CVE-2024-56774

CVE-2024-56774: Linux kernel vulnerability in btrfs_search_slot() where a NULL extent-tree root could cause a null-pointer dereference during scrub when the root is NULL. The issue is fixed by adding a sanity check for the btrfs root before usage. Affected component: btrfs within the Linux kernel...

CVE-2025-21731

Root-cause: Linux kernel NBD subsystem UAF when reconnecting after a disconnect. Exploitation path involves grabbing nbd_config, disconnecting, reconfiguring, and a final workqueue-triggered use-after-free of nbd_config. A fix is implemented by clearing NBD_RT_BOUND in nbd_genl_disconnect(), caus...

CVE-2025-21948

CVE-2025-21948 is a Linux kernel issue affecting HID appleir. The report describes a NULL pointer dereference in input_event() triggered by malformed AppleIR reports, leading to a crash if a NULL input_dev is encountered. The fix adds a guard: check the HID_CLAIMED_INPUT flag and exit the event h...

CVE-2025-22002

CVE-2025-22002 concerns the Linux kernel netfs code path: if a filesystem does not implement invalidate_cache, a write-to-cache failure can trigger a NULL pointer dereference in netfs_write_collection_worker, leading to a kernel crash. The provided documents confirm the root cause as a missing NU...

CVE-2025-23146

The CVE-2025-23146 issue affects the Linux kernel mfd: ene-kb3930 driver, where a NULL pointer dereference could occur because off_gpios may be NULL. The kb3930_probe() lacked a NULL check, fixed in the resolved update (similar to backlight: hx8357 NULL pointer fix). Impact is local, with potenti...

CVE-2026-53366

CVE-2026-53366 affects the Linux kernel IPv4 path. In __ip_append_data(), the paged-allocation branch miscomputed alloclen/pagedlen due to fraggap carried from the previous skb, causing the linear area to be undersized. The patch corrects this by adding the fraggap to alloclen and subtracting it ...

CVE-2010-3858

CVE-2010-3858 is a Linux kernel vulnerability described in MiracleLinux advisories as affecting fs/exec.c with CONFIG_STACK_GROWSDOWN. On 64-bit platforms, for 32-bit applications, the setup_arg_pages function does not properly constrain stack usage of arguments and environment, enabling local us...

CVE-2016-4482

CVE-2016-4482 : The Linux kernel before 4.7 has a flaw in the proc_connectinfo handling. The proc_connectinfo function in drivers/usb/core/devio.c does not initialize a data structure, enabling local users to read sensitive data from kernel stack memory via a crafted USBDEVFS_CONNECTINFO ioctl. T...

CVE-2021-47018

CVE-2021-47018 – Mode C (details available) Affected software: Linux kernel on PPC64 (powerpc/64). Issue: PPC64 fixmap area was defined at the top of the address space or just below KASAN, which is not valid for PPC64. The fix implements using the top of the I/O space for the fixmap area, with a ...

CVE-2021-47505

CVE-2021-47505 in the Linux kernel: use-after-free when polling signalfd or binder fds with aio poll due to POLLFREE not being handled. The PATCH by Ramji Jiyani fixes aio_poll_wake() handling POLLFREE and avoids deadlock by ensuring waitqueue freeing is RCU-delayed, aligning with eventpoll behav...

CVE-2022-44034

The CVE-2022-44034 issue affects the Linux kernel (through 6.0.6) in the PCMCIA driver path, specifically drivers/char/pcmcia/scr24x_cs.c, where a race between scr24x_open() and scr24x_remove() can cause a use-after-free if a physically proximate attacker removes a PCMCIA device while open() is i...

CVE-2022-49207

CVE-2022-49207 is a Linux kernel vulnerability in the bpf/sockmap path (sk_psock_queue_msg memleak). The issue occurs when tcp_bpf_sendmsg runs during tear down, causing memory charged by sk_mem_charge to remain outstanding as messages are queued, potentially leading to memory leaks. The provided...

