CVE-2009-1439

The CVE-2009-1439 entry describes a buffer overflow in CIFS/Tree Connect handling (fs/cifs/connect.c) of the Linux kernel prior to 2.6.30, where a long nativeFileSystem field in an SMB mount response can cause a remote crash (DoS). The vulnerability affects the Linux kernel’s CIFS implementation ...

CVE-2010-3081

CVE-2010-3081 describes a local privilege-escalation in the Linux kernel’s 64-bit compat layer due to missing sanity checks in compat_alloc_user_space, enabling a local user to abuse compat_mc_getsockopt controlling a length value. Affected: kernel 2.6.x before 2.6.36-rc4-git2 on 64-bit platforms...

CVE-2015-0571

CVE-2015-0571 is a local privilege-escalation in the WLAN driver for the Linux kernel as used in Qualcomm QuIC Android contributions (MSM devices and related products). The issue arises from the driver’s lack of authorization checks for private SET IOCTL calls, allowing a crafted application to g...

CVE-2016-4485

The CVE-2016-4485 issue affects the Linux kernel (net/llc/af_llc.c): the llc_cmsg_rcv path does not initialize a data structure, enabling a local attacker to read kernel stack memory and obtain sensitive information. Public references in connected documents indicate this vulnerability existed in ...

CVE-2016-4794

CVE-2016-4794 is a local-use-after-free in the Linux kernel’s percpu allocator (mm/percpu.c) up to version 4.6. A crafted mmap/bpf usage could cause a denial of service or potentially other unspecified impact. The IBM advisories list fixes at code levels 7.7.1.9, 7.8.1.6, 8.1.1.2, and 8.1.2.1 for...

CVE-2016-9756

CVE-2016-9756 affects Linux kernel’s x86 KVM emulation (arch/x86/kvm/emulate.c). The root cause is improper initialization of Code Segment (CS) in certain error paths, enabling a local attacker to read sensitive kernel stack memory via a crafted user-space program. A fix was released in Linux ker...

CVE-2017-18204

CVE-2017-18204 affects the Linux kernel via ocfs2_setattr in fs/ocfs2/file.c, exploitable by local users to cause a denial-of-service (deadlock) when using DIO. The vulnerability exists in kernel versions before 4.14.2; Ubuntu advisories (USN 3617-3 and related) and Unity Linux advisories referen...

CVE-2017-7487

The CVE-2017-7487 issue is in the Linux kernel net/ipx/af_ipx.c ipxitf_ioctl: reference count mishandling causes a use-after-free via a failed SIOCGIFADDR on an IPX interface, enabling local denial of service. Evidence in connected Nessus advisories confirms the vulnerability and that it affects ...

CVE-2019-15223

CVE-2019-15223 affects the Linux kernel up to version 5.1.7 where a NULL pointer dereference can be triggered by a malicious USB device in the sound/usb/line6/driver.c driver. This is a local physical attack vector through USB, potentially causing a kernel crash by dereferencing a NULL pointer. T...

CVE-2019-25045

CVE-2019-25045 is a Linux kernel use-after-free in the XFRM subsystem (xfrm_state_fini panic) reported for kernels before 5.0.19. Publicly documented references from EulerOS and Unity Linux advisories confirm the issue and link the fix to kernel 5.0.19 (and related upstream commit). The impact is...

CVE-2021-47515

CVE-2021-47515 affects Linux kernel segmentation with IPv6 SRH encapsulation. When an IPv4 packet is received, the kernel assigns the receiving interface index to IPCB(iif). If that packet is later encapsulated in an outer IPv6+SRH header, seg6_do_srh_encap clears the IPv6 socket state (IP6CB) an...

CVE-2022-47519

CVE-2022-47519 affects the Linux kernel prior to 6.0.11 due to missing validation of IEEE80211_P2P_ATTR_OPER_CHANNEL in the WILC1000 driver (drivers/net/wireless/microchip/wilc1000/cfg80211.c). This can trigger an out-of-bounds write when parsing the channel list attribute from Wi‑Fi management f...

