CVE-2016-6198

CVE-2016-6198 affects the Linux kernel (pre-4.5.5) in its OverlayFS path. The bug occurs when a file under OverlayFS is renamed to a self-hardlink, causing post-rename operations to run and potentially crash the kernel. Local users can trigger a denial of service (system crash) via a rename sysca...

CVE-2017-15116

CVE-2017-15116 affects the Linux kernel rngapi_reset() in crypto/rng.c, vulnerable before version 4.2. The issue allows a local attacker to trigger a NULL pointer dereference, causing a denial of service. Connected Nessus advisories (Unity Linux and EulerOS entries) reiterate the same description...

CVE-2019-19241

CVE-2019-19241 affects the Linux kernel prior to 5.4.2 where the io_uring path can cause requests to appear with UID 0 and full capabilities due to IORING_OP_SENDMSG handling by kernel worker threads in contexts from unprivileged users. Affected code paths include fs/io-wq.c, fs/io_uring.c, and n...

CVE-2022-48629

Summary : CVE-2022-48629 affects the Linux kernel crypto RNG for Qualcomm (qcom-rng). The issue arises in qcom_rng_read() and qcom_rng_generate() where the destination buffer may not be fully filled on success, leaving trailing zeros when the RNG can return 0 from the generate() function. This co...

CVE-2022-48947

CVE-2022-48947 is a Linux kernel vulnerability related to Bluetooth L2CAP u8 overflow. By repeatedly sending L2CAP_CONF_REQ, chan->num_conf_rsp could wrap at 255. The fix adds a boundary check using L2CAP_MAX_CONF_RSP to prevent overflow. Connected advisories (e.g., Unity Linux/Astra Linux ent...

CVE-2022-49179

CVE-2022-49179 is a Linux kernel UAF in the block I/O BFQ scheduler (block, bfq: don’t move oom_bfqq). The issue manifests as a use-after-free in bfq_put_async_bfqq() during module removal (rmmod) and BFQ/blk-mq teardown, with 1024-byte slab allocations implicated. Unity Linux advisories UTSA-202...

CVE-2022-49197

CVE-2022-49197 affects the Linux kernel’s netlink af_netlink path. When netlink messages are received, netlink_recvmsg() fills sender info including a 32-bit nl_groups bitfield that indicates multicast group membership. The issue is a shift-out-of-bounds in computing the group mask for high-numbe...

CVE-2022-49220

CVE-2022-49220 affects the Linux kernel in the dax subsystem. The issue occurs when inodes are not flushed before destroying dax_cache, triggered by loading and unloading the nd_pmem modules. The root cause is in dax_fs_exit() not flushing inodes prior to cache destruction, which can lead to obje...

CVE-2022-49329

CVE-2022-49329: In the Linux kernel (vdpa/vduse), a NULL pointer dereference can occur when reading the control device’s msg_timeout attribute via sysfs because the control device lacks drvdata. The fix, per the provided description, is to stop creating the unneeded attribute for the control devi...

CVE-2022-49343

CVE-2022-49343 (Linux kernel ext4) : A vulnerability in the ext4 filesystem’s h-tree directory structure allows cycles to exist in a directory’s h-tree, which can cause the kernel to access unallocated memory during a node split when traversing blocks. The root cause is that a corrupted filesyste...

CVE-2022-49394

The CVE-2022-49394 entry describes a Linux kernel vulnerability in blk-iolatency where inflight IO counters could become imbalanced and IOs hang when a cgroup with iolatency is offline or disabled. The root cause is that enabled counters could be manipulated in iolatency_set_limit() and iolatency...

CVE-2022-49578

CVE-2022-49578 concerns a data race in the Linux kernel related to sysctl_ip_prot_sock. The root cause is concurrent access to sysctl_ip_prot_sock, causing load/store tearing unless proper synchronization is used. The vulnerability affects the kernel’s IP/sysctl handling and is stated as resolved...

CVE-2022-49625

CVE-2022-49625: In the Linux kernel, the sfc driver could trigger a kernel panic when creating VFs due to a faulty buffer release path in vunmap in IRQ context. The issue stems from an IRQ/BH context restriction during DMA buffer release, with a patch that re-enables BH to safely release the buff...

CVE-2022-49728

CVE-2022-49728 affects the Linux kernel’s IPv6 path. The issue is a signed integer overflow in __ip6_append_data, triggered by computing [length] that could exceed int range (UBSAN report: 2147479552 + 8567 cannot be represented in type int). The fix implemented across patches changes the [length...

CVE-2023-23004

CVE-2023-23004 affects Linux kernel before 5.19. In drivers/gpu/drm/arm/malidp_planes.c, get_sg_table return value is misinterpreted: code expects NULL in error case, but it is an error pointer. This could lead to a kernel crash/undefined behavior as described in the vendor advisories (e.g., Chan...

CVE-2023-33288

CVE-2023-33288 affects the Linux kernel up to version 6.2.8, with a fix in 6.2.9. Root cause: a use-after-free in bq24190_remove (drivers/power/supply/bq24190_charger.c) that can race and lead to a local attacker crashing the system. Affected component: bq24190_charger.c within the power supply d...

