CVE-2022-49049

CVE-2022-49049 concerns the Linux kernel mm/secretmem path (memfd_secret) where growing a secret memfd via ftruncate could trigger a kernel panic when zeroing pages during truncation. The issue arises because memfd_secret pages are not mapped via the direct map, so page_address() results could be...

CVE-2024-47671

The CVE-2024-47671 entry concerns a Linux kernel vulnerability in USBimp: usbtiusmb? The provided connected documents confirm a kernel-infoleak in USB: usbtmc, with the root cause described as a need to clear the data structure before filling fields in usbtmc_write. The fix/workaround is to preve...

CVE-2024-47738

CVE-2024-47738 affects the Linux kernel’s wifi subsystem (mac80211). The vulnerability lies in handling rate masks for offchannel TX, where an incorrect rate mask could trigger a -EINVAL/unsupported rate warning. The advisory notes that the root cause was traced to a chain of commits, with the pr...

CVE-2024-49965

CVE-2024-49965 concerns the Linux kernel OCFS2 subsystem. The vulnerability arose from an unreasonable unlock in ocfs2_read_blocks, producing a bad unlock balance. A patch series titled “Misc fixes for ocfs2_read_blocks” (v5) fixes two issues in ocfs2_read_blocks(): the first addresses the unlock...

CVE-2024-50083

CVE-2024-50083 concerns a Linux kernel flaw where MPTCP DSS corruption could occur during large PMTU transmissions. The issue, triggered by Syzkaller under a subflow, is tied to __mptcp_move_skbs_from_subflow in net/mptcp/protocol.c and relates to mptcp_data_ready/move_skbs_to_msk paths leading t...

CVE-2024-50290

CVE-2024-50290 is a Linux kernel vulnerability affecting the media: cx24116 driver. The issue arises when reading SNR registers: if the read fails, a negative value could be returned, causing an underflow. The fix prevents that underflow by ensuring reading SNR registers does not produce a negati...

CVE-2024-53236

CVE-2024-53236 (Linux kernel) : The vulnerability occurs in the XDP/AF_XDP path where, if a newly allocated skb for an xsk descriptor is created but its TX metadata options are later deemed invalid, the skb is not freed. This can leak skbs until the send buffer is full, preventing further packet ...

CVE-2024-56598

Technical details about CVE-2024-56598 (Linux kernel jfs: array-index-out-of-bounds in dtReadFirst) are not provided in the connected documents. Please monitor for updates.

CVE-2024-56675

CVE-2024-56675 affects the Linux kernel: UAF can occur when a non-sleepable BPF program is attached to an uprobe and freed via normal RCU, because Uprobes use bpf_prog_run_array_uprobe() under tasks-trace-RCU protection. The fix explicitly waits for a tasks-trace-RCU grace period after removing t...

CVE-2024-56712

CVE-2024-56712 : In the Linux kernel udmabuf code, a memory leak could occur on the last export_udmabuf() error path when dma_buf_fd() fails and a dma_buf has already been created. The root cause was in export_udmabuf()’s error handling, where the dma_buf could be torn down without freeing the co...

CVE-2024-57999

The CVE-2024-57999 issue affects PowerPC pseries IOMMU handling in the Linux kernel. The vulnerability arises because the index used when setting the IOMMU bitmap is an int while the address is unsigned long, producing negative bitmap values, and because the DMA offset is treated as page-sh shift...

CVE-2025-21680

The CVE-2025-21680 issue affects the Linux kernel’s pktgen code, specifically get_imix_entries, where an insufficient boundary check on the imix_entries array allows out-of-bounds access when a large number of imix entries are passed. This leads to UBSAN reported array-index-out-of-bounds in net/...

CVE-2025-21726

In CVE-2025-21726, the Linux kernel padata subsystem had a use-after-free (UAF) in the reorder_work path. The root cause was that the previous patch did not hold a reference to 'pd' long enough when queuing reorder_work. The fix is to take a reference to 'pd' before queuing reorder_work and to ke...

