CVE-2017-13693

CVE-2017-13693 affects Linux kernels up to 4.12.9. The acpi_ds_create_operands() function in drivers/acpi/acpica/dsutils.c does not flush the operand cache, enabling a crafted ACPI table to trigger a kernel memory disclosure and bypass KASLR. This is a local, user‑space–driven information leak/pr...

CVE-2017-15537

The CVE-2017-15537 issue affects the x86 FPU state handling in the Linux kernel prior to 4.13.5. If a CPU supports xsave but not xsaves, ptrace() or rt_sigreturn() mishandles reserved xstate header bits, enabling local users to read other processes’ FPU registers. A fix is provided in Linux kerne...

CVE-2017-7261

CVE-2017-7261 affects the Linux kernel driver vmwgfx. The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c does not check for a zero value of certain levels data, allowing a local user to cause a denial of service (ZERO_SIZE_PTR dereference, GP fault, and potentially a...

CVE-2017-9150

CVE-2017-9150 affects the Linux kernel prior to 4.11.1, where the function do_check in kernel/bpf/verifier.c fails to expose the allow_ptr_leaks setting to constrain the output of print_bpf_insn. This omission enables local attackers to leak sensitive address information through crafted bpf syste...

CVE-2018-13097

The CVE-2018-13097 entry affects the Linux kernel, specifically the f2fs filesystem code in fs/f2fs/super.c up to version 4.17.3. The vulnerability is an out-of-bounds read or divide-by-zero caused by an incorrect user_block_count in a corrupted f2fs image, leading to a denial of service. Connect...

CVE-2022-1043

CVE-2022-1043 concerns a flaw in the Linux kernel io_uring implementation that lets a local attacker corrupt memory, crash the system, or escalate privileges. The connected Nessus advisories (Unity Linux UTSA-2026-004760/003973) reproduce via kernel io_uring flaw; no specific patched version is l...

CVE-2022-47943

Summary: CVE-2022-47943 affects the ksmbd component of the Linux kernel (versions 5.15–5.19 before 5.19.2). The flaw is an out-of-bounds read that can trigger an OOPS when handling SMB2_WRITE with a large length in the zero DataOffset case. Impact (as stated): potential kernel crash/denial of ser...

CVE-2022-48743

CVE-2022-48743 (Linux kernel): The issue is in the amd-xgbe NIC path (net/amd-xgbe) where skb data length underflow could trigger BUG_ON() in skbuff.h, potentially causing kernel panics. The documented fix drops the packet when such underflows occur to handle hardware descriptor inconsistencies. ...

CVE-2022-48974

CVE-2022-48974 – Linux kernel netfilter conntrack fix : The vulnerability occurs in nf_conntrack_hash_check_insert() when nf_ct_ext_valid_pre/post() paths call NF_CT_STAT_INC() in a preemptible context, enabling a use-after-free-like trace. The fix patches nf_conntrack to use NF_CT_STAT_INC_ATOMI...

CVE-2022-49060

CVE-2022-49060 is a Linux kernel vulnerability affecting the net/smc path, where a NULL pointer dereference could occur in smc_pnet_find_ib due to calling dev_name() with dev.parent without a NULL check. The fix implements a NULL-pointer check before the call to dev_name(), mitigating potential c...

CVE-2022-49158

CVE-2022-49158 affects the Linux kernel SCSI driver qla2xxx. The issue is a warning generated when adisc is flushed, where an error code type did not match the expected type. The fix adds translation between error code types to avoid the warning (no documented exploit). The connected advisories c...

CVE-2022-49272

CVE-2022-49272 affects the Linux kernel in ALSA: pcm code. The root cause is a potential AB/BA deadlock between PCM runtime→buffer_mutex and mm→mmap_lock triggered by concurrent access via ALSA and OSS during read/write and mmap/path IOCTLs. The fix replaces the buffer_mutex protection in read/wr...

