CVE-2023-39197

The CVE-2023-39197 entry concerns an out-of-bounds read in Linux kernel Netfilter Connection Tracking (conntrack) for DCCP. A remote attacker could disclose kernel memory contents via crafted DCCP traffic due to copying an unbounded portion of the conntrack header; the issue is categorized as a k...

CVE-2023-52777

CVE-2023-52777 affects the Linux kernel ath11k wifi driver. The gtk offload status event handler called ath11k_mac_get_arvif_by_vdev_id() was not in an RCU read-side critical section, risking use-after-free on active pdevs protected by RCU. The fix marks this code path as an RCU read-side critica...

CVE-2024-26764

CVE-2024-26764 : Linux kernel vulnerability in fs/aio where kiocb_set_cancel_fn() was not restricted to I/O submitted via libaio. If called for io_uring I/O, a kernel warning is produced (kiocb_set_cancel_fn+0x9c/0xa8). The fix: set the IOCB_AIO_RW flag for read/write I/O submitted by libaio to p...

CVE-2024-36897

CVE-2024-36897 — Linux kernel (drm/amd/display, DCN35) Root cause: a new UMA carveout BIOS (version 2.3) wasn’t handled by the DAL BIOS parsing, causing a NULL dereference when code attempted to access Ctx->dc_bios->integrated_info if that pointer was NULL. Affected component: drm/amd/displ...

CVE-2024-40902

CVE-2024-40902: Linux kernel vulnerability in jfs xattr handling where printing an oversized xattr in hex could read past the buffer, risking kernel memory. A fix restricts the debug hex dump size in kernel logs. Public-coverage in Astra Linux and CIRCL references confirms the same vulnerability ...

CVE-2024-41016

CVE-2024-41016 affects the Linux kernel file system OCFS2, specifically the xattr_find_entry() path. The vulnerability arises from an out-of-bounds memory access in a bound check before memcmp when handling xattrs, potentially triggered by crafted images. A fix was applied to perform a strict bou...

CVE-2024-41017

The CVE covers a Linux kernel jfs issue: jfs code path related to ealist traversal could walk past the end of the ealist. The fix adds a bounds check before visiting ea members to ensure each ea stays within the ealist. This is a kernel-level vulnerability in the JFS filesystem component; exploit...

CVE-2024-43863

The CVE CVE-2024-43863 affects the Linux kernel’s DRM vmwgfx driver, fixing a deadlock in dma-buf fence polling. The issue arose when the fence ops release path removed the fence from the pending list, requiring a lock to fix a poll→fence wait→fence unref deadlock. vmwgfx overwrote the wait callb...

CVE-2024-44971

CVE-2024-44971 relates to the Linux kernel bcm_sf2 (net: dsa) driver. The issue was a memory leak in bcm_sf2_mdio_register(): after of_phy_find_device() returns devices, phy_device_remove() is called in a loop but the refcount on the PHY device was not decremented, as get_device() incremented it ...

CVE-2024-46806

CVE-2024-46806 affects the Linux kernel DRM/AMDGPU path: the code path that handles partition mode may perform a division or modulo by zero, leading to a potential crash or denial of service. The available connected documents confirm the issue is fixed in the kernel by addressing a warning divisi...

CVE-2024-47693

CVE-2024-47693 affects the Linux kernel’s IB/core path. The vulnerability arises when ib_cache_update fails and ib_cache_setup_one exits without cleaning gid_table_setup_one, potentially leaving inconsistent gid-table state and triggering a kernel WARN. The fix enforces proper cleanup by calling ...

CVE-2024-49858

CVE-2024-49858: Linux kernel TPM event log handling (efistub/tpm) used EFI_LOADER_DATA, leaving the region unreserved in the EFI 64-bit memory map (via E820) and passed to the kernel via kexec, risking memory corruption. The fix substitutes EFI_ACPI_RECLAIM_MEMORY, which EFI/ACPI treats as reserv...