CVE-2022-4842

CVE-2022-4842 concerns a NULL dereference in the Linux kernel NTFS3 driver’s attr_punch_hole() function. The flaw is described as a NULL pointer dereference that can be triggered locally by a user, leading to a system crash. The vulnerability is discussed in multiple sources (e.g., Astra Linux se...

CVE-2022-49034

CVE-2022-49034 relates to a Linux kernel issue where, when CONFIG_CPUMASK_OFFSTACK and CONFIG_DEBUG_PER_CPU_MAPS are enabled, cpu_max_bits_warn() emits a runtime warning while reading /proc/cpuinfo due to iterating CPUs with NR_CPUS. The patch fixes the warning by iterating up to nr_cpu_ids (runt...

CVE-2022-49264

CVE-2022-49264 (Linux kernel) : The issue fixes how argv is passed to execve when argc is 0. The kernel now forces a single empty string into argv and sets argc to 1, accounting for extra stack space in bprm_stack_limits and emitting a WARN message to notify userspace: “process './argc0' launched...

CVE-2022-49283

Technical details for CVE-2022-49283 are not provided in the connected documents. Public details here are limited to the fix note; no affected products/versions/exploit info is given. Monitor for updates.

CVE-2022-49434

The CVE-2022-49434 issue is in the Linux kernel where pci_dev_lock() historically acquired the config space access lock before the device lock, risking AB/BA deadlocks with sriov_numvfs_store() that already takes the device lock first. The fix is to reverse the order in pci_dev_lock() so it acqui...

CVE-2022-49594

CVE-2022-49594 : In the Linux kernel, a data race around reading sysctl_tcp_mtu_probe_floor could occur because the value was updated concurrently while read. The fix was to add READ_ONCE() to the reader, mitigating a local-exploit class and preserving availability. The connected advisories/refs ...

CVE-2022-49644

CVE-2022-49644 affects the Linux kernel's DRM/I915 component, addressing a possible refcount leak in intel_dp_add_mst_connector. If drm_connector_init fails, the driver must drop the port refcount before calling intel_connector_free to avoid leaks. The issue is tied to a cherry-picked commit (cea...

CVE-2022-49666

CVE-2022-49666 concerns the Linux kernel, specifically the powerpc/memhotplug path. The issue arises from an add_pages override for PPC, where the kernel began validating addresses against high_memory after commit ffa0b64e3be5 (powerpc: Fix virt_addr_valid() for 64-bit). This leads to a BUG_ON in...

CVE-2023-52927

CVE-2023-52927 affects the Linux kernel netfilter feature: nf_conntrack_in() calling nf_ct_find_expectation() currently removes the exp from the hash table, which could occur before the created connection is confirmed. The patch introduces a mechanism to keep the exp when the tmpl’s status has IP...

CVE-2024-38661

CVE-2024-38661 is a Linux kernel vulnerability affecting the s390/ap subsystem. The issue stems from using signed int for internal bitmap-related variables in ap_parse_bitmap_str, allowing overflow during updates to /sys/bus/ap/apmask and related fields, which could trigger a kernel panic (panic_...

CVE-2024-40919

CVE-2024-40919 discusses a Linux kernel bnxt_en issue where a released token (token->state == BNXT_HWRM_DEFERRED) could be logged while the token pointer had already been NULL, risking a NULL pointer dereference. The fix implemented is to add a token pointer check before using the token in log...

CVE-2024-42101

CVE-2024-42101 : In the Linux kernel, the drm/nouveau driver fix for a NULL pointer dereference in nouveau_connector_get_modes. The bug occurred when drm_mode_duplicate() failed, its return value was assigned to mode without a NULL check, potentially dereferencing a NULL pointer. The patch adds a...

