CVE-2024-58052

CVE-2024-58052 — Linux kernel (drm/amdgpu) NULL pointer dereference . The bug occurs in atomctrl_get_smc_sclk_range_table: if smu_atom_get_data_table() fails, it returns NULL and is dereferenced later. The description notes the code path is invoked on Polaris chips, and the vbios data table shoul...

CVE-2024-58058

CVE-2024-58058 affects the Linux kernel ubifs component. The root cause is a null pointer dereference when c->zroot.znode becomes NULL (after slab cache clearing), causing a crash during tnc tree dumping. The vulnerability is described as resolved, with references in multiple advisories indica...

CVE-2025-21721

CVE-2025-21721 is a Linux kernel vulnerability in the NILFS2 filesystem. The patch series fixes nilfs_prepare_chunk() error handling paths that were previously omitted when rewriting directory entries in nilfs_set_link(), nilfs_delete_entry(), and in the caller nilfs_rename(). The issue allowed e...

CVE-2025-21736

CVE-2025-21736 : In the Linux kernel, nilfs2 may overflow when computing the result of nilfs_fiemap() via nilfs_bmap_lookup_contig() if blocks up to maxblocks == INT_MAX are considered; an overflow can occur due to a left shift on blkbits. The advisory notes the fix is to cast the right-hand expr...

CVE-2025-21899

The CVE concerns the Linux kernel tracing subsystem (eventtrigger_write path). A bug in the sequence of operations when registering a hist trigger can leave the named_triggers list inconsistent, because event_trigger_register() succeeds but hist_trigger_enable() does not reliably add the new trig...

CVE-2025-22009

CVE-2025-22009 is a Linux kernel vulnerability affecting the regulator: dummy driver where probing can become unsynchronized across threads, leading to a NULL pointer dereference during boot via kobject_get(). The issue arises when anatop_regulator_probe() and dummy_regulator_probe() race with kw...

CVE-2011-2525

CVE-2011-2525 affects the Linux kernel prior to 2.6.35, where the qdisc_notify function in net/sched/sch_api.c does not prevent tc_fill_qdisc calls referencing builtin Qdisc structures. This can lead to a NULL pointer dereference and OOPS, enabling local users to cause a denial of service and pot...

CVE-2014-7975

CVE-2014-7975 : The Linux kernel up to 3.17 allows a local user to trigger DoS by remounting root read-only without CAP_SYS_ADMIN. This occurs in do_remount_sb invoked via unshare/mount flows, clearing MNT_LOCKED and issuing MNT_FORCE unmount. Connected Nessus advisories for Unity Linux reference...

CVE-2015-2666

CVE-2015-2666 : The Linux kernel contains a stack-based buffer overflow in get_matching_model_microcode (arch/x86/kernel/cpu/microcode/intel_early.c) that can be exploited by a context-dependent local attacker with root privileges to write to the initrd. The description in connected advisories co...

CVE-2016-2185

CVE-2016-2185 : In the Linux kernel, the ati_remote2_probe function (drivers/input/misc/ati_remote2.c) in versions before 4.5.1 is vulnerable. A physically proximate attacker can trigger a NULL pointer dereference via a crafted USB device descriptor, causing a denial of service (system crash). Th...

CVE-2016-3140

CVE-2016-3140 affects the Linux kernel, specifically the digi_port_init function in drivers/usb/serial/digi_acceleport.c. The vulnerability enables physically proximate attackers to trigger a NULL pointer dereference and crash the system by sending a crafted endpoints value in a USB device descri...

CVE-2016-3955

The CVE-2016-3955 issue affects the Linux kernel’s usbip_recv_xbuff path (drivers/usb/usbip/usbip_common.c) prior to version 4.5.3. A crafted length in a USB/IP packet can trigger an out-of-bounds write, enabling remote denial of service (and potentially other impact) without authentication. The ...