CVE-2024-49867

In the Linux kernel, CVE-2024-49867 affects the btrfs filesystem when unmounting a filesystem. During close_ctree(), the sequence previously stopped and freed the cleaner kthread before ensuring all fixup workers finished, which could allow a fixup worker to wake a freed task_struct (the cleaner)...

CVE-2024-50072

CVE-2024-50072 affects the Linux kernel on x86 where VERW is used. The issue can trigger a general protection fault (#GP) in 32-bit vm86 contexts when VERW mitigations (e.g., MDS/RFDS) are enabled and the code segment selector is not properly referenced. The root cause is using VERW with an arbit...

CVE-2024-50168

CVE-2024-50168 affects the Linux kernel component net/sun3_82586. A memory leak could occur in sun3_82586_send_packet() when skb->len is too long, as the function previously returned NETDEV_TX_OK without freeing the socket buffer (skb). The fix adds dev_kfree_skb() to free the skb in that code...

CVE-2024-50246

CVE-2024-50246 is a Linux kernel vulnerability affecting the ntfs3 file-system code path. The issue stems from a missing or insufficient check related to the alloc_size for rough attribute handling in fs/ntfs3, which could allow a local attacker to exploit the flaw. The CVE is described with a CV...

CVE-2024-56565

Technical details about CVE-2024-56565 are not provided in the supplied documents. Monitor for updates.

CVE-2024-56593

CVE-2024-56593 – Linux kernel (brcmfmac wifi driver) Root cause: NULL pointer dereference in brcmf_sdiod_sglist_rw() when a high sd_sgentry_align value (e.g., 512) and a large number of queued SKBs cause the pre-allocated sgtable to run out of entries. The calculation uses nents = max(rxglom_size...

CVE-2024-56755

CVE-2024-56755 : In the Linux kernel, the FSCACHE_VOLUME_CREATING path in netfs/fscache has a missing memory barrier between the bit-clearing operation and the wake-up, allowing a wake-up to occur before the clearing is detected and potentially causing an indefinite wait. The triggering sequence ...

CVE-2024-57951

CVE-2024-57951 affects the Linux kernel and describes a race/state handling issue in hrtimers during CPU hotplug/unplug cycles. The vulnerability arises when a CPU transitions from ONLINE toward HOTUNPLUG and back, causing hrtimers_prepare_cpu() not to run and leaving cpu_base.hres_active at 1. A...

CVE-2025-21711

CVE-2025-21711 affects the Linux kernel in the Rose network stack (net/rose) via rose_setsockopt(). The vulnerability arises when handling large arguments for sockopt, where an integer overflow can occur if the input is unexpectedly large. The fix adds bounds checks on the contents of 'opt', retu...

CVE-2025-21736

CVE-2025-21736 : In the Linux kernel, nilfs2 may overflow when computing the result of nilfs_fiemap() via nilfs_bmap_lookup_contig() if blocks up to maxblocks == INT_MAX are considered; an overflow can occur due to a left shift on blkbits. The advisory notes the fix is to cast the right-hand expr...

CVE-2025-22011

CVE-2025-22011 describes a Linux kernel issue on ARM/bcm2711 in Raspberry Pi CM4 during s2idle when the xHCI power-domain resume triggers a VPU firmware crash. The root cause is the mixed usage of raspberrypi-power and bcm2835-power power domains; the fix is to avoid the VPU power-domain driver, ...

CVE-2025-22113

CVE-2025-22113 — Linux kernel ext4 journal update race (mode C) Affects: Linux kernel with ext4 file system; involved components include ext4, JBD2 journaling, and the update path for superblock writes during shutdown/mount transitions. Summary: The issue arises when an error path can cause an in...

CVE-2025-37757

In CVE-2025-37757, the Linux kernel leak was in tipc_link_xmit where an overloaded backlog transmit queue could cause -ENOBUFS but leave skb lists uncleared, leading to memory leaks during skb allocations. The fix purges the skb list before tipc_link_xmit() returns.

