CVE-2024-38540

CVE-2024-38540 concerns the Linux kernel bnxt_re driver. The vulnerability is due to undefined behavior triggered when bnxt_qplib_alloc_init_hwq is called with hwq_attr->aux_depth != 0 and hwq_attr->aux_stride == 0, which causes roundup_pow_of_two(hwq_attr->aux_stride) to run with a 0 va...

CVE-2024-38544

CVE-2024-38544 relates to a Linux kernel vulnerability in RDMA/rxe where a segfault could occur in rxe_comp_queue_pkt. The root cause was dereferencing a previously freed skb because the code accessed hw counters after enqueuing, and the completion task might run in another thread. The fix change...

CVE-2024-39298

CVE-2024-39298 affects the Linux kernel memory failure path (mm/memory-failure) and is tied to a race in handling dissolved but not removed pages from buddy pages (hugetlb). The provided trace shows a bug path where a buddy page is dissolved/unpoisoned, leading to a VM_BUG_ON_PAGE(!PageBuddy(page...

CVE-2024-39506

CVE-2024-39506 (Linux kernel) : The issue arises in the liquidio driver path within lio_vf_rep_copy_packet(), where pg_info->page is compared to NULL but then unconditionally passed to skb_add_rx_frag(), risking a NULL pointer dereference. The problem trace shows the path from octeon_droq_proc...

CVE-2024-42305

CVE-2024-42305 affects the Linux kernel ext4, where a dir-indexing edge case could trigger out-of-bounds access during directory entry splitting when the first two entries are not dot/dotdot. The description and connected material explain that make_indexed_dir() assumed the first two dirents are ...

CVE-2024-42315

CVE-2024-42315 – exFAT deadlock fix in Linux kernel . The issue occurs when exposing a file with entries exceeding ES_MAX_ENTRY_NUM, where the bh-array is allocated with GFP_KERNEL inside __exfat_get_dentry_set, potentially causing a deadlock on sbi->s_lock between processes. The fix changes t...

CVE-2024-42316

CVE-2024-42316 : Linux kernel fix for div-by-zero in vmpressure_calc_level() within mm/mglru evictions. The issue arose in the second pass of evict_folios(), where deducting scan_control->nr_scanned could underflow nr_scanned if folio_trylock() failed, causing the divisor scale = scanned + rec...

CVE-2024-42321

CVE-2024-42321 affects the Linux kernel, specifically the net: flow_dissector path. The issue arises from a splat triggered by __skb_flow_dissect in flow_dissector.c, linked to __skb_get_hash() usage by nftables tracing. Upstream fixes introduce DEBUG_NET_WARN_ON_ONCE and align with the patch d1d...

CVE-2024-46761

CVE-2024-46761 affects the Linux kernel’s PCI hotplug driver for PowerPC (pci/hotplug/pnv_php.c). The issue caused a kernel crash during hot-unplug/disable of a PCIe switch/bridge from the PHB, due to a NULL dereference when the MSI data structure had already been released and set to NULL, yet un...

CVE-2024-46774

CVE-2024-46774 affects the Linux kernel PowerPC RTAS path (sys_rtas). The issue arises in powerpc/rtas.c where nargs/nret come from a user buffer and are used as indices into a small stack array and as inputs to copy_to_user after bounds checks, allowing speculative execution (Spectre v1) gadget ...

CVE-2024-46795

CVE-2024-46795 affects the Linux kernel when using ksmbd over a reused connection with binding sessions. A null pointer dereference can occur in the SMB 3.1 encryption key path: a reused binding session may leave Preauth_HashValue NULL, which is used as input to crypto_shash_update() during key g...

CVE-2024-46860

CVE-2024-46860 refers to a Linux kernel vulnerability in the wifi subsystem: mt76 mt7921 code path may dereference a NULL mvif->phy when mt7921_ipv6_addr_change is invoked as a notifier while disabling wifi. The description states the fix prevents access to a NULL mvif->phy, addressing a NU...

