CVE-2024-49870

CVE-2024-49870 (Linux kernel, cachefiles) summary : The vulnerability arises in cachefiles when a dentry leak can occur if a lookup cookie and a cull run concurrently in cachefiles_open_file(). The leak happens because the code path may fail to release a reference to a dentry, potentially leaving...

CVE-2024-50130

Summary: CVE-2024-50130 affects the Linux kernel, specifically the netfilter/bpf path. The issue arises when a BPF link is attached to a net namespace without taking a proper reference to the net namespace, allowing a use-after-free scenario during netns teardown. The bug manifests as a KASAN sla...

CVE-2024-53155

CVE-2024-53155 relates to the Linux kernel OCFS2: a fix for an uninitialized value in ocfs2_file_read_iter() caused by a kiocb ‘private’ field possibly being uninitialized when passed from the block layer. The accompanying kernel log shows KMSAN reports and a stack trace ending in ocfs2_file_read...

CVE-2024-53185

CVE-2024-53185 : In the Linux kernel, the SMB client could dereference a NULL pointer in crypto_aead_setkey() when negotiating encryption over SMB2/SMB3, due to @server->cipher_type not being set for SMB3.02. The fix adds a check to smb3_crypto_aead_allocate() and ensures cipher_type is set fo...

CVE-2024-56572

CVE-2024-56572 : In the Linux kernel, the media: platform: allegro-dvt path fixes a memory-leak in allocate_buffers_internal(). The buffer allocated in the loop may leak if not released on the exception path; the fix ensures the buffer is freed when allegro_alloc_buffer fails. This addresses a lo...

CVE-2024-56643

CVE-2024-56643: In the Linux kernel, a memory leak in dccp_feat_change_recv can occur when dccp_feat_push_confirm() fails after a new SP feature value is accepted (entry == NULL branch). The memory allocated for the SP feature value via dccp_feat_clone_sp_val() may not be freed, potentially leadi...

CVE-2024-56754

CVE-2024-56754: Linux kernel vulnerability in crypto: caam where the pointer passed to caam_qi_shutdown() was derived from a devm_add_action_or_reset() parameter of type struct caam_drv_private *, but cast to struct device *. The connected Astra Linux advisory confirms the fix: Pass the correct p...

CVE-2024-56777

CVE-2024-56777 affects the Linux kernel DRM STI path. The vulnerability arises because the return value of drm_atomic_get_crtc_state() is not checked before dereferencing the potential error pointer crtc_state in sti_gdp_atomic_check, which can lead to an invalid memory access if the call fails. ...

CVE-2024-57906

In the Linux kernel, CVE-2024-57906 affects the iio: adc: ti-ads8688 path, where a local buffer used to push data to userspace from a triggered buffer was not initialized for inactive channels. The root cause is failing to zero-initialize the buffer, risking information leakage to userspace. The ...

CVE-2024-58017

CVE-2024-58017 affects the Linux kernel printk LOG_BUF_LEN_MAX. The issue arises when performing the 1 <

CVE-2025-21690

CVE-2025-21690 affects the Linux kernel storvsc SCSI driver where a persistent hypervisor error can cause an unbounded flood of I/O warning logs, leading to kernel log bloat and VM DoS. The issue is addressed by kernel updates across several distributions (e.g., Debian LTS DLA-4076-1:00E2C upgrad...

CVE-2025-21761

CVE-2025-21761 affects the Linux kernel/Open vSwitch area. The root cause is that ovs_vport_cmd_fill_info() could be invoked without RTNL or RCU, risking a use-after-free. The fix adds RCU protection and uses dev_net_rcu() to prevent UAF. This is a kernel-level issue with potential impact describ...

CVE-2025-21917

Summary of CVE-2025-21917 (Renesas USBHS issue) : In the Linux kernel, the USB Renesas USBHS driver (usb: renesas_usbhs) could crash when performing continuous unbind/bind operations on USB drivers for the Renesas RZ/G2L SoC. The root cause is related to the usbhsc_notify_hotplug() path and invol...

