CVE-2026-46054

CVE-2026-46054 affects the Linux kernel SELinux overlayfs access checks for mmap() and mprotect(). The issue arises from insufficient enforcement of backing-file access between the user file and backing file, potentially bypassing policies. A patch introduces security_mmap_backing_file() to enfor...

CVE-2012-6701

CVE-2012-6701 : An integer overflow in fs/aio.c of the Linux kernel before 3.4.1 allows local users to trigger a denial of service (and possibly other impact) via a large AIO iovec. Public sources describe exploitation locally and indicate a fix was applied in 3.4.1 (Linux kernel changelog refere...

CVE-2013-2547

CVE-2013-2547 concerns the Linux kernel: the crypto_report_one() path in crypto_user.c does not fully initialize certain kernel structures when copying data to userspace, risking leakage of kernel heap memory. The vulnerability requires CAP_NET_ADMIN in the base description, enabling a local atta...

CVE-2016-4482

CVE-2016-4482 : The Linux kernel before 4.7 has a flaw in the proc_connectinfo handling. The proc_connectinfo function in drivers/usb/core/devio.c does not initialize a data structure, enabling local users to read sensitive data from kernel stack memory via a crafted USBDEVFS_CONNECTINFO ioctl. T...

CVE-2016-5244

CVE-2016-5244 affects the Linux kernel and involves the function rds_inc_info_copy in net/rds/recv.c not initializing a structure member. This can enable a remote attacker to read sensitive information from kernel stack memory by processing an RDS message, with impact described as kernel informat...

CVE-2017-7294

The CVE-2017-7294 issue affects the Linux kernel up to 4.10.6, specifically vmwgfx vmw_surface_define_ioctl() in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c. A crafted ioctl to /dev/dri/renderD* can trigger an integer overflow and out-of-bounds write, causing denial of service (system hang/crash) and...

CVE-2019-19050

CVE-2019-19050 describes a memory leak in the Linux kernel’s crypto_reportstat() path (crypto/crypto_user_stat.c) that can cause a denial of service via memory consumption when crypto_reportstat_alg() fails, affected up to kernel 5.3.11. Connected Nessus advisories (Unity Linux UTSA-2026-003794 a...

CVE-2021-47352

CVE-2021-47352 affects the Linux kernel’s virtio-net code. The issue arises from missing validation of the length reported by a device, which could lead to data corruption or loss. Affected context is confirmed by MiracleLinux/Nessus advisories that reference “virtio-net: Add validation for used ...

CVE-2022-27950

CVE-2022-27950 : A memory leak exists in Linux kernel drivers/hid/hid-elo.c for a hid_parse error condition, affecting kernels before 5.16.11. Exploitation details are not provided in the documents. A fix is in kernel 5.16.11 (and later). Recommendation: upgrade to a version containing the patch ...

CVE-2022-48978

CVE-2022-48978 is a Linux kernel vulnerability in HID core (hid_report_raw_event) causing a shift-out-of-bounds when processing HID reports. The issue is triggered by syzbot reports and UBSAN shows shift-out-of-bounds in hid-core.c:1323 while computing snto32; fix patches add bounds checks (limit...

CVE-2022-49603

CVE-2022-49603 concerns the Linux kernel where data races around sysctl_ip_fwd_update_priority could occur while readers access it concurrently. The fix adds READ_ONCE() to readers to prevent concurrent modification. Connected advisories (EulerOS/OpenVAS/Nessus) explicitly reference this vulnerab...

CVE-2022-49639

CVE-2022-49639 refers to a Linux kernel issue in the cipso subsystem where sysctl read operations could race with concurrent writes. The root cause is missing synchronization while reading cipso sysctl variables, and the fix is to add READ_ONCE() to prevent data races. Public documents in the con...

CVE-2023-52703

Summary: CVE-2023-52703 is a Linux kernel vulnerability in the USB subsystem (net/usb kalmia) where act_len was uninitialized in the usb_bulk_msg error path in kalmia_send_init_packet(). The kernel fix removes passing act_len to the usb_bulk_msg error paths, since the value would be from the firs...

