CVE-2024-35964

CVE-2024-35964 : Linux kernel Bluetooth ISO component fixed an issue where setsockopt user input was not properly validated. The description states to check input length before copying data, indicating a potential input-validation/overflow risk. Connected advisories reference the CVE and confirm ...

CVE-2024-49999

The CVE-2024-49999 issue is in the Linux kernel afs client (afs_wait_for_operation in fs/afs/fs_operation.c). A loop could exit after receiving a server response that was discarded, leaving op->server possibly NULL and then the code could set a server flag. The fix adds a guard and proper book...

CVE-2024-50023

CVE-2024-50023 packages: Linux kernel net: phy: Remove LED entry from LEDs list on unregister. The issue arises when devm_ usage fixes left the LED entry in the LEDs list after PHY teardown, which can cause a kernel panic when the PHY kmod is removed and later re-added. The fix is implemented in ...

CVE-2024-50108

CVE-2024-50108 affects the Linux kernel DRM-AMD display path. The issue arises from PSR-SU handling for Parade 08-01 TCON, where at boot and during fullscreen VA-API playback a ~1s black screen occurs and kernel warnings are logged when calling dmub_psr_enable(). The vulnerability is mitigated by...

CVE-2024-50109

In the Linux kernel, the md/raid10 subsystem is affected by a null pointer dereference in raid10_size(). The root cause is that in raid10_run(), when raid10_set_queue_limits() succeeds, the function’s return value is overwritten to zero; if subsequent steps fail, raid10_run() may return zero whil...

CVE-2024-50167

CVE-2024-50167 involves the Linux kernel be2net memory path where be_xmit() can leak the skb when be_xmit_enqueue() fails, returning NETDEV_TX_OK without freeing resources. The fix adds dev_kfree_skb_any() to free the skb in that code path. Connected advisories confirm the issue is addressed in n...

CVE-2024-56704

CVE-2024-56704 concerns a Linux kernel issue: in 9p/xen, an IRQ release could be double-freed due to an incorrect IRQ release path, with a fix described as “Pass correct device ID during IRQ release.” Kernel logs reportedly showed an IRQ double-free, and the remediation targets the IRQ release fl...

CVE-2024-56720

The CVE-2024-56720 issue affects the Linux kernel’s BPF sockmap/bpf_msg_pop_data handling. The fixed changes address bpf_msg_pop_data in sk_msg_shift_left, including: using put_page in sk_msg_shift_left; returning early when len == 0; supporting popping the entire sk_msg (last == msg->sg.size)...

CVE-2024-57926

CVE-2024-57926 is a Linux kernel vulnerability affecting the Mediatek DRM path. The issue arises in the shutdown path where private->all_drm_private[i]->drm may be accessed after a failed mtk_drm_bind, causing a use-after-free detected by KASAN in drm_atomic_helper_shutdown. The root cause ...

CVE-2024-58014

The CVE-2024-58014 entry concerns a Linux kernel vulnerability in the wifi brcmsmac driver. In wlc_phy_iqcal_gainparams_nphy(), a gain range check was missing, risking out-of-bounds access to tbl_iqcal_gainparams_nphy. The issue has a fixed variant where the code now WARN()s on out-of-range value...

CVE-2024-58052

CVE-2024-58052 — Linux kernel (drm/amdgpu) NULL pointer dereference . The bug occurs in atomctrl_get_smc_sclk_range_table: if smu_atom_get_data_table() fails, it returns NULL and is dereferenced later. The description notes the code path is invoked on Polaris chips, and the vbios data table shoul...

CVE-2024-58064

Technical details for CVE-2024-58064 are not provided in the given documents; no affected products, impact, or fix are specified here. Monitor for updates from vendor/advisory sources.

CVE-2025-21672

CVE-2025-21672 concerns the Linux kernel, specifically the afs module, where a fix guards against a lock being left held when returning to userspace. The root cause is described as a scenario where if argc is less than 0 and a function returns directly, an inode mutex lock is not released. The pa...

