CVE-2022-2602

CVE-2022-2602 is a Linux kernel vulnerability in io_uring related to a use-after-free in the Unix garbage collection path. Multiple connected sources confirm a local, kernel-side issue (io_uring UAF) that can be exploited to crash the kernel and, in PoC scenarios, enable privilege escalation by r...

CVE-2024-26886

The Linux kernel contains a vulnerability in the af_bluetooth component where attempting to perform sock_lock on .recvmsg can cause a deadlock . To resolve this and avoid a Use-After-Free (UAF) , the kernel uses sk_receive_queue.lock on bt_sock_ioctl instead of sock_sock. Affected systems include...

CVE-2024-27064

CVE-2024-27064 : Linux kernel nf_tables memory leak when nft_netdev_register_hooks() fails. The fix moves nft_stats_alloc() to after successful registration, preventing leaks of nft_stats if registration aborts. Connected Astra Linux advisory mirrors this description for kernel 5.x series, confir...

CVE-2024-27025

CVE-2024-27025 concerns the Linux kernel: a NULL return from nla_nest_start() could lead to NULL pointer dereference if not checked. The patch inserts a NULL check and sets errno consistent with other call sites, preventing a potential crash. Public references show the issue resolved in the kerne...

CVE-2024-27029

CVE-2024-27029 affects the Linux kernel’s DRM AMDGPU path: mmhub client id out-of-bounds access, caused by improper handling of cid 0x140. Reports across multiple advisories (SUSE live patch for SLE 15 SP6, OpenVAS/UUbuntu advisories) confirm this as a kernel vulnerability with high impact (local...

CVE-2024-42089

CVE-2024-42089 affects the Linux kernel’s ASoC: fsl-asoc-card driver. The root cause is that priv->pdev was assigned after it was used in fsl_asoc_card_audmux_init(), risking a NULL dereference because priv is zero-initialised. The fix moves the priv->pdev assignment to the start of the pro...

CVE-2021-46958

CVE-2021-46958 : The Linux kernel fixes a race in btrfs where a transaction abort during a commit can race with an ongoing fsync and the kthread, causing use-after-free of the log_root_tree. The vulnerability can trigger IO errors, forced read-only state, and log/superblock write failures as show...

CVE-2021-47549

CVE-2021-47549 affects the Linux kernel via the sata_fsl driver. The documented issue is a use-after-free (UAF) in sata_fsl_port_stop triggered during rmmod sata_fsl.ko on PPC64 GNU/Linux, where after port_stop is invoked, an ioread32 on hcr_base leads to a kernel OOPS and potential memory access...

CVE-2017-8890

CVE-2017-8890 is a Linux kernel vulnerability affecting the IPv4 networking stack. The issue is a double free in inet_csk_clone_lock() in net/ipv4/inet_connection_sock.c, which can be triggered via the accept() system call and leads to a denial of service (kernel memory corruption/crash). The Cen...

CVE-2021-46973

CVE-2021-46973 is a Linux kernel use-after-free in the MHI path for qrtr (net: qrtr: Avoid potential use after free in MHI send). The issue occurs because the MHI ul_callback could run immediately after queuing an skb, potentially decrementing the associated skb’s refcount and freeing it, which m...

CVE-2023-52923

CVE-2023-52923 affects the Linux kernel netfilter nf_tables backend. The vulnerability arises from switching to the GC transaction API to replace the old gc API and busy-mark approach. No set elements are removed during async GC anymore; the _DEAD bit is set to hide elements from lookups, and asy...

CVE-2024-53144

The CVE-2024-53144 entry maps to a Linux kernel Bluetooth issue in hci_event: BR/EDR JUST_WORKS was aligned with LE, affecting the Just Works pairing flow and forcing user confirmation via confirm_hint due to policy changes in bluetoothd. The description notes this alignment and its rationale; no...

CVE-2025-21659

CVE-2025-21659 covers a Linux kernel netdev issue where NAPI IDs were not namespaced because they were not exposed to user space before the netlink API. The vulnerability arises because netlink must ensure that a NAPI instance belongs to the same network namespace as the genl socket owner; otherw...

CVE-2024-26980

CVE-2024-26980 affects the Linux kernel’s ksmbd component. The vulnerability arises when SMB2_TRANSFORM_PROTO_NUM is used, allowing request size validation to be skipped and potentially triggering a slab-out-of-bounds read in smb2_allocate_rsp_buf(). The issue occurs if a transform request’s size...

CVE-2022-0847

CVE-2022-0847 (Dirty Pipe) is a Linux kernel local privilege-escalation flaw in the pipe buffer handling (flags field) where copy_page_to_iter_pipe and push_pipe fail to initialize flags, allowing an unprivileged local user to write to pages cached from read-only files. Public advisories confirm ...

CVE-2024-26994

CVE-2024-26994 – Linux kernel speakup crash on very long words : The issue occurs when a console is configured with a word longer than 256 characters, risking a crash due to buffer length overflow. The fixed version stops processing before the word buffer length is exceeded. Affected component: s...

