CVE-2021-47191

CVE-2021-47191 affects the Linux kernel’s SCSI debug path (scsi_debug) and fixes an out-of-bounds read in resp_readcap16 caused by treating alloc_len as a signed int, which could lead to an OOB in sg_copy_buffer when handling large allocation lengths. The root cause is the incorrect type for allo...

CVE-2025-21914

CVE-2025-21914 affects the Linux kernel Slimbus path (slimbus) where, in delayed interrupt scenarios, slim_do_transfer() returns a timeout but fails to free the associated transaction ID (TID). This leads to invalid memory access inside qcom_slim_ngd_rx_msgq_cb(), potentially causing a kernel pan...

CVE-2025-21935

In CVE-2025-21935, the Linux kernel rapidio subsystem fixes a missing check in rio_scan_alloc_net(): the return value of rio_add_net() must be checked, and if it fails, put_device() should be called to free memory and drop the reference from rio_add_net(). This prevents potential memory leaks and...

CVE-2011-0521

The CVE-2011-0521 issue affects the Linux kernel’s dvb_ca_ioctl in drivers/media/dvb/ttpci/av7110_ca.c, where the sign of a certain integer field is not checked in versions before 2.6.38-rc2. This allows local users to cause a denial of service via memory corruption and potentially other unspecif...

CVE-2015-0571

CVE-2015-0571 is a local privilege-escalation in the WLAN driver for the Linux kernel as used in Qualcomm QuIC Android contributions (MSM devices and related products). The issue arises from the driver’s lack of authorization checks for private SET IOCTL calls, allowing a crafted application to g...

CVE-2015-2666

CVE-2015-2666 : The Linux kernel contains a stack-based buffer overflow in get_matching_model_microcode (arch/x86/kernel/cpu/microcode/intel_early.c) that can be exploited by a context-dependent local attacker with root privileges to write to the initrd. The description in connected advisories co...

CVE-2016-2187

No new technical details are provided in the Connected documents for CVE-2016-2187. The only available information is in the Initial document, describing a Linux kernel denial-of-service via gtco_probe in gtco.c caused by a crafted USB endpoint in a device descriptor.

CVE-2017-7487

The CVE-2017-7487 issue is in the Linux kernel net/ipx/af_ipx.c ipxitf_ioctl: reference count mishandling causes a use-after-free via a failed SIOCGIFADDR on an IPX interface, enabling local denial of service. Evidence in connected Nessus advisories confirms the vulnerability and that it affects ...

CVE-2021-47073

CVE-2021-47073 concerns a Linux kernel issue in platform/x86 dell-smbios-wmi where unregistering the driver occurred unconditionally, causing a kernel oops at module removal. The fix ensures unregister happens only under the same condition as registration (Dell WMI support). Affects the Dell WMI ...

CVE-2021-47385

CVE-2021-47385 is a Linux kernel hwmon issue affecting the w83792d driver (and related subclients) where a NULL pointer dereference could occur if a value read from the device matches certain bit patterns. The root cause is dereferencing a NULL after reading val; the advisory notes that the patch...

CVE-2021-47592

CVE-2021-47592 affects the Linux kernel stmmac driver and its VLAN priority RX steering path. The issue manifested as a NULL pointer dereference when deleting a tc flower filter for VLAN priority after a previous mis-implemented tc_del_vlan_flow() used flow_cls_offload_flow_rule() (invalid for tc...

CVE-2022-48619

CVE-2022-48619 : A local Linux kernel vulnerability in drivers/input/input.c (input_set_capability) can panic the kernel when an event code falls outside the bitmap. Affected: Linux kernel versions before 5.17.10. Root cause: mishandling in input_set_capability for out-of-bitmap event codes. Impa...

CVE-2022-49345

The CVE-2022-49345 issue affects the Linux kernel’s net: xfrm subsystem, where __init-annotated xfrm4_protocol_init() is exported via EXPORT_SYMBOL, causing use-after-free risk when __init and EXPORT_SYMBOL co-exist. The root cause is the .init text is freed after init, so modules could access fr...

CVE-2022-49372

CVE-2022-49372 affects the Linux kernel where tcp_rtx_synack() can be invoked from process context during a Fast Open TCP backlog/backlog processing sequence when CONFIG_DEBUG_PREEMPT is enabled. The issue arises as a SYN retransmit is processed in process context, cooking a SYN-ACK in that conte...

CVE-2022-49434

The CVE-2022-49434 issue is in the Linux kernel where pci_dev_lock() historically acquired the config space access lock before the device lock, risking AB/BA deadlocks with sriov_numvfs_store() that already takes the device lock first. The fix is to reverse the order in pci_dev_lock() so it acqui...

CVE-2022-49545

CVE-2022-49545 concerns the Linux kernel ALSA USB audio path: a race during closing a USB MIDI output substream where a pending work could access the released rawmidi runtime object. The fix cancels the pending work on substream close to prevent the access. Documented via multiple advisories and ...

