CVE-2024-27053

CVE-2024-27053 affects the Linux kernel WiFi Wilc1000 driver in the connect path. The root cause is incorrect RCU usage in wilc1000/hif.c during target BSS parameter parsing in the cfg80211 connect flow, which can dereference an RCU pointer outside an RCU critical section. A fix moves the RCU-der...

CVE-2024-35824

No public technical details are provided in the connected documents for CVE-2024-35824; monitor for updates.

CVE-2024-35887

CVE-2024-35887 affects the Linux kernel ax25 subsystem. When an ax25 device detaches, ax25_dev_device_down() calls ax25_ds_del_timer() to cleanup the slave_timer; if the timer handler is running, del_timer() may run concurrently with ax25_dev_put() freeing the device, causing a use-after-free. Th...

CVE-2024-42101

CVE-2024-42101 : In the Linux kernel, the drm/nouveau driver fix for a NULL pointer dereference in nouveau_connector_get_modes. The bug occurred when drm_mode_duplicate() failed, its return value was assigned to mode without a NULL check, potentially dereferencing a NULL pointer. The patch adds a...

CVE-2024-43821

Technical details beyond the description of CVE-2024-43821 are not provided in the supplied documents; no explicit affected products/versions/fixes are listed here. Monitor vendor advisories for updates.

CVE-2024-44984

Summary (CVE-2024-44984) : Linux kernel bnxt_en driver fix for double DMA unmapping in XDP_REDIRECT. The patch removes the dma_unmap_page_attrs() call in the XDP path, allowing the page pool to handle DMA mapping and avoiding a warning in iommu_dma_unmap_page. Affected component and root cause: b...

CVE-2024-47703

CVE-2024-47703 — Linux kernel (BPF-LSM return value) details . A BPF program attached to the file_alloc_security LSM hook could cause a kernel panic if the LSM returns a positive value, which the kernel could misinterpret as a file pointer. The issue arises because the positive return was not val...

CVE-2024-49924

CVE-2024-49924 affects the Linux kernel fbdev pxafb path. The vulnerability is a use-after-free caused by scheduling work (pxafb_task) in pxafb_init_fbinfo/pxafb_probe and freeing fbi->fb during pxafb_remove/unregister_framebuffer without canceling that work. The follow sequence shows the UAF ...

CVE-2024-50002

CVE-2024-50002 affects the Linux kernel’s static_call subsystem. The root cause is a union in struct static_call_key where key::mods and key::sites share a pointer and are distinguished by a bit, but static_call_del_module() assumed a valid static_call_mod pointer and dereferenced it when an allo...

CVE-2024-53042

CVE-2024-53042 affects the Linux kernel’s ipv4/ip_tunnel code. The issue arises from paths where ip_tunnel_init_flow() is invoked without holding the RCU read lock, triggering a suspicious RCU usage warning. The fix uses l3mdev_master_upper_ifindex_by_index() to acquire the RCU read lock before c...

CVE-2024-56765

CVE-2024-56765 relates to the Linux kernel (powerpc/pseries/vas) where a close() callback was added to vas_vm_ops to fix a use-after-free/memory access during migration. The vulnerability stemmed from the VAS window’s VMA address being saved when a paste address is mapped and not being updated up...

CVE-2024-57922

The CVE-2024-57922 entry relates to the Linux kernel drm/amd/display code, where wrappers for dcn_bw_ceil2() and dcn_bw_floor2() gained a check for non-zero granularity to prevent asserts/divide-by-zero. The fix is reflected in multiple advisories: Debian LTS DLA-4076-1 and DSA-5860-1 note update...

CVE-2024-57939

CVE-2024-57939 affects the Linux kernel on riscv where die() can be invoked in an exception handler and uses spinlock_t, which may sleep with PREEMPT_RT enabled. This causes a kernel warning (BUG: sleeping function called from invalid context) and potential instability. The fix switches to raw_sp...

