CVE-2025-37881

In CVE-2025-37881, the Linux kernel USB gadget aspeed driver (ast_vhub_init_dev) fixes a NULL pointer dereference by adding a NULL check for d->name (returned by devm_kasprintf). The issue could occur if devm_kasprintf() returns NULL, potentially leading to a crash. The patch, which references...

CVE-2022-49097

CVE-2022-49097 relates to the Linux kernel NFS writeback path. In low-memory conditions, the NFS writeback code could enter infinite loops in mempool_alloc, risking a writeback stall. The issue is resolved in the kernel by allowing the writeback path to fail gracefully instead of deadlocking. The...

CVE-2024-46805

CVE-2024-46805 is a Linux kernel vulnerability in the drm/amdgpu path where a NULL pointer dereference of hive can occur when validating amdgpu_hive_info. The issue (root cause: amdgpu_hive_info *hive may be NULL) can lead to an out-of-bounds or memory access problem in the driver, with the advis...

CVE-2024-47709

Concretely, CVE-2024-47709 concerns the Linux kernel bcm driver path: after remove_proc_entry() bcm_notify() previously left bo->bcm_proc_read set, causing bcm_release() to trigger an extra remove_proc_entry(). The fix clears bo->bcm_proc_read after remove_proc_entry() in bcm_notify(), prev...

CVE-2024-47727

CVE-2024-47727 is a Linux kernel issue (x86/tdx) where userspace could trick the kernel into performing MMIO via #VE by pointing a syscall at an MMIO address. The root cause was the in-kernel MMIO check in handle_mmio() not guaranteeing the target MMIO address was within the kernel before decodin...

CVE-2024-47738

CVE-2024-47738 affects the Linux kernel’s wifi subsystem (mac80211). The vulnerability lies in handling rate masks for offchannel TX, where an incorrect rate mask could trigger a -EINVAL/unsupported rate warning. The advisory notes that the root cause was traced to a chain of commits, with the pr...

CVE-2024-47752

CVE-2024-47752 concerns the Linux kernel media/vcodec/mediatek H264 stateless decoder. The provided description states that a smatch static checker warning in vdec_h264_req_if.c led to a kernel crash when the framebuffer pointer (fb) was NULL. The vulnerability is within the Mediatek vcodec path ...

CVE-2024-49951

The CVE-2024-49951 entry describes a Linux kernel vulnerability in the Bluetooth MGMT layer where mgmt_index_removed can crash if called while commands are queued on cmd_sync. The issue can lead to a crash trace in mgmt_pending_remove, mgmt_remove_adv_monitor_complete, and hci_cmd_sync_work, due ...

CVE-2024-50110

CVE-2024-50110 is a Linux kernel vulnerability fixed by ensuring xfrm algorithm dumping does not leak kernel-infoleak data to userspace. The issue could expose uninitialized or padding-filled data from kernel structures via netlink/dumping paths; padding in dumped algorithm data could reveal sens...

CVE-2024-50132

CVE-2024-50132 – Linux kernel tracing/probes vulnerability . Affected component: tracing_eprobe code in the kernel/trace/trace_eprobe.c module. Root cause: nr_args was initialized before truncating arguments to MAX_TRACE_ARGS, causing invalid memory access when creating trace probes with more tha...

CVE-2024-50209

CVE-2024-50209 is a Linux kernel vulnerability related to RDMA/bnxt_re. The issue arises from memory allocation: __alloc_pbl() can return an error, and the driver does not check the status on one instance, risking a memory-alloc failure being mishandled. The connected Tencent/Tenable/Nessus advis...

CVE-2024-50283

In the Linux kernel, the ksmbd component fixed a slab-use-after-free in smb3_preauth_hash_rsp. The patch ensures ksmbd_user_session_put is called under smb3_preauth_hash_rsp(), preventing the session from being freed before that call. Affected area: ksmbd/smb3_preauth_hash_rsp lifecycle. Remediat...

