CVE-2015-7799

The CVE-2015-7799 issue affects the Linux kernel, specifically slhc_init in drivers/net/slip/slhc.c, up to version 4.2.3. The vulnerability arises because the function does not validate certain slot numbers, allowing a local user to trigger a denial of service via a crafted PPPIOCSMAXCID ioctl ca...

CVE-2019-19079

CVE-2019-19079: A memory leak in the qrtr_tun_write_iter() function (net/qrtr/tun.c) of the Linux kernel before 5.3 allows a remote attacker to trigger memory consumption and Denial of Service. The issue is documented in multiple advisories (e.g., Unity Linux UTSA advisories) as affecting kernels...

CVE-2021-47118

CVE-2021-47118: In the Linux kernel, cad_pid is initialized without taking a reference to the init task’s pid. When cad_pid is later updated via sysctl, the old pid may be put without a corresponding get, risking a use-after-free of the init task’s struct pid. The connected MiracleLinux advisory ...

CVE-2022-49034

CVE-2022-49034 relates to a Linux kernel issue where, when CONFIG_CPUMASK_OFFSTACK and CONFIG_DEBUG_PER_CPU_MAPS are enabled, cpu_max_bits_warn() emits a runtime warning while reading /proc/cpuinfo due to iterating CPUs with NR_CPUS. The patch fixes the warning by iterating up to nr_cpu_ids (runt...

CVE-2022-49236

A use-after-free (UAF) vulnerability exists in the Linux kernel bpf component due to a race condition between btf_try_get_module and load_module. The issue arises because a module's BTF ID can be published to userspace and the BPF verifier while the module is still being initialized. If do_init_m...

CVE-2023-46838

CVE-2023-46838 affects Xen’s virtualization networking path where multi‑part transmitted requests can include zero‑length parts. If all parts of an SKB are zero length, the Linux networking code may dereference NULL, potentially enabling local or guest‑to‑host disruption. Public advisories ( Xen/...

CVE-2023-52690

CVE-2023-52690 is a Linux kernel vulnerability affecting powerpc/powernv where kasprintf() can return NULL on allocation failure and a null pointer check was missing in scom_debug_init_one(). The fix adds a null pointer check and ensures proper release of ent to avoid memory leaks. Connected advi...

CVE-2024-26786

Technical details not publicly disclosed in the provided documents. CVE-2024-26786: Linux kernel iommufd fix for iopt_access_list_id overwrite; adds new_id and updates iopt_access_list_id only on success (root cause: iova alignment check failure).

CVE-2024-26884

CVE-2024-26884 is a Linux kernel vulnerability in the BPF hashtab overflow check on 32-bit architectures. The hashtab code uses roundup_pow_of_two() to determine hash bucket count and performs an overflow check by testing the result against 0. On 32-bit arches, the roundup operation itself can ov...

CVE-2024-35838

CVE-2024-35838 is a Linux kernel vulnerability affecting the wifi/mac80211 stack. The issue arises when a station is allocated and links are added but not immediately marked valid (e.g., during AP MLD connection); if the station is removed before those links are marked valid, the links can leak. ...

CVE-2024-36903

CVE-2024-36903 is a Linux kernel vulnerability related to potential uninitialized value access in IPv6 processing. The cited fix targets __ip6_make_skb() in the IPv6 path by mirroring the IPv4 correction: it now validates FLOWI_FLAG_KNOWN_NH on fl6->flowi6_flags instead of testing HDRINCL on t...

CVE-2024-36967

CVE-2024-36967 - Normal details available The Astra Linux bulletin and IBM/Kern sources confirm a Linux kernel vulnerability CVE-2024-36967 related to a memory leak in KEYS trusted: tpm2_key_encode() where the 'scratch' buffer was not freed. The bug is resolved by freeing scratch on both success ...

CVE-2024-39298

CVE-2024-39298 affects the Linux kernel memory failure path (mm/memory-failure) and is tied to a race in handling dissolved but not removed pages from buddy pages (hugetlb). The provided trace shows a bug path where a buddy page is dissolved/unpoisoned, leading to a VM_BUG_ON_PAGE(!PageBuddy(page...

