CVE-2025-23144

The CVE-2025-23144 issue affects the Linux kernel backlight subsystem (led_bl/led_sysfs). Root cause: led_sysfs_enable() was not guaranteed to run with the led_access lock held, leading to a lockdep warning during led-backlight removal; the patch enforces holding the led_access lock when calling ...

CVE-2025-23163

CVE-2025-23163 relates to a Linux kernel issue in VLAN handling: net: vlan: don't propagate flags on open. The root cause is a possible deadlock when opening VLAN devices due to the device instance lock, where a task may try to acquire dev->lock while already holding it (seen in dev_open + dev...

CVE-2025-37750

The CVE-2025-37750 entry concerns a use-after-free in the Linux kernel SMB/CIFS client when multichannel decryption is used. The root cause is that after the commits “smb: client: allocate crypto only for primary server” and “smb: client: fix UAF in async decryption”, channels could concurrently ...

CVE-2025-37867

CVE-2025-37867 : Affects the Linux kernel RDMA/core subsystem. The issue stems from an oversized kvmalloc() warning during syzkaller-triggered activity; the fix silences the warning by adding __GFP_NOWARN to the kvmalloc path (function: __kvmalloc_node_noprof). Reported in connected advisories (A...

CVE-2025-37943

CVE-2025-37943 affects the Linux kernel wireless driver ath12k (DP_RX_DECAP_TYPE_NATIVE_WIFI). The issue is an invalid data access when hardware delivers packets with a length exceeding the maximum native Wi‑Fi header, potentially causing memory corruption in ath12k_dp_rx_h_undecap_nwifi. The adv...

CVE-2010-4158

The CVE-2010-4158 issue affects the Linux kernel (pre-2.6.36.2) where sk_run_filter in net/core/filter.c may execute BPF_S_LD_MEM or BPF_S_LDX_MEM before a memory location is initialized. This can allow local users to read potentially sensitive kernel stack memory via a crafted socket filter. The...

CVE-2014-1737

CVE-2014-1737 affects the Linux kernel (through 3.14.3) and its floppy driver (drivers/block/floppy.c). The flaw is in raw_cmd_copyin not handling error conditions during processing of an FDRAWCMD ioctl, enabling local users with write access to /dev/fd to trigger kfree and potentially gain privi...

CVE-2016-8646

CVE-2016-8646 affects the Linux kernel: the hash_accept function in crypto/algif_hash.c before version 4.3.6 allows local users to trigger in-kernel hash algorithms for sockets that have received zero bytes, causing a denial of service (OOPS). The vulnerability is local and does not require authe...

CVE-2017-9605

CVE-2017-9605 affects the Linux kernel (up to and including 4.11.4) via the vmw_gb_surface_define_ioctl path (DRM_IOCTL_VMW_GB_SURFACE_CREATE) in vmwgfx_surface.c. The defect is that backup_handle is defined but not initialized, so when creating a GB surface with a previously allocated DMA buffer...

CVE-2021-3864

CVE-2021-3864 is a local privilege-escalation flaw in the Linux kernel involving how the dumpable flag is handled for descendants of certain SUID binaries. If a SUID binary sets real UID equal to effective UID and real GID equal to effective GID, the descendant’s dumpable value can become 1, so a...

CVE-2021-47247

CVE-2021-47247 is a Linux kernel use-after-free in the mlx5e_encap_take path during neigh update, caused by improper handling when encap entries are concurrently inserted/deleted after rtnetlink lock changes. The issue is documented in upstream kernel notes and is listed in Debian’s DLA-4178-1 ad...

CVE-2021-47609

CVE-2021-47609 : Linux kernel vulnerability in the SCPI genpd driver for arm SCPI firmware. The issue was a missing bound check on scpi_pd->name, which could overflow a 30-byte buffer when copying the device name, potentially leading to memory corruption. The fix allocates the string dynamical...

