CVE-2024-56582

CVE-2024-56582: Linux kernel btrfs use-after-free in btrfs_encoded_read_endio() identified via KASAN trace in btrfs-endio path; confirmed in the provided trace and fixed in the kernel. Affected component: btrfs in the kernel; root cause: use-after-free in btrfs_encoded_read_endio(); impact as des...

CVE-2024-56632

CVE-2024-56632 : Linux kernel — nvme-tcp: memory leak when creating a new control path fails. The fix ensures the tagset occupied by admin_q is freed if ctrl creation fails. From the provided metrics, the CVSSv3.1 base score is 5.5 (Medium) with HIGH availability impact; local attacker with LOW p...

CVE-2024-56773

CVE-2024-56773 : In the Linux kernel, a potential NULL pointer dereference could occur in kunit_device_driver_test() when kunit_kzalloc() returns NULL and is dereferenced without a NULL check. The patch adds a NULL check for test_state to mitigate this. The CVE details, including its impact and e...

CVE-2024-57907

CVE-2024-57907 concerns the Linux kernel IIO ADC driver for Rockchip (rockchip_saradc). The vulnerability arises because the local data structure used to push data to userspace from a triggered buffer was not fully initialized; values for inactive channels were left undefined since only active ch...

CVE-2025-21943

The CVE-2025-21943 entry concerns a Linux kernel vulnerability in the gpio_aggregator driver. Description: new_device_store and delete_device_store touch module-global resources (e.g., gpio_aggregator_lock). To prevent race conditions during module unload, the fix adds a reference held via try_mo...

CVE-2025-21966

Summary (CVE-2025-21966): Linux kernel vulnerability in the dm-flakey feature, where memory corruption could occur due to an incorrect parameter passed to bio_init in the optional corrupt_bio_byte path. The issue has been fixed in the kernel, with related fixes cited in public kernel patches (e.g...

CVE-2025-22075

CVE-2025-22075 affects the Linux kernel (netlink rtnetlink path) where VF port/node GUIDs were previously included in ifinfo messages but their size wasn’t accounted for when allocating netlink messages. The issue could produce a “Message too long” warning when many VFs are configured (for exampl...

CVE-2025-23159

CVE-2025-23159 affects the Linux kernel media/venus/hfi component. The issue arises from sfr->buf_size stored in shared memory being modifiable by a local attacker, allowing an out-of-bounds write when the size exceeds the actual SFR data. The fix caps the reported size to the allocated SFR bu...

CVE-2025-37788

CVE-2025-37788 affects the Linux kernel cxgb4 memory handling: in cxgb4_init_ethtool_filters(), a memory leak can occur if loc_array is allocated but bmap allocation fails, because the free path only frees from (i-1) iterations. The fix frees loc_array in the bmap error path, mitigating the leak....

CVE-2025-37803

CVE-2025-37803 : Linux kernel vulnerability in udmabuf where a buffer size overflow can occur during udmabuf creation. The root cause is improper size calculation, mitigated by casting size_limit_mb to u64 when computing pglimit. Connected advisories corroborate a kernel fix; patches are deployed...

CVE-2025-37850

The CVE-2025-37850 issue relates to the Linux kernel PWM Mediatek driver. Under CONFIG_COMPILE_TEST && !CONFIG_HAVE_CLK, pwm_mediatek_config() could divide by zero when obtaining the clock rate for pc->clk_pwms[pwm->hwpwm], because clk_get_rate() may return zero in the !CONFIG_HAVE_CLK path...

CVE-2025-38240

The CVE-2025-38240 entry concerns a NULL pointer dereference in Linux kernel Mediatek DP/HPD path (mtk_dp_wait_hpd_asserted) when mtk_dp->drm_dev is not yet assigned, leading to NULL dereferences if drm prints are emitted in the call path. The issue is mitigated by changing error messages to u...

