CVE-2026-46116

CVE-2026-46116 affects the Linux kernel xfrm subsystem (xfrm_state). The root cause is a local-use-after-free in __xfrm_state_delete due to unsafe deletions from byseq/byspi hash chains. The patch changes deletions to hlist_del_init_rcu and uses hlist_unhashed() checks, preventing writes after LI...

CVE-2025-21722

CVE-2025-21722 concerns the NILFS2 filesystem in the Linux kernel. When filesystem corruption triggers a read-only fallback, buffer state inconsistencies can occur: one path is when mark_buffer_dirty() marks data/metadata dirty but the buffer isn’t uptodate, and another path is nilfs_btree_propag...

CVE-2025-37885

CVE-2025-37885 affects the Linux kernel KVM/x86, where a dangling IRTE could be left posting to a vCPU if the new GSI route cannot be posted. The issue is fixed by restoring IRTE ownership to the host control when the new route isn’t postable, preventing use-after-free and incorrect interrupt del...

CVE-2026-46319

The CVE-2026-46319 entry describes a race in the Linux kernel net/sched act_ct where rcu_read_lock is exited before refcount_inc_not_zero on ct_ft, allowing a UAF when ct_ft is freed during cleanup. This creates a local privilege-escalation risk as an attacker could observe or trigger the race wi...

CVE-2024-56667

CVE-2024-56667 affects the Linux kernel DRM/i915 driver. The root cause is a NULL pointer dereference in drm_info() when the intel_context structure contains NULL, leading to a crash. The issue has been mitigated by a fix cherry-picked from commit 754302a5bc1bd8fd3b7d85c168b0a1af6d4bba4d. The vul...

CVE-2024-56716

CVE-2024-56716 affects the Linux kernel via netdevsim: nsim_dev_health_break_write() accepts a zero or excessively large count, which can crash the kernel. Connected advisories indicate this CVE is addressed in kernel updates for various distributions (e.g., Debian LTS, Mariner/Mageia/Amazon Linu...

CVE-2024-58058

CVE-2024-58058 affects the Linux kernel ubifs component. The root cause is a null pointer dereference when c->zroot.znode becomes NULL (after slab cache clearing), causing a crash during tnc tree dumping. The vulnerability is described as resolved, with references in multiple advisories indica...

CVE-2025-21670

CVE-2025-21670 affects the Linux kernel’s vsock/bpf path. The issue occurs when vsock_transport is not assigned (NULL) during vsock_bpf_recvmsg for connected sockets (stream/seqpacket), leading to a NULL pointer dereference in vsock_connectible_has_data and an in-kernel oops trace. The vulnerabil...

CVE-2025-21721

CVE-2025-21721 is a Linux kernel vulnerability in the NILFS2 filesystem. The patch series fixes nilfs_prepare_chunk() error handling paths that were previously omitted when rewriting directory entries in nilfs_set_link(), nilfs_delete_entry(), and in the caller nilfs_rename(). The issue allowed e...

CVE-2025-23131

CVE-2025-23131 affects the Linux kernel in the DLM subsystem. The issue occurs when do_uevent returns a positive value written to event_done; this value previously caused new_lockspace to consider it a success, leaving lockspace uninitialized and leading to a NULL pointer dereference in dlm_find_...

CVE-2026-46244

The CVE-2026-46244 issue affects the Linux kernel netfilter nft_inner path. In nft_inner_parse_l2l3(), while handling inner IPv6 packets, ipv6_find_hdr() computes the transport header offset correctly across extension headers, but the code later overwrites this value with nhoff + sizeof(_ip6h) (4...

CVE-2016-10277

CVE-2016-10277 : An elevation-of-privilege in the Motorola bootloader allows a local app to run arbitrary code in the bootloader context by exploiting kernel command-line injection, leading to potential full device compromise. Affected: Android with Kernel-3.10 and Kernel-3.18. Exploitation evide...