CVE-2021-47624

CVE-2021-47624 : In the Linux kernel, a reference-count leak in the rpc_sysfs_xprt_state_change error path can occur when the 3rd argument buf doesn’t match “offline”, “online”, or “remove.” The leak affects rpc_xprt and rpc_xprt_switch objects heightened by prior calls to rpc_sysfs_xprt_kobj_get...

CVE-2022-49379

In CVE-2022-49379, the Linux kernel suffers a regression in driver core wait_for_device_probe() interaction with deferred_probe_timeout, causing NFS rootfs mounting to time out when deferred_probe_timeout is non-zero. The root cause was that ip_auto_config() waited for current deferred probes, bu...

CVE-2022-49577

CVE-2022-49577 describes a data-race in the Linux kernel surrounding the UDP sysctl field sysctl_udp_l3mdev_accept. While reading this reader, the value could be changed concurrently, which is addressed by adding a READ_ONCE() to the reader. The vulnerability is Linux kernel related and can be tr...

CVE-2022-49585

CVE-2022-49585 relates to the Linux kernel. It fixes a data race in reading the sysctl_tcp_fastopen_blackhole_timeout, where the value could be changed concurrently. The patch adds READ_ONCE() to the readers to prevent concurrent modification. Affected component: kernel networking/tcp code around...

CVE-2022-49595

CVE-2022-49595 is a Linux kernel data‑race vulnerability affecting the reader of the sysctl_tcp_probe_threshold variable. The issue arises because the value can be changed concurrently while read, leading to a race condition. The documented fix is to guard the reader with a READ_ONCE(), stabilizi...

CVE-2022-49599

CVE-2022-49599 concerns a data race in the Linux kernel involving sysctl_tcp_l3mdev_accept. The connected advisories confirm the vulnerability is in the kernel’s handling of sysctl_tcp_l3mdev_accept and that the fix adds READ_ONCE() to the readers to prevent concurrent modification during reads. ...

CVE-2022-49615

CVE-2022-49615 affects the Linux kernel ASoC rt711-sdca subsystem. A IO error during initial codec settings could dereference a NULL rt711->component before the probe completes, risking kernel panic. The fix changes the code path to use slave->dev instead of component->dev for the early ...

CVE-2022-49634

CVE-2022-49634 : In the Linux kernel, there are data-races in sysctl access to proc_dou8vec_minmax() due to concurrent readers/writers. The fix changes proc_dou8vec_minmax() to use internal READ_ONCE() and WRITE_ONCE() to mitigate races on the sysctl side. The patch notes indicate the function it...

CVE-2023-0469

CVE-2023-0469 is a use-after-free in io_uring/filetable.c (io_install_fixed_file) within the Linux kernel’s io_uring subcomponent during call cleanup, potentially enabling a local DoS. Affected: Linux kernel with vulnerable io_uring code. Exploitation details are not provided in the supplied docu...

CVE-2023-52529

CVE-2023-52529 refers to a Linux kernel vulnerability affecting the Sony HID path, where a memory leak could occur in sony_probe() if an error happens after usb_alloc_urb(). The fix ensures usb_free_urb() is called on error paths after a successful usb_alloc_urb(), addressing the leak. Connected ...

CVE-2023-52885

CVE-2023-52885 affects the Linux kernel SUNRPC component, causing a use-after-free in svc_tcp_listen_data_ready() when a newsock may hold a freed listener sv_sk; the race can occur after the listener socket is freed and before svc_tcp_accept() of the child sock. The fix is to no-op in svc_tcp_lis...

CVE-2023-52902

CVE-2023-52902 concerns the Linux kernel memory-leak in maple tree preallocation during do_mmap() error paths. The preallocated maple tree nodes could leak on error_just_free, addressed by moving the free of maple tree nodes to a shared cleanup location for all error paths. Connected documents (N...

CVE-2024-26864

CVE-2024-26864 concerns the Linux kernel TCP path: a refcount handling issue in __inet_hash_connect() could lead to refcnt underflow and socket leaks if not reverted properly after tb2 allocation failure. The issue manifested as a kernel warning in sk_nulls_del_node_init_rcu() and was addressed b...

