CVE-2025-37860

CVE-2025-37860 : Linux kernel sfc/ef100 design-param NULL dereferences fixed by reordering initialization. The vulnerable path allowed ef100_probe_main() and ef100_check_design_params() to run before efx->net_dev was created, enabling NULL dereferences when calling netif_set_tso_max_size() or ...

CVE-2025-37885

CVE-2025-37885 affects the Linux kernel KVM/x86, where a dangling IRTE could be left posting to a vCPU if the new GSI route cannot be posted. The issue is fixed by restoring IRTE ownership to the host control when the new route isn’t postable, preventing use-after-free and incorrect interrupt del...

CVE-2009-0028

CVE-2009-0028 is a local vulnerability in the Linux kernel up to version 2.6.28 where the clone system call with CLONE_PARENT can allow an unprivileged child to spawn a second child and exit, enabling it to send arbitrary signals to the parent process. The MiracleLinux AXSA-2009-42:04 advisory ex...

CVE-2010-1188

CVE-2010-1188 details (mode C): A use-after-free in net/ipv4/tcp_input.c of the Linux kernel 2.6 prior to 2.6.20. When IPV6_RECVPKTINFO is set on a listening TCP socket, a SYN packet to a LISTEN socket can trigger the skb being freed improperly, allowing a remote attacker to cause a denial of ser...

CVE-2010-3432

CVE-2010-3432 affects the Linux kernel SCTP stack: sctp_packet_config in net/sctp/output.c initializes packet data structures too aggressively in kernels before 2.6.35.6, enabling remote attackers to trigger a denial of service (panic) via a specific SCTP traffic sequence. Affected component: ker...

CVE-2010-3850

CVE-2010-3850: In the Linux kernel, the ec_dev_ioctl function in net/econet/af_econet.c did not require CAP_NET_ADMIN, allowing local users to bypass access restrictions and configure econet addresses via an SIOCSIFADDR ioctl. Documented impact is local privilege/unauthorized configuration; fix a...

CVE-2011-1160

Technical details for CVE-2011-1160 are not publicly available in the supplied connected documents. The initial description identifies a kernel memory info leak in tpm_open (Linux kernel

CVE-2011-4132

CVE-2011-4132 affects the Linux kernel’s Journaling Block Device (JBD) cleanup_journal_tail function. The vulnerability allows local users to trigger a denial of service (assertion error and kernel oops) when handling an ext3 or ext4 image containing an invalid log first block value. The descript...

CVE-2014-4508

CVE-2014-4508 affects the Linux kernel on 32-bit x86 (arch/x86/kernel/entry_32.S) up to version 3.15.1. When syscall auditing is enabled and the sep CPU feature flag is set, a local user can trigger a denial-of-service (OOPS and crash) by using an invalid syscall number (demonstrated with number ...

CVE-2016-1576

CVE-2016-1576 concerns the Linux kernel overlayfs. The overlayfs implementation up to version 4.5.2 does not properly restrict the mount namespace, enabling a local user to gain privileges by mounting an overlay filesystem on top of a FUSE filesystem and then executing a crafted setuid program. T...

CVE-2016-4580

CVE-2016-4580 affects the Linux kernel up to version 4.5.4 (pre-4.5.5). The vulnerability arises in x25_negotiate_facilities() inside net/x25/x25_facilities.c where a data structure is not properly initialized, enabling an attacker to read sensitive data from kernel stack memory via an X.25 Call ...

CVE-2016-9178

CVE-2016-9178 affects the Linux kernel prior to 4.7.5. The macro __get_user_asm_ex in arch/x86/include/asm/uaccess.h does not initialize a certain integer variable, allowing local users to obtain sensitive information from kernel stack memory by triggering a failure of a get_user_ex call. Impact ...

