CVE-2016-2188

CVE-2016-2188 entry is rejected and not used.

CVE-2017-16527

CVE-2017-16527 affects the Linux kernel component sound/usb/mixer.c, vulnerable before version 4.13.8. A crafted USB device can trigger a snd_usb_mixer_interrupt use-after-free, causing denial of service or system crash. Exploitation vectors are local to physical USB device interaction. The conne...

CVE-2017-18255

CVE-2017-18255 affects the Linux kernel: the perf_cpu_time_max_percent_handler in kernel/events/core.c (pre-4.11) can be triggered by a large value, causing a denial of service via integer overflow (and potential unspecified impact). It requires local access. A fix is available in kernel 4.11 and...

CVE-2021-47063

CVE-2021-47063 concerns the Linux kernel DRM: bridge/panel code. The vulnerability arises because a devm-allocated drm_connector can outlive drm_mode_config_cleanup(), so the connector must be cleaned up when the bridge is detached to avoid use-after-free. The fix adds cleanup in panel_bridge_det...

CVE-2021-47412

CVE-2021-47412 affects the Linux kernel block layer rq_qos path. The root cause was calling rq_qos_ops->done_bio for bio structures that aren’t tracked, risking a kernel panic. The fix prevents done_bio from running if the bio isn’t tracked (bio_endio paths and queue references are safer). Thi...

CVE-2022-48884

CVE-2022-48884 affects the Linux kernel in the mlx5 driver stack. The root cause is a NULL pointer dereference that can occur when command stats are freed and reallocated during a mlx5 devlink reload, causing a crash if a command is issued while reinitialization is incomplete. The concrete fix im...

CVE-2022-49093

CVE-2022-49093 is a Linux kernel vulnerability affecting the page_pool fragment handling in skbuff coalescing. The issue is a use-after-free in page_pool fragments when SKBs are coalesced (SKB3) into a cloned/pp_recycle scenario during RX processing (illustrated with RX_BD1 PAGE1 and RX_BD2/3 PAG...

CVE-2022-49226

CVE-2022-49226 affects the Linux kernel's asix USB Ethernet driver. The root cause is that asix_read_cmd() can read fewer bytes than requested, potentially leaving callers with uninitialized data. The fix adds a sanity check to ensure the number of bytes read matches the request and propagates er...

CVE-2022-49257

CVE-2022-49257 affects the Linux kernel and stems from a NULL dereference in watch_queue_set_size() during error cleanup. The code path could call __free_page() on buffers that were not allocated, causing a NULL pointer dereference (observed as a KASAN report in __free_pages). The issue is mitiga...

CVE-2022-49347

CVE-2022-49347 concerns a Linux kernel issue in ext4 where a bug_on can trigger during ext4_writepages in delay allocation mode when inline data has been converted to an extent. The root cause described across the provided documents is a race: inline data may be destroyed before ext4_writepages r...

CVE-2022-49394

The CVE-2022-49394 entry describes a Linux kernel vulnerability in blk-iolatency where inflight IO counters could become imbalanced and IOs hang when a cgroup with iolatency is offline or disabled. The root cause is that enabled counters could be manipulated in iolatency_set_limit() and iolatency...

CVE-2022-49687

CVE-2022-49687 documents a Linux kernel vulnerability in virtio_net where suspend/resume can trigger a driver bug warning due to xdp_rxq_info not being unregistered/registered during freeze/restore. The root cause is that virtnet_freeze() frees the receive_queue (including xdp_rxq_info) without c...

CVE-2023-23004

CVE-2023-23004 affects Linux kernel before 5.19. In drivers/gpu/drm/arm/malidp_planes.c, get_sg_table return value is misinterpreted: code expects NULL in error case, but it is an error pointer. This could lead to a kernel crash/undefined behavior as described in the vendor advisories (e.g., Chan...