CVE-2024-50290

CVE-2024-50290 is a Linux kernel vulnerability affecting the media: cx24116 driver. The issue arises when reading SNR registers: if the read fails, a negative value could be returned, causing an underflow. The fix prevents that underflow by ensuring reading SNR registers does not produce a negati...

CVE-2024-55639

In CVE-2024-55639, the Linux kernel rswitch driver (Renesas) flaw stems from improper use of a saved device-tree node in rswitch_device, where of_node_put() was called after the first reference is used. The node may be released too late/too early across multiple code paths, risking use-after-free...

CVE-2024-57910

CVE-2024-57910 : In the Linux kernel, the iio: light: vcnl4035 driver had an information leak in the triggered buffer. The local buffer used to push data to userspace contained an uninitialized element (a 16-bit value aligned to 8 bytes), leaving at least 4 bytes potentially exposed after a regma...

CVE-2024-57974

The CVE-2024-57974 entry describes a race in the Linux kernel UDP path: if a UDP socket changes its local address during a receive after connect(), a secondary hash/tuple hash update may not complete in time, causing lookups to fail and potentially returning ECONNREFUSED. The issue arises from th...

CVE-2025-21967

The CVE-2025-21967 issue affects the Linux kernel ksmbd subsystem, where a use-after-free could happen in ksmbd_free_work_struct because interim_entry of ksmbd_work could be deleted after an oplock is freed. The vulnerability details and remediation are confirmed by connected advisories (Azure Li...

CVE-2025-22054

CVE-2025-22054: Linux kernel vulnerability in arcnet handling (com20020pci_probe) where devm_kasprintf() can return NULL, leading to a NULL pointer dereference. The fix adds a NULL check after devm_kasprintf() and ensures no resources are leaked. Connected docs (Ubuntu Unity/Linux advisories) con...

CVE-2025-22086

Technical details for CVE-2025-22086 are not publicly provided in the supplied documents. The description notes an RDMA mlx5 CQ handling/QP-number matching issue in mlx5_ib_poll_cq, but specific affected versions, exploit details, or remediation steps are not disclosed here. Monitor for updates.

CVE-2025-22126

CVE-2025-22126 affects the Linux kernel md subsystem: a use-after-free can occur when iterating the mddev list during reboot/exit due to racing with deletions. The fix switches to list_for_each_entry and introduces a mddev_put_locked helper to prevent freeing the active mddev under the lock. Affe...

CVE-2025-37995

CVSS note: CVE-2025-37995 is a Linux kernel issue with a local exploit vector and a MEDIUM impact rating. The vulnerability arises in module handling of kobjects: in lookup_or_create_module_kobject(), an internal kobject is created using module_ktype, and a call to kobject_put() on the error path...

CVE-2010-1173

CVE-2010-1173 affects Linux kernel SCTP: sctp_process_unk_param in net/sctp/sm_make_chunk.c (kernel 2.6.33.3 and earlier) enables remote attackers to crash the system via SCTPChunkInit with many invalid parameters (high error data). Connected advisories (e.g., MiracleLinux AXSA-2010-377:12 and re...

CVE-2010-1188

CVE-2010-1188 details (mode C): A use-after-free in net/ipv4/tcp_input.c of the Linux kernel 2.6 prior to 2.6.20. When IPV6_RECVPKTINFO is set on a listening TCP socket, a SYN packet to a LISTEN socket can trigger the skb being freed improperly, allowing a remote attacker to cause a denial of ser...

CVE-2010-3876

CVE-2010-3876 affects the Linux kernel: the code path net/packet/af_packet.c in kernel versions before 2.6.37-rc2 does not properly initialize certain structure members, allowing local users with CAP_NET_RAW to read copies of the applicable structures from kernel stack memory. Publicly document d...

CVE-2013-7445

CVE-2013-7445 : In the Linux kernel DRM subsystem, the Graphics Execution Manager (GEM) object handling (through GEM requests) is mishandled, allowing a context-aware attacker to cause a denial of service via memory exhaustion. The exploitation described uses JavaScript creating many CANVAS eleme...