CVE-2024-42104

CVE-2024-42104 affects the Linux kernel’s nilfs2 filesystem. A missing check for inode numbers on directory entries allows internal inodes (metadata files) to be exposed in the namespace, potentially causing a use-after-free of metadata file inodes and kernel bugs in lru_add_fn() when mounting/un...

CVE-2024-42321

CVE-2024-42321 affects the Linux kernel, specifically the net: flow_dissector path. The issue arises from a splat triggered by __skb_flow_dissect in flow_dissector.c, linked to __skb_get_hash() usage by nftables tracing. Upstream fixes introduce DEBUG_NET_WARN_ON_ONCE and align with the patch d1d...

CVE-2024-46866

The CVE-2024-46866 issue in the Linux kernel affects the drm/xe client, specifically the bo_meminfo path. Root cause: bo_meminfo() inspects bo state (tt and ttm resource) without consistently holding the bo lock, allowing state changes that can cause NPD or UAF. Mitigation implemented by grabbing...

CVE-2024-47689

CVE-2024-47689 affects the Linux kernel (F2FS). The vulnerability stems from f2fs_handle_critical_error() setting SB_RDONLY instead of using the filesystem’s unmount/remount protection, causing a race with freeze/thaw. Root cause: f2fs sets SB_RDONLY in an internal path; remediation proposed/impl...

CVE-2024-47715

Summary: CVE-2024-47715 affects the Linux kernel’s wifi mt76 driver for MT7915 on MT7986. The issue stemmed from mt7915_band_config() setting band_idx to 1 on the main phy for MT7986 with MT7975_ONE_ADIE or MT7976_ONE_ADIE, which caused a dereference of the phys array via wcid->phy_idx in mt76...

CVE-2024-49861

CVE-2024-49861 affects the Linux kernel: bpf: Fix helper writes to read-only maps. The issue allowed a BPF program to write into a read‑only map (e.g., frozen .rodata) via helpers using ARG_PTR_TO_{LONG,INT}, because meta->raw_mode wasn’t set and check_map_access_type() treated the map as read...

CVE-2024-49939

The CVE-2024-49939 entry concerns the Linux kernel wifi driver rtw89 (rtw89_wow_resume and ieee80211_reconfig flow). When SER L2 occurs during WoWLAN resume, the add-interface path can run twice due to a failed rtw89_wow_resume(), leading to a second list_add and a kernel panic. The available sou...

CVE-2024-50070

Technical details for CVE-2024-50070 are not provided in the connected documents. Monitor for updates from the kernel advisories and OSV/USN entries to obtain affected products, affected versions, impact, and fixes.

CVE-2024-50191

Mode C: The CVE-2024-50191 entry concerns ext4 in the Linux kernel. The issue was that when a filesystem was mounted with errors=remount-ro, the kernel incorrectly set SB_RDONLY after errors, potentially confusing the filesystem freeze logic. The fix removes the SB_RDONLY modification and relies ...

CVE-2024-50196

CVE-2024-50196 affects the Linux kernel pinctrl/ocelot subsystem. The issue causes a system hang when a GPIO interrupt is configured in level mode while the parent interrupt is configured in edge mode, because chained_irq_enter() may not be called if the GPIO interrupt is cleared before the paren...

CVE-2024-53085

CVE-2024-53085 (Linux kernel) describes a race in TPM handling during suspend/read paths. The fix locks the TPM chip before checking chip flags in both tpm_pm_suspend() and tpm_hwrng_read(), and relocates TPM_CHIP_FLAG_SUSPENDED checking inside tpm_get_random() so the lock is considered when the ...

CVE-2024-53112

CVE-2024-53112 affects the Linux kernel via the OCFS2 group add path. The issue occurs when ioctl(OCFS2_IOC_GROUP_ADD, …) fails for an inode; the corresponding buffer head remains cached and a subsequent ioctl triggers a BUG in ocfs2_set_new_buffer_uptodate() while caching the same buffer head. T...