CVE-2023-40791

The CVE-2023-40791 issue is in the Linux kernel’s extract_user_to_sg (lib/scatterlist.c), where pages may not be properly unpinned in a specific scenario, evidenced by a WARNING for try_grab_page. The connected Nessus entry corroborates affected code and versions: Linux kernel before 6.4.12. This...

CVE-2023-52479

The CVE-2023-52479 issue is in the Linux kernel ksmbd SMB2 oplock handling, where a use-after-free occurs due to not dropping a reference to opinfo after smb20_oplock_break_ack. The provided documents state that the fix is to drop the reference after use of opinfo, resolving the use-after-free. T...

CVE-2023-52483

CVE-2023-52483 affects the Linux kernel where mctp_route_lookup/mctp_route_lookup_null traverse net->mctp.routes without an RCU read lock, allowing a potential race that could lead to a use-after-free due to a grace period expiry and a kfree while a route pointer is in use. The security adviso...

CVE-2023-52593

CVE-2023-52593 concerns a potential NULL pointer dereference in the Linux kernel’s wifi driver wfx. The issue arises because ieee80211_beacon_get() can return NULL, and wfx_set_mfp_ap() did not validate this before inspecting skb data. The fix converts wfx_set_mfp_ap() to return an error code whe...

CVE-2023-52617

CVE-2023-52617 : Linux kernel PCI: switchtec device crash on surprise hot-remove fixed. The issue occurred when a PCI device was hot-removed while stdev->cdev was open; stdev_release() ran after switchtec_pci_remove(), risking a fatal page fault in DMA mode and a stale dev pointer during dma_f...

CVE-2023-52638

CVE-2023-52638 : Linux kernel patch changes the j1939_socks_lock to an rwlock to prevent a deadlock among j1939_socks_lock, active_session_list_lock, and sk_session_queue_lock. Patched code reduces circular lock dependency when a thread already holds j1939_socks_lock and may acquire sk_session_qu...

CVE-2023-52740

The CVE-2023-52740 issue affects the Linux kernel on powerpc64s where a race occurs during interrupt exit with security mitigations (RFI/STF). The root cause is that the interrupt_exit_not_reentrant condition can be flipped concurrently with the interrupt exit tests that set MSR[EE|RI], and then ...

CVE-2023-52888

CVE-2023-52888 is a Linux kernel vulnerability affecting the MediaTek vcodec driver, where vcodec memory free operations may attempt to free a NULL VA without proper checks. The root cause is an unguarded path in mtk_vcodec_mem_free() that can trigger warnings and, in practice, exposes a potentia...

CVE-2023-6238

CVE-2023-6238 affects the Linux kernel NVMe driver. A buffer overflow allows a privileged user to provide a small meta buffer and trigger a larger DMA into that same buffer, overwriting unrelated kernel memory and causing random kernel crashes/memory corruption. The vulnerability is locally explo...

CVE-2024-26842

The CVE-2024-26842 issue is a Linux kernel vulnerability in the SCSI UFS host controller code (ufshcd_clear_cmd). In MCQ mode, when task_tag >= 32 and sizeof(unsigned int) == 4, 1U <

CVE-2024-36934

CVE-2024-36934 concerns a Linux kernel vulnerability where a kernel buffer allocated for a userspace copy of nbytes could lack a terminating NUL, causing an out-of-bounds read when sscanf is used on the buffer. The root cause is failing to ensure the copied buffer is NUL-terminated. The fix repla...

CVE-2024-38543

CVE-2024-38543 : In the Linux kernel, a vulnerability in lib/test_hmm.c arose from allocation failures for src_pfns/dst_pfns. If kcalloc() returns NULL, dereferencing these pointers could trigger a null pointer dereference, especially as the device could be evicted. Remediation implemented: add a...

CVE-2024-39482

CVE-2024-39482 (Linux kernel) : The vulnerability affects the bcache subsystem, specifically the btree_iter code path. The bug arises from a fixed-length array inside the btree_iter structure that is indexed out-of-bounds when iterators are created with dynamic size, triggering UBSAN complaints. ...

