CVE-2016-9084

The CVE-2016-9084 entry concerns Linux kernel Vfio PCI: vfio_pci_intrs.c misuses kzalloc, enabling a local attacker with access to a vfio PCI device file to trigger an integer overflow and cause a denial of service or other impact. Connected sources (e.g., Mageia advisories MGASA-2017-0147/0148 a...

CVE-2017-0561

CVE-2017-0561 is a Broadcom Wi‑Fi firmware flaw in Android that affects Broadcom Wi‑Fi devices and enables remote code execution in the Wi‑Fi SoC via the TDLS implementation. Debian LTS advisory and Mageia/Chrome advisories summarize the issue as a Broadcom TDLS flaw that could let an attacker on...

CVE-2017-6348

CVE-2017-6348 affects the Linux kernel: the hashbin_delete function in net/irda/irqueue.c improperly handles lock dropping, enabling a local user to trigger a denial of service through crafted IrDA device operations. The issue exists in kernels before 4.9.13 and is fixed by upgrading to 4.9.13 or...

CVE-2017-7261

CVE-2017-7261 affects the Linux kernel driver vmwgfx. The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c does not check for a zero value of certain levels data, allowing a local user to cause a denial of service (ZERO_SIZE_PTR dereference, GP fault, and potentially a...

CVE-2018-1091

The CVE-2018-1091 entry is supported by connected advisories describing Linux kernel vulnerability on POWERPC: In arch/powerpc/kernel/ptrace.c, the function flush_tmregs_to_thread before 4.13.5 can crash a guest kernel when a core dump occurs, due to a missing processor feature check and an erron...

CVE-2019-11683

CVE-2019-11683 affects the Linux kernel 5.x prior to 5.0.13, caused by mishandling of padded UDP packets in udp_gro_receive_segment (net/ipv4/udp_offload.c). This can enable a remote attacker to cause a denial of service (slab-out-of-bounds memory corruption) and potentially other impact via UDP ...

CVE-2019-19252

CVE-2019-19252 affects the Linux kernel (drivers/tty/vt/vc_screen.c) where vcs_write does not prevent write access to vcsu devices up to and including version 5.3.13. This yields a local access vulnerability with partial confidentiality/integity/availability impacts as described in the CVE and ec...

CVE-2019-25044

The CVE-2019-25044 issue affects the Linux kernel before 5.2, specifically the block subsystem. A use-after-free in the blk_mq_free_rqs/blk_cleanup_queue path can lead to arbitrary code execution in kernel context and local privilege escalation. Affected component: block subsystem of the Linux ke...

CVE-2021-47171

CVE-2021-47171 corresponds to a memory-leak fix in the Linux kernel’s USB SMSC75xx driver (net/usb/smsc75xx.c). The vulnerability arises when errors after memory allocation leave non-freed memory in smsc75xx_bind, causing a memory leak in the kernel upon probe/bind. The MiracleLinux advisories co...

CVE-2022-3543

CVE-2022-3543 affects the Linux kernel BPF component: the memory leak occurs in the unix_sock_destructor/unix_release_sock paths in net/unix/af_unix.c. The issue is localized to the BPF code handling UNIX sockets, and the vulnerability can lead to memory consumption/leaf exhaustion. A patch is av...

CVE-2022-47939

CVE-2022-47939 affects ksmbd in Linux kernel 5.15–5.19 (before 5.19.2). The issue is a use-after-free in fs/ksmbd/smb2pdu.c that can trigger an OOPS when handling SMB2_TREE_DISCONNECT. A fix was released with Linux kernel 5.19.2 (and later). Affected distributions referenced in Connected sources ...

CVE-2022-48760

The CVE-2022-48760 entry concerns a Linux kernel USB subsystem hang in usb_kill_urb() caused by memory-access ordering issues (SB pattern) between usb_kill_urb() and __usb_hcd_giveback_urb() on SMP systems. The vulnerability is fixed by adding memory barriers, specifically using the smp_mb__after...