CVE-2022-49593

CVE-2022-49593 affects the Linux kernel’s TCP subsystem: a data race in reading sysctl_tcp_probe_interval can occur when it is updated concurrently. The documented fix adds READ_ONCE() to the reader to prevent concurrent modification. Connected advisories (EulerOS, OpenVAS, Unity/ASTRA, etc.) ref...

CVE-2022-49631

CVE-2022-49631 is a Linux kernel data-race vulnerability in the reader of sysctl_raw_l3mdev_accept. While reading this sysctl, its value could be changed concurrently, prompting a fix that adds a READ_ONCE() to the reader. The issue is a kernel-level race that can affect availability. The connect...

CVE-2022-49655

CVE-2022-49655 pertains to the Linux kernel fscache invalidation/lookup race. When an NFS file is opened for writing and closed, invalidation requests could be dropped if the cookie was in LOOKING_UP or CREATING, risking cache inconsistency. The fix adds a flag in __fscache_invalidate() to mark t...

CVE-2022-49675

Summary (CVE-2022-49675): In the Linux kernel, the function tick_nohz_full_setup() is exported while annotated with init , which risks a use-after-free of the init text and kernel panic. The issue was detected after a section-mismatch warning from modpost and fixed by the commit 28438794aba4 (“mo...

CVE-2022-49732

The CVE-2022-49732 issue in the Linux kernel concerns psock handling and ULP protection. A change moved the inet_csk_has_ulp(sk) check from sk_psock_init() to tcp_bpf_update_proto(), enabling psocks for non-inet sockets. The destruction path of psock includes the ULP unwind, so sk_psock_init() mu...

CVE-2023-2860

CVE-2023-2860 is an out-of-bounds read vulnerability in the Linux kernel’s SR-IPv6 implementation, specifically in the processing of seg6 attributes. It stems from improper validation of user-supplied data, allowing a privileged local user to read beyond the end of an allocated buffer and disclos...

CVE-2023-3269

A vulnerability exists in the memory management subsystem of the Linux kernel due to incorrect lock handling when accessing and updating virtual memory areas (VMAs) . This flaw leads to use-after-free problems, which can be exploited to execute arbitrary kernel code, escalate containers, and gain...

CVE-2023-52659

CVE-2023-52659 affects the Linux kernel 64-bit builds where the pfn_to_kaddr() macro may lose address bits when shifting a 40-bit GFN, causing guest crashes in SEV-SNP environments. The fix introduces an inline function to implicitly cast inputs to a 64-bit type before the shift, replacing the pr...

CVE-2023-52837

In CVE-2023-52837, the Linux kernel fixed a use-after-free in nbd_open triggered when a disk is opened after nbd_put() because disk->private_data could still reference freed memory. The fix adds a dedicated ->free_disk hook that frees the private data as part of disk cleanup (blk_cleanup_di...

CVE-2023-52864

CVE-2023-52864 affects the Linux kernel (platform/x86) WMI implementation. The root cause is a memory corruption risk when wmi_char_open() runs if the associated driver is missing, due to the miscdevice pointer being stored in filp->private_data after the patch in drivers/misc: pass miscdevice...

CVE-2024-26718

CVE-2024-26718 affects the Linux kernel’s dm-crypt and dm-verity components. The issue arises from a memory‑corruption scenario in tasklets: tasklet_action_common calls tasklet_trylock, then the tasklet callback, then tasklet_unlock; if the callback frees the tasklet’s containing structure (or fr...

CVE-2024-26725

CVE-2024-26725 affects the Linux kernel. The issue is an ABBA deadlock during netlink pin dump where the code acquires dpll_lock in a genl/ netlink dump path and then re-acquires a second lock via netlink_dump, creating a circular lock dependency. The root cause is the order of lock acquisition w...

CVE-2024-35954

CVE-2024-35954: In the Linux kernel, the sg: sg removal teardown race was fixed. sg_remove_sfp_usercontext() must not call sg_device_destroy() after scsi_device_put() because the parent scsi_device’s request_queue is NULL, leading to a NULL pointer dereference and kernel crash. The connected Astr...

CVE-2024-43846

CVE-2024-43846 is a Linux kernel vulnerability in the lib: objagg component that could trigger a general protection fault. The issue occurs because nesting of aggregated objects is disallowed when there is no parent, but the hints-based aggregation path lacked a check, violating the nesting assum...

CVE-2024-43870

CVE-2024-43870 : In the Linux kernel perf subsystem, a window exists during task_exit where pending sigtrap deliveries may be queued but not added to the event’s task_work due to a failure when adding the event’s callback to task_work. This creates a small window in which the event refcount can b...

CVE-2024-45026

CVE-2024-45026 : In the Linux kernel (s390 DASD), data corruption could occur on Extent Space Efficient (ESE) or thin-provisioned volumes during error scenarios. The root cause was an imprecise length check in dasd_ese_needs_format that could mis-handle certain transport errors, potentially corru...

CVE-2024-46786

CVE-2024-46786 concerns the Linux kernel fscache subsystem. The connected documents confirm a concrete root cause: the fscache_cookie_lru_timer is initialized when the fscache module is loaded but is not deleted on module unload, which can lead to the timer being left on the per-CPU timer list an...