CVE-2024-27073

CVE-2024-27073 (Linux kernel) relates to memory leaks in the media: ttpci budget_av_attach path. The fixes ensure budget_av_attach frees resources if saa7146_register_device or saa7146_vv_init fail, aligning with the error-handling pattern in ttpci_budget_init. Two fixme comments noted deallocati...

CVE-2024-27054

A vulnerability exists in the Linux kernel involving a double module refcount decrement in the s390/dasd component. The issue occurs because manual decrementing along an error path causes the refcount to decrease artificially on every error, whereas it should remain unchanged once a discipline is...

CVE-2024-26880

CVE-2024-26880 relates to the Linux kernel vulnerability where dm: call the resume method on internal suspend was improperly paired, risking a crash via a list corruption in the DM (device-mapper) subsystem during suspend/resume handling. The fix standardizes calls by having __dm_internal_resume ...

CVE-2024-26950

CVE-2024-26950 (WireGuard, Linux kernel) : The issue was in the netlink path for WireGuard where the code accessed the device via peer and could dereference a NULL peer->device. The fix standardizes device retrieval from the context by using ctx->wg, since ctx->wg->peer_allowedips.seq...

CVE-2024-26889

A buffer overflow vulnerability exists in the Linux kernel within the Bluetooth: hci_core component. The issue stems from the struct hci_dev_info structure, which contains a fixed-size name[8] field. If hdev->name exceeds this size, the strcpy function attempts to write past the buffer boundar...

CVE-2024-26940

The Linux kernel 's drm/vmwgfx driver is vulnerable to a crash when attempting to read from the mob_ttm debugfs entry. This occurs because the driver creates the entry even when the corresponding ttm_resource_manager is not allocated. The issue is resolved by adding a check to ensure that mob_ttm...

CVE-2024-53240

The CVE-2024-53240 entry refers to a Xen netfront crash in the Linux kernel. The issue occurs when removing a netfront device directly after a suspend/resume cycle, where queues may not be reinitialized and a crash can happen when stopping them. The fix is to check that the queues exist before st...

CVE-2024-53148

CVE-2024-53148 affects the Linux kernel (comedi subsystem). The issue: if remap_pfn_range() calls partially succeed before a failure, some buffer pages remain mapped in userspace page tables after dropping the buffer reference, and cleanup occurs too late in the mmap error path. The root cause is...

CVE-2024-27393

CVE-2024-27393 affects the Linux kernel xen-netfront driver. A missing skb_mark_for_recycle() call led to memory leak in page_pool handling (page_pool_release_page() usage and subsequent removals). The issue was fixed by adding the missing skb_mark_for_recycle in xen-netfront, with historical con...

CVE-2024-26894

The Linux kernel contains a memory leak vulnerability in the ACPI: processor_idle component, specifically within the acpi_processor_power_exit() function. The issue occurs because memory associated with the CPU idle device is not freed after unregistering it. This can lead to a memory leak over t...

CVE-2024-26956

CVE-2024-26956 covers a kernel vulnerability in nilfs2 within the Linux kernel. The issue has two flaws: (1) nilfs_get_block() may misinterpret a DAT-corrupted data block as existing, due to DAT translation returning -ENOENT; and (2) after this inconsistency, the caller may request a read on an u...

CVE-2024-42139

CVE-2024-42139 affects the Linux kernel component related to ice/extts handling for PTP; when the driver is removed while an application using ts2phc is running, a previously enabled extts event may remain active, potentially causing a kernel crash. On driver reload, a remaining extts event for t...

CVE-2021-46976

CVE-2021-46976 refers to a Linux kernel vulnerability in drm/i915: Fix crash in auto_retire. The issue arises from using the two lower bits of the retire function pointer to store flags, and because auto_retire may not be 4-byte aligned, this can cause a jump to an incorrect address and a crash. ...

CVE-2024-26991

The Linux kernel is vulnerable to a vmalloc out-of-bounds read within the KVM x86/mmu component. The issue occurs because the KVM_SET_MEMORY_ATTRIBUTES ioctl operation utilizes an optimization in the hugepage_has_attrs() helper function. While level-1 huge pages are checked first to determine if ...

CVE-2024-27041

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix NULL checks for adev->dm.dc in amdgpu_dm_fini() Since 'adev->dm.dc' in amdgpu_dm_fini() might turn out to be NULLbefore the call to dc_enable_dmub_notifications(), checkbeforehand to ensure there will n...

CVE-2025-21678

In CVE-2025-21678, Linux kernel gtp: Destroy device along with udp socket’s netns dismantle was fixed. The root cause was gtp_newlink() attaching the device to dev_net(dev) instead of src_net, which meant a UDP tunnel socket created in a different netns could leave the device alive in dev_net(dev...

CVE-2024-53241

CVE-2024-53241 affects the Linux kernel when running with Xen PV guests. The root cause is an unsafe PV iret hypercall path via the Xen hypercall page. The fix replaces the hypercall-page jump with an inlined sequence in xen-asm.S to stop using the hypercall page, preparing for its removal due to...

CVE-2025-21702

The CVE CVE-2025-21702 concerns a bug in Linux kernel pfifo_tail_enqueue where, when sch->limit == 0, a path can cause qlen to be increased to one even if a preceding drop would have kept it at zero. This leads to a mismatch where a parent qlen no longer equals the sum of its children’s qlen, ...

