CVE-2020-9391

CVE-2020-9391 affects the Linux kernel on AArch64 (versions 5.4 to 5.5.6). The top byte of the address passed to brk is ignored, potentially moving the program break downward instead of upward, which can cause heap corruption in glibc malloc. Public sources in the connected documents consistently...

CVE-2024-53180

Technical details and affected products/versions for CVE-2024-53180 are not present in the connected documents. The initial description summarizes a Linux kernel change but lacks explicit exploit, affected driver/version, or patch details. Monitor vendor advisories for updates.

CVE-2024-58090

CVE-2024-58090 affects the Linux kernel: sched/core commit fixes a long-standing issue where rescheduling could be triggered with interrupts disabled during kexec-based reboot paths. The root cause involved a wakeup in a syscore_suspend()/resume path that set NEED_RESCHED, leading to cond_resched...

CVE-2025-22002

CVE-2025-22002 concerns the Linux kernel netfs code path: if a filesystem does not implement invalidate_cache, a write-to-cache failure can trigger a NULL pointer dereference in netfs_write_collection_worker, leading to a kernel crash. The provided documents confirm the root cause as a missing NU...

CVE-2026-31685

The connected Red Hat/SUSE/NVD entries confirm CVE-2026-31685 affects the Linux kernel netfilter component ip6t_eui64. The root cause is that eui64_mt6() derives a modified EUI-64 from the Ethernet source and compares it with the IPv6 low 64 bits, but the existing guard only rejects an invalid MA...

CVE-2011-0521

The CVE-2011-0521 issue affects the Linux kernel’s dvb_ca_ioctl in drivers/media/dvb/ttpci/av7110_ca.c, where the sign of a certain integer field is not checked in versions before 2.6.38-rc2. This allows local users to cause a denial of service via memory corruption and potentially other unspecif...

CVE-2015-2830

CVE-2015-2830 affects the Linux kernel (arch/x86/kernel/entry_64.S) prior to 3.19.2. The TS_COMPAT flag can reach a user-mode task, potentially allowing local attackers to bypass seccomp or audit protections via crafted applications using fork or close. A fix is available in 3.19.2 and later; att...

CVE-2016-8646

CVE-2016-8646 affects the Linux kernel: the hash_accept function in crypto/algif_hash.c before version 4.3.6 allows local users to trigger in-kernel hash algorithms for sockets that have received zero bytes, causing a denial of service (OOPS). The vulnerability is local and does not require authe...

CVE-2019-19070

Summary (CVE-2019-19070): A memory-leak in the Linux kernel spi_gpio_probe() (drivers/spi/spi-gpio.c) up to 5.3.11 can cause a denial of service via memory exhaustion when devm_add_action_or_reset() fails. The vulnerability is tied to the probe path and is contingent on memory pressure; a third‑p...

CVE-2020-36557

CVE-2020-36557: A race condition in the Linux kernel before 5.6.2 between VT_DISALLOCATE and closing/opening ttys can cause a use-after-free. Affected software: Linux kernel versions prior to 5.6.2. Impact per available data: potential use-after-free with availability impact; no explicit exploita...

CVE-2020-36691

CVE-2020-36691 affects the Linux kernel up to and including versions prior to 5.8. The flaw is in lib/nlattr.c where a nested Netlink policy with a back reference can trigger unbounded recursion, causing a denial of service. A patch was merged in kernel 5.8 (per ChangeLog-5.8); users should upgra...

CVE-2021-47222

The CVE-2021-47222 issue is a Linux kernel vulnerability in the bridge vlan tunneling path where egress code used dst_clone() and set the result directly, risking invalid refcnt (entry can have 0 refcnt or be deleted) and triggering dst_hold()/dst_release underflow (as seen in dst_release: refcnt...

CVE-2021-47428

CVE-2021-47428 is a Linux kernel issue in powerpc/64s emergency stack handling where the emergency path could jump into a non-trivial macro path; the fix avoids numeric labels when jumping over macros. Several vendor/MiracleUnity advisories reference the same patch and include the same descriptio...

CVE-2021-47429

CVE-2021-47429 – Linux kernel (powerpc/64s): The issue occurs when an unrecoverable MCE is handled in NMI context, where the true NMI handling path could lead to calling an async MCE handler and corrupt IRQ state. The fix introduces separate _async and NMI-specific machine_check_exception handler...

CVE-2022-3202

CVE-2022-3202 involves a NULL pointer dereference in diFree() within fs/jfs/inode.c of the Linux kernel’s Journaled File System (JFS). The underlying cause is a NULL pointer dereference, which could allow a local attacker to crash the system or leak kernel internal information. The CVE is associa...

CVE-2022-48754

CVE-2022-48754 affects the Linux kernel phylib component. A use-after-free could occur because phy_device_reset() was called after put_device() in phy_detach(), whereas the fix reorders the call to phy_device_reset() to occur before put_device(), preventing use-after-free of phydev. That root cau...

CVE-2022-49214

CVE-2022-49214 pertains to the Linux kernel on PowerPC 64s where Data SLB (Data Segment) faults do not set DSISR to a useful value, causing misclassification of read vs. write faults. The fix reworks the printing logic to treat SLB faults separately and only print read/write when the fault type c...