CVE-2024-47730

The CVE-2024-47730 entry concerns the Linux kernel vulnerability crypto: hisilicon/qm - inject error before stopping queue. The issue arises when the accelerator core reports memory errors; the driver injects a qm error to close the master ooo before stopping the queue, preventing access to memor...

CVE-2024-49863

Summary (CVE-2024-49863) A Linux kernel vulnerability in vhost/scsi allowed a null pointer dereference in vhost_scsi_get_req() when handling certain AN SCSI requests. The bug occurred after vhost_scsi_ctl_handle_vq() could assign vc.target = NULL for AN requests; later, vhost_scsi_get_req() deref...

CVE-2024-49870

CVE-2024-49870 (Linux kernel, cachefiles) summary : The vulnerability arises in cachefiles when a dentry leak can occur if a lookup cookie and a cull run concurrently in cachefiles_open_file(). The leak happens because the code path may fail to release a reference to a dentry, potentially leaving...

CVE-2024-49981

The CVE-2024-49981 issue concerns the Linux kernel Venus subsystem. A use-after-free could occur when venus_remove runs while there is unfinished work bound to venus_sys_error_handler (core->work) that is coordinated with venus_event_notify and error handling. The race can involve paths such a...

CVE-2024-50102

CVE-2024-50102 : The connected advisories indicate a Linux kernel x86 issue where using the high address bit to classify user vs. kernel space enabled a speculative-execution leak for non-canonical addresses. The root cause involves non-canonical address handling and an evolving AC/bit behavior a...

CVE-2024-50126

CVE-2024-50126 concerns the Linux kernel’s net/sched path, specifically the taprio_dump() function. The connected advisories confirm a concrete root cause: a use-after-free could occur due to missing an RCU read-side critical section around taprio_dump(). The remediation implemented is to wrap th...

CVE-2024-50180

Technical details about CVE-2024-50180 are not publicly provided in the connected documents. Please monitor official updates and vendor advisories for the affected Linux kernel components and remediation guidance.

CVE-2024-53058

The CVE-2024-53058 issue is a Linux kernel vulnerability in the net/stmmac driver (TSO path) where non-paged SKB data could trigger unbalanced DMA map/unmap operations when DMA AXI width is 40/48-bit or when non-paged data exceeds TSO_MAX_BUFF_SIZE on 32-bit AXI width. The root cause is an incorr...

CVE-2024-53070

CVE-2024-53070 affects the Linux kernel USB subsystem (dwc3). The issue occurs when a device is already runtime suspended and the system suspends, leading to a crash if device registers are accessed. The fix reorders suspend sequence by moving the dwc3_enable_susphy() call to the top of the suspe...

CVE-2024-53177

CVE-2024-53177 affects the Linux kernel SMB client cache code. The vulnerability arises from a use-after-free in smb2_cached_lease_break/open_cached_dir error handling, where freeing a cfid could race with a pending lease-break work item. The fix updates open_cached_dir() to drop references inste...

CVE-2024-56667

CVE-2024-56667 affects the Linux kernel DRM/i915 driver. The root cause is a NULL pointer dereference in drm_info() when the intel_context structure contains NULL, leading to a crash. The issue has been mitigated by a fix cherry-picked from commit 754302a5bc1bd8fd3b7d85c168b0a1af6d4bba4d. The vul...

CVE-2024-56716

CVE-2024-56716 affects the Linux kernel via netdevsim: nsim_dev_health_break_write() accepts a zero or excessively large count, which can crash the kernel. Connected advisories indicate this CVE is addressed in kernel updates for various distributions (e.g., Debian LTS, Mariner/Mageia/Amazon Linu...

CVE-2024-56722

In CVE-2024-56722, the Linux kernel RDMA/hns component fixes a cpu-stall risk during reset by removing unnecessary prints and converting remaining print statements to a rate-limited version when destroying resources (qp, cq, mr). The issue arises if resource destruction logs flood with numerous m...

CVE-2024-58058

CVE-2024-58058 affects the Linux kernel ubifs component. The root cause is a null pointer dereference when c->zroot.znode becomes NULL (after slab cache clearing), causing a crash during tnc tree dumping. The vulnerability is described as resolved, with references in multiple advisories indica...

CVE-2025-21670

CVE-2025-21670 affects the Linux kernel’s vsock/bpf path. The issue occurs when vsock_transport is not assigned (NULL) during vsock_bpf_recvmsg for connected sockets (stream/seqpacket), leading to a NULL pointer dereference in vsock_connectible_has_data and an in-kernel oops trace. The vulnerabil...

CVE-2025-21721

CVE-2025-21721 is a Linux kernel vulnerability in the NILFS2 filesystem. The patch series fixes nilfs_prepare_chunk() error handling paths that were previously omitted when rewriting directory entries in nilfs_set_link(), nilfs_delete_entry(), and in the caller nilfs_rename(). The issue allowed e...

CVE-2025-21893

CVE-2025-21893 concerns a use-after-free in the Linux kernel key handling. The issue arises when the key’s usage reaches 0 and the garbage collector may touch the key after it could have been freed. The fix changes the reclamation logic from inspecting the key’s refcount in the garbage collector ...