CVE-2022-48883

CVE-2022-48883 (Linux kernel) affects net/mlx5e IPoIB: Block PKEY interfaces and occurs when a user configures more rx queues for an interface than the parent supports. The child interface reuses the parent’s receive channels, so the rx-queue count must be large enough to avoid out-of-bounds acce...

CVE-2022-49081

Summary (CVE-2022-49081) : Linux kernel vulnerability in highmem handling (__kmap_local_sched_in/out). When CONFIG_DEBUG_KMAP_LOCAL is enabled, checks on tsk->kmap_ctrl.pteval could misinterpret zeroed slots as unmapped, triggering runtime warnings. The root cause is comparing to pte_none for ...

CVE-2022-49136

CVE-2022-49136 (Linux kernel) fixes a Bluetooth HCI QUEUE issue: hci_cmd_sync_queue must return an error if HCI_UNREGISTER is set to avoid use-after-free when hci_unregister_dev frees the HCI device. The connected advisories (MiracleLinux, AlmaLinux, Oracle Linux RHSA/ELSA, etc.) reference the fi...

CVE-2022-49175

CVE-2022-49175 (Linux kernel) : The vulnerability arises in core PM code where device_pm_check_callbacks() may run under a spinlock and currently uses spin_lock_irq()/spin_unlock_irq(), which can fail to preserve CPU flags. The fix replaces these with irqsave/irqrestore to preserve flags and avoi...

CVE-2022-49305

CVE-2022-49305 affects the Linux kernel driver path drivers/staging/rtl8192u where a deadlock in ieee80211_beacons_stop() could occur. The root cause is a lock-order interaction: del_timer_sync() waited while holding ieee->beacon_lock in ieee80211_beacons_stop(), but the timer handler also nee...

CVE-2022-49513

The CVE-2022-49513 issue is in the Linux kernel cpufreq governor: a dbs_data structure embeds a kobject, which requires a release() method. The fix introduces cpufreq_dbs_data_release() to free the dbs_data via kobject::release() instead of direct kfree(), addressing a call trace involving delaye...

CVE-2022-49573

The CVE-2022-49573 entry refers to a Linux kernel data race in the reader of sysctl_tcp_early_retrans. The vulnerability arises when reading sysctl_tcp_early_retrans, which could be modified concurrently. The fix was to add READ_ONCE() to the reader, mitigating the data race. Connected advisories...

CVE-2022-49601

CVE-2022-49601 is a Linux kernel vulnerability where a data race occurs in the tcp/dccp path around reading the sysctl_fwmark_accept value. The root cause is concurrent modification of the reader while sysctl_tcp_fwmark_accept is being read, leading to potential inconsistency. The documented fix ...

CVE-2022-49659

CVE-2022-49659 : In the Linux kernel, the m_can RX path for peripheral CAN frames (read_fifo/echo_tx_event) was fixed by extending the core timestamps from 16 to 32 bits before passing to RX-offload. The patch in commit 1be37d3b0414 shifts 16-bit timestamps to full 32-bit to prevent overflow issu...

CVE-2022-49695

The CVE-2022-49695 entry affects the Linux kernel igb driver (igb_clean_tx_ring) and is a use-after-free bug triggered when the NIC is in XDP mode. The issue can occur when traffic is redirected to the igb NIC and the device is closed while traffic is flowing. It has been fixed in the kernel (see...

CVE-2022-49710

CVE-2022-49710 affects the Linux kernel's device-mapper dm-log path (dm-mirror) where rounding bitset_size to 32 bits causes an out-of-bounds access on 64-bit architectures when find_next_zero_bit_le reads the bitmap. The root cause is using unsigned long pointers for the bitmap, allowing a 4-byt...

CVE-2022-49853

The CVE-2022-49853 entry documents a Linux kernel macvlan memory-leak in macvlan_common_newlink when macvlan mode is set to source. If register_netdevice() errors during macvlan_changelink_sources(), the resources created by macvlan_changelink_sources() are not cleaned up, leading to a memory lea...

