CVE-2024-58051

CVE-2024-58051 is a Linux kernel vulnerability affecting the IPMI/IPMB driver where devm_kasprintf() can return NULL on failure and its return value was not checked, leading to a NULL pointer dereference. The issue is categorized as Memory Safety with a high availability impact in the CVSS contex...

CVE-2025-21635

CVE-2025-21635 — Linux kernel (RDS): The vulnerability arises from using current->nsproxy in rds_tcp_rcvbuf/rds_tcp_sndbuf sysctl handling, which can cause a NULL pointer dereference when the current task is exiting and the netns proxy is NULL. The fix switches to obtaining the per-netns conte...

CVE-2025-21994

CVE-2025-21994 in the Linux kernel ksmbd component fixes an incorrect validation of the num_aces field in smb_acl. The code previously validated num_aces against ULONG_MAX / sizeof(struct smb_ace *), allowing potential allocation of an array of size ULONG_MAX. The correct check uses the actual nu...

CVE-2025-37752

CVE-2025-37752 is a Linux kernel vulnerability affecting the scheduler, specifically net_sched: sch_sfq. The root cause is that limit validation could be bypassed if the limit was indirectly updated as other parameters changed. The fix moves the limit validation to the end of the configuration up...

CVE-2025-37798

CVE-2025-37798 affects the Linux kernel networking code. The fix removes the qlen check in fq_codel_dequeue() and codel_qdisc_dequeue() after making sch->qlen_notify() callbacks idempotent. The description indicates the vulnerability related to backlog/queue length handling in qdisc code (code...

CVE-2026-46195

The CVE-2026-46195 entry concerns a Linux kernel SMB client vulnerability. 32-bit servers can supply a crafted dacloffset that wraps a DACL pointer, allowing dereferencing of DACL fields during chmod/chown if validated only after pointer arithmetic. The flaw occurs in parse_sec_desc(), build_sec_...

CVE-2013-2852

CVE-2013-2852 refers to a format string vulnerability in the b43_request_firmware path of the Broadcom B43 wireless driver for the Linux kernel (up to 3.9.4). The issue arises from format specifiers in an fwpostfix modprobe parameter, leading to improper construction of an error message and local...

CVE-2014-8160

CVE-2014-8160 : In the Linux kernel, net/netfilter/nf_conntrack_proto_generic.c before 3.18 generates incorrect conntrack entries when handling certain iptables rule sets for SCTP, DCCP, GRE, and UDP-Lite. This can allow remote attackers to bypass intended access restrictions by sending packets w...

CVE-2015-2666

CVE-2015-2666 : The Linux kernel contains a stack-based buffer overflow in get_matching_model_microcode (arch/x86/kernel/cpu/microcode/intel_early.c) that can be exploited by a context-dependent local attacker with root privileges to write to the initrd. The description in connected advisories co...

CVE-2016-2185

CVE-2016-2185 : In the Linux kernel, the ati_remote2_probe function (drivers/input/misc/ati_remote2.c) in versions before 4.5.1 is vulnerable. A physically proximate attacker can trigger a NULL pointer dereference via a crafted USB device descriptor, causing a denial of service (system crash). Th...

CVE-2016-3070

CVE-2016-3070 affects the Linux kernel: the trace_writeback_dirty_page implementation (in include/trace/events/writeback.h) improperly interacts with mm/migrate.c, allowing a local attacker to trigger a NULL pointer dereference and system crash by triggering a certain page move. The publicly docu...

CVE-2018-1091

The CVE-2018-1091 entry is supported by connected advisories describing Linux kernel vulnerability on POWERPC: In arch/powerpc/kernel/ptrace.c, the function flush_tmregs_to_thread before 4.13.5 can crash a guest kernel when a core dump occurs, due to a missing processor feature check and an erron...

CVE-2019-15923

The CVE-2019-15923 entry describes a NULL pointer dereference in the Linux kernel before 5.0.9, specifically for a cd data structure when alloc_disk fails in drivers/block/paride/pf.c. The available references point to upstream commit f0d1762554014ce0ae347b9f0d088f2c157c8c72 and ChangeLog-5.0.9. ...