CVE-2025-21655

CVE-2025-21655 in the Linux kernel’s io_uring/eventfd was fixed by deferring the freeing of the io_eventfd object to an additional RCU grace period. The issue arose because io_eventfd_do_signal() is called from an RCU callback and, when the reference to the io_ev_fd drops to zero, the code attemp...

CVE-2025-21664

CVE-2025-21664 affects the Linux kernel dm-thin component. Root cause: get_first_thin did a non-RCU-safe sequence (list_empty -> list_first) that could race with concurrent updates, risking dereferencing a stale/altered list head during process_deferred_bios flow and leading to a crash. Connec...

CVE-2024-56570

CVE-2024-56570 – Linux kernel ovl (overlayfs) : The vulnerability arises in the ovl module where directory inodes that lack the lookup function could be processed, potentially triggering errors in overlayfs when passed to the lowerstack. The fix adds a check in ovl_dentry_weird() to filter/skip i...

CVE-2025-21653

CVE-2025-21653 affects the Linux kernel net_sched flow classifier (net/sched/cls_flow.c). The vulnerability was due to missing validation of TCA_FLOW_RSHIFT, which could trigger undefined behavior (UB) and a shift-out-of-bounds on large 32-bit shifts, as shown by UBSAN. Connected advisories (Astr...

CVE-2022-48669

A memory leak vulnerability exists in the Linux kernel within the powerpc/pseries component. The issue occurs in the papr_get_attr() function where a buffer (buf) is allocated, but the original buffer is not freed if the krealloc() call fails. This flaw may lead to compromised availability . The ...

CVE-2024-53158

CVE-2024-53158 relates to the Linux kernel: in soc: qcom: geni-se, an array underflow in geni_se_clk_tbl_get() occurred because a loop’s break condition using clk_round_rate() poorly handled the first iteration, causing reads before the start of these->clk_perf_tbl[]. The issue was fixed in th...

CVE-2024-56531

CVE-2024-56531 affects the Linux kernel ALSA caiaq driver. The bug arises because the USB disconnect callback called snd_card_free(), which waits for all fds to close, potentially delaying release and causing upper-layer USB ioctls to block, risking a soft lockup. The fix replaces snd_card_free()...

CVE-2025-21668

CVE-2025-21668 (Linux kernel) : A missing loop break in the imx8mp_blk_ctrl_remove path (imx8mp_blk_ctrl) allows the for loop to run out of bounds, potentially affecting system shutdown/reboot flows. The vulnerability is tied to the imx8mp domain handling in dev_pm_domain_detach during platform s...

CVE-2024-56690

CVE-2024-56690 : Linux kernel crypto: pcrypt fix for -EBUSY/-EAGAIN. After commit 8f4f68e7, padata_do_parallel() may return -EAGAIN for pcrypt encrypt/decrypt when CPUs go online/offline, triggering a WARN/panic under panic_on_warn. The remediation is to call the crypto layer directly (no paralle...

CVE-2024-27040

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add 'replay' NULL check in 'edp_set_replay_allow_active()' In the first if statement, we're checking if 'replay' is NULL. But inthe second if statement, we're not checking if 'replay' is NULL againbefore calling ...

CVE-2024-56709

CVE-2024-56709 : Linux kernel io_uring vulnerability fixed by verifying iowq is not killed before queuing. If a task completes its termination path after io_uring teardown, task_work may see a null ->io_wq and attempt to forward to io_queue_iowq(), causing failure. The fix also accounts for PF...

CVE-2024-26977

CVE-2024-26977 — Linux kernel MMIO leak due to broken guarding of iounmap(). The vulnerability arises because the ARCH_HAS_GENERIC_IOPORT_MAP guard was applied to iounmap() in pci_iounmap(), causing MMIO mappings to leak. The fix relocates the guard so iounmap() is called for MMIO mappings, preve...

CVE-2025-21660

Technical details for CVE-2025-21660 are not provided in the supplied documents. No affected products, root cause, or remediation are disclosed here; monitor for updates from official advisories.

CVE-2024-53160

CVE-2024-53160 : The MiracleLinux advisory confirms a Linux kernel data-race in rcu/kvfree between __mod_timer/kvfree_call_rcu and kfree_rcu_monitor. The fix acquires krcp->lock in kfree_rcu_monitor to ensure both functions do not race when updating krcp->monitor_work.timer.expires, address...

CVE-2024-53229

Summary (CVE-2024-53229) : In the Linux kernel, the RDMArxe path had a fix for qp flush warnings in req. When a QP is in an error state, WQEs in the queue must be marked as error; otherwise a kernel warning can occur (for example in rxe_completer). The provided data confirms this CVE is tracked i...

CVE-2025-21648

CVE-2025-21648 affects the Linux kernel netfilter conntrack code. The vulnerability arises from the hashtable resize path where the maximum size could exceed practical limits, risking a WARN_ON_ONCE in __kvmalloc_node_noprof() when __GFP_NOWARN is unset. The fix clamps the conntrack hashtable siz...