CVE-2025-21994

CVE-2025-21994 in the Linux kernel ksmbd component fixes an incorrect validation of the num_aces field in smb_acl. The code previously validated num_aces against ULONG_MAX / sizeof(struct smb_ace *), allowing potential allocation of an array of size ULONG_MAX. The correct check uses the actual nu...

CVE-2025-22009

CVE-2025-22009 is a Linux kernel vulnerability affecting the regulator: dummy driver where probing can become unsynchronized across threads, leading to a NULL pointer dereference during boot via kobject_get(). The issue arises when anatop_regulator_probe() and dummy_regulator_probe() race with kw...

CVE-2025-22018

CVE-2025-22018 affects the Linux kernel ATM MPOA path. A NULL pointer dereference can occur in MPOA_cache_impos_rcvd() when both entry and holding_time are NULL, leading to a crash (KASAN/GPF observed in logs). The issue has been fixed in upstream kernels and is addressed in vendor updates (examp...

CVE-2025-22066

CVE-2025-22066 concerns the Linux kernel SoC ASoC driver imx-card. The issue arises when devm_kasprintf() returns NULL due to memory allocation failure, and imx_card_probe() does not check for this, leading to a NULL pointer dereference. The vulnerability was resolved by adding a NULL check after...

CVE-2025-22113

CVE-2025-22113 — Linux kernel ext4 journal update race (mode C) Affects: Linux kernel with ext4 file system; involved components include ext4, JBD2 journaling, and the update path for superblock writes during shutdown/mount transitions. Summary: The issue arises when an error path can cause an in...

CVE-2025-23145

Summary (CVE-2025-23145) : Linux kernel MPTCP component fix for a NULL pointer dereference in can_accept_new_subflow when subflow_req->msk is NULL. The issue could occur when a SYN-ACK is received twice in quick succession and the ownership of subflow_req->msk is transferred to the first su...

CVE-2025-37810

CVE-2025-37810 refers to a Linux kernel issue in the usb: dwc3 gadget path where the event count check did not validate that the count did not exceed the event buffer length. The problem could allow an out-of-bounds memcpy of an event if the count is larger than the buffer, leading to a crash (ke...

CVE-2015-2830

CVE-2015-2830 affects the Linux kernel (arch/x86/kernel/entry_64.S) prior to 3.19.2. The TS_COMPAT flag can reach a user-mode task, potentially allowing local attackers to bypass seccomp or audit protections via crafted applications using fork or close. A fix is available in 3.19.2 and later; att...

CVE-2015-4700

The CVE-2015-4700 issue affects the Linux kernel (arch/x86/net/bpf_jit_comp.c) up to version 4.0.5. The bpf_int_jit_compile function can be triggered by crafted BPF instructions to cause a denial-of-service (system crash) via late convergence in the JIT compiler. Affected component is the JIT-com...

CVE-2015-5366

The referenced sources confirm two Linux kernel UDP-handling flaws fixed in version 4.0.6: CVE-2015-5364 and CVE-2015-5366. Affected component: UDP and UDPv6 receive paths (udp_recvmsg and udpv6_recvmsg) in the Linux kernel prior to 4.0.6. Root cause: improper handling of UDP checksums, allowing ...

CVE-2017-16645

CVE-2017-16645 affects the Linux kernel’s ims_pcu_get_cdc_union_desc in drivers/input/misc/ims-pcu.c. According to the provided sources, the vulnerability exists in kernels up to 4.13.11 and can be triggered by a crafted USB device, allowing a local user with LOW privileges and physical access to...

CVE-2017-16914

The vulnerability CVE-2017-16914 affects the Linux kernel’s USB/IP path: the stub_send_ret_submit() function in drivers/usb/usbip/stub_tx.c is vulnerable in kernel versions before 4.14.8, 4.9.71, 4.1.49, and 4.4.107. A specially crafted USB over IP packet can trigger a NULL pointer dereference, l...