CVE-2025-21825

CVE-2025-21825 affects the Linux kernel’s BPF subsystem when PREEMPT_RT is enabled. The issue arises in the bpf_timer cancellation path during map update of preallocated htab elements: freeing of old_element under the bucket lock can race with reuse of the same element, potentially triggering a l...

CVE-2025-21909

CVE-2025-21909 concerns the Linux kernel wifi/nl80211 subsystem. Description: when a monitor interface is set with MONITOR_FLAG_COOK_FRAMES together with other MONITOR flags, a sub-interface can be created without the IEEE80211_SDATA_IN_DRIVER bit, since cooked state takes precedence over other s...

CVE-2025-21943

The CVE-2025-21943 entry concerns a Linux kernel vulnerability in the gpio_aggregator driver. Description: new_device_store and delete_device_store touch module-global resources (e.g., gpio_aggregator_lock). To prevent race conditions during module unload, the fix adds a reference held via try_mo...

CVE-2025-23144

The CVE-2025-23144 issue affects the Linux kernel backlight subsystem (led_bl/led_sysfs). Root cause: led_sysfs_enable() was not guaranteed to run with the led_access lock held, leading to a lockdep warning during led-backlight removal; the patch enforces holding the led_access lock when calling ...

CVE-2025-37794

In CVE-2025-37794, the Linux kernel Wi‑Fi stack (mac80211) could purge the vif TX queue too late during ieee80211_do_stop(), allowing SKBs from the vif’s txq to be dequeued and processed after SDATA_STATE_RUNNING is cleared. This could occur due to a concurrent schedule_and_wake_txq path that deq...

CVE-2025-37840

CVE-2025-37840 concerns the Linux kernel MTD NAND code, specifically brcmnand, where a PM-resume path could trigger a WARN due to an uninitialized nand_operation that checks the chip select. The connected advisories confirm this as a fix: during platform suspend/resume, the code now calls a highe...

CVE-2026-31671

The CVE-2026-31671 issue is in the Linux kernel xfrm_user component. A struct xfrm_user_report includes a __u8 proto field followed by a struct xfrm_selector, creating three padding bytes that were never zeroed before copying to userspace. The vulnerability is a information leak caused by these u...

CVE-2010-3876

CVE-2010-3876 affects the Linux kernel: the code path net/packet/af_packet.c in kernel versions before 2.6.37-rc2 does not properly initialize certain structure members, allowing local users with CAP_NET_RAW to read copies of the applicable structures from kernel stack memory. Publicly document d...

CVE-2010-4073

CVE-2010-4073 affects the Linux kernel IPC compatibility code: before 2.6.37-rc1, several compat syscall handlers (ipc/compat.c and ipc/compat_mq.c) fail to initialize certain structures, enabling local attackers to read potentially sensitive kernel stack memory via vectors in compat_sys_semctl, ...

CVE-2010-4158

The CVE-2010-4158 issue affects the Linux kernel (pre-2.6.36.2) where sk_run_filter in net/core/filter.c may execute BPF_S_LD_MEM or BPF_S_LDX_MEM before a memory location is initialized. This can allow local users to read potentially sensitive kernel stack memory via a crafted socket filter. The...

CVE-2014-2851

CVE-2014-2851: Integer overflow in ping_init_sock (net/ipv4/ping.c) of the Linux kernel up to 3.14.1 allows local users to cause a denial of service (use‑after‑free and system crash) and potentially gain privileges via a crafted application that exploits an improperly managed reference counter. C...

CVE-2016-0821

The CVE-2016-0821 issue relates to the LIST_POISON protection in the Linux kernel (include/linux/poison.h) prior to version 4.3. It affected Android 6.0.1 prior to 2016-03-01 and arises because poison values were used without properly accounting for mmap_min_addr, enabling bypass of poison-pointe...