CVE-2024-50027

CVE-2024-50027 is a Linux kernel Use-After-Free vulnerability in the thermal subsystem (thermal: core) where the tzp object could be accessed after freeing it in thermal_zone_device_unregister(). Miracle/OS advisory notes the fix moves the Free tzp copy to after the removal completes, preventing ...

CVE-2024-50075

CVE-2024-50075 affects the Linux kernel (Tegrа Tegra XUSB) where USB virtualization enables sharing USB2 ports across VFs. The vulnerability arises from using the total USB2 phy number as the port index when checking PORTSC values, which can lead to invalid memory access in the VF context. A patc...

CVE-2024-50272

CVE-2024-50272 is a Linux kernel issue where filemap_read() could enter an infinite loop if a caller provides an iocb->ki_pos near the filesystem limit and an iterator count overflows that limit. The vulnerability was addressed by fixing bounds checking in filemap_read() (kernel code path: fil...

CVE-2024-53042

CVE-2024-53042 affects the Linux kernel’s ipv4/ip_tunnel code. The issue arises from paths where ip_tunnel_init_flow() is invoked without holding the RCU read lock, triggering a suspicious RCU usage warning. The fix uses l3mdev_master_upper_ifindex_by_index() to acquire the RCU read lock before c...

CVE-2024-53101

CVE-2024-53101 concerns the Linux kernel: a fix for an uninitialized value in from_kuid/from_kgid was applied. The issue arose when ocfs2_setattr() referenced attr->ia_mode, ia_uid, and ia_gid in a trace point even if ATTR_MODE/ATTR_UID/ATTR_GID weren’t set. The patch initializes all fields of...

CVE-2024-56587

CVE-2024-56587: In the Linux kernel, a NULL pointer dereference can occur in the LEDs class when brightness_show() accesses led->cdev attributes without proper synchronization. The issue arises during inter-process interaction when a HID device creates a led and a subsequent access from anothe...

CVE-2024-57939

CVE-2024-57939 affects the Linux kernel on riscv where die() can be invoked in an exception handler and uses spinlock_t, which may sleep with PREEMPT_RT enabled. This causes a kernel warning (BUG: sleeping function called from invalid context) and potential instability. The fix switches to raw_sp...

CVE-2024-58071

CVE-2024-58071 describes a Linux kernel bug in the team subsystem where adding a device that is already a lower of another device (e.g., veth0 lower than vlan1) could trigger recursive locking and potential deadlock. The provided evidence shows a stack trace and lockdep warning indicating two loc...

CVE-2025-21763

Summary of CVE-2025-21763 : In the Linux kernel, __neigh_notify() can be invoked without RTNL or RCU protection, creating a potential use-after-free (UAF) scenario in neighbour handling. The mitigation is to apply RCU protection to neighbour notifications to prevent UAF. Connected advisories corr...

CVE-2025-21779

The CVE-2025-21779 entry concerns Linux kernel KVM on x86 where Hyper-V SEND_IPI/SEND_IPI_EX hypercalls are advertised only when the local APIC is emulated/virtualized by KVM. The fix rejects these hypercalls if the local APIC is emulated in userspace, preventing a NULL-pointer dereference when H...

CVE-2025-21811

CVE-2025-21811 affects the Linux kernel NILFS2 component. The vulnerability stems from nilfs_lookup_dirty_data_buffers() iterating buffers attached to dirty data folios/pages and accessing buffers without proper locking, creating a use-after-free risk when buffers lose dirty state due to asynchro...

CVE-2025-21871

Summary of CVE-2025-21871 (Linux kernel): The vulnerability arises in the OP-TEE subsystem where the supplicant wait loop can cause a hang if the supplicant is hung/crashed/killed during an OP-TEE RPC, especially with shutdown ordering issues between the supplicant and the OP-TEE client. The fix ...

CVE-2026-43037

CVE-2026-43037 affects the Linux kernel; vulnerability arises from ip4ip6_err() using a cloned skb where the IPv6 receive path writes cb[] as inet6_skb_parm, which is then misinterpreted as IPv4 inet_skb_parm by __ip_options_echo(), causing a potential data leak/compromise. The fix includes clear...