CVE-2024-58063

CVE-2024-58063 affects the Linux kernel wireless stack (rtlwifi). The described issue is memory leaks and invalid access on probe error paths in the rtlwifi PCI handling, with deinitialization performed in reverse order when probe fails. Specifically, when init_sw_vars fails, rtl_deinit_core shou...

CVE-2025-21779

The CVE-2025-21779 entry concerns Linux kernel KVM on x86 where Hyper-V SEND_IPI/SEND_IPI_EX hypercalls are advertised only when the local APIC is emulated/virtualized by KVM. The fix rejects these hypercalls if the local APIC is emulated in userspace, preventing a NULL-pointer dereference when H...

CVE-2025-21811

CVE-2025-21811 affects the Linux kernel NILFS2 component. The vulnerability stems from nilfs_lookup_dirty_data_buffers() iterating buffers attached to dirty data folios/pages and accessing buffers without proper locking, creating a use-after-free risk when buffers lose dirty state due to asynchro...

CVE-2025-21823

CVE-2025-21823 is about batman-adv in the Linux kernel where the unmanaged ELP metric worker was dropped. The issue arose because the ELP worker, which recalculates metrics for neighbors reachable over an interface, used locks that could sleep, conflicting with the RCU list iterator and risking i...

CVE-2025-21844

Technical details are not publicly available in the provided documents; no connected documents with concrete details for CVE-2025-21844. Monitor for updates.

CVE-2010-3081

CVE-2010-3081 describes a local privilege-escalation in the Linux kernel’s 64-bit compat layer due to missing sanity checks in compat_alloc_user_space, enabling a local user to abuse compat_mc_getsockopt controlling a length value. Affected: kernel 2.6.x before 2.6.36-rc4-git2 on 64-bit platforms...

CVE-2011-1494

CVE-2011-1494 affects the Linux kernel (2.6.38 and earlier) via an integer overflow in the _ctl_do_mpt_command function (drivers/scsi/mpt2sas/mpt2sas_ctl.c). This can allow local users to gain privileges or cause a denial of service (memory corruption) by issuing an ioctl with a crafted value tha...

CVE-2014-3610

CVE-2014-3610 is a Linux kernel KVM WRMSR emulation flaw present up to and including 3.17.2. The issue arises when guest writes a non-canonical value to a model-specific register, causing the host to crash (DoS). It is tied to wrmsr_interception (arch/x86/kvm/svm.c) and handle_wrmsr (arch/x86/kvm...

CVE-2014-7822

CVE-2014-7822 concerns the Linux kernel splice_write path, where the splice() system call does not validate the maximum size of a single file. This enables a local unprivileged user to trigger a denial of service (system crash) and potentially other effects, notably when using an ext4 filesystem....

CVE-2015-7799

The CVE-2015-7799 issue affects the Linux kernel, specifically slhc_init in drivers/net/slip/slhc.c, up to version 4.2.3. The vulnerability arises because the function does not validate certain slot numbers, allowing a local user to trigger a denial of service via a crafted PPPIOCSMAXCID ioctl ca...

CVE-2015-8785

CVE-2015-8785: The fuse_fill_write_pages function in fs/fuse/file.c of the Linux kernel (versions before 4.4) is exploitable locally to cause a denial of service via a writev call that triggers a zero-length first iov. This is a local, non-privileged issue with an attacker able to induce an infin...

CVE-2017-16535

CVE-2017-16535 affects the Linux kernel up to version 4.13.9, where usb_get_bos_descriptor in drivers/usb/core/config.c improperly handles crafted USB devices, enabling a local attacker to trigger an out-of-bounds read that can cause denial of service or a system crash. The issue stems from readi...

CVE-2017-16647

CVE-2017-16647 affects the Linux kernel driver: drivers/net/usb/asix_devices.c, up to version 4.13.11. The issue arises from a NULL pointer dereference when a crafted USB device is connected, enabling local attackers to trigger a denial of service (system crash) and potentially other impact. The ...

