CVE-2022-49321

The CVE-2022-49321 entry is supported by concrete details in connected documents. Affected software: the Linux kernel with the rpcrdma/xprtrdma components. The root cause is described as: when a RDMA server returns a fault format reply and bc_serv is NULL, calls are not treated as a bcall, leadin...

CVE-2022-49632

CVE-2022-49632 is a Linux kernel data-race vulnerability in icmp: reading sysctl_icmp_errors_use_inbound_ifaddr can race with concurrent writes. The fix adds READ_ONCE() to the reader. CVSSv3.1 indicates a Local access requirement, High attack complexity, Low privileges, no user interaction, with...

CVE-2023-52624

CVE-2023-52624 concerns the Linux kernel’s drm/amd/display path where the DMCUB must be awake before issuing GPINT commands. The root cause is that GPINT mailbox access could occur while DMCUB is idle, risking a system hang. The documented fix adds a wake/execute/sleep wrapper via the function dc...

CVE-2023-52625

The CVE-2023-52625 entry concerns the Linux kernel’s drm/amd/display path (DMCUB enter/exit idle). The root cause is a SW/state mismatch when exiting idle before issuing commands to DMCUB, where the exit/notify idle operation can itself issue a command. The provided fix strategy is to track a sof...

CVE-2023-52889

CVE-2023-52889 affects the Linux kernel, via apparmor: Fix null pointer deref when receiving skb during sock creation. The issue occurs when ICMP packets with secmark are received while an ICMP raw socket is being created; SK_CTX(sk)->label may not be set yet, causing a NULL pointer dereferenc...

CVE-2024-26766

CVE-2024-26766 affects the Linux kernel’s IB/hfi1 path. The root cause is an off-by-one error in the sdma.h tx descriptor handling that, when a send consists of six descriptors and requires a seventh-dword padding, prevents proper expansion of the sdma_txreq descriptor array. This overflow can co...

CVE-2024-26786

CVE-2024-26786 : Linux kernel iommufd flaw where iopt_access_list_id could be overwritten in iopt_add_access(), causing a mismatch between the access pointer and its list during iommufd_access_change_ioas() path. Syzkaller reported a WARN_ON related to this, and the fix adds a new_id and updates ...

CVE-2024-36477

CVE-2024-36477 refers to a Linux kernel vulnerability where the TPM SPI transfer did not account for the 4-byte header prepended to the SPI data frame, potentially causing out-of-bounds accesses. The root cause was the use of MAX_SPI_FRAMESIZE to compute the maximum transfer length and buffer siz...

CVE-2024-36967

CVE-2024-36967 - Normal details available The Astra Linux bulletin and IBM/Kern sources confirm a Linux kernel vulnerability CVE-2024-36967 related to a memory leak in KEYS trusted: tpm2_key_encode() where the 'scratch' buffer was not freed. The bug is resolved by freeing scratch on both success ...

CVE-2024-38553

CVE-2024-38553 affects the Linux kernel net/fec driver by removing the .ndo_poll_controller implementation to avoid deadlocks. The root cause is that netpoll runs in an atomic context and disable_irq() (which may sleep) is invoked via the .ndo_poll_controller interface in sungem; fec_poll_control...

CVE-2024-41094

The CVE-2024-41094 issue affects the Linux kernel DRM fbdev-dma path. The root cause is unsafe handling of memory for the framebuffer when smem_start is exported via module options, which can break on systems where DMA memory is backed by vmalloc and may trigger non-linear virt_to_phys address ch...

CVE-2024-42114

CVE-2024-42114 : Linux kernel vulnerability in wifi cfg80211 code where NL80211_ATTR_TXQ_QUANTUM values were not properly validated, enabling a local attacker to trigger soft lockups/DoS by setting TXQ_QUANTUM to 2^31. The issue is tied to lack of proper range checks in nl80211.c and parallels a ...