CVE-2010-4081

CVE-2010-4081 affects the Linux kernel (sound/pci/rme9652/hdspm.c: snd_hdspm_hwdep_ioctl). The root cause is failure to initialize a structure, enabling local users to read potentially sensitive kernel stack memory via SNDRV_HDSPM_IOCTL_GET_CONFIG_INFO. Affected: kernel versions prior to 2.6.36-r...

CVE-2011-1576

CVE-2011-1576 affects the Linux kernel GRO offload path (napi_reuse_skb) used in Red Hat Enterprise Linux 5 (kernel 2.6.18) and Red Hat Enterprise Linux 6 (kernel 2.6.32) as deployed in RHEV Hypervisor. The advisory notes that remote attackers can trigger VLAN-packet processing to cause a denial ...

CVE-2013-2164

The CVE-2013-2164 issue affects the Linux kernel (mmc_ioctl_cdrom_read_data in drivers/cdrom/cdrom.c) and allows local users to read kernel memory from a malfunctioning CD-ROM. Affected context: Linux kernel up to version 3.10; exploitation requires local access. Impact per sources: local informa...

CVE-2014-0069

The CVE-2014-0069 entry affects the Linux kernel (fs/cifs/file.c: cifs_iovec_write) up to version 3.13.5. The vulnerability stems from improper handling of uncached write operations that copy fewer bytes than requested, enabling local users to read kernel memory (information disclosure), cause me...

CVE-2014-0131

CVE-2014-0131 affects the Linux kernel up to version 3.13.6. The vulnerability is a use-after-free in the skb_segment function within net/core/skbuff.c caused by the absence of a certain orphaning operation. Exploitation details are not provided in the supplied documents. The impact is that an at...

CVE-2014-2678

CVE-2014-2678 affects the Linux kernel (net/rds/iw.c). The rds_iw_laddr_check function can be triggered by a bind() on an RDS socket on systems lacking RDS transports, enabling local attackers to cause a NULL pointer dereference and a system crash (DoS). This is described as affecting kernels up ...

CVE-2014-3180

CVE-2014-3180 affects the Linux kernel prior to 3.17, specifically the compatibility code path in kernel/compat.c. The vulnerability is an out-of-bounds read where restart_syscall uses uninitialized data when restarting compat_sys_nanosleep. Note: the description states the code path is unreachab...

CVE-2014-4653

Summary (CVE-2014-4653) : The ALSA control implementation in the Linux kernel has a race/lock handling issue in sound/core/control.c. It does not ensure possession of a read/write lock, enabling a local attacker to trigger a denial of service (use-after-free) and to potentially read kernel memory...

CVE-2014-4654

The CVE-2014-4654 issue affects the Linux kernel ALSA control implementation (snd_ctl_elem_add in sound/core/control.c). The root cause is a lack of authorization checks for SNDRV_CTL_IOCTL_ELEM_REPLACE commands, allowing local attackers with access to /dev/snd/controlX to remove kernel controls....

CVE-2016-2053

CVE-2016-2053: The Linux kernel’s asn1_ber_decoder in lib/asn1_decoder.c is vulnerable to denial-of-service (panic) via a crafted ASN.1 BER file that lacks a public key. The issue occurs in kernel builds prior to 4.3. Consequence is a local DoS without authenticated user interaction. Affected com...

CVE-2016-6327

CVE-2016-6327 affects the Linux kernel: the infiniband ulp srpt driver (ib_srpt.c) before 4.5.1 is vulnerable to a local denial-of-service via an ABORT_TASK command that aborts a device write operation, leading to a NULL pointer dereference and system crash. Affected are kernels prior to 4.5.1; r...

CVE-2016-9644

CVE-2016-9644 involves the Linux kernel, where the __get_user_asm_ex macro in arch/x86/include/asm/uaccess.h, for kernels 4.4.22–4.4.28, uses extended asm statements that are incompatible with the exception table. This misalignment can allow local attackers to obtain root on non-SMEP platforms by...