CVE-2024-26668

CVE-2024-26668 – technical insight The Linux kernel netfilter nft_limit: reject configurations that cause integer overflow (CVE-2024-26668) fixes an overflow when the internal token counter wraps on extremely large requests (notably at very high throughput, e.g., ~17 GB/s). The vulnerability aris...

CVE-2024-35891

CVE-2024-35891: In the Linux kernel, lan8814_get_sig_rx() and lan8814_get_sig_tx() may dereference a NULL ptp_header returned by ptp_parse_header() for abnormal or corrupted packets. The fix adds a check for ptp_header to prevent a potential null pointer dereference. Connected advisories confirm ...

CVE-2024-35982

CVE-2024-35982 affects the Linux kernel’s batman-adv local TT handling. When an attached interface MTU becomes too small to transmit the local translation table, TT resizing can fail to converge, causing an endless loop. Symptoms include repeated log spam like “batman_adv: batadv0: Forced to purg...

CVE-2024-42305

CVE-2024-42305 affects the Linux kernel ext4, where a dir-indexing edge case could trigger out-of-bounds access during directory entry splitting when the first two entries are not dot/dotdot. The description and connected material explain that make_indexed_dir() assumed the first two dirents are ...

CVE-2024-43914

CVE-2024-43914 : In the Linux kernel md/raid5 code, the issue arises when --revert-reshape is used during a reshape; updating the raid from 5 to 4 disks while a reshape position is still set caused a mismatch where the old reshape position influenced writepos checks, triggering a panic. The fix c...

CVE-2024-44984

Summary (CVE-2024-44984) : Linux kernel bnxt_en driver fix for double DMA unmapping in XDP_REDIRECT. The patch removes the dma_unmap_page_attrs() call in the XDP path, allowing the page pool to handle DMA mapping and avoiding a warning in iommu_dma_unmap_page. Affected component and root cause: b...

CVE-2024-46747

CVE-2024-46747 : In the Linux kernel, the Cougar 500k Gaming Keyboard driver was vulnerable to a slab-out-of-bounds Read in cougar_report_fixup due to a missing verification of the report descriptor size before access. The root cause is in report_fixup not validating the descriptor length prior t...

CVE-2024-46761

CVE-2024-46761 affects the Linux kernel’s PCI hotplug driver for PowerPC (pci/hotplug/pnv_php.c). The issue caused a kernel crash during hot-unplug/disable of a PCIe switch/bridge from the PHB, due to a NULL dereference when the MSI data structure had already been released and set to NULL, yet un...

CVE-2024-46859

CVE-2024-46859 is a Linux kernel vulnerability affecting the panasonic-laptop code. The issue arises from unvalidated SINF array indices (0–SINF_CUR_BRIGHT, 0x0d), risking out-of-bounds accesses on devices with fewer SINF entries (e.g., CF-18 has ~10). The fix adds a minimum SINF array size check...

CVE-2024-49996

CVE-2024-49996 affects the Linux kernel CIFS/SMB client when parsing NFS reparse points. The root cause is a buffer length miscalculation in cifs_strndup_from_utf16() that doesn’t subtract InodeType size from ReparseDataLength, allowing reads past the buffer. The InodeType field and Major/Minor R...

CVE-2024-50063

CVE-2024-50063 concerns the Linux kernel BPF tail calls where a program attached to one kernel hook tail-calling another with a different prototype could bypass ctx-parameter verification and return-value constraints. The issue arises when progs attached to func1 and func2 have different paramete...

CVE-2024-50120

CVE-2024-50120 affects the Linux kernel SMB client. The vulnerability stems from missing checks for kstrdup failures when duplicating passwords in smb3_reconfigure(), leading to ses->password or ses->password2 allocation failures. The documented remediation is to return -ENOMEM if ses->p...

