CVE-2024-46754

CVE-2024-46754 : Linux kernel BPF local vulnerability fixed by removing tst_run from lwt_seg6local_prog_ops. Syzbot showed lwt_seg6 BPF ops could be invoked via bpf_test_run() without entering input_action_end_bpf() first. Patch removes test_run for BPF_PROG_TYPE_LWT_SEG6LOCAL; root cause involve...

CVE-2024-46828

CVE-2024-46828 affects the Linux kernel schedulers, specifically the cake qdisc’s host-fairness logic. A hash-collision interaction could trigger an unintended decrement of per-host bulk-flow counters when a flow’s state changes, and when host fairness is enabled this could wrap a per-host counte...

CVE-2024-50070

Technical details for CVE-2024-50070 are not provided in the connected documents. Monitor for updates from the kernel advisories and OSV/USN entries to obtain affected products, affected versions, impact, and fixes.

CVE-2024-56641

The CVE-2024-56641 issue affects the Linux kernel net/smc code. The vulnerability arises when smc_close_cancel_work is triggered (e.g., on RDMA driver unload and LGR termination), causing conn->close_work to be flushed before it has been initialized, which leads to a WARN_ON(!work->func) du...

CVE-2024-56727

Technical details for CVE-2024-56727 are not provided in the connected documents. No affected product/version or remediation is disclosed here. Monitor for updates.

CVE-2024-57911

In CVE-2024-57911, a Linux kernel vulnerability in iio: dummy caused potential information leakage via a triggered buffer. The data buffer allocated with kmalloc() was not initialized for inactive channels, risking uninitialized data being pushed to userspace. The root cause is that iio_for_each_...

CVE-2025-21650

Technical details about CVE-2025-21650 are not provided in the connected documents. The initial description is detailed, but there is no supplementary data in the connected sources to confirm affected products/versions, impact, or fixes. Monitor for updates.

CVE-2025-21905

CVE-2025-21905 refers to a Linux kernel issue in the iwlwifi path where a printed string from a firmware TLV could read beyond the buffer due to missing NUL-termination. The root cause is printing beyond the end of the TLV if the file isn’t NUL-terminated, potentially reading past the file buffer...

CVE-2025-21948

CVE-2025-21948 is a Linux kernel issue affecting HID appleir. The report describes a NULL pointer dereference in input_event() triggered by malformed AppleIR reports, leading to a crash if a NULL input_dev is encountered. The fix adds a guard: check the HID_CLAIMED_INPUT flag and exit the event h...

CVE-2025-22020

CVE-2025-22020 pertains to the Linux kernel memstick subsystem, fixing a slab-use-after-free in rtsx_usb_ms_drv_remove that could crash via rtsx_usb_ms_poll_card. Affected code path involves memstick host allocation during driver probe and removal, with a use-after-free arising from freeing drive...

CVE-2025-23136

CVE-2025-23136 (Linux kernel, thermal/int340x): The issue arises when an ACPI companion fwnode is missing and the kernel may dereference a NULL adev in int3402_thermal_probe() (and similarly in int3400_thermal_probe()). The fix adds a NULL check for adev and returns -ENODEV when it is not set, pr...

CVE-2025-37796

CVE-2025-37796 affects the Linux kernel wifi driver for at76c50x. The root cause is a use-after-free in at76_disconnect: after freeing the priv object (via ieee80211_free_hw) the code accesses the freed object’s udev field to manage the USB device, which can also cause a memory leak. The issue is...

CVE-2010-3301

Summary: CVE-2010-3301 affects the Linux kernel IA32 system call emulation on x86_64 where the 32‑bit entry path to ptrace does not zero‑extend %eax, enabling local privilege escalation via an out‑of‑bounds access to the syscall table. Impact: local users can gain privileges. Affected versions: k...