CVE-2021-47247

CVE-2021-47247 is a Linux kernel use-after-free in the mlx5e_encap_take path during neigh update, caused by improper handling when encap entries are concurrently inserted/deleted after rtnetlink lock changes. The issue is documented in upstream kernel notes and is listed in Debian’s DLA-4178-1 ad...

CVE-2021-47624

CVE-2021-47624 : In the Linux kernel, a reference-count leak in the rpc_sysfs_xprt_state_change error path can occur when the 3rd argument buf doesn’t match “offline”, “online”, or “remove.” The leak affects rpc_xprt and rpc_xprt_switch objects heightened by prior calls to rpc_sysfs_xprt_kobj_get...

CVE-2022-44032

CVE-2022-44032 affects the Linux kernel up to 6.0.6. The race between cmm_open() and cm4000_detach() in drivers/char/pcmcia/cm4000_cs.c can cause a use-after-free when a PCMCIA device is physically removed while open, enabling a physically proximate attacker to trigger memory corruption. The CVSS...

CVE-2022-48942

In CVE-2022-48942, the Linux kernel hwmon subsystem can crash if a sensor’s registration with a thermal zone fails; specifically devm_thermal_zone_of_sensor_register() may return -ENODEV, potentially leading to a NULL pointer dereference in thermal_zone_device_update paths. The described call seq...

CVE-2022-49136

CVE-2022-49136 (Linux kernel) fixes a Bluetooth HCI QUEUE issue: hci_cmd_sync_queue must return an error if HCI_UNREGISTER is set to avoid use-after-free when hci_unregister_dev frees the HCI device. The connected advisories (MiracleLinux, AlmaLinux, Oracle Linux RHSA/ELSA, etc.) reference the fi...

CVE-2022-49404

The CVE-2022-49404 entry concerns the Linux kernel RDMA/hfi1 path. The root cause is an integer multiplication overflow during inter-packet delay calculations due to type-conversion order, allowing overflow and an incorrect result. The fix forces one operand to be u64 so the promotion occurs befo...

CVE-2022-49548

CVE-2022-49548 concerns a Linux kernel BPF trampoline fix. The vulnerability arises from an overflow risk in bpf_trampoline_get_progs(): the cnt check for BPF_MAX_TRAMP_PROGS did not count BPF_TRAMP_MODIFY_RETURN programs, permitting more than the maximum number of trampoline programs to be attac...

CVE-2023-32247

CVE-2023-32247 affects the Linux kernel ksmbd SMB server. The flaw is in SMB2_SESSION_SETUP handling and stems from lack of resource-control, enabling a remote attacker to trigger a denial-of-service (A: HIGH, CVSS 3.1: 7.5). The issue is exploitable over network with no privileges required and n...

CVE-2023-3269

CVE-2023-3269 affects the Linux kernel memory management subsystem. The issue stems from incorrect lock handling when accessing/updating VMAs, enabling use-after-free conditions. This can allow an attacker with local access to execute arbitrary kernel code, escalate containers, and gain root priv...

CVE-2023-52589

The CVE 2023-52589 entry concerns the Linux kernel media rkisp1 driver. The issue is a race in IRQ disable logic within rkisp1_isp_stop() and rkisp1_csi_disable(): interrupts are masked and the code assumes the IRQ handler isn’t running, but the handler can still be active when the stop sequence ...

CVE-2023-53010

The CVE-2023-53010 vulnerability concerns the bnxt Ethernet driver in the Linux kernel. A buffer overread could occur from reading past the end of test names due to concatenation across an offset beyond the end of the first name, triggering the buffer overflow detection logic. The root cause was ...

CVE-2023-53034

CVE-2023-53034 is addressed in the Linux kernel ntb_hw_switchtec driver with a fix for a shift-out-of-bounds condition in switchtec_ntb_mw_set_trans. The root cause was that ntb_mw_clear_trans() could pass 0 to both addr and size, causing xlate_pos to become negative and triggering a UBSAN shift-...

