CVE-2025-37865

CVE-2025-37865 affects Linux kernel net: dsa mv88e6xxx code. The bug arises when deleting VLANs on devices where MST is unsupported: mv88e6xxx_port_vlan_leave() calls mv88e6xxx_mst_put() which looks up an MST entry by sid. If the vtu/vlan population path fails to populate vlan.sid, a stale or zer...

CVE-2023-52593

CVE-2023-52593 concerns a potential NULL pointer dereference in the Linux kernel’s wifi driver wfx. The issue arises because ieee80211_beacon_get() can return NULL, and wfx_set_mfp_ap() did not validate this before inspecting skb data. The fix converts wfx_set_mfp_ap() to return an error code whe...

CVE-2023-52877

CVE-2023-52877 is a Linux kernel vulnerability in usb typec tcpm where a NULL pointer dereference could occur if port->partner is an ERR_PTR. The patch adds a NULL check in tcpm_pd_data_request to avoid dereferencing a NULL pointer when registering a partner. Connected advisories (MiracleLinux...

CVE-2023-53056

CVE-2023-53056 affects the Linux kernel and concerns the SCSI qla2xxx driver where IOCB counts were out of order. This could block commands, leading to a system hang with a NULL pointer dereference trace. The issue is resolved by synchronizing the IOCB count to the correct order. The provided sou...

CVE-2024-26737

CVE-2024-26737 is a Linux kernel vulnerability resolved by a patch that fixes a race between bpf_timer_cancel_and_free and bpf_timer_cancel, which could cause a use-after-free (UAF) of timer structures. The fix frees timer->timer after an RCU grace period (RCU head added to struct bpf_hrtimer)...

CVE-2024-36014

CVE-2024-36014 affects the Linux kernel DRM Mali DP path (drm/arm/malidp). In malidp_mw_connector_reset, memory is allocated with kzalloc but the NULL return is not checked, risking a null pointer dereference when calling __drm_atomic_helper_connector_reset. The issue is addressed in the referenc...

CVE-2024-38543

CVE-2024-38543 : In the Linux kernel, a vulnerability in lib/test_hmm.c arose from allocation failures for src_pfns/dst_pfns. If kcalloc() returns NULL, dereferencing these pointers could trigger a null pointer dereference, especially as the device could be evicted. Remediation implemented: add a...

CVE-2024-38583

CVE-2024-38583 affects the Linux kernel nilfs2 log writer. A use-after-free of the sc_timer used to wake a sleeping log writer thread was observed, since the timer was not shut down until the nilfs_sc_info structure’s lifetime ended. The fix limits timer usage to when the log writer thread is ali...

CVE-2024-39496

CVE-2024-39496 affects the Linux kernel, specifically the btrfs: zoned code path. The issue is a use-after-free caused by a race between loading a zone’s info during block group creation and an ongoing device replacement; if the device being loaded is the source of the replacement, the device can...

CVE-2024-41070

The CVE-2024-41070 issue is a use-after-free in KVM on PPC Book3S HV. The code path kvm_spapr_tce_attach_iommu_group() reads stt from tablefd, then fdputs the fd and uses stt after the fd is released, allowing a race that frees stt via release_spapr_tce_table() (RCU) and can lead to UAF even with...

CVE-2024-41084

CVE-2024-41084 – Linux kernel (CXL region lookup) : The issue stems from cxl_dpa_to_region() incorrectly assuming a mapped DPA endpoint is a fully assembled region. If not, it can dereference a null region pointer when looking up the region name, potentially causing an oops. The race between BIOS...

CVE-2024-43893

CVE-2024-43893 (Linux kernel) fixes a divide-by-zero in uart_get_divisor triggered by TIOCSSERIAL with an invalid baud_base when uartclk becomes zero. The patch adds a zero-check for uartclk in uart_set_info() before subsequent serial_setup calls, preventing a divide-by-zero and potential oops on...

CVE-2024-46685

CVE-2024-46685 is a Linux kernel vulnerability involving the pinctrl/pinmux subsystem. The issue was a potential NULL dereference: pinmux_generic_get_function() could return NULL and PCS_get_function() dereferenced the pointer without NULL-checks. The fix adds a NULL check for the function pointe...

CVE-2024-46751

CVE-2024-46751 affects the Linux kernel's BTRFS path btrfs_lookup_extent_info(), where a 0 reference count could trigger a BUG_ON(). The fix replaces BUG_ON() with returning -EUCLEAN, aborting the transaction, and logging an error. This is documented in Debian/Ubuntu advisories and included in pa...

CVE-2024-46805

CVE-2024-46805 is a Linux kernel vulnerability in the drm/amdgpu path where a NULL pointer dereference of hive can occur when validating amdgpu_hive_info. The issue (root cause: amdgpu_hive_info *hive may be NULL) can lead to an out-of-bounds or memory access problem in the driver, with the advis...

CVE-2024-47809

CVE-2024-47809 (Linux kernel) fixes a possible NULL pointer dereference in the DLM code path when a lock block (lkb) is created but the lkb_resource is not yet assigned (until attach_lkb via validate_lock_args). The issue could occur when request_lock() calls, potentially exposing a crash; anothe...

