CVE-2024-24861

CVE-2024-24861 affects the Linux kernel xc4000 media driver (xc4000_get_frequency) with a race condition that can cause a return-value overflow, potentially leading to malfunction or denial of service. Data from multiple sources confirms the issue originates in the xc4000 driver and is tied to Li...

CVE-2024-26775

CVE-2024-26775 concerns the Linux kernel’s aoe subsystem. The documented issue is a potential deadlock in set_capacity() caused by a locking order: one path holds bdev->bd_size_lock while another holds d->lock, risking a deadlock when an interrupt occurs and the code path re-enters set_capa...

CVE-2024-26791

CVE-2024-26791 — Linux kernel: btrfs dev-replace: properly validate device names. A syzbot report indicated device name buffers passed to device replace could read beyond end (getname_kernel) due to insufficient termination checks. The fix adds a helper that validates both source and target devic...

CVE-2024-35787

CVE-2024-35787 affects the Linux kernel’s md/md-bitmap logic. The root issue stemmed from removing page->index (via commit d7038f951828) in the bitmap code while leaving faulty logic for clustered-md, causing slots to be mis-set for cluster nodes and potentially crashes in clustered environmen...

CVE-2024-36956

CVE-2024-36956 affects the Linux kernel’s thermal subsystem (thermal/debugfs). The root cause is that thermal_debug_tz_remove() does not free all allocated memory for thermal zone diagnostics when a zone is removed, making some memory unreachable. The vulnerability is addressed by modifying therm...

CVE-2024-40983

The CVE-2024-40983 entry affects the Linux kernel TIPc path. Root cause: crypto requests may complete asynchronously and exit the rcu region, risking use-after-free of the skb destination during xfrm input/output handling. The fix is to force a destination dst reference before entering TIPC decry...

CVE-2024-41000

CVE-2024-41000 : Linux kernel: block/ioctl: prefer different overflow check. UBSAN signed-overflow triggered by overflow in signed arithmetic during ioctl handling; fixed by reworking the overflow check to avoid performing an actual overflow in the check itself. The issue is linked to reintroduci...

CVE-2024-41085

CVE-2024-41085 concerns the Linux kernel CXL memory region probing. The bug was a NULL pointer dereference when auto-assembling a pmem region during endpoint port probing because cxl_nvd (NVDIMM) was not yet registered. The fix changes the probe sequence so the cxl_nvd is available before or duri...

CVE-2024-41932

CVE-2024-41932 affects the Linux kernel scheduling path, specifically sched_setaffinity. The issue is a race between per-task affinity updates and cpuset updates, which can cause the task affinity to become non-subset of the cpuset. The code falls back to using the cpuset mask, but a WARN is trig...

CVE-2024-42141

Technical details for CVE-2024-42141 are not provided in the supplied documents; public exploitability, affected products, and fixes are not specified here. Monitor for updates.

CVE-2024-46677

CVE-2024-46677 affects the Linux kernel gtp path. Root cause: when sockfd_lookup() fails, gtp_encap_enable_socket() returns a NULL pointer, but its callers only check for error pointers, so the NULL pointer could be dereferenced. Fix : return an error pointer carrying the sockfd_lookup() error co...

CVE-2024-46731

CVE-2024-46731 : Linux kernel vulnerability in drm/amdgpu/pm where an out-of-bounds read can occur for mc_data[] when i == 0 due to indexing as i-1. The issue has been resolved by a kernel patch. Connected sources confirm the vulnerability and patch context (Out-of-bounds read warning fix in drm/...

CVE-2024-47709

Concretely, CVE-2024-47709 concerns the Linux kernel bcm driver path: after remove_proc_entry() bcm_notify() previously left bo->bcm_proc_read set, causing bcm_release() to trigger an extra remove_proc_entry(). The fix clears bo->bcm_proc_read after remove_proc_entry() in bcm_notify(), prev...