CVE-2014-3673

The vulnerability CVE-2014-3673 affects the SCTP implementation in the Linux kernel up to version 3.17.2. A malformed ASCONF chunk can be sent by a remote attacker to trigger a denial of service (system crash). Affected components are net/sctp/sm_make_chunk.c and net/sctp/sm_statefuns.c. Remediat...

CVE-2015-2830

CVE-2015-2830 affects the Linux kernel (arch/x86/kernel/entry_64.S) prior to 3.19.2. The TS_COMPAT flag can reach a user-mode task, potentially allowing local attackers to bypass seccomp or audit protections via crafted applications using fork or close. A fix is available in 3.19.2 and later; att...

CVE-2015-7613

CVE-2015-7613 is a Linux kernel race condition in the IPC object implementation (up to version 4.2.3) that can allow a local unprivileged user to escalate privileges by triggering ipc_addid, which uses uid/gid values from uninitialized data (topics include msg.c, shm.c, util.c). Connected sources...

CVE-2016-1575

CVE-2016-1575 concerns the overlayfs implementation in the Linux kernel up to 4.5.2, which, according to the provided documents, does not properly maintain POSIX ACL xattr data. This can allow local users to gain privileges by leveraging a group-writable setgid directory. The connected Nessus ent...

CVE-2017-8797

CVE-2017-8797 affects the Linux kernel NFSv4 server. A remote attacker can send NFSv4 pNFS GETDEVICEINFO or LAYOUTGET operands in UDP; an uninitialized layout type is used as an array index, causing an OOPS and potentially a system DoS via knfsd soft-lockup. Affected: Linux kernel versions prior ...

CVE-2018-7480

The CVE-2018-7480 issue affects the Linux kernel, where blkcg_init_queue in block/blk-cgroup.c (pre-4.11) can be triggered by a creation failure to cause a double-free and potential unspecified impact. Public sources in the connected documents consistently describe a local-denial-of-service risk ...

CVE-2020-36691

CVE-2020-36691 affects the Linux kernel up to and including versions prior to 5.8. The flaw is in lib/nlattr.c where a nested Netlink policy with a back reference can trigger unbounded recursion, causing a denial of service. A patch was merged in kernel 5.8 (per ChangeLog-5.8); users should upgra...

CVE-2020-9391

CVE-2020-9391 affects the Linux kernel on AArch64 (versions 5.4 to 5.5.6). The top byte of the address passed to brk is ignored, potentially moving the program break downward instead of upward, which can cause heap corruption in glibc malloc. Public sources in the connected documents consistently...

CVE-2022-48632

CVE-2022-48632 — The Linux kernel flaw in the i2c mlxbf driver allows a stack overflow via an unbounded memcpy loop in mlxbf_i2c_smbus_start_transaction() because the upper bound of operation->length is not checked and data_idx increments. Public docs in connected Nessus advisories reference t...

CVE-2022-48786

CVE-2022-48786 – summary The issue is in the Linux kernel’s vsock path: if a connect() is interrupted by a signal while a socket is in the TCP_ESTABLISHED state, the socket may remain in the vsock connected table and could be re-added, corrupting the list. The patch fixes this by calling vsock_re...

CVE-2022-48975

CVE-2022-48975 concerns a memory leak in Linux kernel GPIO handling. The backtrace shows the leak occurs during gpiochip_setup_dev() when registering GPIO devices, with resources allocated in device_private_init() not released on error paths. The fix moves the release logic to use put_device() to...

CVE-2022-49028

CVE-2022-49028 concerns the Linux kernel ixgbevf driver. The advisory notes a resource leak in ixgbevf_init_module(): when pci_register_driver() fails, the workqueue created by create_singlethread_workqueue() is not destroyed. The fix adds destroy_workqueue() in the failure path to prevent the le...

CVE-2022-49372

CVE-2022-49372 affects the Linux kernel where tcp_rtx_synack() can be invoked from process context during a Fast Open TCP backlog/backlog processing sequence when CONFIG_DEBUG_PREEMPT is enabled. The issue arises as a SYN retransmit is processed in process context, cooking a SYN-ACK in that conte...

