CVE-2025-21672

CVE-2025-21672 concerns the Linux kernel, specifically the afs module, where a fix guards against a lock being left held when returning to userspace. The root cause is described as a scenario where if argc is less than 0 and a function returns directly, an inode mutex lock is not released. The pa...

CVE-2008-4395

CVE-2008-4395 concerns multiple buffer overflows in the ndiswrapper module for Linux kernel 2.6. The issue allows a remote attacker to execute arbitrary code by sending WLAN packets with long ESSIDs, effectively exploiting a vulnerability in ESSID handling. Connected advisories confirm affected d...

CVE-2011-1020

CVE-2011-1020 affects the Linux kernel (2.6.37 and earlier) where the proc filesystem does not restrict access to /proc after a process execs a setuid program. This can let local attackers obtain sensitive information or cause a denial of service by performing open, lseek, read, or write operatio...

CVE-2013-2852

CVE-2013-2852 refers to a format string vulnerability in the b43_request_firmware path of the Broadcom B43 wireless driver for the Linux kernel (up to 3.9.4). The issue arises from format specifiers in an fwpostfix modprobe parameter, leading to improper construction of an error message and local...

CVE-2014-4608

CVE-2014-4608 refers to multiple integer overflows in the LZO decompressor (lzo1x_decompress_safe) in the Linux kernel before 3.15.2, which can cause memory corruption and denial of service via a crafted Literal Run. Some advisories note the Linux kernel is not affected (media hype), while securi...

CVE-2016-2544

CVE-2016-2544 corresponds to a race in the Linux kernel’s sound/core/seq/seq_queue.c queue_delete path (pre-4.4.1). A local attacker can trigger a use-after-free via an ioctl timing flaw, leading to a denial of service and possible system crash. Public references note fixes in kernel 4.4.1 and re...

CVE-2017-16526

CVE-2017-16526 affects the Linux kernel driver code drivers/uwb/uwbd.c up to version 4.13.5; a crafted USB device could trigger a general protection fault and system crash via local access, potentially causing denial of service or other impact. The connected Unity Linux advisories (UTSA-2026-0016...

CVE-2017-16649

CVE-2017-16649 affects the Linux kernel up to version 4.13.11. The vulnerable code is usbnet_generic_cdc_bind in drivers/net/usb/cdc_ether.c. Exploitation requires local access and a crafted USB device, which can trigger a divide-by-zero error and system crash, with possible other impact. The con...

CVE-2019-19053

CVE-2019-19053 affects the Linux kernel (through 5.3.11). A memory leak in the function rpmsg_eptdev_write_iter() (drivers/rpmsg/rpmsg_char.c) can be triggered when copy_from_iter_full() fails, leading to a denial of service via memory consumption. The connected Nessus entries (Unity Linux UTSA a...

CVE-2020-36691

CVE-2020-36691 affects the Linux kernel up to and including versions prior to 5.8. The flaw is in lib/nlattr.c where a nested Netlink policy with a back reference can trigger unbounded recursion, causing a denial of service. A patch was merged in kernel 5.8 (per ChangeLog-5.8); users should upgra...

CVE-2021-47098

CVE-2021-47098 affects Linux kernel hwmon lm90, where setting the hysteresis value could overflow/underflow when the temperature limit is MAX_LONG with a negative critical limit. The root cause was an integer overflow/underflow in hysteresis calculations after a prior fix; the resolution introduc...

CVE-2021-47606

CVE-2021-47606 affects the Linux kernel net: netlink af_netlink fix. The vulnerability arises from an empty skb usage, where skb->len=0 and skb->data_len=0 could trigger a division error in netem_enqueue during randomized corruption: skb->data[prandom_u32() % skb_headlen(skb)] ^= 1<

CVE-2022-49029

CVE-2022-49029 concerns the Linux kernel hwmon IBM PEX driver. If ibmpex_find_sensors() fails during ibmpex_register_bmc(), the data object is freed but data->list is not removed from driver_data.bmc_data, risking a use-after-free. The fixed code removes the entry from driver_data.bmc_data bef...

