CVE-2024-50027

CVE-2024-50027 affects the Linux kernel thermal subsystem. The issue arises in thermal_zone_device_unregister() where the object tzp can be accessed after its memory is freed. The patch moves the freeing of tzp to after the removal completion, ensuring it cannot be accessed post-free. This repres...

CVE-2024-50056

CVE-2024-50056 pertains to the Linux kernel USB gadget UVC driver. The description documents a fix for an ERR_PTR dereference in uvc_v4l2.c, specifically preventing potential dereferencing of ERR_PTR() in find_format_by_pix() and uvc_v4l2_enum_format(). A related related issue is also addressed i...

CVE-2024-56544

CVE-2024-56544 details a kernel fix where the udmabuf folios array was changed from kmalloc to kvmalloc_array to support larger allocations. Under PAGE_SIZE=4096, MAX_PAGE_ORDER=10 (4MB memory limit for kmalloc), an udmabuf larger than 4MB could fail with a warning and NULL return. The patch enab...

CVE-2024-56640

Summary : CVE-2024-56640 affects the Linux kernel net/smc subsystem, related to a use-after-free caused by incorrect refcount handling of LGR/link. The issue can occur when refcnt reaches 0 and triggers premature clearing, or underflow after repeated releases, as observed in two call paths (LGR t...

CVE-2024-56662

CVE-2024-56662 affects the Linux kernel’s ACPI-NFIT path. The vulnerability is a vmalloc-out-of-bounds read in acpi_nfit_ctl, triggered when cmd_to_func accesses call_pkg->nd_reserved2 without validating that the buffer is sized as a struct nd_cmd_pkg. The root cause is a missing bounds check ...

CVE-2024-58058

CVE-2024-58058 affects the Linux kernel ubifs component. The root cause is a null pointer dereference when c->zroot.znode becomes NULL (after slab cache clearing), causing a crash during tnc tree dumping. The vulnerability is described as resolved, with references in multiple advisories indica...

CVE-2025-21763

Summary of CVE-2025-21763 : In the Linux kernel, __neigh_notify() can be invoked without RTNL or RCU protection, creating a potential use-after-free (UAF) scenario in neighbour handling. The mitigation is to apply RCU protection to neighbour notifications to prevent UAF. Connected advisories corr...

CVE-2025-21910

CVE-2025-21910 affects the Linux kernel (wifi: cfg80211: regulatory) where invalid user regulatory hints could pass through via regulatory_hint_user() into user_alpha2[]. The root cause involves isalpha() handling non-Latin symbols and a subsequent toupper() mutation that bypassed a prior check. ...

CVE-2025-21916

CVE-2025-21916 is part of Unity Linux/Fedora kernel advisories describing a fix for a flaw in USB ATM CXACRU endpoint checking. The root cause was insufficient verification of USB endpoint addresses in cxacru_bind(), leading to incorrect URB handling (e.g., bogus urb xfers). The mitigation is to ...

CVE-2025-21938

CVE-2025-21938 refers to a Linux kernel vulnerability in MPTCP where, when multiple connection requests create an implicit MPTCP endpoint in parallel, concurrent mptcp_pm_nl_get_local_id calls may delete the address entry created by a previous caller. The root cause is risky deletes via synchroni...

CVE-2025-22089

The CVE-2025-22089 issue concerns the Linux kernel RDMA/core subsystem where hw_counters could be exposed outside the init net namespace due to an incorrect container_of() cast in hw_stat_device_show(), which led to memory corruption when users read /sys/class/infiniband/mlx4_0/hw_counters from a...

CVE-2025-22104

The CVE-2025-22104 issue concerns the ibmvnic driver in the Linux kernel. The root cause was printing hex dumps by casting the buffer to an 8-byte long and using string formatters, which could trigger a read buffer overflow if the buffer size isn’t a multiple of 8. The fix introduces a new ibmvni...