CVE-2022-49728

CVE-2022-49728 affects the Linux kernel’s IPv6 path. The issue is a signed integer overflow in __ip6_append_data, triggered by computing [length] that could exceed int range (UBSAN report: 2147479552 + 8567 cannot be represented in type int). The fix implemented across patches changes the [length...

CVE-2022-49750

CVE-2022-49750 affects the Linux kernel CPPC support in cpufreq. The root cause is that the _CPC object fields are unsigned 32-bit values, which could overflow. The fix is to add u64 casts to these values to prevent overflow when used. Documented impact indicates potential availability impact (A)...

CVE-2022-49839

CVE-2022-49839 : In the Linux kernel, the scsi_transport_sas path sas_phy_add() could crash if transport_add_device() failed, since error handling did not account for a NULL device during transport_remove_device() invoked from sas_remove_host(). The issue is mitigated by the upstream fix to check...

CVE-2022-49927

CVE-2022-49927: Linux kernel NFSv4 kmemleak when allocating a slot failed. If a slot allocation fails, previously allocated slots must be cleaned up; otherwise, the allocated slots leak (example: unreferenced object 0xffff8881115aa100, size 64). The fix ensures cleanup of all allocated slots on f...

CVE-2023-26544

CVE-2023-26544 affects the Linux kernel 6.0.8 where a use-after-free occurs in fs/ntfs3/run.c:run_unpack due to a mismatch between NTFS sector size and media sector size. The issue is a use-after-free in NTFS handling; upstream fix is available (commit referenced). Remediation is to upgrade to a ...

CVE-2023-35827

CVE-2023-35827 : A use-after-free in the Linux kernel up to version 6.3.8 is reported, specifically in ravb_remove() inside drivers/net/ethernet/renesas/ravb_main.c. The issue arises from a use-after-free in the Renesas AVB/RAVB driver, as described in Astra Linux and Nessus feeds. The vulnerabil...

CVE-2023-52689

CVE-2023-52689 affects the Linux kernel ALSA scarlett2 meter control: scarlett2_meter_ctl_get() accesses meter_level_map[] without holding data_mutex. The fix adds a mutex around get_meter_levels to protect the shared data and prevent use of an uninitialized resource. References point to kernel p...

CVE-2023-53015

CVE-2023-53015 affects the Linux kernel HID betop: betopff_init() verifies only the total sum of report field counts (>=4) while hid_betopff_play() requires exactly 4 fields, enabling a NULL pointer dereference when an output report has one field with four counts. Multiple connected advisories...

CVE-2024-26805

CVE-2024-26805 (Linux kernel) fixed a kernel-infoleak-after-free in netlink path. The issue occurred in __skb_datagram_iter via netlink_to_full_skb, where len was computed from skb->end (buffer offset) instead of skb->len (actual data length), causing uninit memory to be copied. The patch c...

CVE-2024-35984

CVE-2024-35984 is resolved in the Linux kernel by adding a NULL pointer check in __i2c_transfer to prevent a NULL function pointer dereference in i2c: smbus when the designware controller is used in target-only mode. Baruch reported an OOPS in this scenario due to the assumption that a transfer f...

CVE-2024-36476

CVE-2024-36476 affects the Linux kernel (RDMA/rtrs path). The bug arises from declaring the ib_sge list inside the always_invalidate block, making it inaccessible later in the function and enabling a potential kernel NULL pointer dereference. The vulnerability is addressed by moving the ib_sge li...

CVE-2024-42243

CVE-2024-42243 relates to the Linux kernel mm/filemap MAX_PAGECACHE_ORDER handling. The issue arises because xarray cannot support arbitrary page cache sizes, triggering WARN_ON in xas_split_alloc on ARM64 when base page size is 64KB (huge pages can be 512MB). The fix implemented patches to LIMIT...

CVE-2024-43890

CVE-2024-43890: Linux kernel tracing overflow in get_free_elt() is fixed. The issue was that tracing_map->next_elt could overflow beyond tracing_map->max_elt, allowing insertion into a full tracing_map and potentially causing an infinite loop with preemption disabled, leading to a CPU hang....