CVE-2017-7346

The CVE-2017-7346 issue is a Linux kernel vulnerability in vmwgfx where vmw_gb_surface_define_ioctl in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c fails to validate certain levels data, enabling a local attacker to cause a denial of service (system hang) via a crafted ioctl to /dev/dri/renderD* on ke...

CVE-2018-10087

CVE-2018-10087 is present in the MiracleLinux kernel package listed in AXSA:2024-8953:34. The advisory shows a local DoS risk due to the kernel_wait4 function in kernel/exit.c triggering undefined behavior when using -INT_MIN on an unspecified architecture/compiler. The connected Nessus entry ide...

CVE-2018-16885

The CVE-2018-16885 issue is a Linux kernel vulnerability (affecting kernel 3.10.x as shipped with Red Hat Enterprise Linux 7) where userspace can call memcpy_fromiovecend() and similar functions with a zero offset and buffer length, causing a read beyond the buffer boundaries. This can lead to a ...

CVE-2020-11725

CVE-2020-11725 affects the Linux kernel (through 5.6.3) in snd_ctl_elem_add (sound/core/control.c). The root cause is a count=info->owner usage that can feed into a private_size*count multiplication, causing unspecified side effects. Kernel engineers dispute the finding, noting it may only mat...

CVE-2021-47073

CVE-2021-47073 concerns a Linux kernel issue in platform/x86 dell-smbios-wmi where unregistering the driver occurred unconditionally, causing a kernel oops at module removal. The fix ensures unregister happens only under the same condition as registration (Dell WMI support). Affects the Dell WMI ...

CVE-2021-47289

CVE-2021-47289 in the Linux kernel fixes a NULL pointer dereference in ACPI: utils when calling acpi_dev_put() on a possibly NULL pointer. The patch makes acpi_dev_put() silently accept NULL (avoiding downcalls with a NULL offset). The public advisory notes the change as part of resolving the ACP...

CVE-2022-1651

CVE-2022-1651 affects the Linux kernel in the ACRN Device Model (acrn_dev_ioctl in drivers/virt/acrn/hsm.c). The vulnerability is a memory leak during ioctl handling that can be exploited locally by a privileged user to leak kernel information and cause a denial of service. Public documents ident...

CVE-2022-3621

CVE-2022-3621 : A vulnerability in the Linux kernel component nilfs2 affects the function nilfs_bmap_lookup_at_level in fs/nilfs2/inode.c. The issue enables a NULL pointer dereference, with the document noting that the flaw can be exploited remotely. The vulnerability is caused by manipulation of...

CVE-2022-48912

CVE-2022-48912 concerns a Linux kernel use-after-free in netfilter: the fix is to avoid dereferencing new_hooks after nf_hook_mutex is released in __ nf_register_net_hook, preventing a KASAN read after free. The Astra Linux advisory reproduces the exact description, including the kasan report: Re...

CVE-2022-48978

CVE-2022-48978 is a Linux kernel vulnerability in HID core (hid_report_raw_event) causing a shift-out-of-bounds when processing HID reports. The issue is triggered by syzbot reports and UBSAN shows shift-out-of-bounds in hid-core.c:1323 while computing snto32; fix patches add bounds checks (limit...

CVE-2022-49034

CVE-2022-49034 relates to a Linux kernel issue where, when CONFIG_CPUMASK_OFFSTACK and CONFIG_DEBUG_PER_CPU_MAPS are enabled, cpu_max_bits_warn() emits a runtime warning while reading /proc/cpuinfo due to iterating CPUs with NR_CPUS. The patch fixes the warning by iterating up to nr_cpu_ids (runt...

CVE-2022-49116

CVE-2022-49116 – Linux kernel Bluetooth memset fix : The vulnerability concerns the Bluetooth stack (l2cap_ecred_connect) where structs could leak memory if not initialized. The fix is to use memset to initialize structs to prevent memory leaks. Affected component: Linux kernel Bluetooth subsyste...

