CVE-2024-56662

CVE-2024-56662: Linux kernel ACPI NFIT vmalloc-out-of-bounds Read in acpi_nfit_ctl. Root cause: cmd_to_func accesses call_pkg->nd_reserved2 without ensuring the buffer is sized as a struct nd_cmd_pkg, causing out-of-bounds access. The fix adds checks in acpi_nfit_ctl to require buf != NULL and...

CVE-2024-56715

CVE-2024-56715 relates to the Linux kernel fix for netdev notifier leaks when register_netdev() fails. The vulnerability occurs if a driver registers a netdev notifier but the subsequent register_netdev() call fails, causing a leak of the netdev notifier. The patch implements ionic_lif_unregister...

CVE-2024-56755

CVE-2024-56755 : In the Linux kernel, the FSCACHE_VOLUME_CREATING path in netfs/fscache has a missing memory barrier between the bit-clearing operation and the wake-up, allowing a wake-up to occur before the clearing is detected and potentially causing an indefinite wait. The triggering sequence ...

CVE-2024-57922

The CVE-2024-57922 entry relates to the Linux kernel drm/amd/display code, where wrappers for dcn_bw_ceil2() and dcn_bw_floor2() gained a check for non-zero granularity to prevent asserts/divide-by-zero. The fix is reflected in multiple advisories: Debian LTS DLA-4076-1 and DSA-5860-1 note update...

CVE-2025-21727

CVE-2025-21727 : Linux kernel issue in padata_reorder causing a use-after-free in padata_find_next under certain race conditions. The provided connected documents confirm a KASAN UAF scenario when a parallel padata_reorder/serial flow frees Pd too early and later calls padata_find_next. The remed...

CVE-2025-21728

CVE-2025-21728: Linux kernel vulnerability where BPF programs in non-preemptible contexts calling bpf_send_signal() can sleep, causing issues. The fix changes irqs_disabled() to !preemptible(). Affects kernels with BPF support; CVSSv3.1 base 5.5 (LOCAL, LOW privileges, NONE user interaction, HIGH...

CVE-2025-21796

CVE-2025-21796 concerns the Linux kernel NFS server (nfsd). Affected path: acl_access/acl_default handling when acl_default release fails, leaving acl_access with a dangling pointer to a released posix_acl. This can trigger a use-after-free and a kernel panic if warnings are treated as fatal. The...

CVE-2025-21844

CVE-2025-21844 affects the Linux kernel SMB client path. The vulnerability could allow a NULL pointer dereference in the receive_encrypted_standard() path due to missing checks, which could crash the kernel. The fix adds checks for the next_buffer in receive_encrypted_standard() and validates the...

CVE-2025-21916

CVE-2025-21916 is part of Unity Linux/Fedora kernel advisories describing a fix for a flaw in USB ATM CXACRU endpoint checking. The root cause was insufficient verification of USB endpoint addresses in cxacru_bind(), leading to incorrect URB handling (e.g., bogus urb xfers). The mitigation is to ...

CVE-2025-22005

The CVE-2025-22005 issue, fixed in the Linux kernel, is a memleak in nhc_pcpu_rth_output within fib_check_nh_v6_gw(). The root cause was that fib_nh_common_init() was moved before alloc_percpu_gfp() and cleanup for nhc_pcpu_rth_output was not added on failure. The fix adds cleanup by calling fib_...

CVE-2025-37789

CVE-2025-37789 (net: openvswitch: fix nested key length validation in the set() action) is covered by connected advisories, which confirm a Linux kernel vulnerability in netlink key length handling for the set() action in Open vSwitch. The description notes that accessing nla_len(ovs_key) is unsa...

CVE-2010-4243

CVE-2010-4243 affects the Linux kernel up to version 2.6.37. The issue is in fs/exec.c where the OOM Killer does not assess stack memory usage of the arrays representing (1) arguments and (2) environment during an exec, enabling a local user to cause memory exhaustion (denial of service) via a cr...

