CVE-2024-58013

CVE-2024-58013 : In the Linux kernel, a slab-use-after-free in Bluetooth MGMT code (mgmt_remove_adv_monitor_sync) can lead to a crash (KASAN slab-use-after-free) via a read after free in the hci/mgmt path. The issue is triggered during advanced monitor removal (remove_adv_monitor) flow and is exp...

CVE-2025-21642

CVE-2025-21642 affects the Linux kernel’s MPTCP subsystem. The issue arises from using current->nsproxy/netns when accessing per-netns data via sysctl entries (net/mptcp/ctrl.c), which can diverge from the netns the table is associated with. The described consequence is a general protection fa...

CVE-2025-21799

CVE-2025-21799 covers a Linux kernel net:ethernet:ti:am65-cpsw issue. The root cause is improper IRQ handling: k3_udma_glue_tx_get_irq() may return a negative error value, and a non-null check is not sufficient; the IRQ must be validated as > 0. At runtime, .set_channels can trigger a chain th...

CVE-2025-21881

CVE-2025-21881 describes a Linux kernel vulnerability in the uprobes code path, specifically in uprobe_write_opcode() where a zero page (zeropage) is rejected but not properly accounted. The issue arises when a zero pfn is written to a PTE without increasing the RSS counter, causing the zero foli...

CVE-2025-22049

The CVE-2025-22049 issue affects the Linux kernel's LoongArch code. It fixes the need to raise ARCH_DMA_MINALIGN from 1 to 16 to accommodate LoongArch devices (e.g., APBDMA) that require 16-byte alignment. The vulnerability stemmed from potential DMA cacheline write errors when data buffers were ...

CVE-2025-22063

CVE-2025-22063 is a Linux kernel vulnerability in netlabel CALIPSO handling that can trigger a NULL pointer dereference when an IPv4 socket is used with an IPv6 connect. The issue arises from evaluating sk_fullsock(__sk) ? inet_sk(__sk)->pinet6 : NULL and accessing pinet6 for an IPv4 socket. A...

CVE-2025-37788

CVE-2025-37788 affects the Linux kernel cxgb4 memory handling: in cxgb4_init_ethtool_filters(), a memory leak can occur if loc_array is allocated but bmap allocation fails, because the free path only frees from (i-1) iterations. The fix frees loc_array in the bmap error path, mitigating the leak....

CVE-2025-37800

CVE-2025-37800 affects the Linux kernel driver core code, specifically a potential NULL pointer dereference in dev_uevent() when a userspace read of the uevent attribute overlaps with a driver unbind. The fix switches to using READ_ONCE() to fetch the driver pointer and acquires the bus’ drivers ...

CVE-2025-37891

The provided documents confirm CVE-2025-37891 affects the Linux kernel’s ALSA: ump path, where SysEx messages could overflow an internal 4-byte buffer during MIDI 1.0 to UMP conversion. The root cause is that SysEx can be up to 6 bytes, exceeding the original 4-byte buffer, risking memory corrupt...

CVE-2026-31532

CVE-2026-31532 affects the Linux kernel’s raw CAN socket implementation. A use-after-free can occur when, during unregistration of CAN receive filters, the kernel defers receiver deletion with RCU and frees per-CPU storage ro->uniq too early in raw_release(). The fix moves free_percpu(ro->u...

CVE-2026-31533

The CVE-2026-31533 entry concerns a Linux kernel net/tls use-after-free in tls_do_encryption() when crypto_aead_encrypt() returns -EBUSY. The underlying issue is double cleanup of encrypt_pending and the scatterlist entry due to distinct cleanup paths (async callback tls_encrypt_done() vs synchro...

CVE-2026-31635

The Linux kernel (versions 6.10 through 6.13 ) contains a local privilege escalation vulnerability in the rxrpc subsystem, specifically within the rxgk component. The root cause is a missing skb_cow_data() check in rxgk_decrypt_skb() , where an inverted length check allows oversized RESPONSE auth...

CVE-2009-2406

CVE-2009-2406 refers to a stack-based buffer overflow in the parse_tag_11_packet function in fs/ecryptfs/keystore.c of the Linux kernel before 2.6.30.4. The issue arises from not ensuring that the key signature length in a Tag 11 packet is compatible with the key signature buffer size, enabling l...