CVE-2025-37992

CVE-2025-37992 affects the Linux kernel net_sched subsystem. Affected: qdiscs (codel, fq, fq_codel, fq_pie, hhf, pie). Root cause: during qdisc ->change(), trimming only the main queue could leave packets on the gso_skb list, risking NULL pointer dereference when sch->limit is compared to s...

CVE-2025-37998

CVE-2025-37998 concerns openvswitch in the Linux kernel where unsafe Netlink attribute parsing in output_userspace() could lead to processing of malformed attributes. The connected documents confirm a patch that replaces the manual Netlink attribute iteration in output_userspace() with nla_for_ea...

CVE-2026-46266

Summary (CVE-2026-46266): In the Linux kernel, RAW sockets using IPPROTO_RAW (255) could be triggered by a malicious incoming ICMP packet that sets the protocol field to 255 and matches a RAW socket, causing undesired FNHE cache changes. This issue has been resolved in updates cited across multip...

CVE-2011-1020

CVE-2011-1020 affects the Linux kernel (2.6.37 and earlier) where the proc filesystem does not restrict access to /proc after a process execs a setuid program. This can let local attackers obtain sensitive information or cause a denial of service by performing open, lseek, read, or write operatio...

CVE-2014-3690

CVE-2014-3690 affects arch/x86/kvm/vmx.c in the Linux kernel’s KVM subsystem on Intel, where the CR4 control register value may not be preserved across VM entries. The vendor-provided details in connected Nessus advisories describe a local attacker with access to /dev/kvm who can kill arbitrary p...

CVE-2016-3951

CVE-2016-3951 concerns a double-free in Linux kernel drivers/net/usb/cdc_ncm.c, exploitable when a USB device with an invalid descriptor is inserted. Affected: Linux kernel pre-4.5; impact: denial of service (system crash) and potential unspecified effects. The linked Unity security advisories co...

CVE-2016-6213

CVE-2016-6213 affects the Linux kernel (fs/namespace.c): an unrestricted limit on the number of mounts in a mount namespace allows a local attacker to cause memory exhaustion and potential deadlock via MS_BIND mount calls. The vulnerability is present in kernels before 4.9 and has been referenced...

CVE-2021-3864

CVE-2021-3864 is a local privilege-escalation flaw in the Linux kernel involving how the dumpable flag is handled for descendants of certain SUID binaries. If a SUID binary sets real UID equal to effective UID and real GID equal to effective GID, the descendant’s dumpable value can become 1, so a...

CVE-2021-47457

CVE-2021-47457 affects the Linux kernel’s CAN ISOTP path: isotp_sendmsg() failed to check the return value of wait_event_interruptible(), allowing a TX buffer to be accessed by multiple processes and causing interference. The fixes add a result check in isotp_sendmsg() to prevent multiple TX-acce...

CVE-2022-49333

Consolidated from multiple sources: CVE-2022-49333 affects Linux kernels with Mellanox mlx5 E-Switch offloads on pair-only capable devices. Root cause: mlx5_get_next_phys_dev() could be invoked without holding the interface lock, after an assert introduced by the Lag/filter changes. This conditio...

CVE-2022-49339

CVE-2022-49339 affects the Linux kernel’s IPv6 stack, specifically the internal call between seg6.c and seg6_hmac.c. The issue arises from exporting an __init-annotated symbol whose .init.text section can be freed after initialization, creating a potential kernel panic when a module references a ...

CVE-2022-49404

The CVE-2022-49404 entry concerns the Linux kernel RDMA/hfi1 path. The root cause is an integer multiplication overflow during inter-packet delay calculations due to type-conversion order, allowing overflow and an incorrect result. The fix forces one operand to be u64 so the promotion occurs befo...

CVE-2023-32247

CVE-2023-32247 affects the Linux kernel ksmbd SMB server. The flaw is in SMB2_SESSION_SETUP handling and stems from lack of resource-control, enabling a remote attacker to trigger a denial-of-service (A: HIGH, CVSS 3.1: 7.5). The issue is exploitable over network with no privileges required and n...