CVE-2024-24859

CVE-2024-24859: A race condition in Linux kernel Bluetooth code (net/bluetooth sniff_min_interval_set and sniff_max_interval_set) can trigger a bluetooth sniffing exception and potential DoS. The connected Nessus/Azure Unity Unity Linux entries confirm this CVE across multiple distributions, but ...

CVE-2024-26697

CVE-2024-26697 : In the Linux kernel NILFS2, data corruption can occur during dsync block recovery after an unclean shutdown due to an incorrect on-page offset calculated by nilfs_recovery_copy_block() when block size is smaller than the page size. The issue affects the data recovery path that co...

CVE-2024-26778

CVE-2024-26778 concerns a flaw in the Linux kernel fbdev sav age driver (savage) where an unchecked pixclock input to ioctl() can cause a divide-by-zero. The advisory notes that pixclock is partly validated in savagefb_decode_var() but not sufficiently in savagefb_probe(); the fix introduces a ch...

CVE-2024-36924

CVE-2024-36924 – Linux kernel (scsi: lpfc) has a deadlock risk when lpfc_worker_wake_up() is invoked while the hbalock is held. The fix is to release hbalock before calling lpfc_worker_wake_up(), preventing deadlocks in the lpfc SCSI loop. Public advisories from Unity Linux (UTSA-2026-005051) and...

CVE-2024-38604

Technical details about CVE-2024-38604 are not publicly provided in the Connected Documents. The Initial Description mentions refinements to the Linux kernel blkdev_iomap_begin EOF check, but there are no vendor/product/version specifics or remediation details in the supplied material.

CVE-2024-39500

CVE-2024-39500 affects the Linux kernel sock_map subsystem. The race occurs between sock_map_close and sk_psock_put when psock refcount reaches 0 but psock_drop may not have finished; the close callback could still point to sock_map_close with psock NULL, triggering a WARN_ON_ONCE. The documented...

CVE-2024-49858

CVE-2024-49858: Linux kernel TPM event log handling (efistub/tpm) used EFI_LOADER_DATA, leaving the region unreserved in the EFI 64-bit memory map (via E820) and passed to the kernel via kexec, risking memory corruption. The fix substitutes EFI_ACPI_RECLAIM_MEMORY, which EFI/ACPI treats as reserv...

CVE-2024-49867

In the Linux kernel, CVE-2024-49867 affects the btrfs filesystem when unmounting a filesystem. During close_ctree(), the sequence previously stopped and freed the cleaner kthread before ensuring all fixup workers finished, which could allow a fixup worker to wake a freed task_struct (the cleaner)...

CVE-2024-49958

The CVE-2024-49958 issue affects the Linux kernel’s OCFS2 filesystem, caused by a reflink flow that reserves space for inline xattrs at the destination inode after reflink has already recreated the reflink tree. Specifically, ocfs2_reflink_xattr_inline() reduces l_count from 243 to 227 without va...

CVE-2024-49982

CVE-2024-49982 concerns the AoE (ATA over Ethernet) driver in the Linux kernel. The vulnerability stems from improper refcount handling of the net_device during packet transmission, leading to potential use-after-free scenarios. The fix, described in the cited CVE notes, consolidates a safer patt...

CVE-2024-49996

CVE-2024-49996 affects the Linux kernel CIFS/SMB client when parsing NFS reparse points. The root cause is a buffer length miscalculation in cifs_strndup_from_utf16() that doesn’t subtract InodeType size from ReparseDataLength, allowing reads past the buffer. The InodeType field and Major/Minor R...

CVE-2024-50023

CVE-2024-50023 packages: Linux kernel net: phy: Remove LED entry from LEDs list on unregister. The issue arises when devm_ usage fixes left the LED entry in the LEDs list after PHY teardown, which can cause a kernel panic when the PHY kmod is removed and later re-added. The fix is implemented in ...