CVE-2016-2782

CVE-2016-2782 : In the Linux kernel, the treo_attach function in drivers/usb/serial/visor.c (pre-4.5) can be exploited by a physically proximate attacker who inserts a USB device missing a bulk-in or interrupt-in endpoint, causing a NULL pointer dereference and kernel crash (DoS) or possibly othe...

CVE-2016-7916

CVE-2016-7916 is a Linux kernel local privilege disclosure affecting the environ_read path in fs/proc/base.c. The race condition between environment-variable copying and process setup allows a local user to read sensitive data from kernel memory by accessing a /proc/*/environ file during the setu...

CVE-2017-6951

CVE-2017-6951 : A local denial-of-service in the Linux kernel is caused by a NULL pointer dereference in keyring_search_aux in security/keys/keyring.c when a request_key is used on the dead type. Exploitation could crash the system (OOPS). Affected: Linux kernel up to 3.14.79; impact is local, wi...

CVE-2018-10901

CVE-2018-10901 affects the Linux kernel’s KVM virtualization subsystem. The VMX path fails to restore the guest GDT.LIMIT to the host value, setting it to 64KB instead. This can allow a host userspace process to corrupt GDT entries (notably per-cpu variables), enabling local privilege escalation....

CVE-2018-16885

The CVE-2018-16885 issue is a Linux kernel vulnerability (affecting kernel 3.10.x as shipped with Red Hat Enterprise Linux 7) where userspace can call memcpy_fromiovecend() and similar functions with a zero offset and buffer length, causing a read beyond the buffer boundaries. This can lead to a ...

CVE-2021-47321

CVE-2021-47321 : Linux kernel watchdog use-after-free due to del_timer() not waiting for the timer handler. The issue occurs in the driver remove path, where a timer may still be running after removal, risking a use-after-free. The fixed path uses del_timer_sync() to wait for the timer handler to...

CVE-2021-47428

CVE-2021-47428 is a Linux kernel issue in powerpc/64s emergency stack handling where the emergency path could jump into a non-trivial macro path; the fix avoids numeric labels when jumping over macros. Several vendor/MiracleUnity advisories reference the same patch and include the same descriptio...

CVE-2021-47515

CVE-2021-47515 affects Linux kernel segmentation with IPv6 SRH encapsulation. When an IPv4 packet is received, the kernel assigns the receiving interface index to IPCB(iif). If that packet is later encapsulated in an outer IPv6+SRH header, seg6_do_srh_encap clears the IPv6 socket state (IP6CB) an...

CVE-2022-2318

CVE-2022-2318 is a use-after-free vulnerability in the Linux kernel's Rose (net/rose/rose_timer.c) timer handler that can cause denial of service (crash) with local privileges. Connected advisories confirm the vulnerability affects Linux kernel releases and note fixed versions: Debian security ad...

CVE-2022-48786

The CVE-2022-48786 issue affects the Linux kernel’s vsock path. When a connect() wait is interrupted by a signal, the socket may remain in the TCP_ESTABLISHED/connected list, and a subsequent successful connect could double-add the socket, corrupting the list. The documented fix removes the socke...

CVE-2022-48997

CVE-2022-48997 affects the Linux kernel TPM subsystem, where tpm transactions during suspend were not guarded and could race with other TPM accessors inside tpm_pm_suspend. The referenced fixes call tpm_try_get_ops(), a wrapper around tpm_chip_start() that acquires the appropriate mutex, to seria...

CVE-2022-49579

CVE-2022-49579: In the Linux kernel, a data race around ipv4_fib_multipath_hash_policy was resolved by adding READ_ONCE() guards to readers of sysctl_fib_multipath_hash_policy. Affected component: kernel IPv4 multipath hash policy reader; root cause: concurrent modification during reads; impact: ...

CVE-2022-49594

CVE-2022-49594 : In the Linux kernel, a data race around reading sysctl_tcp_mtu_probe_floor could occur because the value was updated concurrently while read. The fix was to add READ_ONCE() to the reader, mitigating a local-exploit class and preserving availability. The connected advisories/refs ...