CVE-2025-22020

CVE-2025-22020 pertains to the Linux kernel memstick subsystem, fixing a slab-use-after-free in rtsx_usb_ms_drv_remove that could crash via rtsx_usb_ms_poll_card. Affected code path involves memstick host allocation during driver probe and removal, with a use-after-free arising from freeing drive...

CVE-2025-37796

CVE-2025-37796 affects the Linux kernel wifi driver for at76c50x. The root cause is a use-after-free in at76_disconnect: after freeing the priv object (via ieee80211_free_hw) the code accesses the freed object’s udev field to manage the USB device, which can also cause a memory leak. The issue is...

CVE-2017-16525

The CVE-2017-16525 entry affects the Linux kernel: usb_serial_console_disconnect in drivers/usb/serial/console.c allows local users to trigger a denial of service (use-after-free and system crash) via a crafted USB device, with impact on confidentiality/integrity/availability as per the advisory....

CVE-2021-47352

CVE-2021-47352 affects the Linux kernel’s virtio-net code. The issue arises from missing validation of the length reported by a device, which could lead to data corruption or loss. Affected context is confirmed by MiracleLinux/Nessus advisories that reference “virtio-net: Add validation for used ...

CVE-2021-47456

CVE-2021-47456 affects the Linux kernel, specifically the peak_pci driver. The issue is a use-after-free (UAF) that occurs when removing the peak_pci module and the code references 'chan' after releasing 'dev'. The patch fixes the UAF by delaying the release of 'dev'. Logs reference KASAN: use-af...

CVE-2022-47519

CVE-2022-47519 affects the Linux kernel prior to 6.0.11 due to missing validation of IEEE80211_P2P_ATTR_OPER_CHANNEL in the WILC1000 driver (drivers/net/wireless/microchip/wilc1000/cfg80211.c). This can trigger an out-of-bounds write when parsing the channel list attribute from Wi‑Fi management f...

CVE-2022-4842

CVE-2022-4842 concerns a NULL dereference in the Linux kernel NTFS3 driver’s attr_punch_hole() function. The flaw is described as a NULL pointer dereference that can be triggered locally by a user, leading to a system crash. The vulnerability is discussed in multiple sources (e.g., Astra Linux se...

CVE-2022-49401

CVE-2022-49401 pertains to the Linux kernel, where a fault in mm/page_owner handling was fixed: current->comm[] is not guaranteed to be a proper string, and using strlcpy(s1, s2, l) may call strlen(s2) and trigger out-of-bounds access. The fix replaces strlcpy with strscpy() in mm/page_owner.c...

CVE-2022-49631

CVE-2022-49631 is a Linux kernel data-race vulnerability in the reader of sysctl_raw_l3mdev_accept. While reading this sysctl, its value could be changed concurrently, prompting a fix that adds a READ_ONCE() to the reader. The issue is a kernel-level race that can affect availability. The connect...

CVE-2022-49708

CVE-2022-49708 affects the Linux kernel ext4 file system (mballoc allocator). The issue is triggered by a BUG_ON path in ext4_mb_use_inode_pa during disk space accounting, leading to a kernel crash when fsync/writeback paths exercise preallocation and inode pa blocks. Reproduction steps involve c...

CVE-2024-0639

CVE-2024-0639 is a denial-of-service vulnerability in Linux kernel SCTP: a deadlock in sctp_auto_asconf_init (net/sctp/socket.c) can be triggered by guests with local privileges, potentially crashing the system. Some connected advisories (Unity Linux UTSA-2026-001762 and Red Hat/SUSE notes) indic...

CVE-2024-26662

The CVE CVE-2024-26662 affects the Linux kernel DRM/AMD display path. A null pointer dereference could occur in dcn21_set_backlight_level() when panel_cntl is NULL, potentially crashing the GPU/display path. The fix introduces a null-check for panel_cntl before dereferencing and updates dcn21_hws...

