CVE-2023-52835

CVE-2023-52835 affects the Linux kernel perf subsystem. The root issue is that a large AUX area (e.g., 4 GB) can cause rb_alloc_aux and related allocations to hit bounds and mmap failure, triggering a WARN and an ENOMEM during perf-record. The fix is to bail out early if the requested AUX area is...

CVE-2024-26763

CVE-2024-26763 is a Linux kernel vulnerability in dm-crypt related to authenticated encryption. The issue arises when data is modified during encryption, which could produce an invalid tag. The fix copies the data into a clone bio and encrypts there, avoiding in-place modification and potential d...

CVE-2024-35811

In Astra Linux advisories, the brcm80211 component of the Linux kernel (brcmfmac) is affected by a use-after-free in brcmf_cfg80211_detach when a USB disconnect occurs (hotplug). The vulnerability stems from the cfg80211 detach path where a timer and its worker may still run after cfg is freed (c...

CVE-2024-38597

CVE-2024-38597 affects the Linux kernel's Ethernet sungem driver. The vulnerability stems from gem_poll_controller() disabling interrupts and potentially sleeping, causing netpoll-related deadlocks when used with netpoll. The root cause is execution flow around .ndo_poll_controller, which netpoll...

CVE-2024-39484

CVE-2024-39484 - Linux kernel mmc: davinci driver: the remove callback was discarded when built-in and __exit was used, causing resource leaks on unbind/reset. The fix compiles the remove callback unconditionally so it is always executed during driver removal. Connected sources confirm the issue ...

CVE-2024-40910

CVE-2024-40910: Linux kernel ax25 refcount imbalance fixed. The inbound path did not call netdev_hold() before accepting connections, causing refcount underflow on release and potential kernel panic. The patch adds netdev_hold() / ax25_dev_hold() during ax25_accept() so the refcount logic matches...

CVE-2024-40953

CVE-2024-40953: In the Linux kernel KVM path, a data race on last_boosted_vcpu in kvm_vcpu_on_spin() was fixed. The underlying issue allowed non-atomic loads/stores of kvm->last_boosted_vcpu, potentially causing an out-of-bounds vCPU access with very large vCPU counts (e.g., 257). The patch in...

CVE-2024-42141

Technical details for CVE-2024-42141 are not provided in the supplied documents; public exploitability, affected products, and fixes are not specified here. Monitor for updates.

CVE-2024-44939

The CVE-2024-44939 entry describes a Linux kernel vulnerability in the JFS filesystem (dtInsertEntry in fs/jfs/jfs_dtree.c). The issue arises when a pointer h equals p; after UniStrncpy_to_le writes the name, p->header.flag is cleared, causing the test p->header.flag & BT-LEAF to flip from ...

CVE-2024-49919

CVE-2024-49919 describes a null pointer dereference in the Linux kernel DRM AMD display path. Specifically, in dcn201_acquire_free_pipe_for_layer, the code could assume head_pipe was non-null and perform an assertion when it was null. The fix adds an explicit null check for head_pipe and, if it i...

CVE-2024-50040

CVE-2024-50040 concerns the igb driver in the Linux kernel. The issue stemmed from igb_io_error_detected() treating transient non-fatal PCIe errors as non-fatal, which could lead igb_io_resume() to assume the device was still up and attempt a bring-up, causing a kernel panic during recovery from ...

CVE-2024-50166

CVE-2024-50166 affects the Linux kernel. The issue is a refcount handling bug in fman-related devices (fsl/fman) where multiple references taken in mac_probe() by of_find_device_by_node(), fman_bind(), and fman_port_bind() were not fully released on error paths or removal, causing reference leaks...

CVE-2024-50183

CVE-2024-50183 relates to the Linux kernel lpfc SCSI NPIV cleanup: deleting an NPIV instance must release all fabric ndlps, or a kref imbalance race occurs. The fix forces DA_ID to complete synchronously using a wait_queue, per the description in both the original CVE entry and Astra Linux securi...