CVE-2022-49236

CVE-2022-49236 concerns a Linux kernel use-after-free in BPF/BTF handling: a race between module init and module reuse could allow BTF IDs to be published before a module is fully live. The fix, as described in the related documentation, is to set a BTF_MODULE_F_LIVE flag at MODULE_STATE_LIVE so ...

CVE-2022-49520

CVE-2022-49520 (Linux kernel, arm64 compat): The vulnerability occurs when a compat process executes an unknown syscall above __ARM_NR_COMPAT_END; the kernel incorrectly uses the syscall number as ESR_ELx for the fault, causing arm64_show_signal() to print bogus ESR messages. The fix is to stop u...

CVE-2022-49708

CVE-2022-49708 affects the Linux kernel ext4 file system (mballoc allocator). The issue is triggered by a BUG_ON path in ext4_mb_use_inode_pa during disk space accounting, leading to a kernel crash when fsync/writeback paths exercise preallocation and inode pa blocks. Reproduction steps involve c...

CVE-2022-49726

CVE-2022-49726 concerns the Linux kernel clocksource for Hyper-V. The issue arises from exporting an __init-annotated hv_init_clocksource() symbol, while the __init code may be freed after initialization, making the symbol potentially invalid for modules. The vulnerability can lead to a kernel pa...

CVE-2023-52690

CVE-2023-52690 is a Linux kernel vulnerability affecting powerpc/powernv where kasprintf() can return NULL on allocation failure and a null pointer check was missing in scom_debug_init_one(). The fix adds a null pointer check and ensures proper release of ent to avoid memory leaks. Connected advi...

CVE-2023-52806

CVE-2023-52806 concerns the Linux kernel ALSA hda subsystem. The description in the initial document notes a possible NULL pointer dereference when an AudioDSP stream is assigned, specifically when a COUPLED stream is inadvertently accepted despite drivers using HOST or LINK types. The connected ...

CVE-2024-26662

The CVE CVE-2024-26662 affects the Linux kernel DRM/AMD display path. A null pointer dereference could occur in dcn21_set_backlight_level() when panel_cntl is NULL, potentially crashing the GPU/display path. The fix introduces a null-check for panel_cntl before dereferencing and updates dcn21_hws...

CVE-2024-35794

The CVE-2024-35794 entry concerns the Linux kernel issue where dm-raid could have the sync_thread not frozen during suspend. Root cause: a sequence of commits around md_stop_writes and MD_RECOVERY_FROZEN, where the flag does not by itself freeze the running sync_thread and stop_sync_thread() must...

CVE-2024-35824

No public technical details are provided in the connected documents for CVE-2024-35824; monitor for updates.

CVE-2024-36477

CVE-2024-36477 refers to a Linux kernel vulnerability where the TPM SPI transfer did not account for the 4-byte header prepended to the SPI data frame, potentially causing out-of-bounds accesses. The root cause was the use of MAX_SPI_FRAMESIZE to compute the maximum transfer length and buffer siz...

CVE-2024-42104

CVE-2024-42104 affects the Linux kernel’s nilfs2 filesystem. A missing check for inode numbers on directory entries allows internal inodes (metadata files) to be exposed in the namespace, potentially causing a use-after-free of metadata file inodes and kernel bugs in lru_add_fn() when mounting/un...

CVE-2024-42232

Based on the connected advisories, CVE-2024-42232 is a race condition in the Linux kernel’s libceph code (ceph_monc_stop) where delayed_work() handling can race with mon_fault() and finish_hunting(), potentially leading to use-after-free scenarios on monc and related objects. The documented fix r...

CVE-2024-43884

CVE-2024-43884 : In the Linux kernel, the Bluetooth MGMT path could dereference NULL in hci_conn_params_add() when pairing a device, due to a missing NULL check. This could crash the host. The fixed patch adds error handling in pair_device() to validate the NULL value before dereferencing. Connec...