CVE-2024-43901

CVE-2024-43901 — Linux kernel DRM/AMD display NULL pointer dereference in DTN log (DCN401) Affected software: Linux kernel with AMD display driver (DCN401). Root cause: reading the DTN log attempts to access the gamut_remap callback when the DCN401 ASIC does not implement it, leading to a NULL po...

CVE-2024-44940

CVE-2024-44940 pertains to the Linux kernel. The issue is a WARN_ON_ONCE in gue_gro_receive when the encapsulated protocol has no GRO handler; the packet is contrived (Syzbot-triggered) and not actionable. The fix removes this warning, as it is expected and not a vulnerability vector, by dropping...

CVE-2024-44942

CVE-2024-44942 concerns the Linux kernel’s f2fs inline data handling during garbage collection. According to the connected Astra Linux bulletin, the root cause is that an inline_data inode can be fuzzed, allowing a valid blkaddr in its direct node; when background GC migrates the block, a f2fs_bu...

CVE-2024-46770

CVE-2024-46770 applies to the Linux kernel; the issue arises in the PF reset flow where netif_device_attach/detach handling allows ethtool callbacks during reset to dereference deleted resources. Root cause: ethtool coalesce access during reset can hit a NULL dereference when the driver resources...

CVE-2024-47673

CVE-2024-47673 affects the Linux kernel wifi iwlwifi mvm; root cause is that TCM is not paused when the firmware is stopped, causing a host command to be sent to a non-live firmware. This can trigger a WARNING and potential local impact. Connected docs indicate patched kernels/versions: e.g., Mar...

CVE-2024-49900

CVE-2024-49900 (Linux kernel) : Fixes an uninitialized access in jfs/xattr.c where ea_buf->new_ea was not initialized, causing an uninit-value path observed by KMSAN in lzo1x_1_do_compress. The patch initializes the buffer by applying memset at the start of ea_get(), preventing uninitialized w...

CVE-2024-49901

CVE-2024-49901 concerns the Linux kernel DRM MSM Adreno path. The root cause was a NULL pointer dereference during cleanup when gpu->pdev may still be NULL during early initialization, including cases where speedbin data exists but opp/hw data in DT is missing. The vulnerability was resolved b...

CVE-2024-49913

CVE-2024-49913 affects the Linux kernel’s DRM AMD display path. The issue was a potential NULL pointer dereference in commit_planes_for_stream when top_pipe_to_program could be NULL, leading to dereferencing stream_res. The fix adds a null check before accessing top_pipe_to_program to prevent the...

CVE-2024-50159

CVE-2024-50159 relates to the Linux kernel firmware subsystem for ARM SCMI. The vulnerability arises from a double-free in the ARM SCMI debugfs setup path: when devm_add_action_or_reset() fails, scmi_debugfs_common_cleanup() can run twice, leading to freeing the same memory (dbg->name) twice. ...

CVE-2024-50220

CVE-2024-50220 affects the Linux kernel fork path where userfaultfd (UFFD) observers can observe a fork. The issue is that the kernel could expose an incomplete VM address space to userland (via VMAs/uffd) when an error occurs during fork. The fix defers khugepaged/KSMM and disables UFFD_EVENT_FO...

CVE-2024-50258

CVE-2024-50258 affects the Linux kernel net stack. A small gso_max_size/gso_ipv4_max_size can cause an underflow in sk_dst_gso_max_size(), making sk->sk_gso_max_size exceed device limits and trigger a BUG_ON crash during tcp_write_xmit/tso processing. The root cause is in computing tso_segs (D...

CVE-2024-50296

CVE-2024-50296 affects the Linux kernel net/hns3 driver (and related SR-IOV cleanup path). Root cause: race in driver removal where concurrent VF disable and resource release call pci_disable_sriov() twice, leading to a NULL pointer dereference during device removal. Impact: kernel crash when the...