CVE-2024-36477

CVE-2024-36477 refers to a Linux kernel vulnerability where the TPM SPI transfer did not account for the 4-byte header prepended to the SPI data frame, potentially causing out-of-bounds accesses. The root cause was the use of MAX_SPI_FRAMESIZE to compute the maximum transfer length and buffer siz...

CVE-2024-40956

CVE-2024-40956 affects the Linux kernel (dmaengine: idxd). The vulnerability is a use-after-free in irq_process_work_list, caused by reusing a descriptor while it may still be referenced. The fix uses list_for_each_entry_safe() to safely iterate and delete entries during the loop; freeing the des...

CVE-2024-40973

CVE-2024-40973 affects the Linux kernel media/mtk-vcodec SCP path. The root cause is a missing check of the return value from devm_kzalloc(), leading to a potential NULL pointer dereference. The issue is described across multiple sources (e.g., Astra Linux reports in linux-5.15/6.1; Debian adviso...

CVE-2024-43870

CVE-2024-43870 : In the Linux kernel perf subsystem, a window exists during task_exit where pending sigtrap deliveries may be queued but not added to the event’s task_work due to a failure when adding the event’s callback to task_work. This creates a small window in which the event refcount can b...

CVE-2024-46761

CVE-2024-46761 affects the Linux kernel’s PCI hotplug driver for PowerPC (pci/hotplug/pnv_php.c). The issue caused a kernel crash during hot-unplug/disable of a PCIe switch/bridge from the PHB, due to a NULL dereference when the MSI data structure had already been released and set to NULL, yet un...

CVE-2024-46795

CVE-2024-46795 affects the Linux kernel when using ksmbd over a reused connection with binding sessions. A null pointer dereference can occur in the SMB 3.1 encryption key path: a reused binding session may leave Preauth_HashValue NULL, which is used as input to crypto_shash_update() during key g...

CVE-2024-47723

CVE-2024-47723 affects the Linux kernel’s JFS subsystem, causing an out-of-bounds access in functions that manage the AG bitmap. The issue arises in dbNextAG() when bmp->db_numag can be greater or equal to MAXAG due to a polluted image, and in diAlloc() when agno may be greater or equal to MAX...

CVE-2024-47754

CVE-2024-47754 affects the Linux kernel media/mediatek vcodec H264 multi stateless decoder. The issue arises from a smatch static checker warning in vdec_h264_req_multi_if.c, which can trigger a kernel crash when fb is NULL. The connected documents confirm fixes in the kernel (repairs to the smat...

CVE-2024-49886

CVE-2024-49886 concerns the Linux kernel: platform/x86 ISST code fixes a KASAN slab-out-of-bounds bug in _isst_if_get_pci_dev. The issue manifested when attaching an SST PCI device to a VM, triggering a KASAN slab-out-of-bounds read (size 8) in isst_if_common, ultimately related to a 512-byte kma...

CVE-2024-49924

CVE-2024-49924 affects the Linux kernel fbdev pxafb path. The vulnerability is a use-after-free caused by scheduling work (pxafb_task) in pxafb_init_fbinfo/pxafb_probe and freeing fbi->fb during pxafb_remove/unregister_framebuffer without canceling that work. The follow sequence shows the UAF ...

CVE-2024-50077

CVE-2024-50077 — Linux kernel Bluetooth ISO init issue (net/bluetooth/iso.c) : The vulnerability arises when debugfs is disabled (bt_debugfs creation failure) causing iso_init() to return early and not set iso_inited, enabling subsequent calls to trigger duplicate registrations (proto_register(),...

CVE-2024-50180

Technical details about CVE-2024-50180 are not publicly provided in the connected documents. Please monitor official updates and vendor advisories for the affected Linux kernel components and remediation guidance.

CVE-2024-50194

The CVE-2024-50194 issue affects the Linux kernel arm64 uprobes on big-endian kernels, where in-memory instruction encoding (little-endian) was not converted to the kernel nativ e endianness before analysis and simulation. Consequences could include rejecting probeable instructions, unsafe out-of...