CVE-2018-7480

The CVE-2018-7480 issue affects the Linux kernel, where blkcg_init_queue in block/blk-cgroup.c (pre-4.11) can be triggered by a creation failure to cause a double-free and potential unspecified impact. Public sources in the connected documents consistently describe a local-denial-of-service risk ...

CVE-2019-19070

Summary (CVE-2019-19070): A memory-leak in the Linux kernel spi_gpio_probe() (drivers/spi/spi-gpio.c) up to 5.3.11 can cause a denial of service via memory exhaustion when devm_add_action_or_reset() fails. The vulnerability is tied to the probe path and is contingent on memory pressure; a third‑p...

CVE-2021-47222

The CVE-2021-47222 issue is a Linux kernel vulnerability in the bridge vlan tunneling path where egress code used dst_clone() and set the result directly, risking invalid refcnt (entry can have 0 refcnt or be deleted) and triggering dst_hold()/dst_release underflow (as seen in dst_release: refcnt...

CVE-2021-47457

CVE-2021-47457 affects the Linux kernel’s CAN ISOTP path: isotp_sendmsg() failed to check the return value of wait_event_interruptible(), allowing a TX buffer to be accessed by multiple processes and causing interference. The fixes add a result check in isotp_sendmsg() to prevent multiple TX-acce...

CVE-2021-47501

CVE-2021-47501 affects the Linux kernel i40e driver. A NULL pointer dereference in i40e_dbg_dump_desc could crash when dumping VFs VSI RX/TX descriptors via debugfs. The root cause is missing VSI-type validation during dump; the fix adds a check to ensure the VSI type is correct before dumping RX...

CVE-2022-48632

CVE-2022-48632 — The Linux kernel flaw in the i2c mlxbf driver allows a stack overflow via an unbounded memcpy loop in mlxbf_i2c_smbus_start_transaction() because the upper bound of operation->length is not checked and data_idx increments. Public docs in connected Nessus advisories reference t...

CVE-2022-49097

CVE-2022-49097 relates to the Linux kernel NFS writeback path. In low-memory conditions, the NFS writeback code could enter infinite loops in mempool_alloc, risking a writeback stall. The issue is resolved in the kernel by allowing the writeback path to fail gracefully instead of deadlocking. The...

CVE-2022-49145

CVE-2022-49145 affects the Linux kernel's ACPI CPPC parsing of _CPC data. The root cause is an out-of-bounds access when the NumEntries field is less than 2, which could lead to improper access of the Revision element. A fix has been implemented in the kernel to avoid this access. The vulnerabili...

CVE-2022-49592

CVE-2022-49592 affects the Linux kernel driver net/stmmac: a left-shift overflow in MTL_RXQ_DMA_MAP1 occurs when the number of TX/RX queues exceeds four, due to a 32‑bit mask calculation. UBSAN reports show a shift-out-of-bounds during UBSAN checks, leading to a potential warning path in dwmac4_c...

CVE-2022-49699

CVE-2022-49699 : In the Linux kernel, a race in filemap_get_read_batch() between reads and invalidation can replace a folio with a higher-order folio, causing a NULL pointer dereference while holding the RCU read lock. The patch handles the race by returning early; the next call will locate the n...

CVE-2023-35829

Affected software: Linux kernel (before 6.3.2). Vulnerability: a use-after-free in rkvdec_remove() in drivers/staging/media/rkvdec/rkvdec.c. Impact: local attacker could exploit a UAF to crash or potentially escalate privileges (as per CVSS high). Root cause: use-after-free in rkvdec_remove. Affe...

CVE-2023-52667

CVE-2023-52667 affects the Linux kernel net/mlx5e code path. The vulnerability is a potential double-free in fs_any_create_groups when kcalloc() succeeds but kvzalloc() fails, because ft->g could be freed twice up the call chain. The fix implemented is to set ft->g to NULL in fs_any_create_...