CVE-2022-49534

CVE-2022-49534 in the Linux kernel concerns a memory leak in the lpfc driver when NPIV ports send PLOGI_RJT. The description states a leak could originate from allocations in lpfc_ignore_els_cmpl() and lpfc_els_rsp_reject(), tied to login_mbox context and service parameter buffers. The remedy is ...

CVE-2022-49644

CVE-2022-49644 affects the Linux kernel's DRM/I915 component, addressing a possible refcount leak in intel_dp_add_mst_connector. If drm_connector_init fails, the driver must drop the port refcount before calling intel_connector_free to avoid leaks. The issue is tied to a cherry-picked commit (cea...

CVE-2023-52859

CVE-2023-52859 affects the Linux kernel perf: hisi uncore PMU registration. A use-after-free can occur when the PMU register path fails and the uncore PMU offline callback is invoked, potentially migrating the PMU context. The fix replaces cpuhp_state_remove_instance() with cpuhp_state_remove_ins...

CVE-2023-52926

CVE-2023-52926 is a Linux kernel vulnerability where IORING_OP_READ does not fully consume the provided buffer list when read returns a negative value (except -EAGAIN/-EIOCBQUEUED). This can cause a use-after-free when the completion io_rw_done runs in a different context. The issue is documented...

CVE-2024-0582

The CVE-2024-0582 issue affects the Linux kernel io_uring subsystem, specifically the IORING_REGISTER_PBUF_RING path where a user registers, mmaps, and frees a buffer ring. The vulnerability is a memory leak that can be exploited by a local user to crash the system or potentially escalate privile...

CVE-2024-25741

The CVE-2024-25741 issue affects the Linux kernel component printer_write in drivers/usb/gadget/function/f_printer.c (up to kernel 6.7.4). It states that usb_ep_queue is not called properly, which may allow a local attacker to cause a denial of service or other unspecified impact. The connected O...

CVE-2024-26785

CVE-2024-26785 (Linux kernel) fixed a protection fault in iommufd_test_syz_conv_iova due to iommufd_access_change_ioas() setting access->ioas to NULL, creating a race where the lock could be invalid concurrently. The fix aligns with existing sanity checks in iommufd_access_rw() and iommufd_acc...

CVE-2024-26945

CVE-2024-26945 affects the Linux kernel crypto: iaa code. The root cause is when nr_cpus = 1 when nr_iaa > 0 or when nr_iaa == 0. If exploitation details or versioned fixes are needed, refer to the kernel patch references in the CVE record.

CVE-2024-27404

CVE-2024-27404 (Linux kernel) : A data race on remote_id in mptcp was fixed. The issue was resolved by adding appropriate ONCE annotations to the remote_id path to prevent races. Patches were applied in stable Linux kernels (see linked git.kernel.org patches). The CVSS v3.1 vector indicates a Loc...

CVE-2024-35979

The connected MiracleLinux AXSA advisory documents CVE-2024-35979 and describes the Linux kernel raid1 use-after-free in raid1_write_request() where r1_bio->bios[] temporarily pointed to the original bio and could be freed if a blocked rdev was encountered, freeing the underlying bios. The mit...

CVE-2024-36884

The CVE-2024-36884 issue affects the Linux kernel’s IOMMU arm-smmu path. The vulnerability arose from using the wrong type in nvidia_smmu_context_fault() via a function pointer indirection, causing miscalculation of an offset when iommu_domain is embedded at a non-zero offset, leading to a NULL d...

CVE-2024-39479

CVE-2024-39479 affects the Linux kernel (drm/i915) and is caused by device-managed resources in hwmon and hwmon drvdata not reliably released in a defined order on device unbind, creating a potential use-after-free if hwmon is accessed after drvdata is freed. The public details confirm two releas...