CVE-2024-56662

CVE-2024-56662 affects the Linux kernel’s ACPI-NFIT path. The vulnerability is a vmalloc-out-of-bounds read in acpi_nfit_ctl, triggered when cmd_to_func accesses call_pkg->nd_reserved2 without validating that the buffer is sized as a struct nd_cmd_pkg. The root cause is a missing bounds check ...

CVE-2025-21728

CVE-2025-21728: Linux kernel vulnerability where BPF programs in non-preemptible contexts calling bpf_send_signal() can sleep, causing issues. The fix changes irqs_disabled() to !preemptible(). Affects kernels with BPF support; CVSSv3.1 base 5.5 (LOCAL, LOW privileges, NONE user interaction, HIGH...

CVE-2025-21731

The Linux kernel contains a use-after-free (UAF) vulnerability in the nbd (Network Block Device) driver. The flaw occurs because the nbd_genl_disconnect() function flushes work items and releases references, but if a reference is temporarily grabbed, it remains non-zero. Subsequent calls to nbd_g...

CVE-2025-21863

CVE-2025-21863 — Linux kernel io_uring opcode speculation : The vulnerability arises from the io_uring path where sqe->opcode is used for different tables, allowing speculative execution issues. The fix sanitises sqe->opcode to prevent speculation. Affected product: Linux kernel with io_uri...

CVE-2025-21948

CVE-2025-21948 is a Linux kernel issue affecting HID appleir. The report describes a NULL pointer dereference in input_event() triggered by malformed AppleIR reports, leading to a crash if a NULL input_dev is encountered. The fix adds a guard: check the HID_CLAIMED_INPUT flag and exit the event h...

CVE-2025-23146

The CVE-2025-23146 issue affects the Linux kernel mfd: ene-kb3930 driver, where a NULL pointer dereference could occur because off_gpios may be NULL. The kb3930_probe() lacked a NULL check, fixed in the resolved update (similar to backlight: hx8357 NULL pointer fix). Impact is local, with potenti...

CVE-2025-37925

The CVE-2025-37925 entry concerns a Linux kernel vulnerability in the JFS filesystem. When finalizing an on-disk inode, clear_inode() could encounter an unknown type and trigger a kernel BUG; the root cause is an invalid handling path for on-disk inode types, where types 5–15 are reserved. The fi...

CVE-2026-53215

CVE-2026-53215 affects the Linux kernel mvpp2 driver: the RX path could return a descriptor buffer to the hardware Buffer Manager after it had been handed to XDP or an skb, allowing DMA into memory no longer owned by the RX ring. Root cause is improper handling of RX buffers in mvpp2_rx_refill() ...

CVE-2014-3122

CVE-2014-3122 affects the Linux kernel local memory-management path. The advisory centers on the try_to_unmap_cluster function in mm/rmap.c, where the code path did not consistently lock pages, enabling a local user to trigger a memory-usage pattern that can force removal of page-table mappings a...

CVE-2016-2185

CVE-2016-2185 : In the Linux kernel, the ati_remote2_probe function (drivers/input/misc/ati_remote2.c) in versions before 4.5.1 is vulnerable. A physically proximate attacker can trigger a NULL pointer dereference via a crafted USB device descriptor, causing a denial of service (system crash). Th...

CVE-2016-7911

CVE-2016-7911: Race condition in get_task_ioprio in block/ioprio.c of the Linux kernel allows local privilege escalation or use-after-free leading to DoS. A crafted ioprio_get system call can trigger the issue. This vulnerability was addressed by kernel patching in the 4.6.6 release; updating to ...

CVE-2021-29657

CVE-2021-29657 affects the Linux kernel KVM SVM nested virtualization (AMD). A TOCTOU race in arch/x86/kvm/svm/nested.c/nested_svm_vmrun allows a guest to bypass interception checks and corrupt the saved L1 host context, potentially enabling a guest-to-host influence over host MSR state via neste...