CVE-2024-50208

CVE-2024-50208 (Linux kernel) : RDMA/bnxt_re had a bug in setting up Level-2 PBL pages where the code assumed multiple PDE pages; when num_pages > 256K, it could cause memory corruption due to an invalid PDE access. The vulnerability is fixed in the Linux kernel by correcting PDE handling for ...

CVE-2024-56651

CVE-2024-56651 affects the Linux kernel hi311x CAN driver (hi3110_can_ist). The issue is a potential use-after-free: error count data added to the CAN frame after netif_rx() could reference a skb that is freed or reused. Root cause: reporting of rxerr/txerr persisted during non-bus-off operation,...

CVE-2024-58085

CVE-2024-58085 relates to the Linux kernel Tomoyo security module, specifically a warning emission in tomoyo_write_control(). The description notes a syzbot report about a “too large allocation” warning when a long single line is written without a newline. The fix changes memory allocation behavi...

CVE-2025-23144

The CVE-2025-23144 issue affects the Linux kernel backlight subsystem (led_bl/led_sysfs). Root cause: led_sysfs_enable() was not guaranteed to run with the led_access lock held, leading to a lockdep warning during led-backlight removal; the patch enforces holding the led_access lock when calling ...

CVE-2025-37741

CVE-2025-37741 affects the Linux kernel JFS, where a race/locking path can lead to a deadlock in diFree when nlink is incorrectly derived as 0. Root cause: during inode handling for iag creation, a corrupted metapage can cause dinode’s nlink to be copied as 0, triggering diFree and a deadlock seq...

CVE-2025-37750

The CVE-2025-37750 entry concerns a use-after-free in the Linux kernel SMB/CIFS client when multichannel decryption is used. The root cause is that after the commits “smb: client: allocate crypto only for primary server” and “smb: client: fix UAF in async decryption”, channels could concurrently ...

CVE-2025-37840

CVE-2025-37840 concerns the Linux kernel MTD NAND code, specifically brcmnand, where a PM-resume path could trigger a WARN due to an uninitialized nand_operation that checks the chip select. The connected advisories confirm this as a fix: during platform suspend/resume, the code now calls a highe...

CVE-2025-37841

CVE-2025-37841: In the Linux kernel, the vulnerability affects the pm: cpupower: bench path. If malloc returns NULL due to low memory, the config pointer can be NULL, leading to a NULL dereference. The issue has a tracked fix described as adding a NULL check to prevent dereferencing config when m...

CVE-2026-46215

The CVE concerns a race condition in the Linux kernel’s DRM change_handle path. A concurrent gem_close could remove one handle while another remained dangling, enabling a use-after-free. The fix uses the same sequence as gem_close: first replace the old handle with NULL via idr_replace, then, if ...

CVE-2009-0676

The CVE-2009-0676 issue affects the Linux kernel prior to 2.6.28.6, where sock_getsockopt in net/core/sock.c fails to initialize a structure member, enabling local attackers to read potentially sensitive kernel memory via an SO_BSDCOMPAT getsockopt request. Publicly documented in multiple sources...

CVE-2011-1180

The CVE-2011-1180 issue affects the Linux kernel’s IrDA code, specifically the iriap_getvaluebyclass_indication function in net/irda/iriap.c. It describes multiple stack-based buffer overflows caused by unvalidated length fields for names and attributes, allowing remote attackers to trigger memor...

CVE-2013-7263

The CVE-2013-7263 issue affects the Linux kernel before 3.12.4, where certain length values are updated before kernel data structures are initialized, enabling local attackers to read sensitive information from kernel stack memory via recvfrom, recvmmsg, or recvmsg. Connected Nessus entries (Unit...

CVE-2014-2309

CVE-2014-2309 affects the Linux kernel (net/ipv6/route.c, function ip6_route_add) up to version 3.13.6. It causes memory exhaustion via a flood of ICMPv6 Router Advertisement packets, enabling a remote attacker to trigger DoS. The connected Nessus/OpenVAS advisories reference Unity Linux security...