CVE-2017-7374

CVE-2017-7374 is a use-after-free in the Linux kernel fs/crypto/ subsystem prior to 4.10.7, where revoking keyring keys used for ext4, f2fs, or ubifs encryption can free cryptographic transform objects prematurely. This enables local attackers to cause a denial of service via a NULL pointer deref...

CVE-2018-13100

CVE-2018-13100 concerns the Linux kernel, specifically fs/f2fs/super.c up to version 4.17.3, where improper validation of secs_per_zone in a corrupted f2fs image can trigger a divide-by-zero error. The connected advisories confirm the issue and reproduce conditions but do not provide a patch vers...

CVE-2018-14610

CVE-2018-14610 concerns the Linux kernel up to 4.17.10. A crafted btrfs image mounting scenario can trigger an out-of-bounds access in write_extent_buffer() due to insufficient verification that each block group has a corresponding chunk at mount time (in fs/btrfs/extent-tree.c). This can lead to...

CVE-2018-16597

CVE-2018-16597 affects the Linux kernel prior to version 4.8. The issue is an incorrect access check in overlayfs mounts, which could allow a local attacker to modify or truncate files on the underlying filesystem. The connected Nessus/OpenVAS advisories reference kernel updates to fix this vulne...

CVE-2019-10142

CVE-2019-10142 references a flaw in the Linux kernel's freescale hypervisor manager implementation. A parameter passed to an ioctl was not properly validated and was used in size calculations for page size, making the kernel vulnerable on 5.0.x kernels before 5.0.17. Exploitation could crash the ...

CVE-2021-47311

CVE-2021-47311 is a Linux kernel memory use-after-free (UAF) vulnerability in net: qcom/emac, caused by private data (adpt) being used after free_netdev() is called. The fix moves free_netdev() to the end of emac_remove to ensure adpt is not accessed after the netdev is freed. Public advisories (...

CVE-2022-48629

CVE-2022-48629 concerns the Linux kernel crypto/qcom-rng implementation. The issue arises when the RNG generate function can leave part of the destination buffer zeroed if qcom_rng_read() returns a success but qcom_rng_generate() does not verify the value, causing the destination to be only parti...

CVE-2022-48735

CVE-2022-48735 concerns a use‑after‑free in the Linux kernel ALSA hda LED class devices created by HD‑audio codec drivers. The issue arises because LED class devices are registered via devm_led_classdev_register() and tied to the codec device, but the devres release can execute before the devm ch...

CVE-2022-49093

CVE-2022-49093 affects the Linux kernel’s skbuff coalescing with page_pool fragments. The issue is a use-after-free during RX coalescing when SKBs share a PAGE2 reference via skb_shinfo()->dataref, while a third RX descriptor still uses PAGE2. During a coalescing attempt (SKB3 into SKB1), __sk...

CVE-2022-49347

CVE-2022-49347 concerns a Linux kernel issue in ext4 where a bug_on can trigger during ext4_writepages in delay allocation mode when inline data has been converted to an extent. The root cause described across the provided documents is a race: inline data may be destroyed before ext4_writepages r...

CVE-2022-49605

Summary: CVE-2022-49605 concerns the igc Linux kernel driver. The issue arose because the IGC_REMOVED macro was not implemented, unlike the similar E1000/IGB patterns, allowing a PCIe detach scenario to trigger NULL dereferences after an 0xffffffff MMIO read. The connected documents describe the ...

CVE-2022-49616

CVE-2022-49616 affects Linux kernel ASoC Realtek rt7*-sdw headset codecs. The rt700, rt711, and rt711-sdca drivers lacked a null check on the card pointer in jack_detect_handler, allowing potential NULL dereferences during driver bind/unbind tests. Patch/mitigation involves hardened jack_detect_h...

CVE-2022-49673

CVE-2022-49673 concerns the Linux kernel where a KASAN warning in raid5_add_disk was mitigated by validating that rdev->saved_raid_disk is within expected limits during LVM tests (dm raid). The fix is described as adjusting the raid5_add_disks path to ensure bound checks, with the associated c...

