CVE-2024-56535

CVE-2024-56535 affects the Linux kernel’s wifi driver for RTW89 in the coex path. The issue arises from not validating the return value of kmalloc in btc_fw_set_monreg(), which may be NULL and lead to a NULL pointer dereference. A fix adds a NULL return check in btc_fw_set_monreg() to prevent der...

CVE-2012-3400

CVE-2012-3400 describes a heap-based buffer overflow in the udf_load_logicalvol function (fs/udf/super.c) of the Linux kernel up to version 3.4.5. The flaw allows remote attackers to cause a denial of service (system crash) or potentially other impact via a crafted UDF filesystem. Connected advis...

CVE-2024-50259

CVE-2024-50259 affects the Linux kernel via the netdevsim component. The issue is caused by missing a trailing NUL after copy_from_user() in nsim_nexthop_bucket_activity_write(), which could affect string handling in that function. A fix adds the trailing zero to ensure proper operation. The CVE ...

CVE-2024-50265

CVE-2024-50265 concerns the Linux kernel OCFS2 XATTR handling. The issue arises in ocfs2_xa_remove() where, after a fault-injected -ENOMEM path, a faulty rc path causes the code to call ocfs2_xa_remove_entry(loc) twice: first from ocfs2_xa_cleanup_value_truncate() and then again when returning to...

CVE-2024-53187

CVE-2024-53187 affects the Linux kernel io_uring subsystem (io_pin_pages in io_uring/memmap.c). The issue arises from overflow/garbage uaddr handling when deriving size, enabling local attackers to trigger a fault; CVSSv3.1 metrics shown include Local attack, Low complexity, Low privileges, with ...

CVE-2024-56728

CVE-2024-56728: Linux kernel vulnerability in octeontx2-pf (otx2_ethtool.c) where otx2_mbox_get_rsp could return an error pointer that was not checked. The fix adds an explicit error pointer check after calling otx2_mbox_get_rsp(), preventing potential dereference of a NULL/err pointer. The vulne...

CVE-2024-58064

Technical details for CVE-2024-58064 are not provided in the given documents; no affected products, impact, or fix are specified here. Monitor for updates from vendor/advisory sources.

CVE-2024-58093

CVE-2024-58093 affects the Linux kernel’s PCI/ASPM link state handling. The issue arises when removing functions on a bus with a PCIe switch/MFD: freeing the ASPM link state either too late (function 0 removed last) or too early (before all subordinate links are gone), leading to use-after-free o...

CVE-2024-58098

CVE-2024-58098 is a Linux kernel vulnerability related to the BPF verifier and the handling of the changes_pkt_data property for global sub-programs. The provided documents describe that calls to certain helpers can cause the verifier to invalidate packet pointers, and that previously global sub-...

CVE-2025-21642

CVE-2025-21642 affects the Linux kernel’s MPTCP subsystem. The issue arises from using current->nsproxy/netns when accessing per-netns data via sysctl entries (net/mptcp/ctrl.c), which can diverge from the netns the table is associated with. The described consequence is a general protection fa...

CVE-2025-21780

CVE-2025-21780 affects the Linux kernel DRM/AMDGPU, where a local attacker could overflow a PPTABLE buffer in smu_sys_set_pp_table() by cycling pptables via sysfs. The issue arises when a small pptable is followed by a larger one, enabling a buffer overflow as described in the advisory. This vuln...

CVE-2025-21799

CVE-2025-21799 covers a Linux kernel net:ethernet:ti:am65-cpsw issue. The root cause is improper IRQ handling: k3_udma_glue_tx_get_irq() may return a negative error value, and a non-null check is not sufficient; the IRQ must be validated as > 0. At runtime, .set_channels can trigger a chain th...

CVE-2025-21883

CVE-2025-21883 affects the Linux kernel ice driver. The issue occurs when ice_ena_vfs() fails after ice_create_vf_entries(), causing VFs to be freed without removing them from the snapshot PF-VF mailbox list, leading to list corruption (possible kernel BUG in lib/list_debug.c and related traces)....