CVE-2015-3212

CVE-2015-3212: Race condition in net/sctp/socket.c in the Linux kernel before 4.1.2 allows local users to cause a denial of service (list corruption and panic) via a rapid series of socket-related system calls (notably setsockopt). Affected component is the SCTP implementation in the kernel; impa...

CVE-2015-4700

The CVE-2015-4700 issue affects the Linux kernel (arch/x86/net/bpf_jit_comp.c) up to version 4.0.5. The bpf_int_jit_compile function can be triggered by crafted BPF instructions to cause a denial-of-service (system crash) via late convergence in the JIT compiler. Affected component is the JIT-com...

CVE-2016-3699

CVE-2016-3699 affects the Linux kernel as used in Red Hat Enterprise Linux 7.2 and Red Hat MRG 2 when booted with UEFI Secure Boot. The issue allows local attackers to bypass Secure Boot restrictions and execute untrusted code by appending ACPI tables to the initrd. The connected documents corrob...

CVE-2017-16532

CVE-2017-16532: A vulnerability in the Linux kernel ≤ 4.13.11 affects the get_endpoints function in drivers/usb/misc/usbtest.c, enabling local users to trigger a denial of service via a crafted USB device, through a NULL pointer dereference and potential system crash. The issue is triggered by a ...

CVE-2017-9605

CVE-2017-9605 affects the Linux kernel (up to and including 4.11.4) via the vmw_gb_surface_define_ioctl path (DRM_IOCTL_VMW_GB_SURFACE_CREATE) in vmwgfx_surface.c. The defect is that backup_handle is defined but not initialized, so when creating a GB surface with a previously allocated DMA buffer...

CVE-2019-19815

CVE-2019-19815 concerns the Linux kernel 5.0.21: mounting a crafted f2fs filesystem image can trigger a NULL pointer dereference in f2fs_recover_fsync_data (fs/f2fs/recovery.c), related to F2FS_P_SB in fs/f2fs/f2fs.h. The available connected documents reproduce this advisory text and confirm the ...

CVE-2021-47063

CVE-2021-47063 concerns the Linux kernel DRM: bridge/panel code. The vulnerability arises because a devm-allocated drm_connector can outlive drm_mode_config_cleanup(), so the connector must be cleaned up when the bridge is detached to avoid use-after-free. The fix adds cleanup in panel_bridge_det...

CVE-2022-48738

CVE-2022-48738 corresponds to a Linux kernel vulnerability in ASoC: ops where snd_soc_put_volsw() could accept values outside the advertised valid range. The issue arises from missing validation of user-space-reported ranges, allowing out-of-range values to be processed. The connected Astra Linux...

CVE-2022-48884

CVE-2022-48884 affects the Linux kernel in the mlx5 driver stack. The root cause is a NULL pointer dereference that can occur when command stats are freed and reallocated during a mlx5 devlink reload, causing a crash if a command is issued while reinitialization is incomplete. The concrete fix im...

CVE-2022-48989

CVE-2022-48989 (fscache) : In the Linux kernel, a race between fscache_cookie usage and cookie_lru/discard caused a NULL pointer dereference when a cookie was withdrawn while another thread used it. Root cause: the cookie state machine could transition to LRU_DISCARD after another thread started ...

CVE-2022-49130

In CVE-2022-49130, the Linux kernel ath11k subsystem was fixed by replacing mhi_async_power_up() with mhi_sync_power_up() in the MHI path. The crash occurred when amss.bin was missing and ath11k_pci was removed, since the async variant did not check errors. The sync variant adds error checking an...

CVE-2022-49160

CVE-2022-49160 affects the Linux kernel driver scsi: qla2xxx. Root cause: during purex packet handling, a pre-allocated structure was freed incorrectly; the fix skips freeing that entry. Impact: system crashes during module load/unload tests (as shown by the stack traces: sbitmap_init_node, blk_m...