CVE-2015-5366

The referenced sources confirm two Linux kernel UDP-handling flaws fixed in version 4.0.6: CVE-2015-5364 and CVE-2015-5366. Affected component: UDP and UDPv6 receive paths (udp_recvmsg and udpv6_recvmsg) in the Linux kernel prior to 4.0.6. Root cause: improper handling of UDP checksums, allowing ...

CVE-2016-10147

CVE-2016-10147 affects the Linux kernel’s crypto/mcryptd.c. An local attacker can cause a denial of service by using an AF_ALG socket with an incompatible algorithm (demonstrated by mcryptd(md5)), triggering a NULL pointer dereference and system crash. The description notes the issue exists in ke...

CVE-2016-10277

CVE-2016-10277 : An elevation-of-privilege in the Motorola bootloader allows a local app to run arbitrary code in the bootloader context by exploiting kernel command-line injection, leading to potential full device compromise. Affected: Android with Kernel-3.10 and Kernel-3.18. Exploitation evide...

CVE-2016-2187

No new technical details are provided in the Connected documents for CVE-2016-2187. The only available information is in the Initial document, describing a Linux kernel denial-of-service via gtco_probe in gtco.c caused by a crafted USB endpoint in a device descriptor.

CVE-2016-8646

CVE-2016-8646 affects the Linux kernel: the hash_accept function in crypto/algif_hash.c before version 4.3.6 allows local users to trigger in-kernel hash algorithms for sockets that have received zero bytes, causing a denial of service (OOPS). The vulnerability is local and does not require authe...

CVE-2019-25045

CVE-2019-25045 is a Linux kernel use-after-free in the XFRM subsystem (xfrm_state_fini panic) reported for kernels before 5.0.19. Publicly documented references from EulerOS and Unity Linux advisories confirm the issue and link the fix to kernel 5.0.19 (and related upstream commit). The impact is...

CVE-2020-36557

CVE-2020-36557: A race condition in the Linux kernel before 5.6.2 between VT_DISALLOCATE and closing/opening ttys can cause a use-after-free. Affected software: Linux kernel versions prior to 5.6.2. Impact per available data: potential use-after-free with availability impact; no explicit exploita...

CVE-2021-29657

CVE-2021-29657 affects the Linux kernel KVM SVM nested virtualization (AMD). A TOCTOU race in arch/x86/kvm/svm/nested.c/nested_svm_vmrun allows a guest to bypass interception checks and corrupt the saved L1 host context, potentially enabling a guest-to-host influence over host MSR state via neste...

CVE-2021-47098

CVE-2021-47098 affects Linux kernel hwmon lm90, where setting the hysteresis value could overflow/underflow when the temperature limit is MAX_LONG with a negative critical limit. The root cause was an integer overflow/underflow in hysteresis calculations after a prior fix; the resolution introduc...

CVE-2021-47222

The CVE-2021-47222 issue is a Linux kernel vulnerability in the bridge vlan tunneling path where egress code used dst_clone() and set the result directly, risking invalid refcnt (entry can have 0 refcnt or be deleted) and triggering dst_hold()/dst_release underflow (as seen in dst_release: refcnt...

CVE-2022-0382

CVE-2022-0382 is a Linux kernel issue in the TIPC protocol subsystem caused by uninitialized memory when a user sends a TIPC datagram to one or more destinations. It enables a local attacker to read kernel memory (limited to about 7 bytes; read is not controllable). Affected are Linux kernel vers...

CVE-2022-48915

CVE-2022-48915 affects the Linux kernel thermal subsystem. The issue was a NULL pointer dereference in TZ_GET_TRIP when a thermal zone defines no trip, caused by an unsafe call path to get_trip_hyst(). The fix prevents calling get_trip_hyst() if the thermal zone lacks a trip, as described in the ...

CVE-2022-49078

The CVE-2022-49078 issue is a Linux kernel LZ4 decompression vulnerability: in LZ4_decompress_safe_partial, read-out-of-bounds can occur during partial decoding, potentially enabling a use-after-free in extreme corrupted-data cases as reported by KASAN. Upstream fixes in lz4 address this, and ker...