CVE-2016-9685

CVE-2016-9685 affects the Linux kernel’s XFS filesystem: multiple memory leaks in error paths within fs/xfs/xfs_attr_list.c can cause local denial of service through memory consumption. Affects kernel versions before 4.5.1; patch released in 4.5.1. References indicate remediation via upgrading to...

CVE-2021-47099

CVE-2021-47099 relates to a Linux kernel issue where, under GRO in a veth device, shared or cloned skbs could bypass the share check and enter the GRO path when no XDP program is attached. The root cause described in the CVE notes is that when GRO is enabled on a veth pair and the peer has TSO di...

CVE-2021-47428

CVE-2021-47428 is a Linux kernel issue in powerpc/64s emergency stack handling where the emergency path could jump into a non-trivial macro path; the fix avoids numeric labels when jumping over macros. Several vendor/MiracleUnity advisories reference the same patch and include the same descriptio...

CVE-2021-47429

CVE-2021-47429 – Linux kernel (powerpc/64s): The issue occurs when an unrecoverable MCE is handled in NMI context, where the true NMI handling path could lead to calling an async MCE handler and corrupt IRQ state. The fix introduces separate _async and NMI-specific machine_check_exception handler...

CVE-2021-47580

Summary of CVE-2021-47580 / CVE-2024-38575 context: In the Linux kernel, the issue arises from using min_t with type int , which sign-extends large values and can trigger a stack-out-of-bounds during copies in the SCSI path (notably sg_copy_buffer and related code). The vulnerability is demonstra...

CVE-2022-3106

The connected Astra Linux advisory and the CVE entry confirm CVE-2022-3106 affects the Linux kernel up to 5.16-rc6, where ef100_update_stats (drivers/net/ethernet/sfc/ef100_nic.c) does not check the return value of kmalloc(). The lack of a kmalloc() return check is the root cause; without it, all...

CVE-2022-3202

CVE-2022-3202 involves a NULL pointer dereference in diFree() within fs/jfs/inode.c of the Linux kernel’s Journaled File System (JFS). The underlying cause is a NULL pointer dereference, which could allow a local attacker to crash the system or leak kernel internal information. The CVE is associa...

CVE-2022-49097

CVE-2022-49097 relates to the Linux kernel NFS writeback path. In low-memory conditions, the NFS writeback code could enter infinite loops in mempool_alloc, risking a writeback stall. The issue is resolved in the kernel by allowing the writeback path to fail gracefully instead of deadlocking. The...

CVE-2022-49122

CVE-2022-49122 is a Linux kernel vulnerability affecting the dm ioctl path where user-supplied data could act as an index and enable Spectre v1 gadget behavior. The fix, described in connected advisories, prevents leakage of kernel memory to userspace by applying array_index_nospec to index handl...

CVE-2022-49153

CVE-2022-49153 affects the Linux kernel via the wireguard path: when sending to a peer, skb memory is not freed if IPv6 is disabled, causing a memory leak. The root cause is missing kfree_skb() in the send6() handling within wg_socket_send_buffer_to_peer/..send_buffer_to_peer() and related code p...

CVE-2022-49205

CVE-2022-49205 fixes a double memory uncharge bug in the Linux kernel’s bpf/sockmap path (sk_msg) during teardown when psock is freed, which could cause an error path to propagate to user space. Affected component: kernel networking code (tcp_bpf_sendmsg -> tcp_bpf_send_verdict -> sk_msg_re...

CVE-2022-49404

The CVE-2022-49404 entry concerns the Linux kernel RDMA/hfi1 path. The root cause is an integer multiplication overflow during inter-packet delay calculations due to type-conversion order, allowing overflow and an incorrect result. The fix forces one operand to be u64 so the promotion occurs befo...

CVE-2022-49598

CVE-2022-49598 affects the Linux kernel, addressing a data-race around sysctl_tcp_mtu_probing. The issue arises when reading sysctl_tcp_mtu_probing, which could be modified concurrently. The root cause is a missing synchronization in readers of sysctl_tcp_mtu_probing; the fix is to add READ_ONCE(...

