CVE-2024-50086

CVE-2024-50086 affects the Linux kernel ksmbd (SMB2 server). A race between SMB2 session log off and session setup could lead to a use-after-free of the session object. The patch adds a session_lock when setting SMB2_SESSION_EXPIRED and switches to a reference-counted/session-scoped reference to ...

CVE-2024-53180

Technical details and affected products/versions for CVE-2024-53180 are not present in the connected documents. The initial description summarizes a Linux kernel change but lacks explicit exploit, affected driver/version, or patch details. Monitor vendor advisories for updates.

CVE-2022-49675

Summary (CVE-2022-49675): In the Linux kernel, the function tick_nohz_full_setup() is exported while annotated with init , which risks a use-after-free of the init text and kernel panic. The issue was detected after a section-mismatch warning from modpost and fixed by the commit 28438794aba4 (“mo...

CVE-2023-35828

CVE-2023-35828 affects the Linux kernel with a use-after-free in the Renesas USB3 gadget driver (drivers/usb/gadget/udc/renesas_usb3.c: renesas_usb3_remove). The vulnerability is triggered in certain removal paths, enabling local attackers to potentially crash the kernel or escalate privileges. A...

CVE-2023-46838

CVE-2023-46838 affects Xen’s virtualization networking path where multi‑part transmitted requests can include zero‑length parts. If all parts of an SKB are zero length, the Linux networking code may dereference NULL, potentially enabling local or guest‑to‑host disruption. Public advisories ( Xen/...

CVE-2023-52847

CVE-2023-52847 (Linux kernel - media/bttv): A race between the bttv_irq_timeout timer and removal can lead to use-after-free when the timer fires after btv has been freed. The root cause is that remove() didn’t delete the timer, potentially invoking a freed btv in the timer handler. The fix is to...

CVE-2024-26766

CVE-2024-26766 is a Linux kernel vulnerability in the IB/hfi1 SDMA path. The issue was an off-by-one error in sdma.h tx->num_descs that, after a prior fix, could cause the descs array to overflow for certain 6-descriptor SDMA sends requiring padding in the 7th descriptor. This overflow could c...

CVE-2024-26820

CVE-2024-26820 affects the Linux kernel hv_netvsc driver. The issue occurs when the hv_netvsc module is unloaded and reloaded: the NET_DEVICE_REGISTER handler can fail to register a VF because the VF registration call arrives before netvsc_probe finishes, since register_netdevice_notifier() is re...

CVE-2024-36977

CVE-2024-36977 : Linux kernel vulnerability in usb: dwc3 handling of ENDXFER. A 1 ms delay was added in __dwc3_stop_active_transfer() to ensure ENDXFER completes before unmapping requests, preventing SMMU faults when IOC is cleared during a concurrent IN request and soft_disconnect. Affected comp...

CVE-2024-38635

CVE-2024-38635 pertains to the Linux kernel soundwire cadence driver. The root cause was an incorrect PDI offset that added an offset to the PDI array, risking out-of-bounds access. A follow-up patch completely removes this useless offset. The Fixes tag was not provided because no known platforms...

CVE-2024-40910

CVE-2024-40910 affects the Linux kernel ax25 subsystem. The vulnerability stems from a refcount imbalance: when releasing a socket in ax25_release(), the code decreases the refcount on the associated ax.25 device via netdev_put(), but the inbound connection path does not call netdev_hold() for ne...

CVE-2024-41079

CVE-2024-41079 concerns the Linux kernel’s NVMe target controller (nvmet). The issue is that the first two double words, the “results” for a command queue entry, were not consistently initialized to 0 when unused, creating a potential information leak for RDMA clients. The patch standardizes beha...

CVE-2024-42316

CVE-2024-42316 : Linux kernel fix for div-by-zero in vmpressure_calc_level() within mm/mglru evictions. The issue arose in the second pass of evict_folios(), where deducting scan_control->nr_scanned could underflow nr_scanned if folio_trylock() failed, causing the divisor scale = scanned + rec...