CVE-2025-21904

CVE-2025-21904 affects the Linux kernel’s caif_virtio path. The vulnerability stems from a wrong pointer check in cfv_probe: del_vqs() frees virtqueues, and the code previously dereferenced cfv->vdev before confirming NULL. The correct check is cfv->vq_tx for NULL prior to del_vqs(). Upstre...

CVE-2025-21909

CVE-2025-21909 concerns the Linux kernel wifi/nl80211 subsystem. Description: when a monitor interface is set with MONITOR_FLAG_COOK_FRAMES together with other MONITOR flags, a sub-interface can be created without the IEEE80211_SDATA_IN_DRIVER bit, since cooked state takes precedence over other s...

CVE-2025-21992

CVE-2025-21992 concerns the HID subsystem in the Linux kernel, where a non-functional HID sensor on the HP 5MP Camera (USB 0408:5473) could cause system hangs when accessed via iio_info. The issue was mitigated by adding the affected device to the HID ignore list so its sensor interface is not ex...

CVE-2025-22007

CVE-2025-22007 affects the Linux kernel Bluetooth code (chan_alloc_skb_cb()), where returning NULL on error can cause a NULL dereference. Connected advisories show distro-specific fixes: Mariner kernel upgrades to >=6.6.85.1-2; Mariner also lists fixes for older 5.15.x series to 5.15.180.1-1. ...

CVE-2025-22081

CVE-2025-22081 (Linux kernel) is addressed via ntfs3 fixes. The reserved 32‑bit overflow issues in ntfs3 include an integer wrapping risk in hdr_first_de() and related overflows from adding off + sizeof(struct NTFS_DE). The description notes that the fixes use size_add() to prevent wrapping on 32...

CVE-2025-22087

Technical details about CVE-2025-22087 are not provided in the connected documents. The description outlines kernel stack/array bounds handling but no public advisories, affected products/versions, or mitigations are given here. Monitor for updates.

CVE-2025-37743

CVE-2025-37743 affects the Linux kernel wifi driver ath12k. The vulnerability is a memory leak in HAL_RX_MPDU_START TLV handling when enabling statistics, caused by kzalloc of mon_mpdu not being freed. The fix removes the kzalloc in HAL_RX_MPDU_START TLV handling and also removes standalone monit...

CVE-2025-37794

In CVE-2025-37794, the Linux kernel Wi‑Fi stack (mac80211) could purge the vif TX queue too late during ieee80211_do_stop(), allowing SKBs from the vif’s txq to be dequeued and processed after SDATA_STATE_RUNNING is cleared. This could occur due to a concurrent schedule_and_wake_txq path that deq...

CVE-2025-38004

The CVE-2025-38004 entry affects the Linux kernel CAN BCM subsystem. A race allowed by updates to the currframe/count in bcm_can_tx() could enable user-space-triggered modifications from hrtimer context, leading to a KASAN slab-out-of-bounds read. The patch fixes by moving the count variable into...

CVE-2026-52910

The CVE-2026-52910 issue is in the Linux kernel where a cBPF reuseport program may be freed immediately when detached from a reuseport group, without waiting for an RCU grace period. This can lead to a use-after-free and potential memory corruption when a concurrent UDP send crosses the fast path...

CVE-2026-52993

Summary (CVE-2026-52993): In the Linux kernel TIPC module, a double-free flaw occurs in tipc_buf_append() when tipc_msg_validate() reallocates an skb and the code incorrectly frees the original skb. The root cause is that the validation path may free a previously freed skb if reallocation occurs,...

CVE-2013-7445

CVE-2013-7445 : In the Linux kernel DRM subsystem, the Graphics Execution Manager (GEM) object handling (through GEM requests) is mishandled, allowing a context-aware attacker to cause a denial of service via memory exhaustion. The exploitation described uses JavaScript creating many CANVAS eleme...