CVE-2024-39496

CVE-2024-39496 affects the Linux kernel, specifically the btrfs: zoned code path. The issue is a use-after-free caused by a race between loading a zone’s info during block group creation and an ongoing device replacement; if the device being loaded is the source of the replacement, the device can...

CVE-2024-39498

CVE-2024-39498 (Linux kernel) resolves a NULL pointer dereference in the DRM MST path during payload handling. The issue stemmed from an overwrite in a refactored payload allocation/removal flow, which regressed when two commits touched in drm_dp_add_payload_part2 used/modified the state input. T...

CVE-2024-42156

The CVE-2024-42156 issue concerns the Linux kernel s390/pkey code, where copies of clear-key structures are wiped on failure. The underlying flaw wipes sensitive data from the stack for all IOCTLs converting a clear-key into a protected- or secure-key, exposing confidentiality risk. Documents con...

CVE-2024-44940

CVE-2024-44940 pertains to the Linux kernel. The issue is a WARN_ON_ONCE in gue_gro_receive when the encapsulated protocol has no GRO handler; the packet is contrived (Syzbot-triggered) and not actionable. The fix removes this warning, as it is expected and not a vulnerability vector, by dropping...

CVE-2024-44985

CVE-2024-44985 affects the Linux kernel in the IPv6 path (ip6_xmit). The issue is a use-after-free risk: if skb_expand_head() returns NULL, skb and the associated dst/idev may be freed, requiring rcu_read_lock() to prevent UAF. The vulnerability is resolved upstream; commits listed in the connect...

CVE-2024-47661

The CVE-2024-47661 issue affects the Linux kernel’s drm/amd/display path, where dmub_rb_cmd's ramping_boundary was defined as uint8_t but assigned 0xFFFF. The fix changes ramping_boundary to a uint8_t value of 0xFF, addressing two integer-overflow problems reported by Coverity. Affected component...

CVE-2024-47691

CVE-2024-47691 affects the Linux kernel’s F2FS subsystem, tied to a race condition in f2fs_stop_gc_thread() that can cause a use-after-free in sbi->gc_th. The issue can occur during remount/shutdown scenarios where gc_th is freed, and a guard is needed via sb->s_umount semaphore. The descri...

CVE-2024-47712

CVE-2024-47712 affects the Linux kernel, specifically a WiFi driver issue in wilc1000. The bug occurs in wilc_parse_join_bss_param where the TSF field of the ies structure is accessed after unlocking the RCU read-side critical section, violating RCU usage rules and risking use-after-free or memor...

CVE-2024-47735

CVE-2024-47735 concerns the Linux kernel: RDMA/hns: Fix spin_unlock_irqrestore() called with IRQs enabled and correct misuse of spin_lock_irq()/spin_unlock_irq() when spin_lock_irqsave()/spin_lock_irqrestore() was held. The description and connected docs show the issue originated from lock debugg...

CVE-2024-49914

CVE-2024-49914 affects the Linux kernel DRM/AMD display path. A null pointer dereference could occur in dcn20_program_pipe when pipe_ctx->plane_state is null; a patch adds a guard to verify pipe_ctx->plane_state is non-null before access. This stabilizes display pipe programming and prevent...

CVE-2024-49945

CVE-2024-49945 affects the Linux kernel where the ncsi work is not properly synchronized with the freeing of the ncsi device. The issue arises when the ncsi work function can run after the associated structure is freed, leading to use-after-free bugs or kernel panics. The documented impact is a p...

CVE-2024-50158

Technical details about CVE-2024-50158 (affected software, impact, exploitability, and remediation) are not provided in the supplied documents. Please monitor for updates.

CVE-2024-50252

CVE-2024-50252 describes a memory leak in the Linux kernel mlxsw spectrum_ipip implementation when changing the remote IPv6 address of an ip6gre net device. The root cause is that the driver failed to add the new address to its hash table and did not remove the old one, leading to leaks and a war...