CVE-2024-46761

CVE-2024-46761 affects the Linux kernel’s PCI hotplug driver for PowerPC (pci/hotplug/pnv_php.c). The issue caused a kernel crash during hot-unplug/disable of a PCIe switch/bridge from the PHB, due to a NULL dereference when the MSI data structure had already been released and set to NULL, yet un...

CVE-2024-47743

CVE-2024-47743 affects the Linux kernel in the KEYS subsystem. In find_asymmetric_key(), if id_{0,1,2} are all NULL, a WARN is emitted but a null dereference on id_2 occurs, leading to an oops. The vulnerable code is fixed by adding the missing id_2 NULL check and by moving WARN_ON() to the final...

CVE-2024-47750

CVE-2024-47750: In the Linux kernel, RDMA/hns on HIP08 had a Use-After-Free of rsv_qp because rsv_qp was freed before ib_unregister_device() was called. The documented fix moves the release of rsv_qp to after ib_unregister_device(). Affected component: RDMA/hns in HIP08; impact is Use-After-Free,...

CVE-2024-47753

CVE-2024-47753 affects the Linux kernel media/mediatek/vcodec VP8 stateless decoder. The issue stems from a smatch static checker warning in vdec_vp8_req_if.c that can cause a kernel crash when fb is NULL. A fix was applied to resolve the smatch warning and prevent the NULL framebuffer crash; ref...

CVE-2024-49863

Summary (CVE-2024-49863) A Linux kernel vulnerability in vhost/scsi allowed a null pointer dereference in vhost_scsi_get_req() when handling certain AN SCSI requests. The bug occurred after vhost_scsi_ctl_handle_vq() could assign vc.target = NULL for AN requests; later, vhost_scsi_get_req() deref...

CVE-2024-49954

CVE-2024-49954: Linux kernel vulnerability fixed by replacing WARN_ON with pr_warn in static_call_module_notify() to avoid unnecessary fatal behavior on __static_call_add_module() memory allocation failures. The WARN_ON() could panic when panic_on_warn is set, whereas the memory allocation failur...

CVE-2024-50056

CVE-2024-50056 pertains to the Linux kernel USB gadget UVC driver. The description documents a fix for an ERR_PTR dereference in uvc_v4l2.c, specifically preventing potential dereferencing of ERR_PTR() in find_format_by_pix() and uvc_v4l2_enum_format(). A related related issue is also addressed i...

CVE-2024-53177

CVE-2024-53177 affects the Linux kernel SMB client cache code. The vulnerability arises from a use-after-free in smb2_cached_lease_break/open_cached_dir error handling, where freeing a cfid could race with a pending lease-break work item. The fix updates open_cached_dir() to drop references inste...

CVE-2024-56727

Technical details for CVE-2024-56727 are not provided in the connected documents. No affected product/version or remediation is disclosed here. Monitor for updates.

CVE-2024-57795

CVE-2024-57795: In the Linux kernel, a use-after-free was reported in RDMA/rxe when a net_device could be freed before an ib_cache_event_task execution. The root cause is the patch removing the direct link to net_device in RXE (and related SIW/RXE paths), which allows a freed net_device to be acc...

CVE-2024-57911

In CVE-2024-57911, a Linux kernel vulnerability in iio: dummy caused potential information leakage via a triggered buffer. The data buffer allocated with kmalloc() was not initialized for inactive channels, risking uninitialized data being pushed to userspace. The root cause is that iio_for_each_...

CVE-2024-57939

CVE-2024-57939 affects the Linux kernel on riscv where die() can be invoked in an exception handler and uses spinlock_t, which may sleep with PREEMPT_RT enabled. This causes a kernel warning (BUG: sleeping function called from invalid context) and potential instability. The fix switches to raw_sp...