CVE-2017-11472

CVE-2017-11472 affects the Linux kernel via the acpi_ns_terminate() path in drivers/acpi/acpica/nsutils.c. The flaw does not flush the operand cache, enabling a local user to dump kernel memory and bypass KASLR by crafting an ACPI table, with impact described for kernels before 4.12 (and through ...

CVE-2017-16529

CVE-2017-16529 affects the Linux kernel’s snd_usb_create_streams in sound/usb/card.c, allowing a local attacker to trigger an out-of-bounds read and system crash via a crafted USB device, with impact described as a denial of service and potentially other effects. The issue is present in kernels p...

CVE-2017-16643

CVE-2017-16643 affects the Linux kernel, specifically the parse_hid_report_descriptor function in drivers/input/tablet/gtco.c, with exploitation possible via a crafted USB device. It allows a local user to trigger an out-of-bounds read and system crash (DoS) and potentially other impacts. The iss...

CVE-2021-32078

Summary (CVE-2021-32078) An out-of-bounds read was found in the Linux kernel code path arch/arm/mach-footbridge/personal-pci.c, due to a missing check for a value that should not be negative (example: accessing element -2 of an array). The issue affects kernels up to at least 5.12.11. The descrip...

CVE-2021-47639

CVE-2021-47639 affects the Linux kernel KVM x86/mmu code. The issue arises when unmapping a guest frame number (gfn) range in the TDP MMU: both valid and invalid SPTE roots can be zapped, but invalid roots aren’t consistently cleared in mmu_notifier paths. This can leave references to freed pages...

CVE-2021-47657

CVE-2021-47657: In the Linux kernel, the vulnerability affects drm/virtio by risking a NULL pointer use in virtio_gpu_array_put_free() if virtio_gpu_object_shmem_init() fails. The problem arises when objs is NULL and virtio_gpu_array_put_free() is invoked. The fix is to ensure objs is not NULL in...

CVE-2022-48757

In the Linux kernel vulnerability CVE-2022-48757, information leakage occurs in /proc/net/ptype: within one net namespace, a packet socket created without binding to a device can expose the new packet_type to other namespaces by reading /proc/net/ptype. The fix adds a net pointer in packet_type t...

CVE-2022-49090

The CVE-2022-49090 entry concerns Linux kernel arch/arm64: Fix topology initialization for core scheduling. The issue arises when store_cpu_topology() does not call update_siblings_masks() before notify_cpu_starting(), causing core scheduling data structures to reflect an incorrect topology. If s...

CVE-2022-49156

The CVE-2022-49156 entry corresponds to a Linux kernel vulnerability in scsi: qla2xxx where a call into midlayer (fc_remote_port_delete) could sleep in interrupt context, causing a crash via scheduling while atomic. The fix schedules the call in non-interrupt context to avoid sleeping while atomi...

CVE-2022-49295

CVE-2022-49295 documents a race in the Linux kernel nbd subsystem: during module removal, netlink command handling can race with cleanup unless genl_unregister_family() is called first in nbd_cleanup(). The described oops is a NULL pointer dereference (addr 0x98) in down_write(), with a trace thr...

CVE-2022-49343

CVE-2022-49343 : In the Linux kernel, ext4 can encounter cycles in the h-tree stored in a directory. A maliciously corrupted filesystem could cause the kernel to access unallocated memory during a node split. The fix is to verify that traversed block numbers are unique.

CVE-2022-49374

CVE-2022-49374 affects the Linux kernel TIPC bearer path. The root cause is improper validation of the TIPC_NLA_BEARER_NAME attribute length in the bearer enable flow (net/tipc/bearer.c), with fixes implemented in the kernel (referenced commits in the advisory). The connected docs describe the sy...

CVE-2022-49409

Summary: CVE-2022-49409 covers a Linux kernel ext4 bug that can trigger a BUG_ON in __es_tree_search due to a faulty check in ext4_valid_extent_entries when validating extents. The issue can occur during quota-related quota inode loading, propagating through ext4/extents.c to ext4_bread, quota_re...