CVE-2016-2188

CVE-2016-2188 entry is rejected and not used.

CVE-2016-9756

CVE-2016-9756 affects Linux kernel’s x86 KVM emulation (arch/x86/kvm/emulate.c). The root cause is improper initialization of Code Segment (CS) in certain error paths, enabling a local attacker to read sensitive kernel stack memory via a crafted user-space program. A fix was released in Linux ker...

CVE-2017-6347

The CVE-2017-6347 entry describes a vulnerability in the Linux kernel (net/ipv4/ip_sockglue.c: ip_cmsg_recv_checksum) when built before version 4.10.1. The flaw arises from incorrect assumptions about skb data layout, allowing a local attacker to trigger a denial of service via a buffer over-read...

CVE-2019-17054

CVE-2019-17054 affects the Linux kernel (AF_APPLETALK) where atalk_create does not enforce CAP_NET_RAW through 5.3.2, allowing unprivileged users to create raw sockets. Exploitation status and exact fixes are not provided in the supplied documents; no mitigation details are described here.

CVE-2021-47171

CVE-2021-47171 corresponds to a memory-leak fix in the Linux kernel’s USB SMSC75xx driver (net/usb/smsc75xx.c). The vulnerability arises when errors after memory allocation leave non-freed memory in smsc75xx_bind, causing a memory leak in the kernel upon probe/bind. The MiracleLinux advisories co...

CVE-2021-47219

CVE-2021-47219 involves the Linux kernel SCSI subsystem, specifically the scsi_debug path, where an out-of-bounds read occurs in resp_report_tgtpgs() due to an incorrect handling of lengths. The issue can manifest as a negative alen when userspace supplies a large length, enabling a slab/read bou...

CVE-2021-47416

CVE-2021-47416 refers to a Linux kernel issue where a memory leak in the MDIO bus interface could occur due to incorrect state handling of MDIOBUS_ALLOCATED. The bug arises when device_register() is called after a partial allocation; mdiobus_free() would free only the memory with kfree(dev) inste...

CVE-2022-2991

CVE-2022-2991 (Linux kernel LightNVM) Affected software: Linux kernel, LightNVM subsystem. Vulnerability: heap-based buffer overflow caused by insufficient validation of the length of user-supplied data before copying to a fixed-size heap buffer. Impact: local privilege escalation and arbitrary c...

CVE-2022-44033

CVE-2022-44033 affects the Linux kernel up to version 6.0.6, where a race condition in drivers/char/pcmcia/cm4040_cs.c can cause a use-after-free if a physically proximate attacker removes a PCMCIA device while open. The issue is described as a race between cm4040_open() and reader_detach(). The ...

CVE-2022-49087

The CVE-2022-49087 entry documents a race in Linux kernel networking code: rxrpc_exit_net() may exit while rxnet->peer_keepalive_timer is still armed, allowing a use-after-free via the rxrpc_peer_keepalive_timeout path. A fix was committed to address this race (in the kernel and mirrored in As...

CVE-2022-49362

CVE-2022-49362 is a Linux kernel vulnerability affecting NFSD. The issue is a use-after-free in nfsd_file_put, where nfsd_file_put_noref() can free @nf, so the kernel must not dereference @nf immediately after returning from nfsd_file_put_noref(). The CVE is rated critical (CVSS v3.1 base score 9...

CVE-2022-49511

In CVE-2022-49511, the race occurs in the Linux kernel’s fbdev defio path: one thread adds page->lru to the pagelist tail in fb_deferred_io_mkwrite while another re-initializes the same page->lru in fb_deferred_io_fault, without proper synchronization. The fix initializes all page lists onc...

CVE-2022-49538

CVE-2022-49538 affects the Linux kernel’s ALSA jack path in ASoC. The issue arises when input_dev is unregistered while snd_jack_report is called, potentially causing a NULL pointer dereference. The documented fix is to serialize access to input_dev using a mutex. The connected sources confirm th...