CVE-2023-53010

The CVE-2023-53010 vulnerability concerns the bnxt Ethernet driver in the Linux kernel. A buffer overread could occur from reading past the end of test names due to concatenation across an offset beyond the end of the first name, triggering the buffer overflow detection logic. The root cause was ...

CVE-2024-26636

CVE-2024-26636 : In the Linux kernel, the llc_ui_sendmsg() path could allocate an skb with insufficient headroom and then push an Ethernet header, triggering a bug path when the socket lock is reacquired. The fix reserves space with LL_RESERVED_SPACE(), re-checks all conditions after reacquiring ...

CVE-2024-26697

CVE-2024-26697 : In the Linux kernel NILFS2, data corruption can occur during dsync block recovery after an unclean shutdown due to an incorrect on-page offset calculated by nilfs_recovery_copy_block() when block size is smaller than the page size. The issue affects the data recovery path that co...

CVE-2024-26746

The CVE-2024-26746 issue is a Linux kernel vulnerability where event log cache allocation used kmem_cache_create is unsafe for user copies, triggering a kernel bug when HARDENED_USERCOPY is enabled. The connected PT/ Nessus entries confirm the problem is tied to the idxd event log completion reco...

CVE-2024-26778

CVE-2024-26778 concerns a flaw in the Linux kernel fbdev sav age driver (savage) where an unchecked pixclock input to ioctl() can cause a divide-by-zero. The advisory notes that pixclock is partly validated in savagefb_decode_var() but not sufficiently in savagefb_probe(); the fix introduces a ch...

CVE-2024-26885

CVE-2024-26885 – Linux kernel DEVMAP_HASH overflow on 32-bit arches : The issue arises in devmap hash bucket calculation for max_entries, where the code computes the next power of two for the bucket count and stores it in a 32-bit variable. On 32-bit architectures, the rounding up can overflow mi...

CVE-2024-27023

In CVE-2024-27023, the Linux kernel md subsystem (md) had a flaw where active_io was not released when flush_pending fell to zero, causing mddev_suspend() to wait forever. The fix releases active_io in submit_flushes() as soon as flush_pending transitions to zero, preventing the hang. The descrip...

CVE-2024-36007

The CVE-2024-36007 issue relates to the Linux kernel mlxsw spectrum_acl_tcam rehash process. The problem was that on error the chunk marker was reset while entry markers remained relative to it, risking resuming migration from an entry not in the current chunk and causing a chunk to be processed ...

CVE-2024-38388

CVE-2024-38388 affects the Linux kernel ALSA component: specifically ALSA: hda/cs_dsp_ctl. The issue stemmed from not actually removing ALSA controls in hda_cs_dsp_control_remove(), freeing only the internal tracking structure, which could leave ALSA controls behind when the amp driver is removed...

CVE-2024-40930

Vulnerability CVE-2024-40930 in the Linux kernel’s wifi cfg80211 HE operation element parsing due to insufficient length validation. The issue arises during parsing of HE operation elements, potentially allowing malformed input to be processed because the length check was not performed prior to p...

CVE-2024-41017

The CVE covers a Linux kernel jfs issue: jfs code path related to ealist traversal could walk past the end of the ealist. The fix adds a bounds check before visiting ea members to ensure each ea stays within the ealist. This is a kernel-level vulnerability in the JFS filesystem component; exploit...

CVE-2024-41032

CVE-2024-41032 affects the Linux kernel and has been resolved. The issue occurs on systems where cpu_possible_mask has gaps between set CPUs (e.g., SPARC). In this scenario, addr_to_vb_xa() can return a hash index that targets a non-existent and uninitialized per-CPU area accessed via per_cpu() m...

CVE-2024-41080

CVE-2024-41080 concerns the Linux kernel and describes a deadlock risk in io_uring when locking order is not respected in io_register_iowq_max_workers. The root cause is that io_put_sq_data() can be called while uring_lock is held, risking deadlock with sqd->lock. The documented fix releases u...