CVE-2024-50061

CVE-2024-50061 affects the Linux kernel’s i3c: master cdns_i3c_master driver. The root cause is a use-after-free race: cdns_i3c_master_hj_work scheduled in cdns_i3c_master_probe can run after cdns_i3c_master_remove frees master->base via i3c_master_unregister. The documented fix is to cancel t...

CVE-2024-50131

CVE-2024-50131 affects the Linux kernel tracing subsystem, where length validation for events didn’t account for the NULL terminator. strlen() reports length excluding the trailing null, so if the string length equals the maximum buffer, there is no room for the NULL terminator, allowing potentia...

CVE-2024-50168

CVE-2024-50168 affects the Linux kernel component net/sun3_82586. A memory leak could occur in sun3_82586_send_packet() when skb->len is too long, as the function previously returned NETDEV_TX_OK without freeing the socket buffer (skb). The fix adds dev_kfree_skb() to free the skb in that code...

CVE-2024-56573

CVE-2024-56573 affects the Linux kernel EFI libstub path. The root cause is cmdline_ptr being an out parameter that is not allocated by the callee, while cmdline points into an allocation that should be freed on failure. The fix ensures the correct pointer is freed by passing the appropriate pool...

CVE-2024-56638

CVE-2024-56638 affects the Linux kernel’s netfilter nft_inner handling of percpu inner-header offsets under softirq. The vulnerability stems from a race where softirq can interrupt a process-context walk over a percpu area that contains inner header offsets, potentially leading to inconsistent pe...

CVE-2024-57795

CVE-2024-57795: In the Linux kernel, a use-after-free was reported in RDMA/rxe when a net_device could be freed before an ib_cache_event_task execution. The root cause is the patch removing the direct link to net_device in RXE (and related SIW/RXE paths), which allows a freed net_device to be acc...

CVE-2024-57924

CVE-2024-57924 affects the Linux kernel and is described in multiple sources as a fix to “fs: relax assertions on failure to encode file handles.” The issue concerns exportfs_encode_fh and related paths used by filesystem code to encode file handles, with legacy users such as nfsd and name_to_han...

CVE-2024-57925

CVE-2024-57925 affects the Linux kernel’s ksmbd component. A NULL pointer returned by ksmbd_alloc_work_struct() in smb2_send_interim_resp() could allow an illegal memory write to in_work->response_buf during kzalloc() on the in_work structure. The connected documents confirm a fix that adds a ...

CVE-2024-58014

The CVE-2024-58014 entry concerns a Linux kernel vulnerability in the wifi brcmsmac driver. In wlc_phy_iqcal_gainparams_nphy(), a gain range check was missing, risking out-of-bounds access to tbl_iqcal_gainparams_nphy. The issue has a fixed variant where the code now WARN()s on out-of-range value...

CVE-2025-21652

Summary (CVE-2025-21652) : In the Linux kernel, a use-after-free was reported in ipvlan_get_iflink() when handling ipvlan with linkwatch. The issue arises because ipvlan does not hold a refcount on the lower device, unlike vlan/macvlan, which can lead to UAF of ipvlan->phy_dev if the linkwatch...

CVE-2025-21711

CVE-2025-21711 affects the Linux kernel in the Rose network stack (net/rose) via rose_setsockopt(). The vulnerability arises when handling large arguments for sockopt, where an integer overflow can occur if the input is unexpectedly large. The fix adds bounds checks on the contents of 'opt', retu...

CVE-2025-21957

The CVE refers to a Linux kernel issue affecting the SCSI qla1280 driver. When the driver is compiled with DEBUG_QLA1280 and ql_debug_level > 2, a null dereference can cause an oops. The root cause is incorrect handling of debug printing, where sg_next(s) was used instead of sg_dma_len(s). The...

CVE-2025-21981

CVE-2025-21981 corresponds to a memory-leak in the Linux kernel ice driver (aRFS) triggered during VSI reconfiguration after reset. The leak arises when VSI reconfiguration allocates aRFS resources again without releasing prior allocations, leading to unreferenced kmemleak entries (e.g., 8192-byt...