CVE-2014-3673

The vulnerability CVE-2014-3673 affects the SCTP implementation in the Linux kernel up to version 3.17.2. A malformed ASCONF chunk can be sent by a remote attacker to trigger a denial of service (system crash). Affected components are net/sctp/sm_make_chunk.c and net/sctp/sm_statefuns.c. Remediat...

CVE-2015-4167

The CVE-2015-4167 issue affects the Linux kernel UDF code: udf_read_inode in fs/udf/inode.c fails to validate certain length values, enabling local attackers with crafted UDF filesystems to trigger DoS (incorrect data representation or integer overflow, OOPS). Impact is local access with potentia...

CVE-2016-3699

CVE-2016-3699 affects the Linux kernel as used in Red Hat Enterprise Linux 7.2 and Red Hat MRG 2 when booted with UEFI Secure Boot. The issue allows local attackers to bypass Secure Boot restrictions and execute untrusted code by appending ACPI tables to the initrd. The connected documents corrob...

CVE-2016-4581

CVE-2016-4581 affects the Linux kernel: a flaw in mounting propagation where slave mounts can leave the propagation tree in an inconsistent state. Local users could trigger a denial of service via crafted mount calls, causing a NULL pointer dereference and kernel oops. The issue is fixed in kerne...

CVE-2017-16526

CVE-2017-16526 affects the Linux kernel driver code drivers/uwb/uwbd.c up to version 4.13.5; a crafted USB device could trigger a general protection fault and system crash via local access, potentially causing denial of service or other impact. The connected Unity Linux advisories (UTSA-2026-0016...

CVE-2017-16647

CVE-2017-16647 affects the Linux kernel driver: drivers/net/usb/asix_devices.c, up to version 4.13.11. The issue arises from a NULL pointer dereference when a crafted USB device is connected, enabling local attackers to trigger a denial of service (system crash) and potentially other impact. The ...

CVE-2019-19252

CVE-2019-19252 affects the Linux kernel (drivers/tty/vt/vc_screen.c) where vcs_write does not prevent write access to vcsu devices up to and including version 5.3.13. This yields a local access vulnerability with partial confidentiality/integity/availability impacts as described in the CVE and ec...

CVE-2020-36313

CVE-2020-36313 affects the Linux kernel before 5.7. The KVM subsystem allows out‑of‑range access to memslots after a deletion (CID-0774a964ef56), impacting arch/s390/kvm/kvm-s390.c, include/linux/kvm_host.h, and virt/kvm/kvm_main.c. Root cause is a memslot handling bug in KVM/s390; exploitation d...

CVE-2021-38200

Public technical details for CVE-2021-38200 are not present in the connected documents. The initial description notes the affected Linux kernel path and conditions, but no exploits, affected versions beyond general, or remediation details are provided here; monitor for updates.

CVE-2021-43057

The CVE-2021-43057 issue affects the Linux kernel prior to 5.14.8, caused by a use-after-free in selinux_ptrace_traceme (SELinux handler for PTRACE_TRACEME). Local attackers could trigger memory corruption and elevate privileges by accessing the subjective credentials of another task. The advisor...

CVE-2021-47221

CVE-2021-47221 (Linux kernel SLUB redzone issue) The provided sources describe a vulnerability in the SLUB allocator where redzones are checked against s->object_size rather than the in-use size. If a cache is created with an object size less than 24, the freelist pointer may be written beyond...

CVE-2021-47466

The CVE-2021-47466 issue concerns the Linux kernel SLUB allocator: in kmem_cache_open(), an error-path could leak random_seq data from the slub cache. The fix releases all relevant resources via __kmem_cache_release(), mitigating potential memory leakage. Affected advisories (e.g., Unity Linux UT...