CVE-2023-52880

CVE-2023-52880 is a Linux kernel flaw where attaching the N_GSM0710 line discipline can be performed by an unprivileged user only after CAP_NET_ADMIN has been requested to create GSM networking. The initial namespaceCAP_NET_ADMIN is also required to proceed with the attachment. Several connected ...

CVE-2023-53010

The CVE-2023-53010 vulnerability concerns the bnxt Ethernet driver in the Linux kernel. A buffer overread could occur from reading past the end of test names due to concatenation across an offset beyond the end of the first name, triggering the buffer overflow detection logic. The root cause was ...

CVE-2024-26685

A vulnerability exists in the Linux kernel 's nilfs2 file system support within the end_buffer_async_write() function. The issue stems from the improper use of the async_write flag as a marker for segment summary and super root blocks , which share buffers with the backing device. This configurat...

CVE-2024-26746

The CVE-2024-26746 issue is a Linux kernel vulnerability where event log cache allocation used kmem_cache_create is unsafe for user copies, triggering a kernel bug when HARDENED_USERCOPY is enabled. The connected PT/ Nessus entries confirm the problem is tied to the idxd event log completion reco...

CVE-2024-26778

CVE-2024-26778 concerns a flaw in the Linux kernel fbdev sav age driver (savage) where an unchecked pixclock input to ioctl() can cause a divide-by-zero. The advisory notes that pixclock is partly validated in savagefb_decode_var() but not sufficiently in savagefb_probe(); the fix introduces a ch...

CVE-2024-35787

CVE-2024-35787 affects the Linux kernel’s md/md-bitmap logic. The root issue stemmed from removing page->index (via commit d7038f951828) in the bitmap code while leaving faulty logic for clustered-md, causing slots to be mis-set for cluster nodes and potentially crashes in clustered environmen...

CVE-2024-35962

CVE-2024-35962 (Linux kernel): The issue is a netfilter input validation bug in the kernel’s user input handling. The vulnerability arises from do_replace() paths using copy_from_sockptr() followed by unsafe copy_from_sockptr_offset() calls, enabling insufficient validation of optlen against the ...

CVE-2024-35983

CVE-2024-35983 : The Vuln resides in the Linux kernel, caused by incorrect bits_per() rounding for power-of-two CONFIG_NR_CPUS, leading to crashes on certain machines/configs. Public advisories (Unity UTSA-2025-992928) confirm the vulnerability has been resolved in kernel updates. Affected compon...

CVE-2024-36489

CVE-2024-36489: Linux kernel TLS NULL pointer dereference risk due to a missing memory barrier in tls_init() (NULL ctx->sk_proto observed in tls_setsockopt/getsockopt). The fix relies on rcu_assign_pointer() (which implies a release barrier) and moves the assignment of ctx->sk_proto until a...

CVE-2024-36915

CVE-2024-36915 concerns the Linux kernel’s NFC LLCP path where nfc_llcp_setsockopt() could unsafe-copy from user-supplied sockptr data, triggering a slab-out-of-bounds read. Symptom traces show reads of 4 bytes at a user task, linked to copy_from_sockptr() and inline copy_from_sockptr_offset; the...

CVE-2024-39484

CVE-2024-39484 - Linux kernel mmc: davinci driver: the remove callback was discarded when built-in and __exit was used, causing resource leaks on unbind/reset. The fix compiles the remove callback unconditionally so it is always executed during driver removal. Connected sources confirm the issue ...

CVE-2024-40907

The CVE-2024-40907 issue is in the Linux kernel ionic driver XDP/TX path. A kernel panic occurs because ionic_rx_service frees the RX page after TX but does not reset the RX ring entry to NULL, causing a freed page to be reused. This is tied to the ionic_run_xdp() flow in ionic_txrx.c, leading to...