CVE-2024-43821

Technical details beyond the description of CVE-2024-43821 are not provided in the supplied documents; no explicit affected products/versions/fixes are listed here. Monitor vendor advisories for updates.

CVE-2024-43846

CVE-2024-43846 (Linux kernel, lib/objagg): The issue is due to nesting of objects during aggregation based on hints, where a parent object could be nested under another, bypassing a required check. The vulnerability leads to a general protection fault when nesting occurs in the hints-based aggreg...

CVE-2024-46807

CVE-2024-46807 affects the Linux kernel’s DRM/amdgpu path. The root cause is missing validation of the tbo resource pointer, which could dereference a NULL pointer. The mitigation is a patch that validates the tbo resource pointer and skips when NULL, preventing a NULL-deref that could crash the ...

CVE-2024-47689

CVE-2024-47689 affects the Linux kernel (F2FS). The vulnerability stems from f2fs_handle_critical_error() setting SB_RDONLY instead of using the filesystem’s unmount/remount protection, causing a race with freeze/thaw. Root cause: f2fs sets SB_RDONLY in an internal path; remediation proposed/impl...

CVE-2024-47703

CVE-2024-47703 — Linux kernel (bpf, lsm): The vulnerability stems from a BPF LSM return value not being checked, which could cause a kernel panic when a BPF prog attached to file_alloc_security returns a positive value that is misinterpreted as a file pointer. The issue was addressed by adding a ...

CVE-2024-49944

CVE-2024-49944: In the Linux kernel SCTP path, sctp_listen_start() did not reset sk_state when sctp_autobind() failed, so after a failed autobind, a subsequent sctp_inet_listen() could observe sctp_sk(sk)->reuse with sk_state LISTENING and dereference bind_hash (NULL), causing a NULL dereferen...

CVE-2024-50013

CVE-2024-50013 in the Linux kernel fixes a memory leak in the exfat driver. If the first directory entry in the root is not a bitmap directory entry, the buffer head ('bh') may not be released and reassigned, causing a memory leak in exfat_load_bitmap(). The patch fixes the leak by ensuring prope...

CVE-2024-50078

CVE-2024-50078 affects the Linux kernel Bluetooth ISO path. If iso_init() has been called, iso_exit() must be invoked on module unload; failing to do so makes the proto registered with proto_register() invalid, which can lead to list corruption and a kernel BUG (example: list_add corruption and a...

CVE-2024-53079

CVE-2024-53079 affects the Linux kernel THP path (mm/thp): a fix for deferred split unqueue naming and locking aims to address races that could corrupt the THP deferred split queues and related memcg interactions. Under heavy load, long-standing races could lead to list_del corruptions, bad_page ...

CVE-2024-57906

In the Linux kernel, CVE-2024-57906 affects the iio: adc: ti-ads8688 path, where a local buffer used to push data to userspace from a triggered buffer was not initialized for inactive channels. The root cause is failing to zero-initialize the buffer, risking information leakage to userspace. The ...

CVE-2024-57973

CVE-2024-57973 is a Linux kernel vulnerability in rdma/cxgb4 where 32‑bit systems could overflow when calculating gl->tot_len for a CPL pass/RS S header due to arithmetic of gl->tot_len + sizeof(struct cpl_pass_accept_req) + sizeof(struct rss_header). The issue is triggered by user-controll...

CVE-2025-21963

CVE-2025-21963 (Linux kernel, CIFS) : The issue is a local integer overflow in the acdirmax mount option handling. User-supplied acdirmax (u32) is meant to have an upper bound, but the value is converted from seconds to jiffies before validation, enabling an integer overflow. The CVE entry notes ...

CVE-2025-23150

CVE-2025-23150 : In the Linux kernel, an off-by-one error in ext4’s do_split caused a use-after-free in ext4_insert_dentry from an out-of-bounds access during directory entry splitting. The issue can lead to a use-after-free in ext4_insert_dentry and related ext4/namei.c code paths when handling ...