CVE-2023-0122

CVE-2023-0122 : A NULL pointer dereference in the Linux kernel NVMe subsystem (nvmet_setup_auth()) allows a Pre-Auth Denial of Service to be launched remotely over the network. Affected versions are v6.0-rc1 through v6.0-rc3; the issue is fixed in v6.0-rc4. Root cause and impact are described in ...

CVE-2023-52589

The CVE 2023-52589 entry concerns the Linux kernel media rkisp1 driver. The issue is a race in IRQ disable logic within rkisp1_isp_stop() and rkisp1_csi_disable(): interrupts are masked and the code assumes the IRQ handler isn’t running, but the handler can still be active when the stop sequence ...

CVE-2023-52764

CVE-2023-52764 affects the Linux kernel media driver gspca cpia1 (drivers/media/usb/gspca/cpia1.c) with a shift-out-of-bounds in set_flicker triggered when sd->params.exposure.gain grows beyond int bit-width. The issue stems from attempting a left-shift that exceeds the size of an int, causing...

CVE-2024-24861

CVE-2024-24861 affects the Linux kernel xc4000 media driver (xc4000_get_frequency) with a race condition that can cause a return-value overflow, potentially leading to malfunction or denial of service. Data from multiple sources confirms the issue originates in the xc4000 driver and is tied to Li...

CVE-2024-26791

CVE-2024-26791 — Linux kernel: btrfs dev-replace: properly validate device names. A syzbot report indicated device name buffers passed to device replace could read beyond end (getname_kernel) due to insufficient termination checks. The fix adds a helper that validates both source and target devic...

CVE-2024-26805

CVE-2024-26805 (Linux kernel) fixed a kernel-infoleak-after-free in netlink path. The issue occurred in __skb_datagram_iter via netlink_to_full_skb, where len was computed from skb->end (buffer offset) instead of skb->len (actual data length), causing uninit memory to be copied. The patch c...

CVE-2024-27394

CVE-2024-27394 affects the Linux kernel, in the tcp_ao_connect_init path. The vulnerability arises because call_rcu is used during hlist_for_each_entry_rcu traversal outside the RCU read critical section, allowing the RCU grace period to pass while the key may still be referenced, creating a Use-...

CVE-2024-35895

The CVE-2024-35895 vulnerability affects the Linux kernel, specifically the BPF sockmap/sockhash path. A deadlock could occur when map_delete_elem is invoked from a context where interrupts are disabled; the fix adds a hardirq-safety check to bail out if map_delete_elem runs in a non-hardirq-unsa...

CVE-2024-35943

The CVE-2024-35943 entry pertains to the Linux kernel, specifically a vulnerability in TI-related pmdomain handling where omap_prm_domain_init lacked a null-pointer check after a dynamic allocation. The issue arises because devm_kasprintf() can return NULL on allocation failure, and without verif...

CVE-2024-40922

CVE-2024-40922 affects the Linux kernel io_uring rsrc path: a mutex lock could be held while a task is not TASK_RUNNING due to not restoring state after io_run_task_work_sig(), risking unintended blocking/deadlock in io_rsrc_ref_quiesce() and related calls (io_sqe_buffers_unregister, io_uring/reg...

CVE-2024-41048

CVE-2024-41048: In the Linux kernel, sk_msg_recvmsg now skips processing zero-length skbs (skb->len == 0) to avoid passing a NULL page to page_address() on Loongarch, which previously caused a kernel panic during sockmap_skb_verdict_shutdown. The root cause is a zero-length skb enqueued by shu...

CVE-2024-42141

Technical details for CVE-2024-42141 are not provided in the supplied documents; public exploitability, affected products, and fixes are not specified here. Monitor for updates.

CVE-2024-44986

CVE-2024-44986 affects the Linux kernel IPv6 path. A use-after-free can occur in ip6_finish_output2() if skb_expand_head() returns NULL, potentially freeing skb and its dst/idev; the code must hold rcu_read_lock() to keep dst/idev alive. The provided connected documents confirm a kernel fix in th...

CVE-2024-46679

CVE-2024-46679 (Linux kernel) : A race between sysfs reading of ethtool link settings and device removal can read state when the device is not present, causing a crash. The fix moves a device-presence check into ethtool (and related callers) to ensure link settings are only shown when the device ...