CVE-2024-50258

CVE-2024-50258 affects the Linux kernel net stack. A small gso_max_size/gso_ipv4_max_size can cause an underflow in sk_dst_gso_max_size(), making sk->sk_gso_max_size exceed device limits and trigger a BUG_ON crash during tcp_write_xmit/tso processing. The root cause is in computing tso_segs (D...

CVE-2024-53068

CVE-2024-53068 affects the Linux kernel’s ARM SCMI subsystem. The issue is a slab-use-after-free in scmi_bus_notifier caused by prematurely freeing scmi_dev->name in __scmi_device_destroy(); the release of scmi_dev->name is moved to scmi_device_release() to prevent use-after-free, per the p...

CVE-2024-56369

CVE-2024-56369 affects the Linux kernel DRM code: drm/modes/drm_mode_vrefresh() attempted to avoid divide-by-zero by checking htotal/vtotal, but can still trigger div-by-zero (vtotalhtotal ...). This can lead to a crash/denial of service (availability impact). The issue is fixed in the upstream k...

CVE-2024-56634

CVE-2024-56634 concerns a Linux kernel flaw in the GPIO grgpio driver: grgpio_probe can dereference a NULL after devm_kasprintf() returns NULL. The fix adds an explicit NULL check in grgpio_probe to prevent kernel NULL pointer dereference. Public advisories (e.g., Astra Linux and Debian/SEL advis...

CVE-2024-56660

CVE-2024-56660 : In the Linux kernel, the DR (Direct Routing) path for mlx5 may return either -EBUSY or -ENOMEM from dr_domain_add_vport_cap(), but the code can propagate an error pointer when -ENOMEM is returned. This can lead to a dereference of an error pointer inside dr_ste_v0_build_src_gvmi_...

CVE-2024-57936

CVE-2024-57936 affects Linux kernel RDMA/bnxt_re. Gen P7 supports up to 13 SGEs, while WQE software structure can hold only 6, allowing requests up to 13 SGEs. This discrepancy led to traffic failures and potential system crashes. The fix uses a define for the max SGE supported for both static an...

CVE-2024-58013

CVE-2024-58013 : In the Linux kernel, a slab-use-after-free in Bluetooth MGMT code (mgmt_remove_adv_monitor_sync) can lead to a crash (KASAN slab-use-after-free) via a read after free in the hci/mgmt path. The issue is triggered during advanced monitor removal (remove_adv_monitor) flow and is exp...

CVE-2025-21816

CVE-2025-21816 affects the Linux kernel hrtimers subsystem. The issue arises when hrtimers queued on an offline CPU can wake up and arm the deadline timer after CPU hotplug stage CPUHP_AP_HRTIMERS_DYING, potentially impacting bandwidth timer handling (notably RCU-related wakeups). The documented ...

CVE-2025-21826

CVE-2025-21826 affects the Linux kernel nf_tables (netfilter). The issue is a mismatched sum between field_len and set key length in a pipapo-based key, allowing incorrect pipapo width calculation and potential impact on confidentiality, integrity, and availability (as per CVSS data: HIGH). Affec...

CVE-2025-22044

CVE-2025-22044 (Linux kernel) : The issue arises in acpi_nfit_ctl where a narrowing conversion from u64 to int can allow an invalid argument when nd_family is non-zero but its lower 32 bits are zero. Syzkaller warned that to_nfit_bus_uuid() may translate to a non-secondary bus family, and the fix...

CVE-2025-22060

CVE-2025-22060 concerns the Linux kernel mvpp2 parser TCAM/SRAM memory. The issue arises when concurrent accesses to the indirect TCAM/SRAM tables via an index register are not atomic, enabling TOCTOU-like corruption when mvpp2_set_rx_mode() runs on multiple CPUs. In the described scenario, this ...