CVE-2022-49788

Summary: CVE-2022-49788 in the Linux kernel affects the vmware vmci host datagram path. The issue is an information leak caused by padding in the vmci_event_qp struct allocated by qp_notify_peer(); uninitialized data could be exposed to userspace via copy_to_user. The vulnerability is tied to vmc...

CVE-2023-52731

CVE-2023-52731 relates to the Linux kernel fbdev with deferred I/O. After a fbdev device is opened and closed, dirty pages can remain in the pageref list and may later be processed, risking memory/page corruption and an Oops. The fix adds cancellation of the delayed work and cleans up the pageref...

CVE-2023-52913

CVE-2023-52913 affects the Linux kernel’s drm/i915 component, where gem_context_register() exposes a GEM context to userspace and later code path allows a separate thread to trigger I915_GEM_CONTEXT_DESTROY. The root cause is using the ctx pointer after context destruction and not making the ctx ...

CVE-2023-52975

CVE-2023-52975 affects the Linux kernel SCSI/iscsi_tcp component. A use-after-free (UAF) can occur during iSCSI session logout if another task accesses the shost ipaddress attribute, triggering KASAN reports. The issue has concrete fixes in the Linux kernel (e.g., commits in the referenced reposi...

CVE-2024-26736

CVE-2024-26736 (Linux kernel afs): A local vulnerability in afs_update_volume_status() where volume->vid is limited to 20 characters, risking a buffer overflow. The fix increases idbuf size from 20 to 24 and uses snprintf to prevent overflow. Affected: Linux kernel (afs subsystem). Reported by...

CVE-2024-35819

CVE-2024-35819 affects the Linux kernel subsystem soc: fsl: qbman, where smp_call_function is used and can run callbacks in hard IRQ context; to prevent potential sleeping-task issues on PREEMPT_RT, the advisory specifies using a raw spinlock for cgr_lock. The root cause is that smp_call_function...

CVE-2024-42081

CVE-2024-42081 affects the Linux kernel component drm/ xe/ xe_devcoredump. The root cause was assigning xe_devcoredump_snapshot* and xe_device* unconditionally; the fix adds a NULL check and only assigns these pointers when coredump is not NULL. CVSS: Low-Privilege Local access with Medium overal...

CVE-2024-42259

CVE-2024-42259 : Linux kernel fix for drm/i915/gem virtual memory mapping boundaries. The issue arose from calculating the mapped area size as the lesser of requested vs actual size, not accounting for partial mapping offsets, leading to potential page fault access. The patch now derives the tota...

CVE-2024-42289

The CVE-2024-42289 issue in the Linux kernel affects the SCSI qla2xxx driver during vport delete. It caused a crash due to stale outstanding I/O entries not completing, leading to a NULL pointer dereference in dma_direct_unmap_sg during vport deletion. The fix explicitly sends an async logout for...

CVE-2024-43839

CVE-2024-43839 : Linux kernel vulnerability fixed by increasing the internal name buffer in bna_tcb and bna_ccb from 16 to accommodate longer sprintf arguments, and replacing sprintf with snprintf. The change accounts for bnad->netdev->name and expected expansions for %d specifiers, using B...

CVE-2024-43858

CVE-2024-43858 : In the Linux kernel, the JFS filesystem has a fix for an array-index-out-of-bounds in diFree. The IBM bulletin lists this CVE among multiple kernel issues and does not provide a specific remediation version in the supplied documents. Technical detail: the issue is an array-index-...

CVE-2024-46777

CVE-2024-46777 relates to the Linux kernel udf filesystem: the vulnerability arises when mounting a filesystem where the partition length would overflow 32-bit block numbers or where indexing into the block bitmap could be unsafe. The description in the initial CVE specifies that the fix is to av...

CVE-2024-46816

CVE-2024-46816 affects the Linux kernel DRM/AMD display path (amdgpu_dm). The vulnerability arises when initializing display links: the code assumes dc->links has up to max_links elements, but a link count can reach AMDGPU_DM_MAX_DISPLAY_INDEX (31), risking an out-of-bounds condition during in...