CVE-2022-49638

CVE-2022-49638 affects the Linux kernel ICMP subsystem. It arises from data races when reading icmp sysctl variables, which can be changed concurrently. The fix adds READ_ONCE() around these reads. According to the descriptor, impact is Availability (HIGH) with no confidentiality or integrity imp...

CVE-2022-49688

The CVE-2022-49688 entry concerns the Linux kernel afs subsystem. A patch fix for afs_getattr prevents dereferencing vnode->volume when the dynamic root afs superblock has pseudo-inodes without a volume or server, which previously could trigger a NULL pointer dereference when stat’ing a direct...

CVE-2022-49708

CVE-2022-49708 affects the Linux kernel ext4 file system (mballoc allocator). The issue is triggered by a BUG_ON path in ext4_mb_use_inode_pa during disk space accounting, leading to a kernel crash when fsync/writeback paths exercise preallocation and inode pa blocks. Reproduction steps involve c...

CVE-2022-49732

The CVE-2022-49732 issue in the Linux kernel concerns psock handling and ULP protection. A change moved the inet_csk_has_ulp(sk) check from sk_psock_init() to tcp_bpf_update_proto(), enabling psocks for non-inet sockets. The destruction path of psock includes the ULP unwind, so sk_psock_init() mu...

CVE-2023-52659

CVE-2023-52659 affects the Linux kernel 64-bit builds where the pfn_to_kaddr() macro may lose address bits when shifting a 40-bit GFN, causing guest crashes in SEV-SNP environments. The fix introduces an inline function to implicitly cast inputs to a 64-bit type before the shift, replacing the pr...

CVE-2023-52674

CVE-2023-52674: Linux kernel ALSA scarlett2 clocking path vulnerability fixed by Add clamp() in scarlett2_mixer_ctl_put(); the input value is limited to 0..SCARLETT2_MIXER_MAX_VALUE to prevent out-of-bounds access to scarlett2_mixer_values[]. The connected IBM Guardium advisory lists the CVE with...

CVE-2023-52880

CVE-2023-52880 affects the Linux kernel tty subsystem, specifically the N_GSM0710 ldisc. The issue allowed attaching the N_GSM0710 line discipline without privileges, but creating a GSM network would require CAP_NET_ADMIN. The advisory indicates that CAP_NET_ADMIN is now required in the initial n...

CVE-2023-53021

CVE-2023-53021 affects the Linux kernel net/sched sch_taprio component. An invalid TCA_RATE attribute can trigger a use-after-free in a taprio qdisc during qdisc_create/taprio_destroy, with an hrtimer firing and __netif_schedule() leading to net_tx_action() using a destroyed qdisc. The issue is f...

CVE-2024-26636

CVE-2024-26636 : In the Linux kernel, the llc_ui_sendmsg() path could allocate an skb with insufficient headroom and then push an Ethernet header, triggering a bug path when the socket lock is reacquired. The fix reserves space with LL_RESERVED_SPACE(), re-checks all conditions after reacquiring ...

CVE-2024-26831

CVE-2024-26831 : Linux kernel vulnerability affecting the handshake path in net/handshake, where the test handshake_req_destroy_test1 failed due to replacing sock_release(sock) with fput(filp). This change delayed final close/cleanup, risking that hp_destroy might not be invoked before the test c...

CVE-2024-27023

In CVE-2024-27023, the Linux kernel md subsystem (md) had a flaw where active_io was not released when flush_pending fell to zero, causing mddev_suspend() to wait forever. The fix releases active_io in submit_flushes() as soon as flush_pending transitions to zero, preventing the hang. The descrip...

CVE-2024-35827

CVE-2024-35827 stems from a Linux kernel issue in io_uring/net where an overflow check in io_recvmsg_mshot_prep() mis-handles a size_t controllen cast to int, enabling an overflow/underflow mismatch. The root cause is described as casting controllen (size_t) to int fixes the overflow check in che...

CVE-2024-35859

CVE-2024-35859 concerns the Linux kernel: a module reference leakage can occur in the bdev_open_by_dev error path. The vulnerability arises because a module reference is grabbed when bdev_may_open() is invoked and might not be released if that call fails. The issue was identified via code review ...

