CVE-2024-43858

CVE-2024-43858 : In the Linux kernel, the JFS filesystem has a fix for an array-index-out-of-bounds in diFree. The IBM bulletin lists this CVE among multiple kernel issues and does not provide a specific remediation version in the supplied documents. Technical detail: the issue is an array-index-...

CVE-2024-46854

CVE-2024-46854 – Linux kernel net: dpaa padding has been fixed. When sending small packets (

CVE-2022-49839

CVE-2022-49839 : In the Linux kernel, the scsi_transport_sas path sas_phy_add() could crash if transport_add_device() failed, since error handling did not account for a NULL device during transport_remove_device() invoked from sas_remove_host(). The issue is mitigated by the upstream fix to check...

CVE-2023-38431

The CVE-2023-38431 issue affects the Linux kernel ksmbd (fs/smb/server/connection.c) prior to 6.3.8, where NetBIOS header length is not validated against SMB header sizes, via pdu_size in ksmbd_conn_handler_loop, causing an out-of-bounds read. Remediation: upgrade to kernel 6.3.8 or later (per Ch...

CVE-2023-52629

The Linux kernel is vulnerable to a use-after-free bug in the sh: push-switch component due to incorrect ordering of cleanup operations in switch_drv_remove() . Specifically, the original code placed flush_work() before timer_shutdown_sync() , allowing a worker to be rescheduled in switch_timer()...

CVE-2023-52740

The CVE-2023-52740 issue affects the Linux kernel on powerpc64s where a race occurs during interrupt exit with security mitigations (RFI/STF). The root cause is that the interrupt_exit_not_reentrant condition can be flipped concurrently with the interrupt exit tests that set MSR[EE|RI], and then ...

CVE-2023-52766

CVE-2023-52766 : In the Linux kernel, the i3c mipi-i3c-hci component suffers an out-of-bounds access in hci_dma_irq_handler when looping over rings->headers[i] beyond the number of allocated headers. The fix prevents iterating over non-allocated ring headers in hci_dma_init(), stopping the out...

CVE-2023-52846

The CVE-2023-52846 entry concerns a Linux kernel use-after-free in hsr's prp_create_tagged_frame, where prp_fill_rct() may fail and free the skb while the successful path returns the original skb. Impact is described as high for confidentiality, integrity, and availability with local access prere...

CVE-2023-52975

CVE-2023-52975 affects the Linux kernel SCSI/iscsi_tcp component. A use-after-free (UAF) can occur during iSCSI session logout if another task accesses the shost ipaddress attribute, triggering KASAN reports. The issue has concrete fixes in the Linux kernel (e.g., commits in the referenced reposi...

CVE-2023-53013

The CVE-2023-53013 issue in the Linux kernel relates to the ptdma driver: pt_core_irq_handler() could call pt_core_execute_cmd() from interrupt context, where acquiring a mutex is invalid and could cause a kernel panic. The fix replaces the mutex with a spinlock, addressing the interrupt-context ...

CVE-2024-26893

CVE-2024-26893 affects the Linux kernel ARM SCMI SMC transport cleanup path. The vulnerability is caused by a double-free in the chan_free cleanup of a shared transport_info member, which can dereference a NULL pointer on the second cleanup attempt, leading to a kernel crash (OOPs). The issue occ...

CVE-2024-35826

CVE-2024-35826 — Linux kernel: fix page refcounts for unaligned buffers in __bio_release_pages(). This patch corrects the number of pages released for buffers that do not start at the beginning of a page, addressing a vulnerability in block I/O handling. Impact, as described in the FP: local acce...

CVE-2024-35895

The CVE-2024-35895 vulnerability affects the Linux kernel, specifically the BPF sockmap/sockhash path. A deadlock could occur when map_delete_elem is invoked from a context where interrupts are disabled; the fix adds a hardirq-safety check to bail out if map_delete_elem runs in a non-hardirq-unsa...

CVE-2024-38586

CVE-2024-38586 : Linux kernel r8169/RTL8125b transmit path issue leading to possible ring-buffer corruption when transmitting small fragmented packets. Root cause: rtl8169_start_xmit() failed to detect changes to nr_frags after padding in rtl8169_tso_csum_v2(), causing invalid entries in the tran...

CVE-2024-40983

The CVE-2024-40983 entry affects the Linux kernel TIPc path. Root cause: crypto requests may complete asynchronously and exit the rcu region, risking use-after-free of the skb destination during xfrm input/output handling. The fix is to force a destination dst reference before entering TIPC decry...

CVE-2024-41059

CVE-2024-41059 (Linux kernel) : A KMSAN-uninitialized value occurred in hfsplus when copying names during extended attributes operations (copy_name in fs/hfsplus/xattr.c). The issue traces to uninitialized memory used during sized_strscpy, leading to a potential information leak or instability wi...

CVE-2024-41098

CVE-2024-41098 is a Linux kernel vulnerability in the libata-core path. The issue arises when ata_port_alloc() fails during ata_host_alloc(); ata_host_release() then frees ata_port struct members unconditionally, which can cause a NULL pointer dereference (BUG: page fault). The provided trace sho...