CVE-2015-5707

CVE-2015-5707 affects the Linux kernel sg.c sg_start_req function (drivers/scsi/sg.c) where an integer overflow can occur in write requests with a large iov_count, allowing a local attacker to cause a denial of service or potentially other impact on kernel memory. Affected are kernel versions 2.6...

CVE-2015-8374

CVE-2015-8374 affects the Linux kernel prior to 4.3.3. The vulnerability is due to the filesystem driver fs/btrfs/inode.c mishandling compressed inline extents, allowing local users to obtain sensitive pre-truncation data from a file via a clone operation. Affected: Linux kernel up to 4.3.2 (4.3....

CVE-2016-1575

CVE-2016-1575 concerns the overlayfs implementation in the Linux kernel up to 4.5.2, which, according to the provided documents, does not properly maintain POSIX ACL xattr data. This can allow local users to gain privileges by leveraging a group-writable setgid directory. The connected Nessus ent...

CVE-2016-3699

CVE-2016-3699 affects the Linux kernel as used in Red Hat Enterprise Linux 7.2 and Red Hat MRG 2 when booted with UEFI Secure Boot. The issue allows local attackers to bypass Secure Boot restrictions and execute untrusted code by appending ACPI tables to the initrd. The connected documents corrob...

CVE-2016-3955

The CVE-2016-3955 issue affects the Linux kernel’s usbip_recv_xbuff path (drivers/usb/usbip/usbip_common.c) prior to version 4.5.3. A crafted length in a USB/IP packet can trigger an out-of-bounds write, enabling remote denial of service (and potentially other impact) without authentication. The ...

CVE-2017-15126

CVE-2017-15126 affects the Linux kernels fs/userfaultfd.c, where an improper fork handling during event processing can cause a fork event to be removed from an already freed list, i.e., a use-after-free condition. Affected are kernels before 4.13.6 (fixed in 4.13.6), with the issue having high im...

CVE-2017-8797

CVE-2017-8797 affects the Linux kernel NFSv4 server. A remote attacker can send NFSv4 pNFS GETDEVICEINFO or LAYOUTGET operands in UDP; an uninitialized layout type is used as an array index, causing an OOPS and potentially a system DoS via knfsd soft-lockup. Affected: Linux kernel versions prior ...

CVE-2018-14612

CVE-2018-14612 affects the Linux kernel (through 4.17.10) with an invalid pointer dereference in btrfs_root_node() when mounting a crafted btrfs image. The root cause is lack of validation in btrfs_read_block_groups (fs/btrfs/extent-tree.c) and missing empty-tree checks in check_leaf (fs/btrfs/tr...

CVE-2019-19053

CVE-2019-19053 affects the Linux kernel (through 5.3.11). A memory leak in the function rpmsg_eptdev_write_iter() (drivers/rpmsg/rpmsg_char.c) can be triggered when copy_from_iter_full() fails, leading to a denial of service via memory consumption. The connected Nessus entries (Unity Linux UTSA a...

CVE-2021-47098

CVE-2021-47098 affects Linux kernel hwmon lm90, where setting the hysteresis value could overflow/underflow when the temperature limit is MAX_LONG with a negative critical limit. The root cause was an integer overflow/underflow in hysteresis calculations after a prior fix; the resolution introduc...

CVE-2021-47247

CVE-2021-47247 is a Linux kernel use-after-free in the mlx5e_encap_take path during neigh update, caused by improper handling when encap entries are concurrently inserted/deleted after rtnetlink lock changes. The issue is documented in upstream kernel notes and is listed in Debian’s DLA-4178-1 ad...

CVE-2021-47416

CVE-2021-47416 refers to a Linux kernel issue where a memory leak in the MDIO bus interface could occur due to incorrect state handling of MDIOBUS_ALLOCATED. The bug arises when device_register() is called after a partial allocation; mdiobus_free() would free only the memory with kfree(dev) inste...

CVE-2021-47461

CVE-2021-47461 refers to a race in the Linux kernel’s userfaultfd path between writeprotect and exit_mmap() when a process exits and its VMAs are removed concurrently with userfaultfd_writeprotect(). The issue can occur on vanilla kernels as well as development ones and was detected by KASAN. The...