CVE-2024-49888

CVE-2024-49888 – Linux kernel (BPF) sdiv/smod overflow fix . The issue affects the BPF subsystem where division by -1 can overflow for 64-bit operands (LLONG_MIN/-1) on x86_64, potentially triggering a kernel crash; on arm64, results differ (LLONG_MIN/-1 yields LLONG_MIN). The provided patch logi...

CVE-2024-49904

The CVE-2024-49904 issue affects the Linux kernel DRM/AMDGPU subsystem. The vulnerability arises from a missing list empty check in list_for_each_entry_safe, which can lead to a NULL pointer dereference in corner cases. The advisory notes that the fix is to add a list empty check to avoid the nul...

CVE-2024-49955

CVE-2024-49955 : In the Linux kernel, ACPI battery handling fixes a crash when unregistering a battery hook. If a battery hook returns an error while adding a battery, the hook is auto-unregistered; the provider cannot detect this, and later calls to battery_hook_unregister() on an already-unregi...

CVE-2024-50158

Technical details about CVE-2024-50158 (affected software, impact, exploitability, and remediation) are not provided in the supplied documents. Please monitor for updates.

CVE-2024-50248

CVE-2024-50248 affects the Linux kernel ntfs3 driver. Connected advisories confirm a fix that adds bounds checking in ntfs3: mi_enum_attr() to ensure attributes do not read beyond valid memory. This addresses potential memory-safety issues arising from unchecked attribute enumeration. The Debian/...

CVE-2024-56625

CVE-2024-56625 refers to a Linux kernel issue where the can: dev: can_set_termination() implementation used gpiod_set_value() to drive a GPIO behind a sleep-capable expander, which can sleep. The root cause is the use of gpiod_set_value() in the GPIO termination patch, triggering a warning when t...

CVE-2024-56675

CVE-2024-56675 affects the Linux kernel: UAF can occur when a non-sleepable BPF program is attached to an uprobe and freed via normal RCU, because Uprobes use bpf_prog_run_array_uprobe() under tasks-trace-RCU protection. The fix explicitly waits for a tasks-trace-RCU grace period after removing t...

CVE-2024-57932

CVE-2024-57932: In the Linux kernel exFAT filesystem, there is a fixed bug that could cause an infinite loop in exfat_readdir() when a cluster chain is corrupted. The related advisory describes the root cause as a loop condition in directory reading and notes that a patch was applied to prevent t...

CVE-2024-58010

The CVE-2024-58010 issue affects the Linux kernel binfmt_flat code on 32-bit systems, where an integer overflow could occur in the full_data computation (full_data = data_len + relocs * sizeof(unsigned long)). The provided description notes most sizes are capped at 256MB to avoid overflow, but th...

CVE-2025-21642

CVE-2025-21642 affects the Linux kernel’s MPTCP subsystem. The issue arises from using current->nsproxy/netns when accessing per-netns data via sysctl entries (net/mptcp/ctrl.c), which can diverge from the netns the table is associated with. The described consequence is a general protection fa...

CVE-2025-21825

CVE-2025-21825 affects the Linux kernel’s BPF subsystem when PREEMPT_RT is enabled. The issue arises in the bpf_timer cancellation path during map update of preallocated htab elements: freeing of old_element under the bucket lock can race with reuse of the same element, potentially triggering a l...

CVE-2025-22045

Technical details for CVE-2025-22045 are not publicly available in the provided documents. Monitor for updates from vendor advisories and CVE databases.

CVE-2025-22060

CVE-2025-22060 concerns the Linux kernel mvpp2 parser TCAM/SRAM memory. The issue arises when concurrent accesses to the indirect TCAM/SRAM tables via an index register are not atomic, enabling TOCTOU-like corruption when mvpp2_set_rx_mode() runs on multiple CPUs. In the described scenario, this ...

CVE-2025-22063

CVE-2025-22063 is a Linux kernel vulnerability in netlabel CALIPSO handling that can trigger a NULL pointer dereference when an IPv4 socket is used with an IPv6 connect. The issue arises from evaluating sk_fullsock(__sk) ? inet_sk(__sk)->pinet6 : NULL and accessing pinet6 for an IPv4 socket. A...

CVE-2025-22111

CVE-2025-22111: In the Linux kernel, the fix removes the RTNL dance for SIOCBRADDIF and SIOCBRDELIF to avoid RTNL pressure race conditions between bridging and device removal. The description details a race where one thread detaches a device from a bridge while another removes the bridge, potenti...

CVE-2025-23131

CVE-2025-23131 affects the Linux kernel in the DLM subsystem. The issue occurs when do_uevent returns a positive value written to event_done; this value previously caused new_lockspace to consider it a success, leaving lockspace uninitialized and leading to a NULL pointer dereference in dlm_find_...

CVE-2025-23142

CVE-2025-23142 details are not provided in the supplied documents; monitor for updates.

CVE-2025-37749

CVE-2025-37749 concerns a Linux kernel vulnerability in the PPP stack. The issue stemmed from insufficient bounds checking on skb data in ppp_sync_txmung, risking out-of-bounds reads when processing short packets. The fixed description states that there must be enough data in the skb linear buffe...