CVE-2024-46731

CVE-2024-46731 : Linux kernel vulnerability in drm/amdgpu/pm where an out-of-bounds read can occur for mc_data[] when i == 0 due to indexing as i-1. The issue has been resolved by a kernel patch. Connected sources confirm the vulnerability and patch context (Out-of-bounds read warning fix in drm/...

CVE-2024-46817

CVE-2024-46817 affects the Linux kernel DRM-AMD/Display component (amdgpu_dm). The issue arises when stream numbers exceed 6, where Coverity detects an OVERRUN and the code path should abort initialization. The reduction in impact is described as a boundary/initialization check failure leading to...

CVE-2024-47695

CVE-2024-47695 affects the Linux kernel RDMA/rtrs-clt component. The bug occurs in init_conns() cleanup: after create_con() and create_cm(), cid can go out of bounds, leading to out-of-bounds memory access when clt_path->s.con_num is used. A patch fixes this by resetting cid to clt_path->s....

CVE-2024-48876

CVE-2024-48876 - Linux kernel : The issue affects stack_depot’s stack_depot_save_flags() when invoked in NMI context. It could deadlock if pool_lock is held during an NMI, so the fix ensures the lock is only taken if space permits and the operation is safe in NMI. The documentation was updated to...

CVE-2024-49861

CVE-2024-49861 affects the Linux kernel: bpf: Fix helper writes to read-only maps. The issue allowed a BPF program to write into a read‑only map (e.g., frozen .rodata) via helpers using ARG_PTR_TO_{LONG,INT}, because meta->raw_mode wasn’t set and check_map_access_type() treated the map as read...

CVE-2024-49923

The CVE-2024-49923 issue is in the Linux kernel’s DRM/AMD display path. Specifically, dcn20_validate_apply_pipe_split_flags could dereference a null pointer; the patch passes a non-null pointer to fix a null-dereference. Impact is limited to availability (HIGH) with local, low-complexity exploita...

CVE-2024-49971

CVE-2024-49971 affects the Linux kernel DRM/AMD display code. The root cause is an out-of-bounds access when dml2_core_shared_mode_support and dml_core_mode_support read the third element of the two-element dummy_boolean array (hw_debug5 = &s->dummy_boolean[2]), causing an OVERRUN. The fix inc...

CVE-2024-50109

In the Linux kernel, the md/raid10 subsystem is affected by a null pointer dereference in raid10_size(). The root cause is that in raid10_run(), when raid10_set_queue_limits() succeeds, the function’s return value is overwritten to zero; if subsequent steps fail, raid10_run() may return zero whil...

CVE-2024-50229

CVE-2024-50229 affects nilfs2 in the Linux kernel. Symlink creation can trigger memory reclamation causing circular lock dependencies among nilfs-related semaphores and fs locks, potentially leading to a deadlock if nilfs_evict_inode() or nilfs_dirty_inode() run while ns_segctor_sem is held. The ...

CVE-2024-53187

CVE-2024-53187 affects the Linux kernel io_uring subsystem (io_pin_pages in io_uring/memmap.c). The issue arises from overflow/garbage uaddr handling when deriving size, enabling local attackers to trigger a fault; CVSSv3.1 metrics shown include Local attack, Low complexity, Low privileges, with ...

CVE-2024-56581

CVE-2024-56581 affects the Linux kernel’s Btrfs code. The issue is a use-after-free in btrfs_ref_tree_mod() after inserting a new ref entry into a block entry’s rb-tree when an unexpected action (BTRFS_DROP_DELAYED_REF) is encountered. The error path freed the ref entry without removing it from t...

CVE-2024-56648

Overview: CVE-2024-56648 is a Linux kernel vulnerability in the HSR net path that is resolved by extending bounds checking in fill_frame_info(). Affected component: Linux kernel, net/hsr/hsr_forward.c (function fill_frame_info). Root cause: fill_frame_info() depended on skb->mac_len without ha...