CVE-2024-42114

CVE-2024-42114 : Linux kernel vulnerability in wifi cfg80211 code where NL80211_ATTR_TXQ_QUANTUM values were not properly validated, enabling a local attacker to trigger soft lockups/DoS by setting TXQ_QUANTUM to 2^31. The issue is tied to lack of proper range checks in nl80211.c and parallels a ...

CVE-2024-43846

CVE-2024-43846 is a Linux kernel vulnerability in the lib: objagg component that could trigger a general protection fault. The issue occurs because nesting of aggregated objects is disallowed when there is no parent, but the hints-based aggregation path lacked a check, violating the nesting assum...

CVE-2024-43870

CVE-2024-43870 : In the Linux kernel perf subsystem, a window exists during task_exit where pending sigtrap deliveries may be queued but not added to the event’s task_work due to a failure when adding the event’s callback to task_work. This creates a small window in which the event refcount can b...

CVE-2024-46747

CVE-2024-46747 : In the Linux kernel, the Cougar 500k Gaming Keyboard driver was vulnerable to a slab-out-of-bounds Read in cougar_report_fixup due to a missing verification of the report descriptor size before access. The root cause is in report_fixup not validating the descriptor length prior t...

CVE-2024-46770

CVE-2024-46770 applies to the Linux kernel; the issue arises in the PF reset flow where netif_device_attach/detach handling allows ethtool callbacks during reset to dereference deleted resources. Root cause: ethtool coalesce access during reset can hit a NULL dereference when the driver resources...

CVE-2024-47703

CVE-2024-47703 — Linux kernel (BPF-LSM return value) details . A BPF program attached to the file_alloc_security LSM hook could cause a kernel panic if the LSM returns a positive value, which the kernel could misinterpret as a file pointer. The issue arises because the positive return was not val...

CVE-2024-47730

The CVE-2024-47730 entry concerns the Linux kernel vulnerability crypto: hisilicon/qm - inject error before stopping queue. The issue arises when the accelerator core reports memory errors; the driver injects a qm error to close the master ooo before stopping the queue, preventing access to memor...

CVE-2024-49870

CVE-2024-49870 (Linux kernel, cachefiles) summary : The vulnerability arises in cachefiles when a dentry leak can occur if a lookup cookie and a cull run concurrently in cachefiles_open_file(). The leak happens because the code path may fail to release a reference to a dentry, potentially leaving...

CVE-2024-49902

CVE-2024-49902 in the Linux kernel affects the JFS dmmap path. The root cause is an out-of-bounds condition in dbSplit when dmt_leafidx exceeds the number of leaves per dmap tree; a bounds check was added in dbFindLeaf. Shaggy’s change also extends the sanity check to cover control pages in addit...

CVE-2024-49996

CVE-2024-49996 affects the Linux kernel CIFS/SMB client when parsing NFS reparse points. The root cause is a buffer length miscalculation in cifs_strndup_from_utf16() that doesn’t subtract InodeType size from ReparseDataLength, allowing reads past the buffer. The InodeType field and Major/Minor R...

CVE-2024-50002

CVE-2024-50002 affects the Linux kernel’s static_call subsystem. The root cause is a union in struct static_call_key where key::mods and key::sites share a pointer and are distinguished by a bit, but static_call_del_module() assumed a valid static_call_mod pointer and dereferenced it when an allo...

CVE-2024-50063

CVE-2024-50063 concerns the Linux kernel BPF tail calls where a program attached to one kernel hook tail-calling another with a different prototype could bypass ctx-parameter verification and return-value constraints. The issue arises when progs attached to func1 and func2 have different paramete...

CVE-2024-50077

CVE-2024-50077 — Linux kernel Bluetooth ISO init issue (net/bluetooth/iso.c) : The vulnerability arises when debugfs is disabled (bt_debugfs creation failure) causing iso_init() to return early and not set iso_inited, enabling subsequent calls to trigger duplicate registrations (proto_register(),...