CVE-2024-42102

CVE-2024-42102 concerns a Linux kernel vulnerability in the dirty throttling path used by the mm/wb subsystem. The issue centers on assuming that dirty limits in page units fit in 32 bits and a patch series titled “mm: Avoid possible overflows in dirty throttling” was applied. The entry notes tha...

CVE-2024-42134

CVE-2024-42134 : In the Linux kernel, virtio-pci may dereference vp_dev->is_avq when determining admin virtqueues in vp_del_vqs, since vp_dev->is_avq can be empty on some installations (virtio_pci_legacy). The bug could crash guests; the fix is to validate vp_dev->is_avq before use. Conn...

CVE-2024-44974

CVE-2024-44974 affects the Linux kernel, describing a Use-After-Free risk in MPTCP path management when selecting end-points. The description specifies that select_local_address() and select_signal_address() return a reference to an endpoint read outside an RCU-protected window, risking UaF after...

CVE-2024-46686

CVE-2024-46686 (Linux kernel) : The vulnerability lies in the SMBv2 read path where smb2_new_read_req() can dereference rdata=NULL when SMB2_read() is used with RDMA and the rdma_readwrite_threshold is reached. This affects the Linux kernel smb client code and is triggered from the SMB2_read() fl...

CVE-2024-46763

CVE-2024-46763 is a Linux kernel vulnerability related to a NULL pointer dereference in Fou GRO handling. The issue occurs in fou_gro_receive() where a socket’s sk_user_data could be NULL during in-flight udp4_gro_receive() after fou_release() clears sk_user_data during netns teardown, leading to...

CVE-2024-46765

CVE-2024-46765 affects the Linux kernel ice driver XDP configuration, where ice_xdp() and PF reset race on shared resources (ice_vsi_close/ice_prepare_for_reset, ice_vsi_rebuild, ice_vsi_open). The fix adds a mutex (xdp_state_lock) to protect ice_vsi_rebuild() and ice_xdp(), and introduces ICE_VS...

CVE-2024-49913

CVE-2024-49913 affects the Linux kernel’s DRM AMD display path. The issue was a potential NULL pointer dereference in commit_planes_for_stream when top_pipe_to_program could be NULL, leading to dereferencing stream_res. The fix adds a null check before accessing top_pipe_to_program to prevent the...

CVE-2024-49957

CVE-2024-49957 is a Linux kernel vulnerability tied to ocfs2/journal handling. When mounting, if journal_reset() fails due to a too-short journal, jbd2_journal_load() may leave journal->j_sb_buffer NULL, triggering a NULL pointer dereference through ocfs2_journal_shutdown() -> jbd2_journal_...

CVE-2024-50166

CVE-2024-50166 affects the Linux kernel. The issue is a refcount handling bug in fman-related devices (fsl/fman) where multiple references taken in mac_probe() by of_find_device_by_node(), fman_bind(), and fman_port_bind() were not fully released on error paths or removal, causing reference leaks...

CVE-2024-56708

Technical details about affected products/versions are not provided in the documents. The CVE description states a fix for a double free during module unload in edac/igen6, but no vendor/version specifics are included.

CVE-2024-56773

CVE-2024-56773 : In the Linux kernel, a potential NULL pointer dereference could occur in kunit_device_driver_test() when kunit_kzalloc() returns NULL and is dereferenced without a NULL check. The patch adds a NULL check for test_state to mitigate this. The CVE details, including its impact and e...

CVE-2024-57981

CVE-2024-57981 affects the Linux kernel USB xHCI code. When a command is queued to the final usable TRB and later aborted, the abort path could dereference a NULL cur_cmd, crashing due to a timer-setup path. The fix prevents timer setup if cur_cmd is NULL, and keeps the doorbell sequence safe. Af...

CVE-2024-58085

CVE-2024-58085 relates to the Linux kernel Tomoyo security module, specifically a warning emission in tomoyo_write_control(). The description notes a syzbot report about a “too large allocation” warning when a long single line is written without a newline. The fix changes memory allocation behavi...

CVE-2024-58098

CVE-2024-58098 is a Linux kernel vulnerability related to the BPF verifier and the handling of the changes_pkt_data property for global sub-programs. The provided documents describe that calls to certain helpers can cause the verifier to invalidate packet pointers, and that previously global sub-...

CVE-2025-21816

CVE-2025-21816 affects the Linux kernel hrtimers subsystem. The issue arises when hrtimers queued on an offline CPU can wake up and arm the deadline timer after CPU hotplug stage CPUHP_AP_HRTIMERS_DYING, potentially impacting bandwidth timer handling (notably RCU-related wakeups). The documented ...

CVE-2025-21883

CVE-2025-21883 affects the Linux kernel ice driver. The issue occurs when ice_ena_vfs() fails after ice_create_vf_entries(), causing VFs to be freed without removing them from the snapshot PF-VF mailbox list, leading to list corruption (possible kernel BUG in lib/list_debug.c and related traces)....

CVE-2025-21885

Technical details (affected product, vulnerable component, root cause, exploitability) are not publicly provided in the supplied documents. Monitor for updates from vendor advisories and security feeds.