CVE-2024-42080

CVE-2024-42080 affects Linux kernels with the RDMA restrack entry handling. The issue arises when ib_create_cq() sets rdma_restrack_entry kern_name to KBUILD_MODNAME; if the module exits without deleting this entry, rdma_restrack_clean() may perform an invalid address access when printing the own...

CVE-2024-42133

The CVE-2024-42133 issue affects the Linux kernel Bluetooth subsystem. It fixes an incorrect handling of large handle values in the BIG (BIG_SYNC_ESTABLISHED) path by filtering handles to ensure that IDs do not get released erroneously during hci_conn_cleanup. The vulnerability arises from miscla...

CVE-2024-49982

CVE-2024-49982 concerns the AoE (ATA over Ethernet) driver in the Linux kernel. The vulnerability stems from improper refcount handling of the net_device during packet transmission, leading to potential use-after-free scenarios. The fix, described in the cited CVE notes, consolidates a safer patt...

CVE-2024-50083

CVE-2024-50083 concerns a Linux kernel flaw where MPTCP DSS corruption could occur during large PMTU transmissions. The issue, triggered by Syzkaller under a subflow, is tied to __mptcp_move_skbs_from_subflow in net/mptcp/protocol.c and relates to mptcp_data_ready/move_skbs_to_msk paths leading t...

CVE-2024-50131

CVE-2024-50131 affects the Linux kernel tracing subsystem, where length validation for events didn’t account for the NULL terminator. strlen() reports length excluding the trailing null, so if the string length equals the maximum buffer, there is no room for the NULL terminator, allowing potentia...

CVE-2024-50147

CVE-2024-50147 affects the Linux kernel mlx5 subsystem. The issue stems from improper initialization of the command bitmask for MANAGE_PAGES and from mlx5_cmd_trigger_completions() attempting to trigger a completion for MANAGE_PAGES, which could cause a null-deref if a health error occurs before ...

CVE-2024-50203

CVE-2024-50203 affects the Linux kernel BPF trampoline path on arm64 when BPF_TRAMP_F_CALL_ORIG is enabled and tag-based KASAN is active. The issue arises because the stack address (bpf_tramp_image) is computed during size calculation using one address and then a heap address is used during code ...

CVE-2024-50211

CVE-2024-50211 is a Linux kernel issue where the udf inode_bmap() function was refactored to handle errors from udf_next_aext() and other error paths. The change allows udf_extend_file() and related code paths to detect errors earlier (e.g., during operations like ftruncate) instead of relying on...

CVE-2024-53047

Connected document MiracleLinux AXSA advisory explicitly notes CVE-2024-53047: in the Linux kernel mptcp: init incorrectly uses RCU when creating a socket, leading to a suspicious RCU usage warning. Root cause: rcu_read_lock() was omitted during mptcp_sched_find() execution; fix implemented by ad...

CVE-2024-56574

CVE-2024-56574 affects the Linux kernel ts2020 I2C driver (ts2020_probe). A NULL pointer dereference occurs when registering an i2c device via sysfs without platform data, because probe uses platform data that may be missing. The root cause is missing platform data during dynamic sysfs registrati...

CVE-2024-56629

Technical details about CVE-2024-56629 are not provided in the supplied documents. The connected sources do not specify affected products, root cause, or fixes. Monitor for updates and vendor advisories.

CVE-2024-57792

CVE-2024-57792 is a Linux kernel vulnerability in the power: supply: gpio-charger path. The issue arises when the lowest charge current limit is forced to be > 0 and a requested limit falls below this, causing an index calculation that can access memory beyond the allocated memory. It has been...

CVE-2024-57926

CVE-2024-57926 is a Linux kernel vulnerability affecting the Mediatek DRM path. The issue arises in the shutdown path where private->all_drm_private[i]->drm may be accessed after a failed mtk_drm_bind, causing a use-after-free detected by KASAN in drm_atomic_helper_shutdown. The root cause ...