CVE-2024-47711

Technical details about CVE-2024-47711 (affected products, impact, and fixes) are not provided in the supplied documents. Monitor official advisories and vendor patches for updates.

CVE-2024-49951

The CVE-2024-49951 entry describes a Linux kernel vulnerability in the Bluetooth MGMT layer where mgmt_index_removed can crash if called while commands are queued on cmd_sync. The issue can lead to a crash trace in mgmt_pending_remove, mgmt_remove_adv_monitor_complete, and hci_cmd_sync_work, due ...

CVE-2024-49985

CVE-2024-49985 : In the Linux kernel, the i2c-stm32f7 path could deadlock during runtime suspend/resume if a clock controller is attached to the I2C bus (e.g., Versaclock or an AIC32x4 codec). The root cause is a transfer that triggers clk_ops.prepare, which grabs clk.c’s prepare_lock and, after ...

CVE-2024-50159

CVE-2024-50159 relates to the Linux kernel firmware subsystem for ARM SCMI. The vulnerability arises from a double-free in the ARM SCMI debugfs setup path: when devm_add_action_or_reset() fails, scmi_debugfs_common_cleanup() can run twice, leading to freeing the same memory (dbg->name) twice. ...

CVE-2024-50179

In CVE-2024-50179, the Linux kernel vulnerability stems from the direct-io read path attempting to mark pages dirty without holding Firmware (Fw) caps, which could lead to an incorrect Fw reference during page dirtying. The fix, as described in the initial document, is a patch that ceph applies: ...

CVE-2024-56556

CVE-2024-56556 targets the Linux kernel binder: a race in binder_add_freeze_work() where proc->inner_lock is dropped while acquiring node->lock, allowing binder_node_release() to race and trigger a use-after-free. Impact is local privilege escalation/high, as indicated by multiple advisorie...

CVE-2024-56651

CVE-2024-56651 affects the Linux kernel hi311x CAN driver (hi3110_can_ist). The issue is a potential use-after-free: error count data added to the CAN frame after netif_rx() could reference a skb that is freed or reused. Root cause: reporting of rxerr/txerr persisted during non-bus-off operation,...

CVE-2024-57981

CVE-2024-57981 affects the Linux kernel USB xHCI code. When a command is queued to the final usable TRB and later aborted, the abort path could dereference a NULL cur_cmd, crashing due to a timer-setup path. The fix prevents timer setup if cur_cmd is NULL, and keeps the doorbell sequence safe. Af...

CVE-2025-21714

CVE-2025-21714 : Linux kernel RDMA/mlx5: fix implicit ODP use after free. The issue could lead to invalidating the MR twice, queuing MR destroy work twice, and a race where the second work runs after the first freed MR, causing a user-after-free and refcount underflow. The fix uses __xa_cmpxchg()...

CVE-2025-21745

CVE-2025-21745 affects the Linux kernel blk-cgroup subsystem. The root cause was a leak of the subsystem refcount in blkcg_fill_root_iostats() caused by iterating devices with class_dev_iter_(init|next)() without class_dev_iter_exit(). The fix ends the iteration with class_dev_iter_exit(), preven...

CVE-2025-21749

CVE-2025-21749: In the Linux kernel, the Rose network layer is affected. The issue arises in rose_bind() where the socket must be locked to prevent a soft lockup triggered by a repro that binds from multiple threads, as reported by syzbot (rose_loopback_timer()). Affected component: roseBind path...

CVE-2025-21781

CVE-2025-21781 is a memory-safety crash in the Batman-adv networking module of the Linux kernel. The issue stems from improper reference counting for batman-adv objects during interface removal, which can lead to a crash when a soft interface goes away before ongoing work completes (notably durin...

CVE-2025-22021

Summary: The CVE-2025-22021 issue is in the Linux kernel netfilter socket lookup for IPv6 SNAT. The IPv4 path already performs a conntrack lookup to restore the original 5-tuple for socket matching; the IPv6 path nf_sk_lookup_slow_v6 lacked this, causing xt_socket matching failures on SNATed IPv6...