CVE-2025-37769

CVE-2025-37769 (Linux kernel): A division-by-zero condition exists in the DRM AMD SMU11 path (drm/amd/pm/smu11) when a user sets a speed value greater than UINT_MAX/8. The vulnerability is fixed in the kernel by a commit cherry-picked from da7dc714a8f8e1c9fc33c57cd63583779a3bef71, as reported by ...

CVE-2025-38152

CVE-2025-38152 affects the Linux kernel remoteproc subsystem. The root cause is the rproc_shutdown path not clearing rproc->table_sz, which allows a memcpy of loaded_table from rproc->cached_table to use a NULL rproc->cached_table after stopping, causing a kernel crash. The issue is repo...

CVE-2025-40325

CVE-2025-40325 – Linux kernel raid10 discard handling Issue: In md/raid10, a discard BIO with REQ_NOWAIT could be returned without waiting for a barrier, potentially leaving the system with an inconsistent discard handling path. The fix enforces waiting for the barrier before returning such a dis...

CVE-2026-31635

CVE-2026-31635 affects the Linux kernel rxrpc component. The vulnerability stems from an inverted length check in rxgk_verify_response(), where oversized RESPONSE authenticators can be accepted and later cause a contradictory length that leads to a BUG_ON(len) in skb_to_sgvec(). This can crash th...

CVE-2026-31670

Summary: CVE-2026-31670 affects the Linux kernel rfkill subsystem. The vulnerability allows a local attacker to create an unbounded number of rfkill events (without consuming them from the rfkill descriptor), potentially leading to memory exhaustion and DoS. The issue is fixed by bounding the num...

CVE-2004-0495

Summary: CVE-2004-0495 refers to multiple vulnerabilities in Linux kernel 2.4 and 2.6, identified by the Sparse source-checking tool, that can allow local privilege escalation or access to kernel memory. Affected software: Linux kernel for 2.4 and 2.6 series. Root cause/impact: local attacker cou...

CVE-2009-4537

CVE-2009-4537 concerns the Linux kernel before 2.6.32.3, specifically the r8169 Ethernet driver (drivers/net/r8169.c). The vulnerability arises from not properly checking the size of frames that exceed the MTU, allowing remote attackers to cause a denial of service via crafted packets that exploi...

CVE-2010-2798

The CVE-2010-2798 entry concerns the Linux kernel prior to 2.6.35, where gfs2_dirent_find_space uses an incorrect size value in calculations related to sentinel directory entries. This can allow local attackers to trigger a denial of service via a NULL pointer dereference and kernel panic, with a...

CVE-2010-4655

CVE-2010-4655 affects the Linux kernel’s net/core/ethtool.c, where uninitialized data structures in ethtool ioctl handling could allow a local user with CAP_NET_ADMIN to leak information from kernel heap memory. The initial description specifies the vulnerability exists in kernel builds before 2....

CVE-2011-1746

The CVE affects the Linux kernel prior to 2.6.38.5, specifically the AGP subsystem in drivers/char/agp/generic.c. It is caused by multiple integer overflows in the functions agp_allocate_memory and agp_create_user_memory, allowing local users to trigger buffer overflows and potentially crash the ...

CVE-2011-2022

The CVE-2011-2022 issue affects the Linux kernel (drivers/char/agp/generic.c) prior to 2.6.38.5. The vulnerability is due to failure to validate a start parameter in the agp_generic_remove_memory function, enabling local users to gain privileges or cause a denial of service (system crash) via a c...

CVE-2013-4345

CVE-2013-4345 is an off-by-one vulnerability in the Linux kernel’s crypto/ansi_cprng.c get_prng_bytes function, exploitable through requests for small data blocks up to kernel versions before 3.11.4. The issue allows context-dependent attackers to defeat cryptographic protections by mismanaging t...

CVE-2014-3688

CVE-2014-3688 affects the Linux kernel SCTP implementation prior to 3.17.4. The vulnerability allows a remote attacker to cause a denial of service via memory consumption by triggering a large number of chunks in an association’s output queue (ASCONF probes), related to net/sctp/inqueue.c and net...

CVE-2015-8845

CVE-2015-8845 affects the Linux kernel on powerpc platforms prior to 4.4.1. The vulnerability arises because the tm_reclaim_thread function in arch/powerpc/kernel/process.c may proceed with a TM reclaim call without verifying that TM suspend mode exists, enabling local users to trigger a denial o...

CVE-2016-3138

CVE-2016-3138 : The Linux kernel’s acm_probe in drivers/usb/class/cdc-acm.c is vulnerable before 4.5.1. A USB device with no both a control and a data endpoint descriptor can trigger a NULL pointer dereference, enabling a physically proximate attacker to crash the system. Impact is denial of serv...

CVE-2016-8632

CVE-2016-8632 affects the Linux kernel’s tipc_msg_build() in net/tipc/msg.c (up to version 4.8.11). The vulnerability stems from failing to validate the relationship between minimum fragment length and maximum packet size, enabling a local user with CAP_NET_ADMIN to gain privileges or cause a hea...