CVE-2014-3673

The vulnerability CVE-2014-3673 affects the SCTP implementation in the Linux kernel up to version 3.17.2. A malformed ASCONF chunk can be sent by a remote attacker to trigger a denial of service (system crash). Affected components are net/sctp/sm_make_chunk.c and net/sctp/sm_statefuns.c. Remediat...

CVE-2014-7842

The CVE-2014-7842 issue affects the Linux kernel’s arch/x86/kvm/x86.c; a race condition prior to 3.17.4 can allow a guest OS user to trigger an MMIO/PIO‑driven emulation error report, causing a guest crash (denial of service). Public notes in Nessus advisories reference CVE-2010-5313 as related. ...

CVE-2015-7566

CVE-2015-7566 affects the Linux kernel driver drivers/usb/serial/visor.c (clie_5_attach). A USB device without a bulk-out endpoint can cause a NULL pointer dereference, leading to a denial of service and potential system crash. The vulnerability is confirmed by Nessus advisories referencing the v...

CVE-2016-5828

CVE-2016-5828 affects the Linux kernel on powerpc platforms (up to 4.6.3). The start_thread function mishandles transactional memory, allowing local users to cause a denial of service (invalid process state or TM Bad Thing exception, and system crash) by starting and suspending a transaction befo...

CVE-2017-5669

The vulnerability CVE-2017-5669 affects the Linux kernel’s do_shmat() in ipc/shm.c up to and including 4.9.12, where the rounding operation on the mapped address is not restricted. This allows local (privileged) users to map page zero and bypass the mmap protection mechanism via crafted shmget/sh...

CVE-2018-14613

CVE-2018-14613 affects the Linux kernel up to 4.17.10. It involves an invalid pointer dereference in io_ctl_map_page() when mounting/operating a crafted btrfs image, caused by a lack of block group item validation in fs/btrfs/tree-checker.c (check_leaf_item). The issue yields a local, likely kern...

CVE-2021-47321

CVE-2021-47321 : Linux kernel watchdog use-after-free due to del_timer() not waiting for the timer handler. The issue occurs in the driver remove path, where a timer may still be running after removal, risking a use-after-free. The fixed path uses del_timer_sync() to wait for the timer handler to...

CVE-2021-47579

Mode C: CVE-2021-47579 affects the Linux kernel overlayfs component (ovl) with a WARN_ON path in ovl_workdir_create() when mkdir returns a dentry without an inode (not instantiated). The fix, described in the connected advisories, calls ovl_mkdir_real() directly from ovl_workdir_create() and reje...

CVE-2022-48975

CVE-2022-48975 concerns a memory leak in Linux kernel GPIO handling. The backtrace shows the leak occurs during gpiochip_setup_dev() when registering GPIO devices, with resources allocated in device_private_init() not released on error paths. The fix moves the release logic to use put_device() to...

CVE-2022-49078

The CVE-2022-49078 issue is a Linux kernel LZ4 decompression vulnerability: in LZ4_decompress_safe_partial, read-out-of-bounds can occur during partial decoding, potentially enabling a use-after-free in extreme corrupted-data cases as reported by KASAN. Upstream fixes in lz4 address this, and ker...

CVE-2022-49545

CVE-2022-49545 concerns the Linux kernel ALSA USB audio path: a race during closing a USB MIDI output substream where a pending work could access the released rawmidi runtime object. The fix cancels the pending work on substream close to prevent the access. Documented via multiple advisories and ...

CVE-2022-49632

CVE-2022-49632 is a Linux kernel data-race vulnerability in icmp: reading sysctl_icmp_errors_use_inbound_ifaddr can race with concurrent writes. The fix adds READ_ONCE() to the reader. CVSSv3.1 indicates a Local access requirement, High attack complexity, Low privileges, no user interaction, with...

CVE-2023-52658

CVE-2023-52658 is referenced in MiracleLinux advisory AXSA:2024-8938:33 for MiracleLinux 9. The advisory lists a Linux kernel issue: “net/mlx5: Block entering switchdev mode with ns inconsistency” that was reverted in the upstream commit 662404b24a4c4d839839ed25e3097571f5938b9b, due to instabilit...