CVE-2022-49330

CVE-2022-49330 affects the Linux kernel TCP MTU probing path. The issue arises in tcp_mtu_probe() which gates MTU probing on tcp_snd_cwnd(tp) >= 11, but tcp_snd_cwnd(tp) can be reduced afterward before the probe completes, enabling a scenario that could lead to a zero-divide condition. The roo...

CVE-2022-49339

CVE-2022-49339 affects the Linux kernel’s IPv6 stack, specifically the internal call between seg6.c and seg6_hmac.c. The issue arises from exporting an __init-annotated symbol whose .init.text section can be freed after initialization, creating a potential kernel panic when a module references a ...

CVE-2022-49579

CVE-2022-49579: In the Linux kernel, a data race around ipv4_fib_multipath_hash_policy was resolved by adding READ_ONCE() guards to readers of sysctl_fib_multipath_hash_policy. Affected component: kernel IPv4 multipath hash policy reader; root cause: concurrent modification during reads; impact: ...

CVE-2022-49592

CVE-2022-49592 affects the Linux kernel driver net/stmmac: a left-shift overflow in MTL_RXQ_DMA_MAP1 occurs when the number of TX/RX queues exceeds four, due to a 32‑bit mask calculation. UBSAN reports show a shift-out-of-bounds during UBSAN checks, leading to a potential warning path in dwmac4_c...

CVE-2022-49651

CVE-2022-49651 affects the Linux kernel. The advisory states that cleanup_srcu_struct() now checks for a grace period that is started but not yet started, addressing a potential use-after-free (UAF). It is resolved by a commit tightening GP checks in cleanup_srcu_struct(), with references to kern...

CVE-2022-49707

CVE-2022-49707 concerns a Linux kernel ext4 resize bug where a NULL pointer dereference could occur when resizing a corrupted ext4 image with resize_inode previously cleared. The root cause is that during ext4_resize_fs() transitioning to meta_bg mode, es->s_reserved_gdt_blocks was not reduced...

CVE-2022-49746

The CVE-2022-49746 issue affects the Linux kernel DMA engine, specifically the imx-sdma path. A memory leak can occur in sdma_transfer_init when sdma_load_context() fails: the sdma_desc is freed, but the allocated desc->bd was not, leading to a leak (as illustrated by timeout/login messages). ...

CVE-2023-45898

Summary (CVE-2023-45898): The vulnerability lies in the Linux kernel prior to 6.5.4, where an es1 use-after-free in the ext4 extents_status path (fs/ext4/extents_status.c) related to ext4_es_insert_extent can lead to a local privilege escalation or kernel integrity/availability impact as describe...

CVE-2023-52639

CVE-2023-52639 affects the Linux kernel KVM s390: vsie shadow creation. The issue is a race where gmap->private can be observed as zero in kvm_s390_vsie_gmap_notifier due to adding gmap->private == kvm after creation. The root cause is a race during shadow creation in acquire_gmap_shadow(),...

CVE-2023-52658

CVE-2023-52658 is referenced in MiracleLinux advisory AXSA:2024-8938:33 for MiracleLinux 9. The advisory lists a Linux kernel issue: “net/mlx5: Block entering switchdev mode with ns inconsistency” that was reverted in the upstream commit 662404b24a4c4d839839ed25e3097571f5938b9b, due to instabilit...

CVE-2023-52777

CVE-2023-52777 affects the Linux kernel ath11k wifi driver. The gtk offload status event handler called ath11k_mac_get_arvif_by_vdev_id() was not in an RCU read-side critical section, risking use-after-free on active pdevs protected by RCU. The fix marks this code path as an RCU read-side critica...

CVE-2023-52837

In CVE-2023-52837, the Linux kernel fixed a use-after-free in nbd_open triggered when a disk is opened after nbd_put() because disk->private_data could still reference freed memory. The fix adds a dedicated ->free_disk hook that frees the private data as part of disk cleanup (blk_cleanup_di...