CVE-2024-46759

CVE-2024-46759 : Linux kernel hwmon: adc128d818 underflow when writing limit attributes. The issue stemmed from DIV_ROUND_CLOSEST() after kstrtol() allowing large negative values (e.g., -9223372036854775808) to underflow. The patch reorders clamp_val() and DIV_ROUND_CLOSEST() to fix the underflow...

CVE-2024-46835

CVE-2024-46835 affects the Linux kernel DRM/AMDGPU component. The root cause is a NULL dereference risk in adev->gfx.imu.funcs triggered by a smatch static checker warning, fixed in the kernel code as part of “drm/amdgpu: Fix smatch static checker warning” mitigation. Impact per the provided m...

CVE-2024-49939

The CVE-2024-49939 entry concerns the Linux kernel wifi driver rtw89 (rtw89_wow_resume and ieee80211_reconfig flow). When SER L2 occurs during WoWLAN resume, the add-interface path can run twice due to a failed rtw89_wow_resume(), leading to a second list_add and a kernel panic. The available sou...

CVE-2024-50070

Technical details for CVE-2024-50070 are not provided in the connected documents. Monitor for updates from the kernel advisories and OSV/USN entries to obtain affected products, affected versions, impact, and fixes.

CVE-2024-50194

The CVE-2024-50194 issue affects the Linux kernel arm64 uprobes on big-endian kernels, where in-memory instruction encoding (little-endian) was not converted to the kernel nativ e endianness before analysis and simulation. Consequences could include rejecting probeable instructions, unsafe out-of...

CVE-2024-53070

CVE-2024-53070 affects the Linux kernel USB subsystem (dwc3). The issue occurs when a device is already runtime suspended and the system suspends, leading to a crash if device registers are accessed. The fix reorders suspend sequence by moving the dwc3_enable_susphy() call to the top of the suspe...

CVE-2024-53112

CVE-2024-53112 affects the Linux kernel via the OCFS2 group add path. The issue occurs when ioctl(OCFS2_IOC_GROUP_ADD, …) fails for an inode; the corresponding buffer head remains cached and a subsequent ioctl triggers a BUG in ocfs2_set_new_buffer_uptodate() while caching the same buffer head. T...

CVE-2024-56572

CVE-2024-56572 : In the Linux kernel, the media: platform: allegro-dvt path fixes a memory-leak in allocate_buffers_internal(). The buffer allocated in the loop may leak if not released on the exception path; the fix ensures the buffer is freed when allegro_alloc_buffer fails. This addresses a lo...

CVE-2024-56640

Summary : CVE-2024-56640 affects the Linux kernel net/smc subsystem, related to a use-after-free caused by incorrect refcount handling of LGR/link. The issue can occur when refcnt reaches 0 and triggers premature clearing, or underflow after repeated releases, as observed in two call paths (LGR t...

CVE-2024-56723

CVE-2024-56723 affects the Linux kernel driver for mfd/intel_soc_pmic_bxtwc. The vulnerability stems from not respecting IRQ domains when creating each MFD device, which can lead to incorrect IRQ handling and a WARN() on IRQ 0 (vIRQ) via platform_get_irq(). The Astra Linux security bulletin mirro...

CVE-2024-57887

CVE-2024-57887 : In the Linux kernel DRM path for adv7511/adv7533, a use-after-free occurs when a host_node pointer freed in adv7533_parse_dt() is later used by adv7533_attach_dsi(). The issue arises because of deallocating the node too early and reusing the same reference. The fix, as described ...

CVE-2025-21690

CVE-2025-21690 affects the Linux kernel storvsc SCSI driver where a persistent hypervisor error can cause an unbounded flood of I/O warning logs, leading to kernel log bloat and VM DoS. The issue is addressed by kernel updates across several distributions (e.g., Debian LTS DLA-4076-1:00E2C upgrad...