CVE-2024-36915

CVE-2024-36915 concerns the Linux kernel’s NFC LLCP path where nfc_llcp_setsockopt() could unsafe-copy from user-supplied sockptr data, triggering a slab-out-of-bounds read. Symptom traces show reads of 4 bytes at a user task, linked to copy_from_sockptr() and inline copy_from_sockptr_offset; the...

CVE-2024-40925

CVE-2024-40925 involves the Linux kernel and a fault in block layer MQ flush handling. The root cause was a faulty use of rq->queuelist during PREFLUSH/POSTFLUSH sequences, where list_move_tail(&rq->queuelist, pending) could operate on an uninitialized queue when rq was popped from plug-&gt...

CVE-2024-43879

Summary (CVE-2024-43879) In the Linux kernel, the wifi/bt stack vulnerability related to 2x996 RU allocation was fixed. NL80211_RATE_INFO_HE_RU_ALLOC_2x996 was not handled in cfg80211_calculate_bitrate_he(), causing a warning: “invalid HE MCS: bw:6, ru:6”. The fix mirrors the handling of 160 MHz ...

CVE-2024-46685

CVE-2024-46685 is a Linux kernel vulnerability involving the pinctrl/pinmux subsystem. The issue was a potential NULL dereference: pinmux_generic_get_function() could return NULL and PCS_get_function() dereferenced the pointer without NULL-checks. The fix adds a NULL check for the function pointe...

CVE-2024-46854

CVE-2024-46854 – Linux kernel net: dpaa padding has been fixed. When sending small packets (

CVE-2024-47143

CVE-2024-47143 relates to the Linux kernel and describes a potential deadlock in the dma-debug flow caused by holding radix_lock while dma_hash_entry locks are held. The fix, as documented in the connected sources, is to perform dma_entry_free() after put_hash_bucket() inside check_unmap() to pre...

CVE-2024-47671

The CVE-2024-47671 entry concerns a Linux kernel vulnerability in USBimp: usbtiusmb? The provided connected documents confirm a kernel-infoleak in USB: usbtmc, with the root cause described as a need to clear the data structure before filling fields in usbtmc_write. The fix/workaround is to preve...

CVE-2024-49858

CVE-2024-49858: Linux kernel TPM event log handling (efistub/tpm) used EFI_LOADER_DATA, leaving the region unreserved in the EFI 64-bit memory map (via E820) and passed to the kernel via kexec, risking memory corruption. The fix substitutes EFI_ACPI_RECLAIM_MEMORY, which EFI/ACPI treats as reserv...

CVE-2024-49892

CVE-2024-49892 (Linux kernel) : Affects the DRM/AMD display path. The bug was caused by get_bytes_per_element() potentially returning 0, leading to multiple DIVIDE_BY_ZERO errors. The patch initializes the default to 1, ensuring bytes_per_element_y and bytes_per_element_c are never denominators o...

CVE-2024-49958

The CVE-2024-49958 issue affects the Linux kernel’s OCFS2 filesystem, caused by a reflink flow that reserves space for inline xattrs at the destination inode after reflink has already recreated the reflink tree. Specifically, ocfs2_reflink_xattr_inline() reduces l_count from 243 to 227 without va...

CVE-2024-49999

The CVE-2024-49999 issue is in the Linux kernel afs client (afs_wait_for_operation in fs/afs/fs_operation.c). A loop could exit after receiving a server response that was discarded, leaving op->server possibly NULL and then the code could set a server flag. The fix adds a guard and proper book...

CVE-2024-50023

CVE-2024-50023 packages: Linux kernel net: phy: Remove LED entry from LEDs list on unregister. The issue arises when devm_ usage fixes left the LED entry in the LEDs list after PHY teardown, which can cause a kernel panic when the PHY kmod is removed and later re-added. The fix is implemented in ...

CVE-2024-50061

CVE-2024-50061 affects the Linux kernel’s i3c: master cdns_i3c_master driver. The root cause is a use-after-free race: cdns_i3c_master_hj_work scheduled in cdns_i3c_master_probe can run after cdns_i3c_master_remove frees master->base via i3c_master_unregister. The documented fix is to cancel t...