CVE-2022-49122

CVE-2022-49122 is a Linux kernel vulnerability affecting the dm ioctl path where user-supplied data could act as an index and enable Spectre v1 gadget behavior. The fix, described in connected advisories, prevents leakage of kernel memory to userspace by applying array_index_nospec to index handl...

CVE-2022-49333

Consolidated from multiple sources: CVE-2022-49333 affects Linux kernels with Mellanox mlx5 E-Switch offloads on pair-only capable devices. Root cause: mlx5_get_next_phys_dev() could be invoked without holding the interface lock, after an assert introduced by the Lag/filter changes. This conditio...

CVE-2022-49362

CVE-2022-49362 is a Linux kernel vulnerability affecting NFSD. The issue is a use-after-free in nfsd_file_put, where nfsd_file_put_noref() can free @nf, so the kernel must not dereference @nf immediately after returning from nfsd_file_put_noref(). The CVE is rated critical (CVSS v3.1 base score 9...

CVE-2022-49404

The CVE-2022-49404 entry concerns the Linux kernel RDMA/hfi1 path. The root cause is an integer multiplication overflow during inter-packet delay calculations due to type-conversion order, allowing overflow and an incorrect result. The fix forces one operand to be u64 so the promotion occurs befo...

CVE-2022-49598

CVE-2022-49598 affects the Linux kernel, addressing a data-race around sysctl_tcp_mtu_probing. The issue arises when reading sysctl_tcp_mtu_probing, which could be modified concurrently. The root cause is a missing synchronization in readers of sysctl_tcp_mtu_probing; the fix is to add READ_ONCE(...

CVE-2022-49600

CVE-2022-49600 : In the Linux kernel, a data race around reading sysctl_ip_autobind_reuse allows concurrent modification during read. The fix adds READ_ONCE() to the reader. Impact is described as HIGH for availability with local access required; exploitation status is not detailed in the provide...

CVE-2023-3269

CVE-2023-3269 affects the Linux kernel memory management subsystem. The issue stems from incorrect lock handling when accessing/updating VMAs, enabling use-after-free conditions. This can allow an attacker with local access to execute arbitrary kernel code, escalate containers, and gain root priv...

CVE-2023-39197

The CVE-2023-39197 entry concerns an out-of-bounds read in Linux kernel Netfilter Connection Tracking (conntrack) for DCCP. A remote attacker could disclose kernel memory contents via crafted DCCP traffic due to copying an unbounded portion of the conntrack header; the issue is categorized as a k...

CVE-2023-52810

CVE-2023-52810 refers to a Linux kernel issue in fs/jfs where l2nbperpage could become negative, causing a shift-out-of-bounds UBSAN failure in jfs_dmap.c. Reports indicate UBSAN: shift-out-of-bounds with shift exponent -16777216 and that the fix adds a validity check for negative db_l2nbperpage ...

CVE-2024-26685

CVE-2024-26685 concerns a Linux kernel issue where end_buffer_async_write() could BUG_ON when handling the async_write flag in certain nilfs2 scenarios. The connected Astra Linux advisory confirms the vulnerability and states the fix is to remove the manipulation of the async_write flag for the r...

CVE-2024-27413

CVE-2024-27413 is a Linux kernel vulnerability affecting the EFI capsule loader. The defect occurs in drivers/firmware/efi/capsule-loader.c during efi_capsule_open, where an allocation uses sizeof(void*) for a phys_addr_t on 32-bit builds, leading to insufficient allocation size (4 bytes vs 8). T...

CVE-2024-35787

CVE-2024-35787 affects the Linux kernel’s md/md-bitmap logic. The root issue stemmed from removing page->index (via commit d7038f951828) in the bitmap code while leaving faulty logic for clustered-md, causing slots to be mis-set for cluster nodes and potentially crashes in clustered environmen...