CVE-2022-49339

CVE-2022-49339 affects the Linux kernel’s IPv6 stack, specifically the internal call between seg6.c and seg6_hmac.c. The issue arises from exporting an __init-annotated symbol whose .init.text section can be freed after initialization, creating a potential kernel panic when a module references a ...

CVE-2022-49586

Technical details about CVE-2022-49586 are not provided in the connected documents. The sources only reiterate that the Linux kernel fix involved reading of sysctl_tcp_fastopen and a READ_ONCE() addition. Monitor for vendor updates.

CVE-2022-49595

CVE-2022-49595 is a Linux kernel data‑race vulnerability affecting the reader of the sysctl_tcp_probe_threshold variable. The issue arises because the value can be changed concurrently while read, leading to a race condition. The documented fix is to guard the reader with a READ_ONCE(), stabilizi...

CVE-2022-49638

CVE-2022-49638 affects the Linux kernel ICMP subsystem. It arises from data races when reading icmp sysctl variables, which can be changed concurrently. The fix adds READ_ONCE() around these reads. According to the descriptor, impact is Availability (HIGH) with no confidentiality or integrity imp...

CVE-2022-49872

CVE-2022-49872 affects the Linux kernel net/gso code. A bug in skb_segment when GRO packets have a frag_list with mixed head allocation types could trigger a BUG_ON, due to an incorrect assumption that the first list_skb member’s head_frag reflects all members. The issue arises because skbs on th...

CVE-2023-32820

CVE-2023-32820 affects MediaTek wlan firmware. The issue arises from improper input handling that can trigger a firmware assertion, potentially enabling remote denial of service without extra privileges or user interaction. Public details consistently reference a patch ID ALPS07932637 (and ALPS07...

CVE-2023-52667

CVE-2023-52667 affects the Linux kernel net/mlx5e code path. The vulnerability is a potential double-free in fs_any_create_groups when kcalloc() succeeds but kvzalloc() fails, because ft->g could be freed twice up the call chain. The fix implemented is to set ft->g to NULL in fs_any_create_...

CVE-2023-52880

CVE-2023-52880 is a Linux kernel flaw where attaching the N_GSM0710 line discipline can be performed by an unprivileged user only after CAP_NET_ADMIN has been requested to create GSM networking. The initial namespaceCAP_NET_ADMIN is also required to proceed with the attachment. Several connected ...

CVE-2024-35827

CVE-2024-35827 – Linux kernel io_uring/net overflow fix : The vulnerability arises in io_recvmsg_mshot_prep() where a size_t controllen (unsigned long) is cast to int for overflow checking, allowing an overflow misinterpretation if the value becomes negative. The check_add_overflow() logic depend...

CVE-2024-35891

CVE-2024-35891: In the Linux kernel, lan8814_get_sig_rx() and lan8814_get_sig_tx() may dereference a NULL ptp_header returned by ptp_parse_header() for abnormal or corrupted packets. The fix adds a check for ptp_header to prevent a potential null pointer dereference. Connected advisories confirm ...

CVE-2024-35983

CVE-2024-35983 : The Vuln resides in the Linux kernel, caused by incorrect bits_per() rounding for power-of-two CONFIG_NR_CPUS, leading to crashes on certain machines/configs. Public advisories (Unity UTSA-2025-992928) confirm the vulnerability has been resolved in kernel updates. Affected compon...

CVE-2024-36489

CVE-2024-36489: Linux kernel TLS NULL pointer dereference risk due to a missing memory barrier in tls_init() (NULL ctx->sk_proto observed in tls_setsockopt/getsockopt). The fix relies on rcu_assign_pointer() (which implies a release barrier) and moves the assignment of ctx->sk_proto until a...

CVE-2024-36881

CVE-2024-36881: Linux kernel mm/userfaultfd vulnerability where wr-protected page table entries (uffd_wp) were not cleared on close(), only on UFFDIO_UNREGISTER. The fix unregisters wr-protect bits during close() as well, eliminating potential leftovers in pgtable entries and preventing WARN repo...

CVE-2024-38388

CVE-2024-38388 affects the Linux kernel ALSA component: specifically ALSA: hda/cs_dsp_ctl. The issue stemmed from not actually removing ALSA controls in hda_cs_dsp_control_remove(), freeing only the internal tracking structure, which could leave ALSA controls behind when the amp driver is removed...

CVE-2024-41032

CVE-2024-41032 affects the Linux kernel and has been resolved. The issue occurs on systems where cpu_possible_mask has gaps between set CPUs (e.g., SPARC). In this scenario, addr_to_vb_xa() can return a hash index that targets a non-existent and uninitialized per-CPU area accessed via per_cpu() m...

CVE-2024-43873

CVE-2024-43873 describes a Linux kernel issue in vhost/vsock where seqpacket_allow could be read uninitialized due to not being initialized at socket creation, and could remain uncleared when VIRTIO_VSOCK_F_SEQPACKET is cleared. The fix initializes seqpacket_allow after allocation and uncondition...