CVE-2024-53064

CVE-2024-53064 is a Linux kernel issue in the idpf/vc_core mailbox path. During a reboot-retry sequence, the mailbox workqueue may still run after resources are freed, leading to a NULL pointer dereference when the released control queue is accessed. The fix unrolls the workqueue cancellation and...

CVE-2024-53068

CVE-2024-53068 affects the Linux kernel’s ARM SCMI subsystem. The issue is a slab-use-after-free in scmi_bus_notifier caused by prematurely freeing scmi_dev->name in __scmi_device_destroy(); the release of scmi_dev->name is moved to scmi_device_release() to prevent use-after-free, per the p...

CVE-2024-53216

CVE-2024-53216 (Linux kernel) : The vulnerability exists in nfsd’s handling of svc_expkey/svc_export release. When the last reference to cache_head can drop to zero in c_show/e_show, svc_export_put and expkey_put may free ex_uuid, after which access to ex_uuid can occur (use-after-free). An rcu_r...

CVE-2024-56535

CVE-2024-56535 affects the Linux kernel’s wifi driver for RTW89 in the coex path. The issue arises from not validating the return value of kmalloc in btc_fw_set_monreg(), which may be NULL and lead to a NULL pointer dereference. A fix adds a NULL return check in btc_fw_set_monreg() to prevent der...

CVE-2024-56721

CVE-2024-56721 affects the Linux kernel x86/CPU/AMD handling of the erratum_1386_microcode array. The issue occurs because the array requires an empty entry at the end; without it, x86_match_cpu_with_stepping() may continue iterating past the end. The fix is to add an empty entry to the end of er...

CVE-2024-56728

CVE-2024-56728: Linux kernel vulnerability in octeontx2-pf (otx2_ethtool.c) where otx2_mbox_get_rsp could return an error pointer that was not checked. The fix adds an explicit error pointer check after calling otx2_mbox_get_rsp(), preventing potential dereference of a NULL/err pointer. The vulne...

CVE-2024-57974

The CVE-2024-57974 entry describes a race in the Linux kernel UDP path: if a UDP socket changes its local address during a receive after connect(), a secondary hash/tuple hash update may not complete in time, causing lookups to fail and potentially returning ECONNREFUSED. The issue arises from th...

CVE-2024-58064

Technical details for CVE-2024-58064 are not provided in the given documents; no affected products, impact, or fix are specified here. Monitor for updates from vendor/advisory sources.

CVE-2024-58098

The CVE-2024-58098 issue affects the Linux kernel BPF verifier, specifically the logic tracking changes_pkt_data for global sub-programs. When verifiers process calls to helpers, pointers may be invalidated inconsistently between callers and global sub-programs, making certain programs unsafe (e....

CVE-2025-21804

CVE-2025-21804 : In the Linux kernel, the rcar-ep code (PCI rc ar-ep) used devm_request_mem_region() with a stack-allocated string that was passed as a resource name, risking undefined behavior and potential system instability. The bug arose in rcar_pcie_parse_outbound_ranges() where a stack vari...

CVE-2025-21855

Summary (CVE-2025-21855, Linux kernel): The ibmvnic driver is affected by a use-after-free in ibmvnic_xmit caused by referencing skb memory after flushing the transmit buffer to VIOS. A race between skb length access and memory free (triggered by VIOS interrupts) can lead to a UAF condition, as e...

CVE-2025-22027

CVE-2025-22027 affects the Linux kernel, specifically the media: streamzap component. The issue is a race between device disconnection and urb callback that leads to a NULL pointer dereference of dev->raw in ir_raw_event_store_with_filter, even though NULL checks exist in the function. The roo...

CVE-2025-37743

CVE-2025-37743 affects the Linux kernel wifi driver ath12k. The vulnerability is a memory leak in HAL_RX_MPDU_START TLV handling when enabling statistics, caused by kzalloc of mon_mpdu not being freed. The fix removes the kzalloc in HAL_RX_MPDU_START TLV handling and also removes standalone monit...