CVE-2023-52675

Concretely tied to CVE-2023-52675 in the Linux kernel: the issue is twofold. (1) powerpc/imc-pmu: update_events_in_group() gained a null pointer check to prevent dereferencing NULL during event updates. (2) kasprintf() can return NULL if memory allocation fails, which could lead to a NULL pointer...

CVE-2023-52766

CVE-2023-52766 : In the Linux kernel, the i3c mipi-i3c-hci component suffers an out-of-bounds access in hci_dma_irq_handler when looping over rings->headers[i] beyond the number of allocated headers. The fix prevents iterating over non-allocated ring headers in hci_dma_init(), stopping the out...

CVE-2023-53015

CVE-2023-53015 affects the Linux kernel HID betop: betopff_init() verifies only the total sum of report field counts (>=4) while hid_betopff_play() requires exactly 4 fields, enabling a NULL pointer dereference when an output report has one field with four counts. Multiple connected advisories...

CVE-2024-26842

The CVE-2024-26842 issue is a Linux kernel vulnerability in the SCSI UFS host controller code (ufshcd_clear_cmd). In MCQ mode, when task_tag >= 32 and sizeof(unsigned int) == 4, 1U <

CVE-2024-36476

CVE-2024-36476 affects the Linux kernel's RDMA/rtrs path. The vulnerability stems from ib_sge list being declared inside the always_invalidate block, which could lead to a NULL pointer dereference and kernel instability. The fix moves the ib_sge list declaration to a scope accessible throughout t...

CVE-2024-40916

The CVE-2024-40916 issue concerns the Linux kernel DRM/Exynos HDMI driver. When EDID reading fails and the driver reports no modes, the DRM core previously exposed a 1024x786 mode which some Exynos HDMI variants cannot drive. The fix changes this fallback to a safe 640x480 mode to avoid rendering...

CVE-2024-40957

CVE-2024-40957 (Linux kernel seg6) relates to parameter passing when NF_HOOK() is invoked from End.DX4 and End.DX6 in PREROUTING. input_action_end_dx4() and input_action_end_dx6() incorrectly passed a NULL outdev or invalid indev to NF_HOOK(), which can trigger a NULL pointer dereference in rpfil...

CVE-2024-42160

Summary (CVE-2024-42160): In the Linux kernel, the f2fs subsystem had a validation gap in fault attribute handling. Specifically, fault attrs were not validated in parse_options(), and the patch adds a check in f2fs_build_fault_attr() and switches to using f2fs_build_fault_attr() in __sbi_store()...

CVE-2024-43890

CVE-2024-43890: Linux kernel tracing overflow in get_free_elt() is fixed. The issue was that tracing_map->next_elt could overflow beyond tracing_map->max_elt, allowing insertion into a full tracing_map and potentially causing an infinite loop with preemption disabled, leading to a CPU hang....

CVE-2024-44942

CVE-2024-44942 concerns the Linux kernel’s f2fs inline data handling during garbage collection. According to the connected Astra Linux bulletin, the root cause is that an inline_data inode can be fuzzed, allowing a valid blkaddr in its direct node; when background GC migrates the block, a f2fs_bu...

CVE-2024-46777

CVE-2024-46777 concerns the Linux kernel udf component where the vulnerability arises from handling partition lengths that could overflow 32-bit block numbers and unsafe indexing of the block bitmap. The connected sources confirm the issue is fixed in kernel code by rejecting mounting filesystems...

CVE-2024-47684

Technical details about CVE-2024-47684 are not publicly provided in the supplied documents; no affected products, versions, root cause, or fixes are disclosed here. Monitor for updates.

CVE-2024-47699

CVE-2024-47699 relates to the Linux kernel nilfs2 filesystem. The issue is a potential NULL pointer dereference in nilfs_btree_insert() when the b-tree root is broken and has height > 1, even if the root has 0 children. The root cause is that, in certain corrupted images, nilfs_btree_do_lookup...

CVE-2024-47712

CVE-2024-47712 affects the Linux kernel, specifically a WiFi driver issue in wilc1000. The bug occurs in wilc_parse_join_bss_param where the TSF field of the ies structure is accessed after unlocking the RCU read-side critical section, violating RCU usage rules and risking use-after-free or memor...

CVE-2024-49914

CVE-2024-49914 affects the Linux kernel DRM/AMD display path. A null pointer dereference could occur in dcn20_program_pipe when pipe_ctx->plane_state is null; a patch adds a guard to verify pipe_ctx->plane_state is non-null before access. This stabilizes display pipe programming and prevent...

CVE-2024-49920

The CVE-2024-49920 entry concerns the Linux kernel DRM/AMD display subsystem. The vulnerability arises from a null-pointer risk in the AMD display path, where pointers such as stream_enc and dc->bw_vbios are used multiple times after a check that is only performed earlier in the function. The ...

CVE-2024-49955

CVE-2024-49955 : In the Linux kernel, ACPI battery handling fixes a crash when unregistering a battery hook. If a battery hook returns an error while adding a battery, the hook is auto-unregistered; the provider cannot detect this, and later calls to battery_hook_unregister() on an already-unregi...