CVE-2022-49515

The CVE-2022-49515 issue affects the Linux kernel ASoC driver for cs35l41. It is caused by an out-of-bounds access in otp_packed_element_t where CS35L41_NUM_OTP_ELEM is defined as 100 but only 99 entries exist in otp_map_1/2[CS35L41_NUM_OTP_ELEM], triggering UBSAN shift-out-of-bounds warnings in ...

CVE-2022-49549

The CVE-2022-49549 entry concerns a Linux kernel memory-leak in the x86 MCE/AMD path: when threshold_create_bank() fails inside mce_threshold_create_device(), the previously allocated threshold banks array (bp) could be leaked because threshold_remove_device() only frees it if the bank creation s...

CVE-2022-49848

In the Linux kernel, the vulnerability affects the phy: qcom-qmp-combo driver . The root cause was treating the PCS_USB registers as potentially separate from PCS registers, but using the wrong base when no PCS_USB offset is provided. This caused a potential dereference of a NULL pointer during r...

CVE-2023-32258

CVE-2023-32258 affects the Linux kernel ksmbd SMB server. The flaw occurs in processing SMB2_LOGOFF and SMB2_CLOSE due to missing locking when operating on an object, allowing code execution in kernel context. Connected documents confirm this is a ksmbd in-kernel vulnerability with high impact (C...

CVE-2023-39197

The CVE-2023-39197 entry concerns an out-of-bounds read in Linux kernel Netfilter Connection Tracking (conntrack) for DCCP. A remote attacker could disclose kernel memory contents via crafted DCCP traffic due to copying an unbounded portion of the conntrack header; the issue is categorized as a k...

CVE-2023-52502

The CVE-2023-52502 issue affects the Linux kernel’s NFC subsystem, specifically a race in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn() that can lead to use-after-free (UAF). The root cause is a reference on a socket produced during a lookup while holding a lock, which should be taken before rel...

CVE-2023-52591

CVE-2023-52591 affects the Linux kernel’s reiserfs rename path. The issue arises when renaming a directory where the parent directory does not change; the VFS previously could touch a renamed directory due to lack of proper locking, risking filesystem corruption. The fix adjusts the reiserfs rena...

CVE-2023-52781

CVE-2023-52781 concerns the Linux kernel USB config BOS descriptor handling. In usb_get_bos_descriptor(), an iteration issue occurs when skipping USB_DT_DEVICE_CAPABILITY, causing the same descriptor to be read repeatedly. The fix introduces a goto to advance the pointer and bytes read so the fun...

CVE-2023-5972

CVE-2023-5972 concerns a null pointer dereference in the netfilter nft_inner.c path of the Linux kernel. A local attacker could crash the system or escalate privileges via improper handling of nft_inner_num/nft_inner_expr_name attributes in inner tunnel netlink attributes, as described in the CVE...

CVE-2024-26693

CVE-2024-26693 (Linux kernel wifi/iwlwifi - mvm) : A DoS crash occurs when the AP runs out of stations in firmware. The root cause is that iwl_mvm_is_dup() cannot find the per-queue dup_data, which was not allocated. This happened because MAC80211 expected a station to exist (sta_info::uploaded s...

CVE-2024-26868

CVE-2024-26868 : Linux kernel nfs_layout_flexfiles path panicked when nfs4_ff_layout_prepare_ds() failed to initialize mirror_ds, leading to a NULL/missing mirror_ds dereference in ff_layout_cancel_io(). The core issue was dereferencing mirror_ds without IS_ERR_OR_NULL checks, risking a kernel pa...

CVE-2024-40957

CVE-2024-40957: Linux kernel seg6 fix parameter passing when calling NF_HOOK() in End.DX4/End.DX6. input_action_end_dx4/6 pass NULL indev to NF_HOOK() in PREROUTING, risking kernel NULL pointer dereference (rpfilter_mt). Patch in affected kernel versions; remediation requires updating to a versio...