CVE-2023-52837

In CVE-2023-52837, the Linux kernel fixed a use-after-free in nbd_open triggered when a disk is opened after nbd_put() because disk->private_data could still reference freed memory. The fix adds a dedicated ->free_disk hook that frees the private data as part of disk cleanup (blk_cleanup_di...

CVE-2024-25741

The CVE-2024-25741 issue affects the Linux kernel component printer_write in drivers/usb/gadget/function/f_printer.c (up to kernel 6.7.4). It states that usb_ep_queue is not called properly, which may allow a local attacker to cause a denial of service or other unspecified impact. The connected O...

CVE-2024-26634

CVE-2024-26634 — Normal mode Affected: Linux kernel net subsystem involving network namespace handling. Summary: A BUG triggered when removing a net namespace with conflicting interface altnames could cause the main interface name to be overwritten during the namespace teardown. This occurred whe...

CVE-2024-26757

CVE-2024-26757 is a Linux kernel vulnerability affecting the md/mdadm dm-raid path. The root cause: read-only array handling allowed a race between read/write state transitions and sync-thread registration, leading to a potential hang in the recovery/sync flow when the array is toggled between re...

CVE-2024-26825

CVE-2024-26825 refers to a Linux kernel vulnerability where the rx_data_reassembly skb could leak if the NCI device was deallocated before fragmentation processing completed. The root cause is that rx_data_reassembly skb is bound to the NCI device and, if the device is freed early, the skb could ...

CVE-2024-26828

CVE-2024-26828 is a Linux kernel issue in the CIFS SMB client: parse_server_interfaces() incorrectly compares bytes_left/size with mixed signed/unsigned types (ssize_t vs size_t), causing a loop to continue when remaining bytes become negative, enabling a buffer underflow. The advisories describe...

CVE-2024-35892

CVE-2024-35892 stems from a Linux kernel net/sched issue where qdisc_tree_reduce_backlog() was called with the qdisc lock held while RTNL was not held, triggering a lockdep splat due to unsafe RCU usage. The fix switches from qdisc_lookup() to qdisc_lookup_rcu() to safely dereference qdisc data u...

CVE-2024-35979

The connected MiracleLinux AXSA advisory documents CVE-2024-35979 and describes the Linux kernel raid1 use-after-free in raid1_write_request() where r1_bio->bios[] temporarily pointed to the original bio and could be freed if a blocked rdev was encountered, freeing the underlying bios. The mit...

CVE-2024-36929

CVE-2024-36929 concerns the Linux kernel, specifically a vulnerability in net: core handling of GSO fraglist SKBs. The root cause is that SKB_GSO_FRAGLIST skbs must not be linearized; if skb_copy or skb_copy_expand processes such skbs, it can lead to invalid state. The documented fix is to return...

CVE-2024-36979

CVE-2024-36979 is a Linux kernel vulnerability in the bridge mst path (net/bridge/br_mst.c/br_private.h) where a vlan could be freed while walking a list, causing a use-after-free via RCU. The issue arose from suspicious RCU usage and a path involving br_forward_delay_timer and br_mst_set_state. ...

CVE-2024-42104

CVE-2024-42104 affects the Linux kernel’s nilfs2 filesystem. A missing check for inode numbers on directory entries allows internal inodes (metadata files) to be exposed in the namespace, potentially causing a use-after-free of metadata file inodes and kernel bugs in lru_add_fn() when mounting/un...

CVE-2024-42232

Based on the connected advisories, CVE-2024-42232 is a race condition in the Linux kernel’s libceph code (ceph_monc_stop) where delayed_work() handling can race with mon_fault() and finish_hunting(), potentially leading to use-after-free scenarios on monc and related objects. The documented fix r...