CVE-2025-22022

CVE-2025-22022 concerns the Linux kernel USB xHCI driver, where NEC isochronous endpoints with NEC uPD720200 controllers could trigger IOMMU faults due to mis-handling of missed service errors. The description notes a faulty behavior involving transfer descriptors around isochronous rings and a c...

CVE-2025-37849

CVE-2025-37849 affects the Linux kernel KVM arm64; the issue occurs when kvm_arch_vcpu_create() fails to share the vCPU page with the hypervisor, leaving vGIC vCPU data initialised. This can leak memory on vCPU destruction and may cause use-after-free in redistributor handling. The fix adds prope...

CVE-2025-38637

The CVE CVE-2025-38637 affects the Linux kernel skbprio queue in net_sched when used as a child qdisc under Token Bucket Filter (TBF). The root cause is an overly strict assertion in skbprio enqueue/dequeue that can miscount lengths because TBF may peek at packets without dequeueing when tokens a...

CVE-2026-46244

The CVE-2026-46244 issue affects the Linux kernel netfilter nft_inner path. In nft_inner_parse_l2l3(), while handling inner IPv6 packets, ipv6_find_hdr() computes the transport header offset correctly across extension headers, but the code later overwrites this value with nhoff + sizeof(_ip6h) (4...

CVE-2014-0077

CVE-2014-0077 concerns the Linux kernel component drivers/vhost/net.c . When mergeable buffers are disabled, the code path does not properly validate packet lengths, enabling a guest OS user to trigger a memory corruption that could cause a host crash or, per wording, potentially gain privileges ...

CVE-2014-3144

CVE-2014-3144 affects the Linux kernel up to 3.14.3. The (1) BPF_S_ANC_NLATTR and (2) BPF_S_ANC_NLATTR_NEST implementations in the sk_run_filter function (net/core/filter.c) do not properly verify a length value, enabling a local attacker to trigger a denial of service via crafted BPF instruction...

CVE-2014-3687

The provided materials confirm CVE-2014-3687 affects the Linux kernel SCTP implementation (net/sctp/associola.c) up to version 3.17.2. The vulnerability allows remote attackers to cause a denial of service (panic) by sending duplicate ASCONF chunks, triggering an incorrect uncork within the side-...

CVE-2015-0239

CVE-2015-0239 affects the Linux kernel KVM emulation path (arch/x86/kvm/emulate.c). If a guest OS does not initialize SYSENTER MSRs, em_sysenter can trigger using a 16‑bit code segment to emulate SYSENTER, allowing a guest OS user to gain guest privileges or cause a guest crash. The vulnerability...

CVE-2015-7550

CVE-2015-7550 concerns the Linux kernel’s keyctl_read_key in security/keys/keyctl.c, where a missing semaphore around a race between keyctl_revoke and keyctl_read can allow a local user to trigger a NULL pointer dereference and system crash (DoS) and possibly other impact. The vulnerability exist...

CVE-2015-8374

CVE-2015-8374 affects the Linux kernel prior to 4.3.3. The vulnerability is due to the filesystem driver fs/btrfs/inode.c mishandling compressed inline extents, allowing local users to obtain sensitive pre-truncation data from a file via a clone operation. Affected: Linux kernel up to 4.3.2 (4.3....

CVE-2016-1237

CVE-2016-1237 affects the Linux kernel’s nfsd: a missing permissions check when setting POSIX ACLs allows a local user to bypass file-permission restrictions by manipulating ACLs (nfs2acl.c, nfs3acl.c, nfs4acl.c). The vulnerability is described as present in kernels up to 4.6.3 and is addressed i...

CVE-2016-2782

CVE-2016-2782 : In the Linux kernel, the treo_attach function in drivers/usb/serial/visor.c (pre-4.5) can be exploited by a physically proximate attacker who inserts a USB device missing a bulk-in or interrupt-in endpoint, causing a NULL pointer dereference and kernel crash (DoS) or possibly othe...