CVE-2024-50194

The CVE-2024-50194 issue affects the Linux kernel arm64 uprobes on big-endian kernels, where in-memory instruction encoding (little-endian) was not converted to the kernel nativ e endianness before analysis and simulation. Consequences could include rejecting probeable instructions, unsafe out-of...

CVE-2024-50202

CVE-2024-50202 (nilfs2) is a Linux kernel issue where nilfs_find_entry() ignored errors loading a directory folio/page, allowing corrupted images with large i_size to trigger repeated error messages and a task hang in vcs_open(). The root cause is error suppression when nilfs_get_folio() fails; t...

CVE-2024-53042

CVE-2024-53042 affects the Linux kernel’s ipv4/ip_tunnel code. The issue arises from paths where ip_tunnel_init_flow() is invoked without holding the RCU read lock, triggering a suspicious RCU usage warning. The fix uses l3mdev_master_upper_ifindex_by_index() to acquire the RCU read lock before c...

CVE-2024-53129

CVE-2024-53129 affects the Linux kernel DRM Rockchip VOP as described. The root cause was a NULL-dereference in vop_plane_atomic_async_check() where 'state' could be dereferenced before a NULL check; patch fixes crtc_state validation (rockchip_drm_vop.c:1096). Connected advisories confirm the iss...

CVE-2024-53210

CVE-2024-53210 affects the Linux kernel (s390/iucv) where passing MSG_PEEK to skb_recv_datagram() increments skb->users refcount and iucv_sock_recvmsg() does not decrement it, causing a skb memory leak during skb_queue_purge() and a WARN_ON during socket destruction. The fix is to decrement sk...

CVE-2024-56572

CVE-2024-56572 : In the Linux kernel, the media: platform: allegro-dvt path fixes a memory-leak in allocate_buffers_internal(). The buffer allocated in the loop may leak if not released on the exception path; the fix ensures the buffer is freed when allegro_alloc_buffer fails. This addresses a lo...

CVE-2024-56678

The Linux kernel contains a vulnerability in powerpc/mm/fault where the copy_from_kernel_nofault() function can trigger page faults when reading unmapped kfence objects from /proc/kzone . This occurs because the function incorrectly relies on kfence to handle faults instead of using the fixup tab...

CVE-2024-56724

CVE-2024-56724 affects the Linux kernel MFD driver for Intel/PMIC (intel_soc_pmic_bxtwc). The connected docs confirm a concrete root cause: the driver previously treated TMU devices under a single IRQ domain, causing mismatched IRQ domains across MFD devices. The fix is to rework the driver to us...

CVE-2024-56765

CVE-2024-56765 relates to the Linux kernel (powerpc/pseries/vas) where a close() callback was added to vas_vm_ops to fix a use-after-free/memory access during migration. The vulnerability stemmed from the VAS window’s VMA address being saved when a paste address is mapped and not being updated up...

CVE-2024-57996

The CVE-2024-57996 issue affects the Linux kernel’s net_sched sch_sfq code, where a limit of 1 packet is mishandled, causing an array-index-out-of-bounds. The vulnerability can lead to a UBSAN crash in sfq_link/sfq_dequeue path when qlen handling interacts with SFQ limits, notably under scenarios...

CVE-2025-21787

CVE-2025-21787 affects the Linux kernel's team subsystem due to insufficient validation of TEAM_OPTION_TYPE_STRING in the net/TEAM code paths. The root cause is validated data handling in team_mode_get/ team_mode_option_set/ team_option_set, with inline occurrences in team_core.c:480, 607, 1401 a...

CVE-2025-21806

CVE-2025-21806 : Linux kernel vulnerability in net.core.dev_weight where setting dev_weight to 0 can cause NAPI backlog processing to misbehave and napi to be re-polled repeatedly, potentially triggering a stall until softirq timeout. Reproducing issue: sysctl -w net.core.dev_weight=0 followed by...