CVE-2024-50124

CVE-2024-50124: The Linux kernel Bluetooth ISO path fixed a use-after-free (UAF) on iso_sock_timeout. conn->sk could be unlinked/freed while iso_conn_lock is waiting, with the fix validating conn->sk by ensuring it is part of iso_sk_list before use. Impact is high for local access scenarios...

CVE-2024-50132

CVE-2024-50132 – Linux kernel tracing/probes vulnerability . Affected component: tracing_eprobe code in the kernel/trace/trace_eprobe.c module. Root cause: nr_args was initialized before truncating arguments to MAX_TRACE_ARGS, causing invalid memory access when creating trace probes with more tha...

CVE-2024-50159

CVE-2024-50159 relates to the Linux kernel firmware subsystem for ARM SCMI. The vulnerability arises from a double-free in the ARM SCMI debugfs setup path: when devm_add_action_or_reset() fails, scmi_debugfs_common_cleanup() can run twice, leading to freeing the same memory (dbg->name) twice. ...

CVE-2024-50168

CVE-2024-50168 affects the Linux kernel component net/sun3_82586. A memory leak could occur in sun3_82586_send_packet() when skb->len is too long, as the function previously returned NETDEV_TX_OK without freeing the socket buffer (skb). The fix adds dev_kfree_skb() to free the skb in that code...

CVE-2024-50233

CVE-2024-50233 concerns the Linux kernel: in staging: iio: frequency: ad9832, ad9832_write_frequency() may divide by clk_get_rate() which can be 0, leading to a division by zero in ad9832_calc_freqreg(). The fout value comes from user-controlled text and the zero-rate edge case is not protected b...

CVE-2024-53145

CVE-2024-53145 – Linux kernel integer overflow in physmem setup : The vulnerability occurs when the real map size is greater than LONG_MAX, which can be triggered on UML/i386, leading to an overflow during physical memory (physmem) setup. The connected Astra Linux security bulletin mirrors the Li...

CVE-2024-56720

The CVE-2024-56720 issue affects the Linux kernel’s BPF sockmap/bpf_msg_pop_data handling. The fixed changes address bpf_msg_pop_data in sk_msg_shift_left, including: using put_page in sk_msg_shift_left; returning early when len == 0; supporting popping the entire sk_msg (last == msg->sg.size)...

CVE-2024-57925

CVE-2024-57925 affects the Linux kernel’s ksmbd component. A NULL pointer returned by ksmbd_alloc_work_struct() in smb2_send_interim_resp() could allow an illegal memory write to in_work->response_buf during kzalloc() on the in_work structure. The connected documents confirm a fix that adds a ...

CVE-2024-58014

The CVE-2024-58014 entry concerns a Linux kernel vulnerability in the wifi brcmsmac driver. In wlc_phy_iqcal_gainparams_nphy(), a gain range check was missing, risking out-of-bounds access to tbl_iqcal_gainparams_nphy. The issue has a fixed variant where the code now WARN()s on out-of-range value...

CVE-2025-21649

CVE-2025-21649 (Linux kernel) : Affected component: net: hns3 on HIP08 devices. Root cause: NULL pointer dereference when attempting to set TX hardware timestamp information if HIP08 devices do not register PTP devices (ptp is NULL). This can cause a kernel crash during 1588 timestamping flow in ...

CVE-2025-21680

The CVE-2025-21680 issue affects the Linux kernel’s pktgen code, specifically get_imix_entries, where an insufficient boundary check on the imix_entries array allows out-of-bounds access when a large number of imix entries are passed. This leads to UBSAN reported array-index-out-of-bounds in net/...

CVE-2025-21749

CVE-2025-21749: In the Linux kernel, the Rose network layer is affected. The issue arises in rose_bind() where the socket must be locked to prevent a soft lockup triggered by a repro that binds from multiple threads, as reported by syzbot (rose_loopback_timer()). Affected component: roseBind path...