CVE-2024-41017

Public technical details (affected products/versions, root cause, impact or patch) for CVE-2024-41017 are not provided in the connected documents. Monitor vendor advisories and CVE feeds for updates.

CVE-2024-45828

CVE-2024-45828 affects the Linux kernel i3c-mipi-i3c-hci driver. The issue is a NULL pointer deref caused by a race where the ring stop path may trigger a RING_OP_STAT interrupt after io_data is NULLed during cleanup. The fix masks the ring interrupts before the ring stop request to prevent this ...

CVE-2024-47712

CVE-2024-47712: In the Linux kernel, a RCU usage issue in wifi/wilc1000 was fixed. In wilc_parse_join_bss_param, the code accessed the ies TSF field after the RCU read-side section, which is illegal. The TSF value is now stored in a local variable (ies_tsf) before releasing the RCU lock, and para...

CVE-2024-47735

CVE-2024-47735 concerns the Linux kernel: RDMA/hns: Fix spin_unlock_irqrestore() called with IRQs enabled and correct misuse of spin_lock_irq()/spin_unlock_irq() when spin_lock_irqsave()/spin_lock_irqrestore() was held. The description and connected docs show the issue originated from lock debugg...

CVE-2024-49850

The CVE affects the Linux kernel: a malformed BPF_CORE_TYPE_ID_LOCAL relocation referencing a non-existing BTF type can trigger a NULL pointer dereference in bpf_core_calc_relo_insn. The issue is fixed by adding an upper-call-stack check to reject malformed relocations passed from user space. Rep...

CVE-2024-49891

CVE-2024-49891 : In the Linux kernel, the SCSI lpfc path can NULL-deref when an HBA is resetting or handling an errata event due to hdwq pointers that may have been freed. Fixes add NULL pointer checks before dereferencing hdwq pointers in affected routines (e.g., lpfc_sli_flush_io_rings, lpfc_de...

CVE-2024-49981

The CVE-2024-49981 issue concerns the Linux kernel Venus subsystem. A use-after-free could occur when venus_remove runs while there is unfinished work bound to venus_sys_error_handler (core->work) that is coordinated with venus_event_notify and error handling. The race can involve paths such a...

CVE-2024-49997

CVE-2024-49997 is a Linux kernel vulnerability where padding was not zeroed, causing memory disclosure observable on the wire in the net: ethernet: lantiq_etop driver. The root cause is missing zeroing during padding; the patch adds skb_put_padto() to pad Ethernet frames and zero expanded buffers...

CVE-2024-50132

Technical details for CVE-2024-50132 are not publicly available in the provided documents. Monitor for updates.

CVE-2024-50146

The CVE-2024-50146 entry concerns the Linux kernel mlx5e driver: when profile rollback fails in mlx5e_netdev_change_profile, the netdev profile is left NULL and the subsequent unload can crash if profile->cleanup is called. The issue is triggered during profile rollback failures (e.g., due to ...

CVE-2024-50155

CVE-2024-50155 affects the Linux kernel’s netdevsim driver, specifically the nsim_dev_trap_report_work() path. The issue arises from not using conditional rescheduling in the work that handles trap reports, which can cause a task to be blocked for long periods (as seen in syzbot output). The conn...

CVE-2024-53043

CVE-2024-53043 : Linux kernel vulnerability in mctp i2c handling NULL header address. The issue arises when daddr can be NULL if there is no neighbour table entry, in which case the tx packet should be dropped; saddr may be NULL if a different protocol transmits a packet. This could affect transm...

CVE-2024-56369

CVE-2024-56369 affects the Linux kernel DRM code: drm/modes/drm_mode_vrefresh() attempted to avoid divide-by-zero by checking htotal/vtotal, but can still trigger div-by-zero (vtotalhtotal ...). This can lead to a crash/denial of service (availability impact). The issue is fixed in the upstream k...