CVE-2008-4395

CVE-2008-4395 concerns multiple buffer overflows in the ndiswrapper module for Linux kernel 2.6. The issue allows a remote attacker to execute arbitrary code by sending WLAN packets with long ESSIDs, effectively exploiting a vulnerability in ESSID handling. Connected advisories confirm affected d...

CVE-2017-16649

CVE-2017-16649 affects the Linux kernel up to version 4.13.11. The vulnerable code is usbnet_generic_cdc_bind in drivers/net/usb/cdc_ether.c. Exploitation requires local access and a crafted USB device, which can trigger a divide-by-zero error and system crash, with possible other impact. The con...

CVE-2020-36313

CVE-2020-36313 affects the Linux kernel before 5.7. The KVM subsystem allows out‑of‑range access to memslots after a deletion (CID-0774a964ef56), impacting arch/s390/kvm/kvm-s390.c, include/linux/kvm_host.h, and virt/kvm/kvm_main.c. Root cause is a memslot handling bug in KVM/s390; exploitation d...

CVE-2021-47352

CVE-2021-47352 affects the Linux kernel’s virtio-net code. The issue arises from missing validation of the length reported by a device, which could lead to data corruption or loss. Affected context is confirmed by MiracleLinux/Nessus advisories that reference “virtio-net: Add validation for used ...

CVE-2021-47505

CVE-2021-47505 in the Linux kernel: use-after-free when polling signalfd or binder fds with aio poll due to POLLFREE not being handled. The PATCH by Ramji Jiyani fixes aio_poll_wake() handling POLLFREE and avoids deadlock by ensuring waitqueue freeing is RCU-delayed, aligning with eventpoll behav...

CVE-2022-48997

CVE-2022-48997 affects the Linux kernel TPM subsystem, where tpm transactions during suspend were not guarded and could race with other TPM accessors inside tpm_pm_suspend. The referenced fixes call tpm_try_get_ops(), a wrapper around tpm_chip_start() that acquires the appropriate mutex, to seria...

CVE-2022-49034

CVE-2022-49034 relates to a Linux kernel issue where, when CONFIG_CPUMASK_OFFSTACK and CONFIG_DEBUG_PER_CPU_MAPS are enabled, cpu_max_bits_warn() emits a runtime warning while reading /proc/cpuinfo due to iterating CPUs with NR_CPUS. The patch fixes the warning by iterating up to nr_cpu_ids (runt...

CVE-2022-49291

The CVE-2022-49291 entry describes a Linux kernel flaw in ALSA: pcm where concurrent hw_params and hw_free ioctls could trigger a use-after-free. The fix introduces a dedicated mutex (runtime->buffer_mutex) and applies it to both hw_params and hw_free code paths, with small reordering (mmap_co...

CVE-2022-49675

Summary (CVE-2022-49675): In the Linux kernel, the function tick_nohz_full_setup() is exported while annotated with init , which risks a use-after-free of the init text and kernel panic. The issue was detected after a section-mismatch warning from modpost and fixed by the commit 28438794aba4 (“mo...

CVE-2023-22995

CVE-2023-22995 affects the Linux kernel’s DesignWare USB3 for Qualcomm SoCs driver (dwc3_qcom_acpi_register_core). The connected ENISA/OSV advisory notes an error-path handling defect where platform_device_put and kfree calls are omitted, leaving cleanup incomplete during device registration. Thi...

CVE-2023-46838

CVE-2023-46838 affects Xen’s virtualization networking path where multi‑part transmitted requests can include zero‑length parts. If all parts of an SKB are zero length, the Linux networking code may dereference NULL, potentially enabling local or guest‑to‑host disruption. Public advisories ( Xen/...

CVE-2024-26820

CVE-2024-26820 affects the Linux kernel hv_netvsc driver. The issue occurs when the hv_netvsc module is unloaded and reloaded: the NET_DEVICE_REGISTER handler can fail to register a VF because the VF registration call arrives before netvsc_probe finishes, since register_netdevice_notifier() is re...