CVE-2024-53079

CVE-2024-53079 affects the Linux kernel’s memory management (mm/thp) with a fix for the deferred split unqueue naming and locking. The description details races in THP deferred split queues under load, causing list_del corruptions and “Bad page state” issues, linked to changes around 6.8 (mTHP), ...

CVE-2024-53101

CVE-2024-53101 concerns the Linux kernel: a fix for an uninitialized value in from_kuid/from_kgid was applied. The issue arose when ocfs2_setattr() referenced attr->ia_mode, ia_uid, and ia_gid in a trace point even if ATTR_MODE/ATTR_UID/ATTR_GID weren’t set. The patch initializes all fields of...

CVE-2024-53129

CVE-2024-53129 affects the Linux kernel DRM Rockchip VOP as described. The root cause was a NULL-dereference in vop_plane_atomic_async_check() where 'state' could be dereferenced before a NULL check; patch fixes crtc_state validation (rockchip_drm_vop.c:1096). Connected advisories confirm the iss...

CVE-2024-53171

CVE-2024-53171 affects the Linux kernel ubifs authentication path. The published details describe a use-after-free in ubifs_tnc_end_commit arising when a node’s znode->parent changes due to a tree split, while the node’s znode->cparent may still point to freed memory after deletions. The is...

CVE-2024-56627

The CVE-2024-56627 issue affects the Linux kernel ksmbd component, specifically ksmbd_vfs_stream_read. A client-supplied negative offset could trigger an out-of-bounds read from the stream_buf when the ksmbd.conf setting vfs objects = streams_xattr is used. The vulnerability originates in the ker...

CVE-2024-56723

CVE-2024-56723 affects the Linux kernel driver for mfd/intel_soc_pmic_bxtwc. The vulnerability stems from not respecting IRQ domains when creating each MFD device, which can lead to incorrect IRQ handling and a WARN() on IRQ 0 (vIRQ) via platform_get_irq(). The Astra Linux security bulletin mirro...

CVE-2024-58087

CVE-2024-58087 affects ksmbd in the Linux kernel and was resolved by incrementing the session reference count within the lookup lock to prevent a race with session expire. The vulnerability pertains to a racy session lookup/expire scenario in ksmbd, with impact described as high for confidentiali...

CVE-2025-21823

CVE-2025-21823 is about batman-adv in the Linux kernel where the unmanaged ELP metric worker was dropped. The issue arose because the ELP worker, which recalculates metrics for neighbors reachable over an interface, used locks that could sleep, conflicting with the RCU list iterator and risking i...

CVE-2025-21864

CVE-2025-21864 affects the Linux kernel TCP path. The issue arises when netns are deleted and an skb defers free, leaving a lingering reference to an xfrm_state via the secpath attached to the skb. The kernel previously dropped dst but not the secpath; the fix drops the secpath in the TCP receive...

CVE-2025-22079

The CVE-2025-22079 issue affects the Linux kernel OCFS2 path handling. A 16-bit l_tree_depth could exceed OCFS2_MAX_PATH_DEPTH, risking out-of-bounds access (noted when reading from a corrupted mounted disk). A fix was implemented to validate l_tree_depth and guard against invalid values, prevent...

CVE-2016-6213

CVE-2016-6213 affects the Linux kernel (fs/namespace.c): an unrestricted limit on the number of mounts in a mount namespace allows a local attacker to cause memory exhaustion and potential deadlock via MS_BIND mount calls. The vulnerability is present in kernels before 4.9 and has been referenced...

CVE-2018-16885

The CVE-2018-16885 issue is a Linux kernel vulnerability (affecting kernel 3.10.x as shipped with Red Hat Enterprise Linux 7) where userspace can call memcpy_fromiovecend() and similar functions with a zero offset and buffer length, causing a read beyond the buffer boundaries. This can lead to a ...