CVE-2022-49223

The CVE-2022-49223 issue affects the Linux kernel, in the cxl/port path within cxl_core. The root cause is a use-after-free risk in cxl_decoder_release() when it dereferences its parent cxl_port to return an ID to port->decoder_ida, highlighting that the device core only guarantees parent life...

CVE-2022-49395

CVE-2022-49395 concerns the Linux kernel, where an out-of-bounds read occurs in LDT setup due to syscall_stub_data() treating data_count as bytes instead of longs. This yields a 128-byte read on the stack (local to swapper/1) and is triggered during LDT entry initialization. Public advisories fro...

CVE-2023-52509

CVE-2023-52509 affects the Linux kernel ravb driver. The vulnerability arises when ravb_stop() does not cancel pending ravb_tx_timeout_work(), allowing ravb_tx_timeout_work() to access freed priv after ravb_remove() and unregister_netdev(), potentially using freed resources. The root cause is use...

CVE-2023-52680

CVE-2023-52680 concerns the Linux kernel ALSA scarlett2 driver. The vulnerability arises because the ctl_get() functions that call scarlett2_update () did not check the return value, potentially causing unhandled errors to propagate to the caller. The description states this was fixed by adding p...

CVE-2023-53002

CVE-2023-53002 concerns the Linux kernel DRM/I915 memory leak when mmap_offset is reused. The root cause is that drm_vma_node_allow() and drm_vma_node_revoke() were not called in balanced pairs: allow is invoked once per-file per mmap_offset, while revoke was only called per-file per mmap_offset,...

CVE-2023-53013

The CVE-2023-53013 issue in the Linux kernel relates to the ptdma driver: pt_core_irq_handler() could call pt_core_execute_cmd() from interrupt context, where acquiring a mutex is invalid and could cause a kernel panic. The fix replaces the mutex with a spinlock, addressing the interrupt-context ...

CVE-2024-26635

CVE-2024-26635 affects the Linux kernel LLС path. The issue arises from legacy support for ETH_P_TR_802_2 in 802.2 LLC handling, where llc_conn_handler/llc_pdu_decode paths initialized saddr/daddr.mac only for ETH_P_802_2, causing reads of garbage in other protocols (e.g., ETH_P_TR_802_2). The bu...

CVE-2024-26703

CVE-2024-26703 affects the Linux kernel tracing/timerlat: the hrtimer was previously initialized at first timerlat_fd read and destroyed on close, which could trigger a NULL pointer dereference if a user opens and closes timerlat_fd without reading. A fix was implemented to move hrtimer_init to t...

CVE-2024-26893

CVE-2024-26893 affects the Linux kernel ARM SCMI SMC transport cleanup path. The vulnerability is caused by a double-free in the chan_free cleanup of a shared transport_info member, which can dereference a NULL pointer on the second cleanup attempt, leading to a kernel crash (OOPs). The issue occ...

CVE-2024-35895

The CVE-2024-35895 vulnerability affects the Linux kernel, specifically the BPF sockmap/sockhash path. A deadlock could occur when map_delete_elem is invoked from a context where interrupts are disabled; the fix adds a hardirq-safety check to bail out if map_delete_elem runs in a non-hardirq-unsa...

CVE-2024-36903

CVE-2024-36903 is a Linux kernel vulnerability related to potential uninitialized value access in IPv6 processing. The cited fix targets __ip6_make_skb() in the IPv6 path by mirroring the IPv4 correction: it now validates FLOWI_FLAG_KNOWN_NH on fl6->flowi6_flags instead of testing HDRINCL on t...

CVE-2024-38586

CVE-2024-38586 : Linux kernel r8169/RTL8125b transmit path issue leading to possible ring-buffer corruption when transmitting small fragmented packets. Root cause: rtl8169_start_xmit() failed to detect changes to nr_frags after padding in rtl8169_tso_csum_v2(), causing invalid entries in the tran...