CVE-2025-22027

CVE-2025-22027 affects the Linux kernel, specifically the media: streamzap component. The issue is a race between device disconnection and urb callback that leads to a NULL pointer dereference of dev->raw in ir_raw_event_store_with_filter, even though NULL checks exist in the function. The roo...

CVE-2025-22080

CVE-2025-22080 affects the Linux kernel fs/ntfs3 driver. The vulnerability is due to an integer overflow in hdr_first_de() where de_off and used originate from disk; on 32-bit systems, if both exceed UINT_MAX-16, the overflow can cause the check to fail. The issue has been resolved in the kernel,...

CVE-2025-37778

CVE-2025-37778 is a Linux kernel vulnerability in ksmbd’s krb_authenticate path. The root cause is a use-after-free: krb_authenticate frees sess->user and may not NULL it; if ksmbd_krb5_authenticate does not reinitialize sess->user, smb2_sess_setup may later access freed memory. Several adv...

CVE-2025-37799

CVE-2025-37799 : In the Linux kernel, the vmxnet3 driver’s XDP handling is vulnerable due to malformed packet sizing in vmxnet3_process_xdp when packets fall in the 128–3k byte range. This caused MTU-related connectivity issues (e.g., with HTTP requests and IPIP-encapsulated traffic) and, in some...

CVE-2025-40014

Technical details for CVE-2025-40014 are not publicly provided in the connected documents. The supplied materials do not specify affected products/versions or remediation. Monitor for updates.

CVE-2011-0711

CVE-2011-0711 affects the Linux kernel through the xfs_fs_geometry function in fs/xfs/xfs_fsops.c. The vulnerability arises because a structure member is not initialized, enabling local attackers to read potentially sensitive data from kernel stack memory via the FSGEOMETRY_V1 ioctl. The affected...

CVE-2011-2022

The CVE-2011-2022 issue affects the Linux kernel (drivers/char/agp/generic.c) prior to 2.6.38.5. The vulnerability is due to failure to validate a start parameter in the agp_generic_remove_memory function, enabling local users to gain privileges or cause a denial of service (system crash) via a c...

CVE-2012-2136

CVE-2012-2136 affects the Linux kernel prior to 3.4.5. The sock_alloc_send_pskb function does not properly validate a length value, enabling a local user to trigger a heap-based overflow that can crash the system or potentially gain privileges via access to a TUN/TAP device. Affected software is ...

CVE-2013-4345

CVE-2013-4345 is an off-by-one vulnerability in the Linux kernel’s crypto/ansi_cprng.c get_prng_bytes function, exploitable through requests for small data blocks up to kernel versions before 3.11.4. The issue allows context-dependent attackers to defeat cryptographic protections by mismanaging t...

CVE-2013-7263

The CVE-2013-7263 issue affects the Linux kernel before 3.12.4, where certain length values are updated before kernel data structures are initialized, enabling local attackers to read sensitive information from kernel stack memory via recvfrom, recvmmsg, or recvmsg. Connected Nessus entries (Unit...

CVE-2014-2309

CVE-2014-2309 affects the Linux kernel (net/ipv6/route.c, function ip6_route_add) up to version 3.13.6. It causes memory exhaustion via a flood of ICMPv6 Router Advertisement packets, enabling a remote attacker to trigger DoS. The connected Nessus/OpenVAS advisories reference Unity Linux security...

CVE-2014-3688

CVE-2014-3688 affects the Linux kernel SCTP implementation prior to 3.17.4. The vulnerability allows a remote attacker to cause a denial of service via memory consumption by triggering a large number of chunks in an association’s output queue (ASCONF probes), related to net/sctp/inqueue.c and net...

CVE-2014-9683

CVE-2014-9683 describes an off-by-one error in the Linux kernel’s eCryptfs path: ecryptfs_decode_from_filename in fs/ecryptfs/crypto.c (pre-3.18.2). A crafted filename can cause a buffer overflow, leading to a denial of service and, potentially, local privilege escalation. The vulnerability is lo...