CVE-2025-39755

CVE-2025-39755 affects the Linux kernel (staging: gpib) where the pcmcia_driver struct used the old .name initialization in the drv field, causing a NULL pointer dereference in strcmp during pcmcia_register_driver. The fix is to initialize the pcmcia_driver struct name field. Impact is a local at...

CVE-2014-3690

CVE-2014-3690 affects arch/x86/kvm/vmx.c in the Linux kernel’s KVM subsystem on Intel, where the CR4 control register value may not be preserved across VM entries. The vendor-provided details in connected Nessus advisories describe a local attacker with access to /dev/kvm who can kill arbitrary p...

CVE-2014-7842

The CVE-2014-7842 issue affects the Linux kernel’s arch/x86/kvm/x86.c; a race condition prior to 3.17.4 can allow a guest OS user to trigger an MMIO/PIO‑driven emulation error report, causing a guest crash (denial of service). Public notes in Nessus advisories reference CVE-2010-5313 as related. ...

CVE-2015-7513

The CVE-2015-7513 vulnerability affects arch/x86/kvm/x86.c in the Linux kernel prior to 4.4, where PIT counter values are not reset during guest state restoration. This can allow guest OS users to trigger a denial-of-service (divide-by-zero) and host crash via a zero PIT value, related to kvm_vm_...

CVE-2015-7566

CVE-2015-7566 affects the Linux kernel driver drivers/usb/serial/visor.c (clie_5_attach). A USB device without a bulk-out endpoint can cause a NULL pointer dereference, leading to a denial of service and potential system crash. The vulnerability is confirmed by Nessus advisories referencing the v...

CVE-2017-16645

CVE-2017-16645 affects the Linux kernel’s ims_pcu_get_cdc_union_desc in drivers/input/misc/ims-pcu.c. According to the provided sources, the vulnerability exists in kernels up to 4.13.11 and can be triggered by a crafted USB device, allowing a local user with LOW privileges and physical access to...

CVE-2019-19814

CVE-2019-19814 affects Linux kernel 5.0.21 when mounting a crafted f2fs filesystem image. The bug is in the __remove_dirty_segment slab code: an array is bounded by 8 dirty types, but an index can exceed this bound, causing a slab-out-of-bounds write and potential memory corruption. The provided ...

CVE-2021-47073

CVE-2021-47073 concerns a Linux kernel issue in platform/x86 dell-smbios-wmi where unregistering the driver occurred unconditionally, causing a kernel oops at module removal. The fix ensures unregister happens only under the same condition as registration (Dell WMI support). Affects the Dell WMI ...

CVE-2021-47579

Mode C: CVE-2021-47579 affects the Linux kernel overlayfs component (ovl) with a WARN_ON path in ovl_workdir_create() when mkdir returns a dentry without an inode (not instantiated). The fix, described in the connected advisories, calls ovl_mkdir_real() directly from ovl_workdir_create() and reje...

CVE-2022-44034

The CVE-2022-44034 issue affects the Linux kernel (through 6.0.6) in the PCMCIA driver path, specifically drivers/char/pcmcia/scr24x_cs.c, where a race between scr24x_open() and scr24x_remove() can cause a use-after-free if a physically proximate attacker removes a PCMCIA device while open() is i...

CVE-2022-48929

CVE-2022-48929 : In the Linux kernel, a crash was fixed in the BPF path. The issue arose when kfunc support expanded reg2btf_ids to map verifier register types to BTF IDs, but a relocation of __BPF_REG_TYPE_MAX and subsequent type-flag composition could cause direct reg->type indexing to fall ...

CVE-2022-49264

CVE-2022-49264 is a Linux kernel issue where execve(2) argv handling could lead to an elevation of privilege. The fix injects a single empty string into argv when argc == 0 and updates argc accordingly, preventing argv from being empty or NULL. The description indicates this is a local privilege-...