CVE-2022-49644

CVE-2022-49644 affects the Linux kernel's DRM/I915 component, addressing a possible refcount leak in intel_dp_add_mst_connector. If drm_connector_init fails, the driver must drop the port refcount before calling intel_connector_free to avoid leaks. The issue is tied to a cherry-picked commit (cea...

CVE-2022-49651

CVE-2022-49651 affects the Linux kernel. The advisory states that cleanup_srcu_struct() now checks for a grace period that is started but not yet started, addressing a potential use-after-free (UAF). It is resolved by a commit tightening GP checks in cleanup_srcu_struct(), with references to kern...

CVE-2023-52859

CVE-2023-52859 affects the Linux kernel perf: hisi uncore PMU registration. A use-after-free can occur when the PMU register path fails and the uncore PMU offline callback is invoked, potentially migrating the PMU context. The fix replaces cpuhp_state_remove_instance() with cpuhp_state_remove_ins...

CVE-2024-27413

CVE-2024-27413 is a Linux kernel vulnerability affecting the EFI capsule loader. The defect occurs in drivers/firmware/efi/capsule-loader.c during efi_capsule_open, where an allocation uses sizeof(void*) for a phys_addr_t on 32-bit builds, leading to insufficient allocation size (4 bytes vs 8). T...

CVE-2024-35979

The connected MiracleLinux AXSA advisory documents CVE-2024-35979 and describes the Linux kernel raid1 use-after-free in raid1_write_request() where r1_bio->bios[] temporarily pointed to the original bio and could be freed if a blocked rdev was encountered, freeing the underlying bios. The mit...

CVE-2024-36961

The CVE-2024-36961 issue relates to the Linux kernel’s thermal debugfs code. The root cause is two locking problems in the thermal zone debugfs handling: (1) a race where user space can open the mitigations file before the thermal zone’s debugfs pointer is set, leading to a NULL pointer dereferen...

CVE-2024-38388

CVE-2024-38388 affects the Linux kernel ALSA component: specifically ALSA: hda/cs_dsp_ctl. The issue stemmed from not actually removing ALSA controls in hda_cs_dsp_control_remove(), freeing only the internal tracking structure, which could leave ALSA controls behind when the amp driver is removed...

CVE-2024-42316

CVE-2024-42316 : Linux kernel fix for div-by-zero in vmpressure_calc_level() within mm/mglru evictions. The issue arose in the second pass of evict_folios(), where deducting scan_control->nr_scanned could underflow nr_scanned if folio_trylock() failed, causing the divisor scale = scanned + rec...

CVE-2024-44981

In CVE-2024-44981, the Linux kernel vulnerability is in the workqueue path: shift_and_mask() constructs a mask with a signed immediate and is invoked with a shift of 31, leading UBSAN to report an integer subtraction overflow and triggering a kernel panic. The documented fix uses an unsigned cons...

CVE-2024-47700

CVE-2024-47700: In the Linux kernel, ext4 stripe size compatibility check failed to run on remount, leaving cases where sbi->s_stripe could become 0 and cause faults (e.g., divide-by-zero). The fix adds the stripe-size compatibility check to the remount path in __ext4_fill_super, ensuring stripe

CVE-2024-50060

CVE-2024-50060 is documented in the IBM bulletin as a Linux kernel vulnerability fix for the io_uring subsystem. The issue involved the need to reschedule during overflow flush in io_uring handling. The described root cause notes that overflow entries can accumulate and flushing could take a long...

CVE-2024-50068

Technical details about CVE-2024-50068 are not publicly provided in the supplied documents. The references list the vulnerability but do not describe affected versions, root cause, or fixes. Monitor official advisories for updates.