CVE-2017-16532

CVE-2017-16532: A vulnerability in the Linux kernel ≤ 4.13.11 affects the get_endpoints function in drivers/usb/misc/usbtest.c, enabling local users to trigger a denial of service via a crafted USB device, through a NULL pointer dereference and potential system crash. The issue is triggered by a ...

CVE-2017-9605

CVE-2017-9605 affects the Linux kernel (up to and including 4.11.4) via the vmw_gb_surface_define_ioctl path (DRM_IOCTL_VMW_GB_SURFACE_CREATE) in vmwgfx_surface.c. The defect is that backup_handle is defined but not initialized, so when creating a GB surface with a previously allocated DMA buffer...

CVE-2022-3629

CVE-2022-3629 affects the Linux kernel’s vsock_connect in net/vmw_vsock/af_vsock.c, causing a memory leak. The issue is described as a local problem with low overall severity (CVSS 3.1: low, availability impact), and exploitation is not trivial but feasible locally. The primary remediation guidan...

CVE-2022-48743

CVE-2022-48743 affects the Linux kernel net/amd-xgbe driver. The issue is an skb data length underflow triggered by hardware descriptor inconsistencies, causing a BUG_ON() in include/linux/skbuff.h and intermittent kernel panics. A fix drops the offending packet when such underflows are detected....

CVE-2022-48772

CVE-2022-48772 affects the Linux kernel media lgdt3306a driver. Root cause: missing null-pointer check for platform_data in the probe path, causing a null-deref (observed via KASAN kmemdup in lgdt3306a_probe). Impact: potential kernel crash via local access; observed read of a null pointer. Remed...

CVE-2022-48989

CVE-2022-48989 affects the Linux kernel fscache component. The issue is a race between cookie_lru and use_cookie where a cookie can be withdrawn after being reused, causing a NULL dereference. The published fix clears the LRU_DISCARD bit if another thread uses the cookie before the cookie_worker ...

CVE-2022-49093

CVE-2022-49093 is a Linux kernel vulnerability affecting the page_pool fragment handling in skbuff coalescing. The issue is a use-after-free in page_pool fragments when SKBs are coalesced (SKB3) into a cloned/pp_recycle scenario during RX processing (illustrated with RX_BD1 PAGE1 and RX_BD2/3 PAG...

CVE-2023-2860

CVE-2023-2860 is an out-of-bounds read vulnerability in the Linux kernel’s SR-IPv6 implementation, specifically in the processing of seg6 attributes. It stems from improper validation of user-supplied data, allowing a privileged local user to read beyond the end of an allocated buffer and disclos...

CVE-2023-3159

CVE-2023-3159 is a Linux kernel use-after-free in driver/firewire outbound_phy_packet_callback. A local privileged attacker can trigger a UAF when queue_event() fails, as described in the CVE entry and corroborated by connected Astra Linux advisories. Mitigation/remediation is via the vendor/kern...

CVE-2023-35827

CVE-2023-35827 : A use-after-free in the Linux kernel up to version 6.3.8 is reported, specifically in ravb_remove() inside drivers/net/ethernet/renesas/ravb_main.c. The issue arises from a use-after-free in the Renesas AVB/RAVB driver, as described in Astra Linux and Nessus feeds. The vulnerabil...

CVE-2023-52593

CVE-2023-52593 concerns a potential NULL pointer dereference in the Linux kernel’s wifi driver wfx. The issue arises because ieee80211_beacon_get() can return NULL, and wfx_set_mfp_ap() did not validate this before inspecting skb data. The fix converts wfx_set_mfp_ap() to return an error code whe...

CVE-2023-53002

CVE-2023-53002 concerns the Linux kernel DRM/I915 memory leak when mmap_offset is reused. The root cause is that drm_vma_node_allow() and drm_vma_node_revoke() were not called in balanced pairs: allow is invoked once per-file per mmap_offset, while revoke was only called per-file per mmap_offset,...