CVE-2025-21806

CVE-2025-21806 : Linux kernel vulnerability in net.core.dev_weight where setting dev_weight to 0 can cause NAPI backlog processing to misbehave and napi to be re-polled repeatedly, potentially triggering a stall until softirq timeout. Reproducing issue: sysctl -w net.core.dev_weight=0 followed by...

CVE-2025-21863

CVE-2025-21863 — Linux kernel io_uring opcode speculation : The vulnerability arises from the io_uring path where sqe->opcode is used for different tables, allowing speculative execution issues. The fix sanitises sqe->opcode to prevent speculation. Affected product: Linux kernel with io_uri...

CVE-2025-22036

CVE-2025-22036: In the Linux kernel exfat code, get_block can corrupt a stack when a buffer_head is allocated on the stack during racing reads (e.g., do_mpage_readpage). The fix ensures -EAGAIN is returned if a folio has no buffers when bh_read is invoked, so the caller can fallback to block_read...

CVE-2025-37925

The CVE-2025-37925 entry concerns a Linux kernel vulnerability in the JFS filesystem. When finalizing an on-disk inode, clear_inode() could encounter an unknown type and trigger a kernel BUG; the root cause is an invalid handling path for on-disk inode types, where types 5–15 are reserved. The fi...

CVE-1999-0513

CVE-1999-0513 describes a vulnerability where ICMP messages to broadcast addresses are allowed, enabling a Smurf attack that can cause a denial of service. The primary sources (NVD, Red Hat, and CVE listings) consistently state that the issue involves ICMP traffic to broadcast addresses, resultin...

CVE-2015-0569

CVE-2015-0569 is a heap-based buffer overflow in the WLAN private wireless extensions IOCTL path (wlan_hdd_wext.c) of the Linux kernel 3.x–4.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices. The vulnerability allows a local attacker to escalate privileges via ...

CVE-2016-6136

CVE-2016-6136 is a Linux kernel race condition in audit_log_single_execve_arg (auditsc.c) that can allow a local user to bypass character-set restrictions or disrupt system-call auditing via a double-fetch flaw. Connected advisories confirm multiple vendors map this CVE to Linux kernel fixes; rem...

CVE-2018-10901

CVE-2018-10901 affects the Linux kernel’s KVM virtualization subsystem. The VMX path fails to restore the guest GDT.LIMIT to the host value, setting it to 64KB instead. This can allow a host userspace process to corrupt GDT entries (notably per-cpu variables), enabling local privilege escalation....

CVE-2022-2991

CVE-2022-2991 (Linux kernel LightNVM) Affected software: Linux kernel, LightNVM subsystem. Vulnerability: heap-based buffer overflow caused by insufficient validation of the length of user-supplied data before copying to a fixed-size heap buffer. Impact: local privilege escalation and arbitrary c...

CVE-2022-48866

CVE-2022-48866: In the Linux kernel HID thrustmaster driver, a slab-out-of-bounds read occurred in thrustmaster_probe() due to missing validation of actual endpoints in usb_host_interface::endpoint. The fix adds a validation check comparing the actual number of endpoints to the expected number an...

CVE-2022-49639

CVE-2022-49639 refers to a Linux kernel issue in the cipso subsystem where sysctl read operations could race with concurrent writes. The root cause is missing synchronization while reading cipso sysctl variables, and the fix is to add READ_ONCE() to prevent data races. Public documents in the con...

CVE-2022-49642

CVE-2022-49642 concerns the Linux kernel: the Synopsys DWC Ethernet driver (net: stmmac: dwc-qos) on Tegra194 can crash the system when the split header feature is enabled, due to an unexpected buffer length that can overflow the total buffer length calculation. NVIDIA feedback indicates split he...

CVE-2023-22995

CVE-2023-22995 affects the Linux kernel’s DesignWare USB3 for Qualcomm SoCs driver (dwc3_qcom_acpi_register_core). The connected ENISA/OSV advisory notes an error-path handling defect where platform_device_put and kfree calls are omitted, leaving cleanup incomplete during device registration. Thi...