CVE-2025-21917

Summary of CVE-2025-21917 (Renesas USBHS issue) : In the Linux kernel, the USB Renesas USBHS driver (usb: renesas_usbhs) could crash when performing continuous unbind/bind operations on USB drivers for the Renesas RZ/G2L SoC. The root cause is related to the usbhsc_notify_hotplug() path and invol...

CVE-2025-22058

CVE-2025-22058 affects the Linux kernel UDP memory accounting. When INT_MAX was used for SO_RCVBUF, an overflow in udp_rmem_release() could wrap the total UDP memory, causing memory accounting to double after socket close and potentially leading to packet drops once rmem_alloc exceeded net.ipv4.u...

CVE-2025-22105

CVE-2025-22105 affects the Linux kernel bonding driver. When an XDP program is attached to a bonded interface, changing the bond mode may trigger a warning inside bond_xdp_set. The fix adds a check for the presence of an XDP program when setting bond mode, since some modes (e.g., balance-rr with ...

CVE-2009-3547

CVE-2009-3547 refers to multiple race conditions in fs/pipe.c of the Linux kernel before 2.6.32-rc6. The flaws can allow local users to cause a denial of service (NULL pointer dereference and system crash) or gain privileges by opening an anonymous pipe via a /proc/*/fd/ pathname. A fix is availa...

CVE-2015-0569

CVE-2015-0569 is a heap-based buffer overflow in the WLAN private wireless extensions IOCTL path (wlan_hdd_wext.c) of the Linux kernel 3.x–4.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices. The vulnerability allows a local attacker to escalate privileges via ...

CVE-2015-8816

CVE-2015-8816 affects the Linux kernel prior to 4.3.5, where hub_activate in drivers/usb/core/hub.c mishandles hub-interface data. Physically proximate attackers can unplug a USB hub to trigger invalid memory access and a system crash (DoS); impact may be unspecified otherwise. A fixed version ex...

CVE-2017-16538

CVE-2017-16538 refers to a vulnerability in the Linux kernel (drivers/media/usb/dvb-usb-v2/lmedm04.c) up to version 4.13.11. A local user can cause a denial of service (general protection fault and system crash) or potentially other impact by plugging a crafted USB device. The root cause is a mis...

CVE-2017-7187

The CVE-2017-7187 issue affects the Linux kernel sg_ioctl in drivers/scsi/sg.c, where a large SG_NEXT_CMD_LEN ioctl can trigger a stack-based buffer overflow, leading to a DoS or potentially other impact via out-of-bounds writes in sg_write. Descriptions across connected sources (CNVD-2017-03858)...

CVE-2018-11506

CVE-2018-11506 affects the Linux kernel’s sr_do_ioctl (drivers/scsi/sr_ioctl.c) through version 4.16.12. The issue arises because sense buffers at the CDROM layer and SCSI layer use different sizes, enabling a local attacker to trigger a stack-based buffer overflow via CDROMREADMODE2 ioctl, poten...

CVE-2021-38203

CVE-2021-38203 affects the btrfs component in the Linux kernel, with the issue present in versions before 5.13.4. The root cause is a race condition during allocations of new system chunks when space is scarce in space_info, which can lead to a denial-of-service (deadlock) for local attackers. Pu...

CVE-2021-47018

CVE-2021-47018 – Mode C (details available) Affected software: Linux kernel on PPC64 (powerpc/64). Issue: PPC64 fixmap area was defined at the top of the address space or just below KASAN, which is not valid for PPC64. The fix implements using the top of the I/O space for the fixmap area, with a ...

CVE-2022-48672

CVE-2022-48672 is a Linux kernel issue in the device-tree flattening path: in unflatten_dt_nodes(), an off-by-one error can overflow the nps[] buffer due to an unfixed depth check in the loop. The problem was fixed by commit 78c44d910d3e, in which the depth handling during unflattening was correc...

CVE-2022-48969

CVE-2022-48969 applies to the Linux kernel Xen netfront driver. The issue arises during live migration: a NAPI polling path is created for a sr-ing, but the old NAPI is not deleted promptly when the source string is nulled and the new one is set on the target host. This creates a tiny window wher...