity check. Connected entries reference the same issue and point to a fixing commit in the kernel source (commit 0d4837fdb796f99369cf7691d33de1b856bca...