CVE-2024-50042

Technical details for CVE-2024-50042 are not publicly available in the provided documents. The connected advisories list kernel issues but do not disclose the affected product/version, root cause, impact, or a concrete fix for this CVE. Monitor for updates.

CVE-2024-50116

CVE-2024-50116 relates to a Linux kernel nilfs2 bug where the buffer delay flag was not cleared when discarding a page/folio or buffer head, leading to a BUG_ON in submit_bh_wbc() after reading a corrupted filesystem image and degraded read-only. The issue is caused by not clearing the buffer del...

CVE-2024-50184

CVE-2024-50184 describes a Linux kernel vulnerability in virtio_pmem where a pmem device in a bad status could cause the host to wait indefinitely for an ack in virtio_pmem_flush(), leading to a system hang. The issue is resolved by adding a status check at the start of virtio_pmem_flush() to ret...

CVE-2024-50286

The CVE-2024-50286 entry concerns the Linux kernel ksmbd subsystem. A race exists between ksmbd_smb2_session_create and ksmbd_expire_session that can lead to a use-after-free in the global sessions table. The fix adds a missing sessions_table_lock when adding or deleting sessions from the global ...

CVE-2024-53075

The CVE-2024-53075 entry concerns the Linux kernel riscv path used while populating cache leaves. Root cause: when ACPI is enabled, the code path early-returns and omits of_node_put for the CPU device node, creating a potential bad reference count. The fix moves the CPU node initialization to aft...

CVE-2024-53191

CVE-2024-53191 affects the Linux kernel, specifically the ath12k driver for WLAN (PCI/PCIE path). The issue arises when an initialization error during firmware handling leaves buffers dp->tx_ring[i].tx_status released, but they are freed again during device unbinding (ath12k_pci_remove), causi...

CVE-2024-56632

A connected report (BDU:2025-15313) describes a memory-leak vulnerability in the Linux kernel NVMe over TCP driver, specifically nvme_tcp_setup_ctrl() in driver/nvme/host/tcp.c. The issue leaks memory (tagset occupied by admin_q) when creating a new ctrl fails, potentially causing service failure...

CVE-2024-56679

Technical details for CVE-2024-56679 are not publicly available in the provided documents. Please monitor for updates from upstream advisories and vendor advisories to obtain affected products, root cause, and remediation.

CVE-2024-57907

CVE-2024-57907 concerns the Linux kernel IIO ADC driver for Rockchip (rockchip_saradc). The vulnerability arises because the local data structure used to push data to userspace from a triggered buffer was not fully initialized; values for inactive channels were left undefined since only active ch...

CVE-2025-21799

CVE-2025-21799 covers a Linux kernel net:ethernet:ti:am65-cpsw issue. The root cause is improper IRQ handling: k3_udma_glue_tx_get_irq() may return a negative error value, and a non-null check is not sufficient; the IRQ must be validated as > 0. At runtime, .set_channels can trigger a chain th...

CVE-2025-22027

CVE-2025-22027 affects the Linux kernel, specifically the media: streamzap component. The issue is a race between device disconnection and urb callback that leads to a NULL pointer dereference of dev->raw in ir_raw_event_store_with_filter, even though NULL checks exist in the function. The roo...

CVE-2025-22063

CVE-2025-22063 is a Linux kernel vulnerability in netlabel CALIPSO handling that can trigger a NULL pointer dereference when an IPv4 socket is used with an IPv6 connect. The issue arises from evaluating sk_fullsock(__sk) ? inet_sk(__sk)->pinet6 : NULL and accessing pinet6 for an IPv4 socket. A...

CVE-2025-37771

CVE-2025-37771 affects the Linux kernel (drm/amd/pm) with a division-by-zero flaw when the user sets a speed value greater than UINT_MAX/8. It is a local vulnerability; kernel fixes are referenced in upstream commits (e.g., 6413fed016208171592c88b5df002af8a1387e24 and related edits). The issue ha...

CVE-2025-37792

The CVE-2025-37792 issue affects the Linux kernel Bluetooth btrtl driver (rtl load file path). root cause: btrtl_initialize() may treat a zero-length rtl_load_file() as non-error, causing an error pointer vs NULL and a subsequent NULL dereference. Severity is MEDIUM (CVSSv3.1 base 5.5), with loca...

CVE-2025-37871

CVE-2025-37871 is a Linux kernel vulnerability fixed by changing how sc_count is decremented when a dl_recall queue operation fails for NFS delegations. The described scenario shows a deadlock warning during nfs4_put_stid after a failed dl_recall queue, caused by a potential lock ordering issue w...

CVE-2025-40014

Technical details for CVE-2025-40014 are not publicly provided in the connected documents. The supplied materials do not specify affected products/versions or remediation. Monitor for updates.

CVE-2025-40364

CVE-2025-40364 : In the Linux kernel, the io_uring path titled “io_req_prep_async with provided buffers” has been resolved. The issue allowed io_req_prep_async() to import provided buffers and then commit the ring state by giving up on that path, with the buffers potentially being reimported late...