CVE-2021-47580

The connected Astra/Linux advisory documents confirm CVE-2021-47580 affects the Linux kernel component scsi_debug by a bug in min_t() that could yield a stack out-of-bounds condition. The root cause is using int for min_t(), which sign-extends and allows a larger value to overflow the stack when ...

CVE-2022-0382

CVE-2022-0382 is a Linux kernel issue in the TIPC protocol subsystem caused by uninitialized memory when a user sends a TIPC datagram to one or more destinations. It enables a local attacker to read kernel memory (limited to about 7 bytes; read is not controllable). Affected are Linux kernel vers...

CVE-2022-47939

CVE-2022-47939 affects ksmbd in Linux kernel 5.15–5.19 (before 5.19.2). The issue is a use-after-free in fs/ksmbd/smb2pdu.c that can trigger an OOPS when handling SMB2_TREE_DISCONNECT. A fix was released with Linux kernel 5.19.2 (and later). Affected distributions referenced in Connected sources ...

CVE-2022-48760

The CVE-2022-48760 entry concerns a Linux kernel USB subsystem hang in usb_kill_urb() caused by memory-access ordering issues (SB pattern) between usb_kill_urb() and __usb_hcd_giveback_urb() on SMP systems. The vulnerability is fixed by adding memory barriers, specifically using the smp_mb__after...

CVE-2022-49395

CVE-2022-49395 concerns the Linux kernel, where an out-of-bounds read occurs in LDT setup due to syscall_stub_data() treating data_count as bytes instead of longs. This yields a 128-byte read on the stack (local to swapper/1) and is triggered during LDT entry initialization. Public advisories fro...

CVE-2022-49565

CVE-2022-49565 concerns the Linux kernel, specifically perf/x86/intel/lbr, where unchecked MSR writes (WRMSR to 0x689) can occur due to an absent TSX quirk application when accessing LBR data. The issue manifests on systems with LBR_FORMAT_EIP_FLAGS2 and, if TSX is disabled, requires a quirk to a...

CVE-2022-49710

CVE-2022-49710 affects the Linux kernel's device-mapper dm-log path (dm-mirror) where rounding bitset_size to 32 bits causes an out-of-bounds access on 64-bit architectures when find_next_zero_bit_le reads the bitmap. The root cause is using unsigned long pointers for the bitmap, allowing a 4-byt...

CVE-2022-49739

The CVE-2022-49739 issue concerns the GFS2 subsystem in the Linux kernel where the inode size of stuffed (inline) inodes was not consistently validated when reading inodes from disk. The fix enforces that the inode size of inline inodes is within the allowed range (gfs2_dinode_in()), preventing o...

CVE-2022-49848

In the Linux kernel, the vulnerability affects the phy: qcom-qmp-combo driver . The root cause was treating the PCS_USB registers as potentially separate from PCS registers, but using the wrong base when no PCS_USB offset is provided. This caused a potential dereference of a NULL pointer during r...

CVE-2022-49864

Summary: CVE-2022-49864 is a Linux kernel vulnerability within the DRM/AMDKFD driver. The root cause is a NULL pointer dereference in svm_migrate_to_ram() in kfd_migrate.c (p dereferenced as NULL). The issue manifests as a potential kernel crash or denial of service via a local attack vector. The...

CVE-2022-49908

CVE-2022-49908 affects the Linux kernel Bluetooth path, where a memory leak could occur in L2CAP/vhci_write: when an ACL fragment lacks the L2CAP length, the HCI core may copy the skb to conn->rx_skb and finish processing without freeing it. The provided patches fix this by releasing the relat...

CVE-2022-49928

The CVE-2022-49928 entry corresponds to a Linux kernel vulnerability (SUNRPC) where a null-ptr-deref can occur if the xps sysfs allocation fails, specifically in sysfs_do_create_link_sd during RPC client setup (gssproxy path). The concrete issue is triggered when the xprt_switch sysfs allocation ...