CVE-2024-58071

CVE-2024-58071 describes a Linux kernel bug in the team subsystem where adding a device that is already a lower of another device (e.g., veth0 lower than vlan1) could trigger recursive locking and potential deadlock. The provided evidence shows a stack trace and lockdep warning indicating two loc...

CVE-2024-58090

CVE-2024-58090 affects the Linux kernel: sched/core commit fixes a long-standing issue where rescheduling could be triggered with interrupts disabled during kexec-based reboot paths. The root cause involved a wakeup in a syscore_suspend()/resume path that set NEED_RESCHED, leading to cond_resched...

CVE-2025-21721

CVE-2025-21721 is a Linux kernel vulnerability in the NILFS2 filesystem. The patch series fixes nilfs_prepare_chunk() error handling paths that were previously omitted when rewriting directory entries in nilfs_set_link(), nilfs_delete_entry(), and in the caller nilfs_rename(). The issue allowed e...

CVE-2025-21871

Summary of CVE-2025-21871 (Linux kernel): The vulnerability arises in the OP-TEE subsystem where the supplicant wait loop can cause a hang if the supplicant is hung/crashed/killed during an OP-TEE RPC, especially with shutdown ordering issues between the supplicant and the OP-TEE client. The fix ...

CVE-2025-21935

In CVE-2025-21935, the Linux kernel rapidio subsystem fixes a missing check in rio_scan_alloc_net(): the return value of rio_add_net() must be checked, and if it fails, put_device() should be called to free memory and drop the reference from rio_add_net(). This prevents potential memory leaks and...

CVE-2025-22058

CVE-2025-22058 affects the Linux kernel UDP memory accounting. When INT_MAX was used for SO_RCVBUF, an overflow in udp_rmem_release() could wrap the total UDP memory, causing memory accounting to double after socket close and potentially leading to packet drops once rmem_alloc exceeded net.ipv4.u...

CVE-2025-37757

In CVE-2025-37757, the Linux kernel leak was in tipc_link_xmit where an overloaded backlog transmit queue could cause -ENOBUFS but leave skb lists uncleared, leading to memory leaks during skb allocations. The fix purges the skb list before tipc_link_xmit() returns.

CVE-2025-37997

CVE-2025-37997 affects the Linux kernel netfilter ipset region locking for hash types. The root cause is an incorrect ahash_region() mapping, which can cause a race between the garbage collector and adding new elements to sets with timeouts. The connected advisories confirm fixes to region lockin...

CVE-2011-1494

CVE-2011-1494 affects the Linux kernel (2.6.38 and earlier) via an integer overflow in the _ctl_do_mpt_command function (drivers/scsi/mpt2sas/mpt2sas_ctl.c). This can allow local users to gain privileges or cause a denial of service (memory corruption) by issuing an ioctl with a crafted value tha...

CVE-2013-7446

CVE-2013-7446 is a use-after-free vulnerability in the Linux kernel (net/unix/af_unix.c) up to version 4.3.2, fixed in 4.3.3. It allows local attackers to bypass AF_UNIX socket permissions or cause a denial of service (panic) via crafted epoll_ctl calls. Affected: Linux kernel before 4.3.3 (inclu...

CVE-2016-10277

CVE-2016-10277 : An elevation-of-privilege in the Motorola bootloader allows a local app to run arbitrary code in the bootloader context by exploiting kernel command-line injection, leading to potential full device compromise. Affected: Android with Kernel-3.10 and Kernel-3.18. Exploitation evide...

CVE-2016-2185

CVE-2016-2185 : In the Linux kernel, the ati_remote2_probe function (drivers/input/misc/ati_remote2.c) in versions before 4.5.1 is vulnerable. A physically proximate attacker can trigger a NULL pointer dereference via a crafted USB device descriptor, causing a denial of service (system crash). Th...

CVE-2017-15299

CVE-2017-15299 affects the Linux kernel KEYS subsystem: adding a key that already exists but is uninstantiated can cause a NULL pointer dereference, leading to a system crash (local DoS) or other impact. The issue is documented for kernels up to at least 4.13.7; remediation is to apply the kernel...