CVE-2021-47609

CVE-2021-47609 : Linux kernel vulnerability in the SCPI genpd driver for arm SCPI firmware. The issue was a missing bound check on scpi_pd->name, which could overflow a 30-byte buffer when copying the device name, potentially leading to memory corruption. The fix allocates the string dynamical...

CVE-2021-47639

CVE-2021-47639 affects the Linux kernel KVM x86/mmu code. The issue arises when unmapping a guest frame number (gfn) range in the TDP MMU: both valid and invalid SPTE roots can be zapped, but invalid roots aren’t consistently cleared in mmu_notifier paths. This can leave references to freed pages...

CVE-2022-49379

In CVE-2022-49379, the Linux kernel suffers a regression in driver core wait_for_device_probe() interaction with deferred_probe_timeout, causing NFS rootfs mounting to time out when deferred_probe_timeout is non-zero. The root cause was that ip_auto_config() waited for current deferred probes, bu...

CVE-2022-49511

In CVE-2022-49511, the race occurs in the Linux kernel’s fbdev defio path: one thread adds page->lru to the pagelist tail in fb_deferred_io_mkwrite while another re-initializes the same page->lru in fb_deferred_io_fault, without proper synchronization. The fix initializes all page lists onc...

CVE-2022-49539

CVE-2022-49539 concerns the Linux kernel driver rtw89 where CAM leaks (address CAM and bssid CAM) can occur during SER L2 reset and ieee80211_restart_hw(). The fix releases CAM regardless of security state during L2 reset and, if AP mode, releases address CAM of all stations before restart. Conne...

CVE-2022-49699

CVE-2022-49699 : In the Linux kernel, a race in filemap_get_read_batch() between reads and invalidation can replace a folio with a higher-order folio, causing a NULL pointer dereference while holding the RCU read lock. The patch handles the race by returning early; the next call will locate the n...

CVE-2023-0469

CVE-2023-0469 is a use-after-free in io_uring/filetable.c (io_install_fixed_file) within the Linux kernel’s io_uring subcomponent during call cleanup, potentially enabling a local DoS. Affected: Linux kernel with vulnerable io_uring code. Exploitation details are not provided in the supplied docu...

CVE-2023-52524

CVE-2023-52524 (Linux kernel) affects the net:nfc:llcp subsystem. The issue arises from modifying the device list without holding the required lock, which could allow list corruption as observed by syzbot. The vulnerability is local and requires privileges, with a high impact on confidentiality, ...

CVE-2023-52529

The Linux kernel contains a vulnerability in the HID: sony component where a memory leak occurs within the sony_probe() function. The issue is caused by failing to call usb_free_urb() if an error occurs following a successful usb_alloc_urb() call. This vulnerability is categorized as a denial of ...

CVE-2023-52902

CVE-2023-52902 concerns the Linux kernel memory-leak in maple tree preallocation during do_mmap() error paths. The preallocated maple tree nodes could leak on error_just_free, addressed by moving the free of maple tree nodes to a shared cleanup location for all error paths. Connected documents (N...

CVE-2024-26636

CVE-2024-26636 : In the Linux kernel, the llc_ui_sendmsg() path could allocate an skb with insufficient headroom and then push an Ethernet header, triggering a bug path when the socket lock is reacquired. The fix reserves space with LL_RESERVED_SPACE(), re-checks all conditions after reacquiring ...

CVE-2024-38604

Technical details about CVE-2024-38604 are not publicly provided in the Connected Documents. The Initial Description mentions refinements to the Linux kernel blkdev_iomap_begin EOF check, but there are no vendor/product/version specifics or remediation details in the supplied material.

CVE-2024-41011

CVE-2024-41011 (Linux kernel): The vulnerability affects the DRM/AMDKFD path where mapping the MMIO HDP page with large pages can expose an incorrect MMIO offset, leaking a 4K area of BAR space used for HDP flush registers when remapping VRAM-related registers. This can occur on systems with page...