CVE-2024-44971

CVE-2024-44971 relates to the Linux kernel bcm_sf2 (net: dsa) driver. The issue was a memory leak in bcm_sf2_mdio_register(): after of_phy_find_device() returns devices, phy_device_remove() is called in a loop but the refcount on the PHY device was not decremented, as get_device() incremented it ...

CVE-2024-44992

The CVE-2024-44992 issue affects the Linux kernel SMB/CIFS client code, specifically a possible NULL dereference in cifs_free_subrequest() when handling rdata->server. The root cause is code that could dereference rdata->server->ops->add_credits() if rdata->credits.value != 0 and r...

CVE-2024-46745

CVE-2024-46745 affects the Linux kernel uinput interface. The root cause is an unbounded request for slots via syzkaller, causing memory allocation failure in input_mt_init_slots. The fix limits the allowed number of slots to 100 (extendable if devices require more). Consequences described in the...

CVE-2024-46859

CVE-2024-46859 is a Linux kernel vulnerability affecting the panasonic-laptop code. The issue arises from unvalidated SINF array indices (0–SINF_CUR_BRIGHT, 0x0d), risking out-of-bounds accesses on devices with fewer SINF entries (e.g., CF-18 has ~10). The fix adds a minimum SINF array size check...

CVE-2024-47693

CVE-2024-47693 affects the Linux kernel’s IB/core path. The vulnerability arises when ib_cache_update fails and ib_cache_setup_one exits without cleaning gid_table_setup_one, potentially leaving inconsistent gid-table state and triggering a kernel WARN. The fix enforces proper cleanup by calling ...

CVE-2024-49903

CVE-2024-49903 is a Linux kernel vulnerability involving a slab-use-after-free in the JFS mapping code (dbFreeBits/dbFreeDmap) caused by a race between two paths (dbUnmount and jfs_ioc_trim) that access bmap. The race can lead to uaf when trimming or unmounting JFS and subsequently freeing object...

CVE-2024-50072

CVE-2024-50072 affects the Linux kernel on x86 where VERW is used. The issue can trigger a general protection fault (#GP) in 32-bit vm86 contexts when VERW mitigations (e.g., MDS/RFDS) are enabled and the code segment selector is not properly referenced. The root cause is using VERW with an arbit...

CVE-2024-50102

CVE-2024-50102 : The connected advisories indicate a Linux kernel x86 issue where using the high address bit to classify user vs. kernel space enabled a speculative-execution leak for non-canonical addresses. The root cause involves non-canonical address handling and an evolving AC/bit behavior a...

CVE-2024-50147

CVE-2024-50147 affects the Linux kernel mlx5 subsystem. The issue stems from improper initialization of the command bitmask for MANAGE_PAGES and from mlx5_cmd_trigger_completions() attempting to trigger a completion for MANAGE_PAGES, which could cause a null-deref if a health error occurs before ...

CVE-2024-53177

CVE-2024-53177 affects the Linux kernel SMB client cache code. The vulnerability arises from a use-after-free in smb2_cached_lease_break/open_cached_dir error handling, where freeing a cfid could race with a pending lease-break work item. The fix updates open_cached_dir() to drop references inste...

CVE-2024-56568

CVE-2024-56568 affects the Linux kernel IOMMU/arm-smmu stack. A race between the smmu driver’s probe and a client driver’s probe can cause a NULL pointer dereference when of_dma_configure() runs after iommu_device_register() but before the smmu driver is fully bound. The race occurs during defere...

CVE-2024-56596

CVE-2024-56596 relates to the Linux kernel, in the JFS filesystem implementation. The issue is an array-index-out-of-bounds in jfs_readdir, caused by potential invalid values in the directory index table (stbl). The fix adds a validation check to detect invalid stbl values and return an error cod...

CVE-2024-56693

The connected material describes CVE-2024-56693, a Linux kernel issue in the brd (RAM block device) and brd_init path that can lead to a use-after-free (UAF) when modprobe brd triggers error paths. Root cause: loop_init() in the kernel’s loop device code adds disks only after successful blkdev re...

CVE-2024-58052

CVE-2024-58052 — Linux kernel (drm/amdgpu) NULL pointer dereference . The bug occurs in atomctrl_get_smc_sclk_range_table: if smu_atom_get_data_table() fails, it returns NULL and is dereferenced later. The description notes the code path is invoked on Polaris chips, and the vbios data table shoul...

CVE-2025-21736

CVE-2025-21736 : In the Linux kernel, nilfs2 may overflow when computing the result of nilfs_fiemap() via nilfs_bmap_lookup_contig() if blocks up to maxblocks == INT_MAX are considered; an overflow can occur due to a left shift on blkbits. The advisory notes the fix is to cast the right-hand expr...

CVE-2025-21861

CVE-2025-21861 : Technical details (affected product/component, root cause, impact, and fixes) are not provided in the supplied Connected documents; monitor for updates from vendors/security advisories.

CVE-2025-22035

CVE-2025-22035 affects the Linux kernel tracing subsystem. The issue is a use-after-free in print_graph_function_flags during tracer switching, caused by iter->private being left pointing to freed data when switching from function_graph to another tracer. The root cause is that two code paths ...