CVE-2024-43823

CVE-2024-43823 is a Linux kernel PCI keystone issue where a DT error can cause a NULL pointer dereference in ks_pcie_setup_rc_app_regs when IORESOURCE_MEM is missing. The description in the sources states the bug occurs if a Device Tree error leads to a NULL in resource_list_first_type(), with pc...

CVE-2024-44981

In CVE-2024-44981, the Linux kernel vulnerability is in the workqueue path: shift_and_mask() constructs a mask with a signed immediate and is invoked with a shift of 31, leading UBSAN to report an integer subtraction overflow and triggering a kernel panic. The documented fix uses an unsigned cons...

CVE-2024-45025

CVE-2024-45025 affects the Linux kernel and relates to bitmap handling in the close_range path of file descriptor tables. The issue arises in copy_fd_bitmaps(), which copies words into full_fds_bits[] and may leave garbage in the last word if bits beyond the cutoff aren’t clear. The root cause is...

CVE-2024-47698

CVE-2024-47698 (Linux kernel) affects DVB frontends rtl2830/rtl2832 in the media/dvb-frontends subsystem. The issue is an out-of-bounds write in the pid_filter logic for rtl2832, caused by not enforcing the maximum index on bit manipulations (dev->filters is 32-bit; indices must be 0–31). The ...

CVE-2024-47715

Summary: CVE-2024-47715 affects the Linux kernel’s wifi mt76 driver for MT7915 on MT7986. The issue stemmed from mt7915_band_config() setting band_idx to 1 on the main phy for MT7986 with MT7975_ONE_ADIE or MT7976_ONE_ADIE, which caused a dereference of the phys array via wcid->phy_idx in mt76...

CVE-2024-49863

Summary (CVE-2024-49863) A Linux kernel vulnerability in vhost/scsi allowed a null pointer dereference in vhost_scsi_get_req() when handling certain AN SCSI requests. The bug occurred after vhost_scsi_ctl_handle_vq() could assign vc.target = NULL for AN requests; later, vhost_scsi_get_req() deref...

CVE-2024-49924

CVE-2024-49924 affects the Linux kernel fbdev pxafb path. The vulnerability is a use-after-free caused by scheduling work (pxafb_task) in pxafb_init_fbinfo/pxafb_probe and freeing fbi->fb during pxafb_remove/unregister_framebuffer without canceling that work. The follow sequence shows the UAF ...

CVE-2024-49954

CVE-2024-49954: Linux kernel vulnerability fixed by replacing WARN_ON with pr_warn in static_call_module_notify() to avoid unnecessary fatal behavior on __static_call_add_module() memory allocation failures. The WARN_ON() could panic when panic_on_warn is set, whereas the memory allocation failur...

CVE-2024-50051

CVE-2024-50051 (Linux kernel) affects the mpc52xx SPI driver. The issue arises when a module is removed while a scheduled work item (ms->work) is still alive, because ms is freed via spi_unregister_controller but the work item may still be executed, enabling a use-after-free scenario. The fix ...

CVE-2024-50120

CVE-2024-50120 affects the Linux kernel SMB client. The vulnerability stems from missing checks for kstrdup failures when duplicating passwords in smb3_reconfigure(), leading to ses->password or ses->password2 allocation failures. The documented remediation is to return -ENOMEM if ses->p...

CVE-2024-50171

CVE-2024-50171 affects the Linux kernel BCM SYSPORT driver: bcm_sysport_xmit() can leak memory because skb is not freed when dma_map_single() fails, with a fix that frees the skb via dev_kfree_skb() and returns NETDEV_TX_OK. Public records indicate the issue is resolved in patched kernel releases...

CVE-2024-50235

The CVE affects the Linux kernel wifi stack, specifically the cfg80211 path. The root cause is not clearing wdev->cqm_config on free during unregister, which enables a double-free if the same wdev/netdev is re-registered in another network namespace and destroyed later. The documented impact i...