CVE-2021-47073

CVE-2021-47073 concerns a Linux kernel issue in platform/x86 dell-smbios-wmi where unregistering the driver occurred unconditionally, causing a kernel oops at module removal. The fix ensures unregister happens only under the same condition as registration (Dell WMI support). Affects the Dell WMI ...

CVE-2021-47097

CVE-2021-47097 : In the Linux kernel, the elantech PS/2 driver has a stack-based out-of-bounds access in elantech_change_report_id(), caused by an array param[] that must be at least 3 bytes while elantech_read_reg_params() calls ps2_command() with 3 bytes. The stack was only 2 bytes, enabling a ...

CVE-2021-47385

CVE-2021-47385 is a Linux kernel hwmon issue affecting the w83792d driver (and related subclients) where a NULL pointer dereference could occur if a value read from the device matches certain bit patterns. The root cause is dereferencing a NULL after reading val; the advisory notes that the patch...

CVE-2022-3202

CVE-2022-3202 involves a NULL pointer dereference in diFree() within fs/jfs/inode.c of the Linux kernel’s Journaled File System (JFS). The underlying cause is a NULL pointer dereference, which could allow a local attacker to crash the system or leak kernel internal information. The CVE is associa...

CVE-2022-48885

CVE-2022-48885 — Linux kernel ice_gnss_tty_write() leak fixed . The vulnerability affects the Linux kernel’s ice_gnss_tty_write() path. When write_buf allocation fails, the code returns early and leaks cmd_buf; a fix frees cmd_buf in this failure path. The documented remediation is to apply the k...

CVE-2022-49014

CVE-2022-49014 affects the Linux kernel net/tun subsystem. A use-after-free occurs in tun_detach() when sock_put() drops the last reference to struct net before net notifier code (notifier_call_chain/netdev_state_change) has finished accessing it. The patch fixes this by calling sock_put() from t...

CVE-2022-49345

The CVE-2022-49345 issue affects the Linux kernel’s net: xfrm subsystem, where __init-annotated xfrm4_protocol_init() is exported via EXPORT_SYMBOL, causing use-after-free risk when __init and EXPORT_SYMBOL co-exist. The root cause is the .init text is freed after init, so modules could access fr...

CVE-2022-49579

CVE-2022-49579: In the Linux kernel, a data race around ipv4_fib_multipath_hash_policy was resolved by adding READ_ONCE() guards to readers of sysctl_fib_multipath_hash_policy. Affected component: kernel IPv4 multipath hash policy reader; root cause: concurrent modification during reads; impact: ...

CVE-2022-49587

The CVE-2022-49587 entry concerns a data-race in the Linux kernel related to reading sysctl_tcp_notsent_lowat, which could be modified concurrently. The fix is to add READ_ONCE() to the reader, addressing a sysctl data-race in the tcp stack. The vulnerability is rated with CVSS v3.1 metrics indic...

CVE-2022-49632

CVE-2022-49632 is a Linux kernel data-race vulnerability in icmp: reading sysctl_icmp_errors_use_inbound_ifaddr can race with concurrent writes. The fix adds READ_ONCE() to the reader. CVSSv3.1 indicates a Local access requirement, High attack complexity, Low privileges, no user interaction, with...

CVE-2022-49646

CVE-2022-49646 affects the Linux kernel’s wifi/mac80211 code. When using iTXQ, the queue-selection logic assumed a single broadcast vif queue (BE). Allowing non-BE queue markings breaks that assumption and can break txq->ac == skb_queue_mapping, impacting queue handling in the driver and poten...

CVE-2023-52837

In CVE-2023-52837, the Linux kernel fixed a use-after-free in nbd_open triggered when a disk is opened after nbd_put() because disk->private_data could still reference freed memory. The fix adds a dedicated ->free_disk hook that frees the private data as part of disk cleanup (blk_cleanup_di...