CVE-2024-50203

CVE-2024-50203 affects the Linux kernel BPF trampoline path on arm64 when BPF_TRAMP_F_CALL_ORIG is enabled and tag-based KASAN is active. The issue arises because the stack address (bpf_tramp_image) is computed during size calculation using one address and then a heap address is used during code ...

CVE-2024-50218

CVE-2024-50218 relates to the Linux kernel ocfs2 truncation path where passing a 64-bit value to ocfs2_truncate_inline could overflow. The fix introduces a sanity check for byte_start and byte_len in ocfs2_remove_inode_range(); if either is greater than ocfs2_max_inline_data_with_xattr, the funct...

CVE-2024-50267

CVE-2024-50267 — Linux kernel (USB: serial: io_edgeport) A use-after-free in a debug printk after usb_free_urb(urb) was fixed by storing the urb->dev pointer at the start of the function to avoid referencing a freed urb. The vulnerability affects the Linux kernel’s USB serial edgeport driver a...

CVE-2024-50275

The CVE (CVE-2024-50275) affects the Linux kernel on arm64 with SVE traps. A race allows stale FPSIMD/SVE state to be reused across preemption, leading to SVE traps while TIF_SVE is set and potentially incorrect live state handling. The fix detaches from the saved CPU state when not live by calli...

CVE-2024-53084

CVE-2024-53084 affects the Linux kernel’s DRM/Imagination driver path for PVR, where a resource cleanup reference loop between PVR VM Context and VM Mappings could leak VM resources. The official fix breaks the loop by freeing outstanding VM mappings before destroying the PVR Context associated w...

CVE-2024-56629

Technical details about CVE-2024-56629 are not provided in the supplied documents. The connected sources do not specify affected products, root cause, or fixes. Monitor for updates and vendor advisories.

CVE-2024-57912

CVE-2024-57912 affects the Linux kernel iio: pressure: zpa2326 path. The issue stems from a local-triggered buffer where a sample struct (u32 pressure, u16 temperature, gap, u64 timestamp) contains an uninitialized hole between temperature and timestamp, risking information leakage to userspace. ...

CVE-2024-58005

CVE-2024-58005 in the Linux kernel has concrete details in the connected documents: the root cause is a memory allocation path in the TPM eventlog ACPI handling that could allocate an oversized 16 MiB buffer due to how the order parameter is mapped. The patched fix changes the allocation strategy...

CVE-2025-21652

Summary (CVE-2025-21652) : In the Linux kernel, a use-after-free was reported in ipvlan_get_iflink() when handling ipvlan with linkwatch. The issue arises because ipvlan does not hold a refcount on the lower device, unlike vlan/macvlan, which can lead to UAF of ipvlan->phy_dev if the linkwatch...

CVE-2025-37741

CVE-2025-37741 affects the Linux kernel JFS, where a race/locking path can lead to a deadlock in diFree when nlink is incorrectly derived as 0. Root cause: during inode handling for iag creation, a corrupted metapage can cause dinode’s nlink to be copied as 0, triggering diFree and a deadlock seq...

CVE-2009-1439

The CVE-2009-1439 entry describes a buffer overflow in CIFS/Tree Connect handling (fs/cifs/connect.c) of the Linux kernel prior to 2.6.30, where a long nativeFileSystem field in an SMB mount response can cause a remote crash (DoS). The vulnerability affects the Linux kernel’s CIFS implementation ...

CVE-2013-0871

CVE-2013-0871 refers to a race condition in the Linux kernel’s ptrace implementation (PTRACE_SETREGS) that could allow a local user to gain privileges. The issue is in kernels prior to 3.7.5, with the ChangeLog for 3.7.5 documenting the fix. Affected component: Linux kernel (pre-3.7.5); root caus...

CVE-2014-7822

CVE-2014-7822 concerns the Linux kernel splice_write path, where the splice() system call does not validate the maximum size of a single file. This enables a local unprivileged user to trigger a denial of service (system crash) and potentially other effects, notably when using an ext4 filesystem....