CVE-2024-42269

CVE-2024-42269 (Linux kernel) : A local DoS via NULL pointer dereference in ip6table_nat_table_init() was resolved. The root cause: ip6table_nat_table_init() accessed net->gen->ptr[...] before per-network entry was allocated. The fix: call register_pernet_subsys() before xt_register_templat...

CVE-2024-42305

CVE-2024-42305 affects the Linux kernel ext4, where a dir-indexing edge case could trigger out-of-bounds access during directory entry splitting when the first two entries are not dot/dotdot. The description and connected material explain that make_indexed_dir() assumed the first two dirents are ...

CVE-2024-43826

CVE-2024-43826 : In the Linux kernel, the nfs trace points can expose a safety issue in nfs_folio_length when folio locking or NULL ->f_mapping checks are missing, risking kernel crashes under certain NFS trace configurations (e.g., xfstests generic/065). The root cause is unsafe handling of f...

CVE-2024-43854

The CVE-2024-43854 entry relates to the Linux kernel vulnerability where the integrity buffer used for media writes was not zero-initialized. Root cause: metadata allocated by bio_integrity_prep used plain kmalloc, risking writing random kernel memory into media; PI metadata exposure is limited, ...

CVE-2024-46820

CVE-2024-46820 is a Linux kernel vulnerability in the AMDGPU VCN suspend path. The fix removes calls that disable IRQs and stops tracking IRQ state in vcn 5 suspend, because the code did not properly enable/disable VCN IRQs and did not manage IRQ state. The patch eliminates the WARN_ON(!amdgpu_ir...

CVE-2024-46828

CVE-2024-46828 affects the Linux kernel schedulers, specifically the cake qdisc’s host-fairness logic. A hash-collision interaction could trigger an unintended decrement of per-host bulk-flow counters when a flow’s state changes, and when host fairness is enabled this could wrap a per-host counte...

CVE-2024-46852

CVE-2024-46852 — Linux kernel CMA heap off-by-one fix : The issue occurred when a mapping larger than the buffer size could be created via mremap, allowing an overflow bypass in dma_buf_mmap_internal. The CMA heap fault handler incorrectly bound the fault offset by 1 when validating the end of th...

CVE-2024-47687

The CVE-2024-47687 issue affects the Linux kernel mlx5/vdpa path. It fixes an invalid MR resource destroy where error paths could release uninitialized MR resources. The patch adds a missing check in mlx5_vdpa_destroy_mr_resources() to block destroying non-initialized MR resources, addressing a N...

CVE-2024-47730

The CVE-2024-47730 entry concerns the Linux kernel vulnerability crypto: hisilicon/qm - inject error before stopping queue. The issue arises when the accelerator core reports memory errors; the driver injects a qm error to close the master ooo before stopping the queue, preventing access to memor...

CVE-2024-50063

CVE-2024-50063 concerns the Linux kernel BPF tail calls where a program attached to one kernel hook tail-calling another with a different prototype could bypass ctx-parameter verification and return-value constraints. The issue arises when progs attached to func1 and func2 have different paramete...

CVE-2024-50075

CVE-2024-50075 is an issue in the Linux kernel specifically for Tegra XUSB (xhci) where, when USB virtualization is enabled, USB2 ports shared across VFs can cause an invalid memory access due to using the total USB2 phy number to check PORTSC values. The vulnerability stems from the port-numberi...

CVE-2024-50120

CVE-2024-50120 affects the Linux kernel SMB client. The vulnerability stems from missing checks for kstrdup failures when duplicating passwords in smb3_reconfigure(), leading to ses->password or ses->password2 allocation failures. The documented remediation is to return -ENOMEM if ses->p...

CVE-2024-50218

CVE-2024-50218 relates to the Linux kernel ocfs2 truncation path where passing a 64-bit value to ocfs2_truncate_inline could overflow. The fix introduces a sanity check for byte_start and byte_len in ocfs2_remove_inode_range(); if either is greater than ocfs2_max_inline_data_with_xattr, the funct...