CVE-2022-2905

CVE-2022-2905 is an out-of-bounds memory read in the Linux kernel’s BPF subsystem, exploitable by a local user via bpf_tail_call with a map key larger than max_entries. The Debian LTS advisory DLA-3173-1 (linux-5.10) lists CVE-2022-2905 among others and notes that an update to linux-5.10-149-2~de...

CVE-2022-4128

CVE-2022-4128 is a NULL pointer dereference in the Linux kernel’s MPTCP implementation during subflow traversal at disconnect time. The issue can be triggered by a local user and may crash the host, resulting in a denial-of-service condition. The connected vulnerability listings (including Miracl...

CVE-2022-48866

CVE-2022-48866: In the Linux kernel HID thrustmaster driver, a slab-out-of-bounds read occurred in thrustmaster_probe() due to missing validation of actual endpoints in usb_host_interface::endpoint. The fix adds a validation check comparing the actual number of endpoints to the expected number an...

CVE-2022-49520

CVE-2022-49520 (Linux kernel, arm64 compat): The vulnerability occurs when a compat process executes an unknown syscall above __ARM_NR_COMPAT_END; the kernel incorrectly uses the syscall number as ESR_ELx for the fault, causing arm64_show_signal() to print bogus ESR messages. The fix is to stop u...

CVE-2023-3355

CVE-2023-3355 affects the Linux kernel’s MSM GPU driver, specifically the code path in drivers/gpu/drm/msm/msm_gem_submit.c (submit_lookup_cmds). The vulnerability arises from a NULL pointer dereference due to an missing validation of kmalloc() return value, enabling a local user to crash the sys...

CVE-2024-26831

CVE-2024-26831 : Linux kernel vulnerability affecting the handshake path in net/handshake, where the test handshake_req_destroy_test1 failed due to replacing sock_release(sock) with fput(filp). This change delayed final close/cleanup, risking that hp_destroy might not be invoked before the test c...

CVE-2024-26835

CVE-2024-26835 affects the Linux kernel nf_tables (netfilter). When memory pressure causes hook registration to fail, a table can be marked active with no registered hooks, and on table/base chain deletion nf_tables may unregister hooks again, causing a core warn. The connected documents confirm ...

CVE-2024-27018

CVE-2024-27018 affects the Linux kernel br_netfilter component. The issue arises when a bridge device is in promiscuous mode, causing certain bridge-tapped packets to bypass conntrack input handling; a patch resets the conntrack state for these packets. The crash/reply trace and warnings (br_nf_l...

CVE-2024-35795

CVE-2024-35795 : In the Linux kernel, a deadlock was fixed in the AMDGPU driver when reading the MQD via debugfs. The issue arose from a circular locking dependency between mmap_lock and the reservation_ww_class_* locks during a read path implemented in amdgpu_debugfs_mqd_read. The reverse-lock c...

CVE-2024-35824

No public technical details are provided in the connected documents for CVE-2024-35824; monitor for updates.

CVE-2024-36030

The Linux kernel contains a double free vulnerability in the octeontx2-af driver within the rvu_npc_freemem() function. The issue was triggered because the function npc_mcam_rsrcs_deinit() had already released the memory for mcam->counters.bmap, making a subsequent kfree() call redundant and d...

CVE-2024-36979

CVE-2024-36979 is a Linux kernel vulnerability in the bridge mst path (net/bridge/br_mst.c/br_private.h) where a vlan could be freed while walking a list, causing a use-after-free via RCU. The issue arose from suspicious RCU usage and a path involving br_forward_delay_timer and br_mst_set_state. ...

CVE-2024-39292

The CVE-2024-39292 issue concerns the Linux kernel UML subsystem. The vulnerability arises in the winch handling path: registering a winch IRQ can race with the winch being added to the winch_handlers list, potentially allowing an interrupt to occur before the winch is tracked, which could lead t...