CVE-2024-35964

CVE-2024-35964 : Linux kernel Bluetooth ISO component fixed an issue where setsockopt user input was not properly validated. The description states to check input length before copying data, indicating a potential input-validation/overflow risk. Connected advisories reference the CVE and confirm ...

CVE-2024-36913

CVE-2024-36913 : Linux kernel vulnerability in the Hyper-V vmbus driver where memory could leak if set_memory_encrypted()/set_memory_decrypted() fails in CoCo VMs. The untrusted host can trigger an error so that decrypted (shared) memory reaches the page allocator, causing potential functional or...

CVE-2024-36915

CVE-2024-36915 concerns the Linux kernel’s NFC LLCP path where nfc_llcp_setsockopt() could unsafe-copy from user-supplied sockptr data, triggering a slab-out-of-bounds read. Symptom traces show reads of 4 bytes at a user task, linked to copy_from_sockptr() and inline copy_from_sockptr_offset; the...

CVE-2024-36938

CVE-2024-36938 : Linux kernel vulnerability in bpf, skmsg subsystems causing NULL pointer dereference and data races in sk_psock_skb_ingress_enqueue. The issue involves concurrent access to saved_data_ready and related sk_psock state, leading to an in-kernel NULL dereference under data-race condi...

CVE-2024-43839

CVE-2024-43839 : Linux kernel vulnerability fixed by increasing the internal name buffer in bna_tcb and bna_ccb from 16 to accommodate longer sprintf arguments, and replacing sprintf with snprintf. The change accounts for bnad->netdev->name and expected expansions for %d specifiers, using B...

CVE-2024-43863

The CVE CVE-2024-43863 affects the Linux kernel’s DRM vmwgfx driver, fixing a deadlock in dma-buf fence polling. The issue arose when the fence ops release path removed the fence from the pending list, requiring a lock to fix a poll→fence wait→fence unref deadlock. vmwgfx overwrote the wait callb...

CVE-2024-46677

CVE-2024-46677 affects the Linux kernel gtp path. Root cause: when sockfd_lookup() fails, gtp_encap_enable_socket() returns a NULL pointer, but its callers only check for error pointers, so the NULL pointer could be dereferenced. Fix : return an error pointer carrying the sockfd_lookup() error co...

CVE-2024-46805

CVE-2024-46805 is a Linux kernel vulnerability in the drm/amdgpu path where a NULL pointer dereference of hive can occur when validating amdgpu_hive_info. The issue (root cause: amdgpu_hive_info *hive may be NULL) can lead to an out-of-bounds or memory access problem in the driver, with the advis...

CVE-2024-47408

CVE-2024-47408 affects the Linux kernel component net/smc. The root cause is unvalidated smcd_v2_ext_offset from remote proposals, which could lead to out-of-bounds access and a crash when its value exceeds the maximum. The published fix adds a validation check before using smcd_v2_ext_offset dur...

CVE-2024-47674

Technical details about CVE-2024-47674 are not publicly provided in the supplied documents; monitor for updates from official advisories.

CVE-2024-50059

CVE-2024-50059 affects the Linux kernel’s ntb subsystem for Switchtec NTB: a race between switchtec_ntb_add/init_sndev binding and switchtec_ntb_remove freeing sndev can lead to a use-after-free of sndev from its scheduled check_link_status_work. The provided description and patches indicate the ...

CVE-2024-50108

CVE-2024-50108 affects the Linux kernel DRM-AMD display path. The issue arises from PSR-SU handling for Parade 08-01 TCON, where at boot and during fullscreen VA-API playback a ~1s black screen occurs and kernel warnings are logged when calling dmub_psr_enable(). The vulnerability is mitigated by...

CVE-2024-50110

CVE-2024-50110 is a Linux kernel vulnerability fixed by ensuring xfrm algorithm dumping does not leak kernel-infoleak data to userspace. The issue could expose uninitialized or padding-filled data from kernel structures via netlink/dumping paths; padding in dumped algorithm data could reveal sens...