CVE-2023-53015

CVE-2023-53015 affects the Linux kernel HID betop: betopff_init() verifies only the total sum of report field counts (>=4) while hid_betopff_play() requires exactly 4 fields, enabling a NULL pointer dereference when an output report has one field with four counts. Multiple connected advisories...

CVE-2024-25740

CVE-2024-25740 describes a memory leak in the Linux kernel UBI driver (drivers/mtd/ubi/attach.c) up to version 6.7.4 for UBI_IOCATT, where kobj->name is not released. The issue affects the kernel code path used to attach UBI devices and is documented with an impact of high on availability. Con...

CVE-2024-26635

CVE-2024-26635 affects the Linux kernel LLС path. The issue arises from legacy support for ETH_P_TR_802_2 in 802.2 LLC handling, where llc_conn_handler/llc_pdu_decode paths initialized saddr/daddr.mac only for ETH_P_802_2, causing reads of garbage in other protocols (e.g., ETH_P_TR_802_2). The bu...

CVE-2024-26693

CVE-2024-26693 (Linux kernel wifi/iwlwifi - mvm) : A DoS crash occurs when the AP runs out of stations in firmware. The root cause is that iwl_mvm_is_dup() cannot find the per-queue dup_data, which was not allocated. This happened because MAC80211 expected a station to exist (sta_info::uploaded s...

CVE-2024-26805

CVE-2024-26805 (Linux kernel) fixed a kernel-infoleak-after-free in netlink path. The issue occurred in __skb_datagram_iter via netlink_to_full_skb, where len was computed from skb->end (buffer offset) instead of skb->len (actual data length), causing uninit memory to be copied. The patch c...

CVE-2024-27394

CVE-2024-27394 affects the Linux kernel, in the tcp_ao_connect_init path. The vulnerability arises because call_rcu is used during hlist_for_each_entry_rcu traversal outside the RCU read critical section, allowing the RCU grace period to pass while the key may still be referenced, creating a Use-...

CVE-2024-38543

CVE-2024-38543 : In the Linux kernel, a vulnerability in lib/test_hmm.c arose from allocation failures for src_pfns/dst_pfns. If kcalloc() returns NULL, dereferencing these pointers could trigger a null pointer dereference, especially as the device could be evicted. Remediation implemented: add a...

CVE-2024-43893

CVE-2024-43893 (Linux kernel) fixes a divide-by-zero in uart_get_divisor triggered by TIOCSSERIAL with an invalid baud_base when uartclk becomes zero. The patch adds a zero-check for uartclk in uart_set_info() before subsequent serial_setup calls, preventing a divide-by-zero and potential oops on...

CVE-2024-46867

In CVE-2024-46867, the Linux kernel component drm/xe/client exhibited a deadlock and an atomic sleep issue in show_meminfo when the bo (buffer object) being destroyed had the last reference. The root cause was the destruction path attempting to grab the same spinlock, risking a sleep in atomic co...

CVE-2024-47679

In CVE-2024-47679, a race exists in the Linux kernel VFS between evict_inodes() (triggered via iput() and generic_shutdown_super()) and btrfs/iget() path through find_inode(). The race can allow an inode (example ino 261) to be evicted by one thread while another thread revalidates and reuses it,...

CVE-2024-47809

CVE-2024-47809 (Linux kernel) fixes a possible NULL pointer dereference in the DLM code path when a lock block (lkb) is created but the lkb_resource is not yet assigned (until attach_lkb via validate_lock_args). The issue could occur when request_lock() calls, potentially exposing a crash; anothe...

CVE-2024-50010

CVE-2024-50010 affects the Linux kernel’s exec path checks. The issue is a race in the path_noexec (and i_mode) checks that led to spurious WARN_ON warnings when noexec is toggled, rather than a real permission failure. The fix removes the redundant path_noexec WARN and updates commentary; no exp...