CVE-2024-26825

CVE-2024-26825 refers to a Linux kernel vulnerability where the rx_data_reassembly skb could leak if the NCI device was deallocated before fragmentation processing completed. The root cause is that rx_data_reassembly skb is bound to the NCI device and, if the device is freed early, the skb could ...

CVE-2024-27053

CVE-2024-27053 affects the Linux kernel WiFi Wilc1000 driver in the connect path. The root cause is incorrect RCU usage in wilc1000/hif.c during target BSS parameter parsing in the cfg80211 connect flow, which can dereference an RCU pointer outside an RCU critical section. A fix moves the RCU-der...

CVE-2024-35890

CVE-2024-35890 : In the Linux kernel, a GRO (generic receive offload) fraglist ownership transfer bug can lead to use-after-free/dos conditions when packets are GROed with fraglist. The issue arises because skb_gro_receive_list removes the socket reference but the skb_segment_list may reuse skbs ...

CVE-2024-35892

CVE-2024-35892 stems from a Linux kernel net/sched issue where qdisc_tree_reduce_backlog() was called with the qdisc lock held while RTNL was not held, triggering a lockdep splat due to unsafe RCU usage. The fix switches from qdisc_lookup() to qdisc_lookup_rcu() to safely dereference qdisc data u...

CVE-2024-36979

CVE-2024-36979 is a Linux kernel vulnerability in the bridge mst path (net/bridge/br_mst.c/br_private.h) where a vlan could be freed while walking a list, causing a use-after-free via RCU. The issue arose from suspicious RCU usage and a path involving br_forward_delay_timer and br_mst_set_state. ...

CVE-2024-39282

CVE-2024-39282 : Linux kernel vulnerability in net: wwan: t7xx where the FSM command timeout handling can lead to a fault when an asynchronous worker finishes after the main thread releases its completion object. The issue manifests as a page fault (CR2 fffffffffffffff8) in complete_all during FS...

CVE-2024-40919

CVE-2024-40919 discusses a Linux kernel bnxt_en issue where a released token (token->state == BNXT_HWRM_DEFERRED) could be logged while the token pointer had already been NULL, risking a NULL pointer dereference. The fix implemented is to add a token pointer check before using the token in log...

CVE-2024-40961

CVE-2024-40961 affects the Linux kernel IPv6 route handling. The issue is a NULL dereference in fib6_nh_init() when in6_dev_get(dev) returns NULL, which can trigger a general protection fault during IP6 GW validation and route lookup (ip6_validate_gw, ip6_route_check_nh). Affected code path: fib6...

CVE-2024-41079

Mode C: The CVE-2024-41079 issue affects the Linux kernel nvmet subsystem. The vulnerability arises because the first two double words (cqe.result) may remain uninitialized when not used, allowing potential leakage of stack data for RDMA paths (behavior was 0 for TCP/FC but not for RDMA). The fix...

CVE-2024-42258

The CVE-2024-42258 entry relates to a Linux kernel issue where 32-bit x86 builds using the CONFIG_X86_32 path mishandled huge page alignment. The fix was to stop forcing a specific alignment on 32-bit systems by relying on !CONFIG_64BIT, which should cover all 32-bit machines. The connected docum...

CVE-2024-43826

CVE-2024-43826 : In the Linux kernel, the nfs trace points can expose a safety issue in nfs_folio_length when folio locking or NULL ->f_mapping checks are missing, risking kernel crashes under certain NFS trace configurations (e.g., xfstests generic/065). The root cause is unsafe handling of f...

CVE-2024-44965

CVE-2024-44965 is a Linux kernel vulnerability where pti_clone_pgtable() made alignment assumptions (PMD alignment) on the start address, which is valid on x86_64 but not on i386, causing the end condition to malfunction and potentially a short clone of user mappings. The issue could lead to trap...

CVE-2024-46747

CVE-2024-46747 : In the Linux kernel, the Cougar 500k Gaming Keyboard driver was vulnerable to a slab-out-of-bounds Read in cougar_report_fixup due to a missing verification of the report descriptor size before access. The root cause is in report_fixup not validating the descriptor length prior t...