CVE-2024-0639

CVE-2024-0639 is a denial-of-service vulnerability in Linux kernel SCTP: a deadlock in sctp_auto_asconf_init (net/sctp/socket.c) can be triggered by guests with local privileges, potentially crashing the system. Some connected advisories (Unity Linux UTSA-2026-001762 and Red Hat/SUSE notes) indic...

CVE-2024-35795

CVE-2024-35795 : In the Linux kernel, a deadlock was fixed in the AMDGPU driver when reading the MQD via debugfs. The issue arose from a circular locking dependency between mmap_lock and the reservation_ww_class_* locks during a read path implemented in amdgpu_debugfs_mqd_read. The reverse-lock c...

CVE-2024-35954

The CVE-2024-35954 issue concerns the Linux kernel SCSI sg teardown race: sg_remove_sfp_usercontext() may call sg_device_destroy() after scsi_device_put() has released the last reference to the parent scsi_device, causing the parent queue pointer to be NULL and a crash. A connected Astra Linux ad...

CVE-2024-40948

Technical details for CVE-2024-40948 (e.g., affected products/versions, root cause, impact, fix) are not provided in the Connected documents. Monitor for updates and refer to the initial description for the vulnerability summary.

CVE-2024-41057

CVE-2024-41057: Linux kernel fix for slab-use-after-free in cachefiles_withdraw_cookie() during FSCACHE withdrawal. The issue could occur when a cache volume is freed while cookie lookups are in flight, leading to UAF on cachefilesVolume. The recommended fix/process order is to call fscache_withd...

CVE-2024-41062

CVE-2024-41062 affects the Linux kernel Bluetooth L2CAP code. A race exists between closing a socket and the HCI receive work: if hci_rx_work processes pending data after sock_close releases the sock, the work may access an invalid sock. Root cause: lack of synchronization between sock release an...

CVE-2024-42312

CVE-2024-42312 relates to the Linux kernel vulnerability where sysctl did not consistently initialize i_uid/i_gid. The resolution initializes i_uid/i_gid inside the sysfs core so that set_ownership() can safely skip setting them. The change is documented as part of commit 5ec27ec735ba, which fixe...

CVE-2024-43834

CVE-2024-43834 (Linux kernel) : The issue is a race/invalid wait-context in page_pool destruction when a driver uses XDP with a page pool. Specifically, page_pool_destroy() decreases the pool’s refcount and calls mem_allocator_disconnect(), which may acquire mutex_lock(). If the driver has regist...

CVE-2024-43854

The CVE-2024-43854 entry relates to the Linux kernel vulnerability where the integrity buffer used for media writes was not zero-initialized. Root cause: metadata allocated by bio_integrity_prep used plain kmalloc, risking writing random kernel memory into media; PI metadata exposure is limited, ...

CVE-2024-44992

CVE-2024-44992 affects the Linux kernel CIFS/SMB client. A NULL dereference could occur in add_credits() when rdata->credits.value != 0 and rdata->server == NULL, due to missing server pointer checks. The fix (commit 519be989717c) adds a guard for rdata->server to prevent dereferencing s...

CVE-2024-45018

The connected advisories confirm CVE-2024-45018 affects the Linux kernel netfilter flowtable. It is caused by missing initialisation of extack before use in flow offload. The impact is described in the CVE entry, and remediation is to apply the kernel update/patch provided by the vendor (update t...

CVE-2024-45022

Technical details beyond the Initial Description are not provided in the connected documents. Monitor for updates from official advisories to confirm affected products, scope, and fixes for CVE-2024-45022.

CVE-2024-45026

CVE-2024-45026 : In the Linux kernel (s390 DASD), data corruption could occur on Extent Space Efficient (ESE) or thin-provisioned volumes during error scenarios. The root cause was an imprecise length check in dasd_ese_needs_format that could mis-handle certain transport errors, potentially corru...