CVE-2022-49565

CVE-2022-49565 concerns the Linux kernel, specifically perf/x86/intel/lbr, where unchecked MSR writes (WRMSR to 0x689) can occur due to an absent TSX quirk application when accessing LBR data. The issue manifests on systems with LBR_FORMAT_EIP_FLAGS2 and, if TSX is disabled, requires a quirk to a...

CVE-2022-49580

The CVE-2022-49580 entry describes a data-race in the Linux kernel IPv4 path around reading sysctl_fib_multipath_use_neigh, which could be changed concurrently. The referenced fix adds READ_ONCE() to the reader to guard against concurrent modification. Affected software is the Linux kernel (IPv4 ...

CVE-2022-49585

CVE-2022-49585 relates to the Linux kernel. It fixes a data race in reading the sysctl_tcp_fastopen_blackhole_timeout, where the value could be changed concurrently. The patch adds READ_ONCE() to the readers to prevent concurrent modification. Affected component: kernel networking/tcp code around...

CVE-2022-49601

CVE-2022-49601 is a Linux kernel vulnerability where a data race occurs in the tcp/dccp path around reading the sysctl_fwmark_accept value. The root cause is concurrent modification of the reader while sysctl_tcp_fwmark_accept is being read, leading to potential inconsistency. The documented fix ...

CVE-2022-49695

The CVE-2022-49695 entry affects the Linux kernel igb driver (igb_clean_tx_ring) and is a use-after-free bug triggered when the NIC is in XDP mode. The issue can occur when traffic is redirected to the igb NIC and the device is closed while traffic is flowing. It has been fixed in the kernel (see...

CVE-2022-49928

The CVE-2022-49928 entry corresponds to a Linux kernel vulnerability (SUNRPC) where a null-ptr-deref can occur if the xps sysfs allocation fails, specifically in sysfs_do_create_link_sd during RPC client setup (gssproxy path). The concrete issue is triggered when the xprt_switch sysfs allocation ...

CVE-2023-0122

CVE-2023-0122 : A NULL pointer dereference in the Linux kernel NVMe subsystem (nvmet_setup_auth()) allows a Pre-Auth Denial of Service to be launched remotely over the network. Affected versions are v6.0-rc1 through v6.0-rc3; the issue is fixed in v6.0-rc4. Root cause and impact are described in ...

CVE-2023-26605

CVE-2023-26605 affects Linux kernel 6.0.8: a use-after-free in inode_cgwb_move_to_attached (fs/fs-writeback.c) related to __list_del_entry_valid. Documentation indicates CVSS v3.1 base score 7.8 ( HIGH ) with local attack vector, low complexity, and no user interaction. The vulnerability is a loc...

CVE-2023-32254

CVE-2023-32254 affects the Linux kernel ksmbd SMB server, due to missing locking when processing SMB2_TREE_DISCONNECT commands. The flaw can allow code execution in kernel context. Multiple connected sources (Ubuntu USNs 6173/6283, Astra Linux bulletin, CBL-Mariner entries) confirm ksmbd involvem...

CVE-2023-53020

CVE-2023-53020 affects the Linux kernel: l2tp_tunnel_register() contains race conditions that modify the tunnel socket after publishing, call setup_udp_tunnel_sock() on an existing socket without locking, and change sock lock class on the fly. A patch fixes these by initializing the socket before...

CVE-2024-24861

CVE-2024-24861 affects the Linux kernel xc4000 media driver (xc4000_get_frequency) with a race condition that can cause a return-value overflow, potentially leading to malfunction or denial of service. Data from multiple sources confirms the issue originates in the xc4000 driver and is tied to Li...

CVE-2024-26775

CVE-2024-26775 concerns the Linux kernel’s aoe subsystem. The documented issue is a potential deadlock in set_capacity() caused by a locking order: one path holds bdev->bd_size_lock while another holds d->lock, risking a deadlock when an interrupt occurs and the code path re-enters set_capa...