CVE-2022-49345

The CVE-2022-49345 issue affects the Linux kernel’s net: xfrm subsystem, where __init-annotated xfrm4_protocol_init() is exported via EXPORT_SYMBOL, causing use-after-free risk when __init and EXPORT_SYMBOL co-exist. The root cause is the .init text is freed after init, so modules could access fr...

CVE-2022-49442

CVE-2022-49442 pertains to the Linux kernel: the compaction sysfs file created by compaction_register_node in drivers/base/node.c was not removed in unregister_node, allowing a leaked sysfs file. The issue is fixed by applying compaction_unregister_node. According to the provided documents, the v...

CVE-2022-49519

The CVE-2022-49519 issue concerns the Linux kernel wireless driver ath10k. A double invocation of ath10k_halt during a suspend sequence could occur when FW recovery triggered by ath10k_core_restart() interleaves with suspend, freezing the restart worker and causing ath10k_htt_rx_free() to be free...

CVE-2022-49587

The CVE-2022-49587 entry concerns a data-race in the Linux kernel related to reading sysctl_tcp_notsent_lowat, which could be modified concurrently. The fix is to add READ_ONCE() to the reader, addressing a sysctl data-race in the tcp stack. The vulnerability is rated with CVSS v3.1 metrics indic...

CVE-2022-49603

CVE-2022-49603 concerns the Linux kernel where data races around sysctl_ip_fwd_update_priority could occur while readers access it concurrently. The fix adds READ_ONCE() to readers to prevent concurrent modification. Connected advisories (EulerOS/OpenVAS/Nessus) explicitly reference this vulnerab...

CVE-2022-49631

CVE-2022-49631 is a Linux kernel data-race vulnerability in the reader of sysctl_raw_l3mdev_accept. While reading this sysctl, its value could be changed concurrently, prompting a fix that adds a READ_ONCE() to the reader. The issue is a kernel-level race that can affect availability. The connect...

CVE-2024-26634

CVE-2024-26634 — Normal mode Affected: Linux kernel net subsystem involving network namespace handling. Summary: A BUG triggered when removing a net namespace with conflicting interface altnames could cause the main interface name to be overwritten during the namespace teardown. This occurred whe...

CVE-2024-26668

CVE-2024-26668 – technical insight The Linux kernel netfilter nft_limit: reject configurations that cause integer overflow (CVE-2024-26668) fixes an overflow when the internal token counter wraps on extremely large requests (notably at very high throughput, e.g., ~17 GB/s). The vulnerability aris...

CVE-2024-26687

CVE-2024-26687 concerns the Linux kernel xen/events subsystem. The issue arises from a lock-order inversion between irq_mapping_update_lock and irq_desc->lock in shutdown_pirq/startup_pirq paths, allowing race conditions where evtchn mappings can be torn down and re-established concurrently. S...

CVE-2024-26757

CVE-2024-26757 is a Linux kernel vulnerability affecting the md/mdadm dm-raid path. The root cause: read-only array handling allowed a race between read/write state transitions and sync-thread registration, leading to a potential hang in the recovery/sync flow when the array is toggled between re...

CVE-2024-26884

CVE-2024-26884 is a Linux kernel vulnerability in the BPF hashtab overflow check on 32-bit architectures. The hashtab code uses roundup_pow_of_two() to determine hash bucket count and performs an overflow check by testing the result against 0. On 32-bit arches, the roundup operation itself can ov...

CVE-2024-35894

CVE-2024-35894: In the Linux kernel, a mitigation for a subflow-level BPF access issue was implemented in mptcp by preventing BPF from accessing mptcp-level proto_ops from a subflow scope. The root cause was a misconfigured interaction where BPF could reach mptcp proto_ops through a tcp subflow, ...

CVE-2024-35969

CVE-2024-35969 : Linux kernel vulnerability describing a race between ipv6_get_ifaddr and ipv6_del_addr when iterating inet6_addr_lst under RCU. The issue can allow a freed or invalid memory to be returned due to a window where the reference count reaches zero if ipv6_del_addr and ipv6_get_ifaddr...