CVE-2016-3699

CVE-2016-3699 affects the Linux kernel as used in Red Hat Enterprise Linux 7.2 and Red Hat MRG 2 when booted with UEFI Secure Boot. The issue allows local attackers to bypass Secure Boot restrictions and execute untrusted code by appending ACPI tables to the initrd. The connected documents corrob...

CVE-2016-6198

CVE-2016-6198 affects the Linux kernel (pre-4.5.5) in its OverlayFS path. The bug occurs when a file under OverlayFS is renamed to a self-hardlink, causing post-rename operations to run and potentially crash the kernel. Local users can trigger a denial of service (system crash) via a rename sysca...

CVE-2017-16533

CVE-2017-16533 affects the Linux kernel’s usbhid_parse() in drivers/hid/usbhid/hid-core.c up to and including version 4.13.7; a crafted USB device can cause an out-of-bounds read, leading to local denial of service or a crash. Affected component: HID USB host controller driver (usbhid). Root caus...

CVE-2021-47606

CVE-2021-47606 affects the Linux kernel net: netlink af_netlink fix. The vulnerability arises from an empty skb usage, where skb->len=0 and skb->data_len=0 could trigger a division error in netem_enqueue during randomized corruption: skb->data[prandom_u32() % skb_headlen(skb)] ^= 1<

CVE-2022-48696

CVE-2022-48696 affects the Linux kernel regmap_spi code. The vulnerability arises because max_raw_read/max_raw_write in regmap_spi didn’t account for transmitted register address/padding, risking SPI message sizes being exceeded and causing undefined behavior (e.g., data corruption). The fix is t...

CVE-2022-48934

CVE-2022-48934 affects the Linux kernel code for nfp: flower. The issue is a leak in nfp_tunnel_add_shared_mac() related to ida_simple_get() returning an id in 0..NFP_MAX_MAC_INDEX (0xff) and the error path requiring the invalid ida_idx not to be within that range. The fix is to set the invalid v...

CVE-2022-48944

The CVE-2022-48944 issue is a Linux kernel race in sched/fork() related to how new tasks are exposed via pidhash and runqueue handling. The description cites prior fixes that fixed a fork race vs cgroup (commit 4ef0c5c6b5ba) and a subsequent change that effectively reverted that, aiming to fix th...

CVE-2022-49022

CVE-2022-49022 affects the Linux kernel’s wifi/mac80211 stack. The issue is a potential out-of-bounds access in ieee80211_get_rate_duration during rate duration calculation, reported as UBSAN: array-index-out-of-bounds in net/mac80211/airtime.c. The index 15 is out of range for type 'u16 [12]'. A...

CVE-2022-49175

CVE-2022-49175 (Linux kernel) : The vulnerability arises in core PM code where device_pm_check_callbacks() may run under a spinlock and currently uses spin_lock_irq()/spin_unlock_irq(), which can fail to preserve CPU flags. The fix replaces these with irqsave/irqrestore to preserve flags and avoi...

CVE-2022-49539

CVE-2022-49539 concerns the Linux kernel driver rtw89 where CAM leaks (address CAM and bssid CAM) can occur during SER L2 reset and ieee80211_restart_hw(). The fix releases CAM regardless of security state during L2 reset and, if AP mode, releases address CAM of all stations before restart. Conne...

CVE-2022-49739

The CVE-2022-49739 issue concerns the GFS2 subsystem in the Linux kernel where the inode size of stuffed (inline) inodes was not consistently validated when reading inodes from disk. The fix enforces that the inode size of inline inodes is within the allowed range (gfs2_dinode_in()), preventing o...

CVE-2023-38431

The CVE-2023-38431 issue affects the Linux kernel ksmbd (fs/smb/server/connection.c) prior to 6.3.8, where NetBIOS header length is not validated against SMB header sizes, via pdu_size in ksmbd_conn_handler_loop, causing an out-of-bounds read. Remediation: upgrade to kernel 6.3.8 or later (per Ch...