CVE-2025-23161

CVE-2025-23161 : In the Linux kernel, the PCI vmd driver fixed a lock context issue by changing vmd_dev::cfg_lock from spinlock_t to raw_spinlock_t so it can be used with interrupts disabled in PREEMPT_RT contexts. This avoids a sleeping-lock scenario when accessing PCI config space via pci_ops r...

CVE-2025-37860

CVE-2025-37860 : Linux kernel sfc/ef100 design-param NULL dereferences fixed by reordering initialization. The vulnerable path allowed ef100_probe_main() and ef100_check_design_params() to run before efx->net_dev was created, enabling NULL dereferences when calling netif_set_tso_max_size() or ...

CVE-2025-37875

CVE-25-37875 concerns the Linux kernel igc/PTM logic. The issue arose from writing to clear the PTM status 'valid' bit while a PTM cycle was in progress, causing unreliablePTM operation. The fix disables PTM trigger most of the time and limits triggering to very brief windows (roughly 10–100 μs) ...

CVE-2025-40325

CVE-2025-40325 – Linux kernel raid10 discard handling Issue: In md/raid10, a discard BIO with REQ_NOWAIT could be returned without waiting for a barrier, potentially leaving the system with an inconsistent discard handling path. The fix enforces waiting for the barrier before returning such a dis...

CVE-2026-53224

The vulnerability CVE-2026-53224 affects the Linux kernel SCTP implementation. The issue arises from insufficient validation of embedded INIT chunks and address list lengths in cookies: sctp_unpack_cookie() may accept a truncated INIT chunk, and the subsequent sctp_process_init() could read INIT ...

CVE-2010-4655

CVE-2010-4655 affects the Linux kernel’s net/core/ethtool.c, where uninitialized data structures in ethtool ioctl handling could allow a local user with CAP_NET_ADMIN to leak information from kernel heap memory. The initial description specifies the vulnerability exists in kernel builds before 2....

CVE-2015-2041

CVE-2015-2041 affects Unity Linux kernels (20.1050e/20.1060e/20.1070e) where the Linux kernel before 3.19 contains an error in net/llc/sysctl_net_llc.c using an incorrect data type in a sysctl table. This local information-disclosure flaw allows an unprivileged local user to read potentially sens...

CVE-2016-4805

CVE-2016-4805 describes a use-after-free in the Linux kernel’s drivers/net/ppp/ppp_generic.c before 4.5.2. The flaw allows local attackers to trigger memory corruption and potential DoS (system crash) by removing a network namespace, related to ppp_register_net_channel and ppp_unregister_channel....

CVE-2017-15537

The CVE-2017-15537 issue affects the x86 FPU state handling in the Linux kernel prior to 4.13.5. If a CPU supports xsave but not xsaves, ptrace() or rt_sigreturn() mishandles reserved xstate header bits, enabling local users to read other processes’ FPU registers. A fix is provided in Linux kerne...

CVE-2017-16649

CVE-2017-16649 affects the Linux kernel up to version 4.13.11. The vulnerable code is usbnet_generic_cdc_bind in drivers/net/usb/cdc_ether.c. Exploitation requires local access and a crafted USB device, which can trigger a divide-by-zero error and system crash, with possible other impact. The con...

CVE-2017-16914

The vulnerability CVE-2017-16914 affects the Linux kernel’s USB/IP path: the stub_send_ret_submit() function in drivers/usb/usbip/stub_tx.c is vulnerable in kernel versions before 4.14.8, 4.9.71, 4.1.49, and 4.4.107. A specially crafted USB over IP packet can trigger a NULL pointer dereference, l...

CVE-2017-8925

Technical details beyond the description are not provided in the supplied documents. The provided materials confirm CVE-2017-8925 affects the Linux kernel omninet_open and describes a local denial of service due to reference-count mishandling; no further specifics are available here. Monitor for ...

CVE-2022-49049

CVE-2022-49049 concerns the Linux kernel mm/secretmem path (memfd_secret) where growing a secret memfd via ftruncate could trigger a kernel panic when zeroing pages during truncation. The issue arises because memfd_secret pages are not mapped via the direct map, so page_address() results could be...

CVE-2022-49107

CVE-2022-49107 affects the Linux kernel in the ceph subsystem. The issue is a memory leak in ceph_readdir when note_last_dentry returns an error. The fix resets last_readdir at the same time and adds a comment explaining why last_readdir isn’t freed when dir_emit returns false. Public references ...

CVE-2022-49215

CVE-2022-49215 : In the Linux kernel, a race in xsk socket teardown can cause a NULL pointer dereference. The bug happens because xs->dev is NULL’ed before all users finish using the socket, and synchronize_net() does not wait for in-flight data-plane operations (xsk_poll, xsk_sendmsg, xsk_rec...

CVE-2022-49574

CVE-2022-49574 is a Linux kernel security issue involving a data race in reading the sysctl_tcp_recovery variable within the TCP stack. The root cause is concurrent modification of sysctl_tcp_recovery while it is being read, which could lead to inconsistent reads or memory corruption. The descrip...