CVE-2024-35880

Summary of CVE-2024-35880 (Linux kernel) : A local privilege escalation fix addressing io_uring kbuf handling during mmap. The issue stems from unsafe use of the io_uring lock while mmap’ing, requiring a reference to the io_buffer_list to prevent unregistering during use. The lookup now returns t...

CVE-2024-35962

CVE-2024-35962 (Linux kernel netfilter nf_tables) involves incomplete validation of user input in netfilter: complete validation of user input. Root cause: do_replace() handlers use copy_from_sockptr() followed by unsafe copy_from_sockptr_offset() without validating optlen early enough; the patch...

CVE-2024-38575

In CVE-2024-38575, the Linux kernel wifi: brcmfmac: pcie: handle randbuf allocation failure fixes a NULL pointer dereference that could occur when get_random_bytes() is used after kzalloc() returns NULL in brcmf_pcie_download_fw_nvram(). The patch adds a kernel-stack based buffer approach to gene...

CVE-2024-41032

CVE-2024-41032: Linux kernel vulnerability in vmalloc hash indexing. Systems where cpu_possible_mask has gaps (e.g., SPARC) could cause addr_to_vb_xa() to hash to a non-existent CPU, accessing an uninitialized per-CPU area and triggering an oops. The per-CPU vmap_block_queue also treated cpu_poss...

CVE-2024-41080

CVE-2024-41080 concerns the Linux kernel and describes a deadlock risk in io_uring when locking order is not respected in io_register_iowq_max_workers. The root cause is that io_put_sq_data() can be called while uring_lock is held, risking deadlock with sqd->lock. The documented fix releases u...

CVE-2024-43865

Technical details for CVE-2024-43865 are not provided in the supplied documents. No information on affected product versions, impact, or remediation is present. Monitor for updates from official advisories.

CVE-2024-46745

CVE-2024-46745 affects the Linux kernel uinput interface. The root cause is an unbounded request for slots via syzkaller, causing memory allocation failure in input_mt_init_slots. The fix limits the allowed number of slots to 100 (extendable if devices require more). Consequences described in the...

CVE-2024-46786

CVE-2024-46786 concerns the Linux kernel fscache subsystem. The connected documents confirm a concrete root cause: the fscache_cookie_lru_timer is initialized when the fscache module is loaded but is not deleted on module unload, which can lead to the timer being left on the per-CPU timer list an...

CVE-2024-46822

CVE-2024-46822 αφορά Linux kernel, prädominantemente为 ARM64 架构，涉及 acpi_map_gic_cpu_interface() 中对 MPIDR 检查失败时导致 cpu_madt_gicc[cpu] 为 NULL 的情况，从而可能造成空指针解引用。修复为对 get_cpu_for_acpi_id() 的调用路径进行强化，确保获取到有效 CPU 条目后再进行索引，避免空指针 dereference。相关公开资料（如 Astra Linux、CIRCL/CVE 记录）确认了该漏洞存在于内核实现并已通过 Harden get_cpu...

CVE-2024-47670

This CVE (CVE-2024-47670) affects the Linux kernel OCFS2 subsystem. The vulnerability arises from insufficient bounds checking in ocfs2_xattr_find_entry(), allowing potential out-of-bounds memory access while scanning for a match in OCFS2 extended attributes. The advisory states that a paranoia c...

CVE-2024-49896

CVE-2024-49896 is a Linux kernel vulnerability affecting the amdgpu/display path. The issue arises when amdgpu_dm passes a null stream to dc_is_stream_unchanged, leading to a potential NULL dereference. The description in the sources notes the root cause as missing null-check before dereferencing...

CVE-2024-50060

CVE-2024-50060 is documented in the IBM bulletin as a Linux kernel vulnerability fix for the io_uring subsystem. The issue involved the need to reschedule during overflow flush in io_uring handling. The described root cause notes that overflow entries can accumulate and flushing could take a long...