CVE-2024-50167

CVE-2024-50167 involves the Linux kernel be2net memory path where be_xmit() can leak the skb when be_xmit_enqueue() fails, returning NETDEV_TX_OK without freeing resources. The fix adds dev_kfree_skb_any() to free the skb in that code path. Connected advisories confirm the issue is addressed in n...

CVE-2024-50209

CVE-2024-50209 is a Linux kernel vulnerability related to RDMA/bnxt_re. The issue arises from memory allocation: __alloc_pbl() can return an error, and the driver does not check the status on one instance, risking a memory-alloc failure being mishandled. The connected Tencent/Tenable/Nessus advis...

CVE-2024-53236

CVE-2024-53236 (Linux kernel) : The vulnerability occurs in the XDP/AF_XDP path where, if a newly allocated skb for an xsk descriptor is created but its TX metadata options are later deemed invalid, the skb is not freed. This can leak skbs until the send buffer is full, preventing further packet ...

CVE-2024-55639

In CVE-2024-55639, the Linux kernel rswitch driver (Renesas) flaw stems from improper use of a saved device-tree node in rswitch_device, where of_node_put() was called after the first reference is used. The node may be released too late/too early across multiple code paths, risking use-after-free...

CVE-2024-56556

CVE-2024-56556 targets the Linux kernel binder: a race in binder_add_freeze_work() where proc->inner_lock is dropped while acquiring node->lock, allowing binder_node_release() to race and trigger a use-after-free. Impact is local privilege escalation/high, as indicated by multiple advisorie...

CVE-2024-56573

CVE-2024-56573 affects the Linux kernel EFI libstub path. The root cause is cmdline_ptr being an out parameter that is not allocated by the callee, while cmdline points into an allocation that should be freed on failure. The fix ensures the correct pointer is freed by passing the appropriate pool...

CVE-2024-56593

CVE-2024-56593 – Linux kernel (brcmfmac wifi driver) Root cause: NULL pointer dereference in brcmf_sdiod_sglist_rw() when a high sd_sgentry_align value (e.g., 512) and a large number of queued SKBs cause the pre-allocated sgtable to run out of entries. The calculation uses nents = max(rxglom_size...

CVE-2024-56638

CVE-2024-56638 affects the Linux kernel’s netfilter nft_inner handling of percpu inner-header offsets under softirq. The vulnerability stems from a race where softirq can interrupt a process-context walk over a percpu area that contains inner header offsets, potentially leading to inconsistent pe...

CVE-2024-56659

CVE-2024-56659 – Linux kernel (net/lapb) Description in scope indicates a fix for LAPB header length: the patch increases LAPB_HEADER_LEN and notes uncertainty whether net/lapb is ready for 8021q. The primary observed failure is a kernel crash related to sk_buff handling (skb_under_panic) in net/...

CVE-2024-57945

CVE-2024-57945 (Linux kernel, riscv): In the sparse vmemmap model, an out-of-bounds virtual address could be computed for struct page if the first page in the phys_ram_base section does not have the expected PFN, causing VA to fall below VMEMMAP_START (and PCI_IO_END) during page initialization. ...

CVE-2024-58237

CVE-2024-58237 affects the Linux kernel’s BPF tail calls: tail-called programs may trigger helpers that invalidate packet pointers. The fix alters bpf_helper_changes_pkt_data() to align with check_cfg() so that global sub-program changes are considered, enabling safe replacement of not-safe tail ...

CVE-2025-21904

CVE-2025-21904 affects the Linux kernel’s caif_virtio path. The vulnerability stems from a wrong pointer check in cfv_probe: del_vqs() frees virtqueues, and the code previously dereferenced cfv->vdev before confirming NULL. The correct check is cfv->vq_tx for NULL prior to del_vqs(). Upstre...