CVE-2022-49321

CVE-2022-49321 affects the Linux kernel’s xprtrdma RPC path. When bc_serv is NULL, a RDMA server fault reply can be misinterpreted as a bcall, causing rpcrdma_bc_receive_call to encounter a NULL pointer and trigger a kernel crash (high availability impact). The provided documents confirm the root...

CVE-2022-49519

The CVE-2022-49519 issue concerns the Linux kernel wireless driver ath10k. A double invocation of ath10k_halt during a suspend sequence could occur when FW recovery triggered by ath10k_core_restart() interleaves with suspend, freezing the restart worker and causing ath10k_htt_rx_free() to be free...

CVE-2022-49534

CVE-2022-49534 in the Linux kernel concerns a memory leak in the lpfc driver when NPIV ports send PLOGI_RJT. The description states a leak could originate from allocations in lpfc_ignore_els_cmpl() and lpfc_els_rsp_reject(), tied to login_mbox context and service parameter buffers. The remedy is ...

CVE-2022-49666

CVE-2022-49666 concerns the Linux kernel, specifically the powerpc/memhotplug path. The issue arises from an add_pages override for PPC, where the kernel began validating addresses against high_memory after commit ffa0b64e3be5 (powerpc: Fix virt_addr_valid() for 64-bit). This leads to a BUG_ON in...

CVE-2022-49675

Summary (CVE-2022-49675): In the Linux kernel, the function tick_nohz_full_setup() is exported while annotated with init , which risks a use-after-free of the init text and kernel panic. The issue was detected after a section-mismatch warning from modpost and fixed by the commit 28438794aba4 (“mo...

CVE-2023-26606

The CVE-2023-26606 issue affects the Linux kernel (6.0.8) with a use-after-free in ntfs_trim_fs (fs/ntfs3/bitmap.c). Affects Linux kernel components related to NTFS handling; impact is high (confidentiality, integrity, availability) with local privileges required and no user interaction. Root cau...

CVE-2023-52864

CVE-2023-52864 affects the Linux kernel (platform/x86) WMI implementation. The root cause is a memory corruption risk when wmi_char_open() runs if the associated driver is missing, due to the miscdevice pointer being stored in filp->private_data after the patch in drivers/misc: pass miscdevice...

CVE-2024-26668

CVE-2024-26668 – technical insight The Linux kernel netfilter nft_limit: reject configurations that cause integer overflow (CVE-2024-26668) fixes an overflow when the internal token counter wraps on extremely large requests (notably at very high throughput, e.g., ~17 GB/s). The vulnerability aris...

CVE-2024-35969

Summary (CVE-2024-35969): A race in IPv6 handling in the Linux kernel between ipv6_get_ifaddr and ipv6_del_addr can cause use-after-free scenarios. When an entry is removed from inet6_addr_lst under RCU, ipv6_get_ifaddr may still return that entry and attempt to increment its reference, leading t...

CVE-2024-36967

CVE-2024-36967 - Normal details available The Astra Linux bulletin and IBM/Kern sources confirm a Linux kernel vulnerability CVE-2024-36967 related to a memory leak in KEYS trusted: tpm2_key_encode() where the 'scratch' buffer was not freed. The bug is resolved by freeing scratch on both success ...

CVE-2024-39491

CVE-2024-39491: In the Linux kernel ALSA: hda cs35l56 driver, the cs_dsp instance was created in probe() but could be used after a remove/rebind cycle, as cs_dsp_remove() was only called on the unbind path and not on error paths. The fix initializes cs_dsp in probe() so failure can be detected ea...

CVE-2024-39506

CVE-2024-39506 (Linux kernel) : The issue arises in the liquidio driver path within lio_vf_rep_copy_packet(), where pg_info->page is compared to NULL but then unconditionally passed to skb_add_rx_frag(), risking a NULL pointer dereference. The problem trace shows the path from octeon_droq_proc...