CVE-2024-50275

The CVE (CVE-2024-50275) affects the Linux kernel on arm64 with SVE traps. A race allows stale FPSIMD/SVE state to be reused across preemption, leading to SVE traps while TIF_SVE is set and potentially incorrect live state handling. The fix detaches from the saved CPU state when not live by calli...

CVE-2024-56754

CVE-2024-56754: Linux kernel vulnerability in crypto: caam where the pointer passed to caam_qi_shutdown() was derived from a devm_add_action_or_reset() parameter of type struct caam_drv_private *, but cast to struct device *. The connected Astra Linux advisory confirms the fix: Pass the correct p...

CVE-2024-58058

CVE-2024-58058 affects the Linux kernel ubifs component. The root cause is a null pointer dereference when c->zroot.znode becomes NULL (after slab cache clearing), causing a crash during tnc tree dumping. The vulnerability is described as resolved, with references in multiple advisories indica...

CVE-2025-21735

CVE-2025-21735 affects the Linux kernel NFC (nci) component, specifically nci_hci_create_pipe(). The pipe value is a net-sourced u8; if it exceeds 127, it can cause memory corruption in the caller, nci_hci_connect_gate(), per the advisory. The description confirms the issue has been resolved in t...

CVE-2025-21916

CVE-2025-21916 is part of Unity Linux/Fedora kernel advisories describing a fix for a flaw in USB ATM CXACRU endpoint checking. The root cause was insufficient verification of USB endpoint addresses in cxacru_bind(), leading to incorrect URB handling (e.g., bogus urb xfers). The mitigation is to ...

CVE-2025-37752

CVE-2025-37752 is a Linux kernel vulnerability affecting the scheduler, specifically net_sched: sch_sfq. The root cause is that limit validation could be bypassed if the limit was indirectly updated as other parameters changed. The fix moves the limit validation to the end of the configuration up...

CVE-2025-38106

Mode C: Concrete details found. The CVE-2025-38106 issue is in the Linux kernel io_uring/sqpoll path, where a use-after-free of sq->thread could occur when __io_uring_show_fdinfo() uses a freed task_struct. The SUSE/OpenSUSE advisory notes the fix: assign and look up sq->thread under RCU wi...

CVE-2011-0521

The CVE-2011-0521 issue affects the Linux kernel’s dvb_ca_ioctl in drivers/media/dvb/ttpci/av7110_ca.c, where the sign of a certain integer field is not checked in versions before 2.6.38-rc2. This allows local users to cause a denial of service via memory corruption and potentially other unspecif...

CVE-2015-2666

CVE-2015-2666 : The Linux kernel contains a stack-based buffer overflow in get_matching_model_microcode (arch/x86/kernel/cpu/microcode/intel_early.c) that can be exploited by a context-dependent local attacker with root privileges to write to the initrd. The description in connected advisories co...

CVE-2016-7916

CVE-2016-7916 is a Linux kernel local privilege disclosure affecting the environ_read path in fs/proc/base.c. The race condition between environment-variable copying and process setup allows a local user to read sensitive data from kernel memory by accessing a /proc/*/environ file during the setu...

CVE-2017-7294

The CVE-2017-7294 issue affects the Linux kernel up to 4.10.6, specifically vmwgfx vmw_surface_define_ioctl() in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c. A crafted ioctl to /dev/dri/renderD* can trigger an integer overflow and out-of-bounds write, causing denial of service (system hang/crash) and...

CVE-2018-16885

The CVE-2018-16885 issue is a Linux kernel vulnerability (affecting kernel 3.10.x as shipped with Red Hat Enterprise Linux 7) where userspace can call memcpy_fromiovecend() and similar functions with a zero offset and buffer length, causing a read beyond the buffer boundaries. This can lead to a ...

CVE-2019-19050

CVE-2019-19050 describes a memory leak in the Linux kernel’s crypto_reportstat() path (crypto/crypto_user_stat.c) that can cause a denial of service via memory consumption when crypto_reportstat_alg() fails, affected up to kernel 5.3.11. Connected Nessus advisories (Unity Linux UTSA-2026-003794 a...