CVE-2009-3726

The CVE-2009-3726 issue affects the Linux kernel NFSv4 client (fs/nfs/nfs4proc.c) and is triggered when a remote NFS server returns a crafted response with incorrect file attributes. This can cause a NULL pointer dereference and kernel panic by attempting to use an open file that has no NFSv4 sta...

CVE-2010-2248

CVE-2010-2248 affects the Linux kernel CIFS/SMB implementation. The issue is triggered by a remote SMB response containing an invalid CountHigh value, leading to a denial of service (kernel panic) via the CIFSSMBWrite and CIFSSMBWrite2 paths (OS/2 server responses). Affected: Linux kernel prior t...

CVE-2011-1585

Technical details for CVE-2011-1585 are not publicly provided in the supplied connected documents. Monitor for updates from vendor advisories or security bulletins to obtain affected products, impact, and fixes.

CVE-2011-2517

The vulnerability CVE-2011-2517 affects the Linux kernel (pre-2.6.39.2) where multiple buffer overflows in net/wireless/nl80211.c can allow local users to gain privileges by exploiting a long SSID during scan operations when CAP_NET_ADMIN is available. Impact is local privilege escalation with co...

CVE-2011-4132

CVE-2011-4132 affects the Linux kernel’s Journaling Block Device (JBD) cleanup_journal_tail function. The vulnerability allows local users to trigger a denial of service (assertion error and kernel oops) when handling an ext3 or ext4 image containing an invalid log first block value. The descript...

CVE-2012-2133

The CVE-2012-2133 issue is a use-after-free in the Linux kernel before 3.3.6 involving hugetlbfs when huge pages are enabled. A local user could crash the system or potentially escalate privileges by interacting with quota data during a umount operation, due to improper handling of quota data in ...

CVE-2013-4587

CVE-2013-4587 describes an array index error in kvm_vm_ioctl_create_vcpu() within virt/kvm/kvm_main.c of the Linux kernel (through 3.12.5). This vulnerability enables local privilege escalation via a large id value. The connected Nessus/OpenVAS advisories reference Unity Linux/SUSE/OpenVAS entrie...

CVE-2014-2851

CVE-2014-2851: Integer overflow in ping_init_sock (net/ipv4/ping.c) of the Linux kernel up to 3.14.1 allows local users to cause a denial of service (use‑after‑free and system crash) and potentially gain privileges via a crafted application that exploits an improperly managed reference counter. C...

CVE-2014-4653

Summary (CVE-2014-4653) : The ALSA control implementation in the Linux kernel has a race/lock handling issue in sound/core/control.c. It does not ensure possession of a read/write lock, enabling a local attacker to trigger a denial of service (use-after-free) and to potentially read kernel memory...

CVE-2016-2188

CVE-2016-2188 entry is rejected and not used.

CVE-2019-19241

CVE-2019-19241 affects the Linux kernel prior to 5.4.2 where the io_uring path can cause requests to appear with UID 0 and full capabilities due to IORING_OP_SENDMSG handling by kernel worker threads in contexts from unprivileged users. Affected code paths include fs/io-wq.c, fs/io_uring.c, and n...

CVE-2019-8956

CVE-2019-8956 corresponds to a use-after-free in the Linux kernel SCTP path. Affects Linux kernel before 4.20.8 and 4.19.21, in sctp_sendmsg() when handling SCTP_SENDALL, risking memory corruption. Publicly available advisories indicate the fix is to update to kernel versions 4.20.8+ or 4.19.21+....

CVE-2021-34981

CVE-2021-34981 concerns the Linux kernel’s Bluetooth CMTP module. The issue stems from failing to validate the existence of an object before performing free operations, enabling a local attacker to escalate privileges by executing code in the kernel context (double free). The vulnerability is lin...

CVE-2021-47153

CVE-2021-47153 involves the Linux kernel i2c: i801 driver. The issue occurs when a KILL-recover/bus-reset process triggers an interrupt that the i801_isr cannot handle, potentially causing an out-of-bounds memory access in block transactions. The connected MiracleLinux advisories (AXSA) reference...

CVE-2021-47468

CVE-2021-47468 is a Linux kernel vulnerability affecting isdn/mISDN where a sleeping function could be called from an atomic context because card->isac.release() is invoked while still holding a lock. The description states the fix is to call this function after releasing the lock. Logs illust...

CVE-2021-47649

The CVE-2021-47649 entry concerns a Linux kernel udmabuf issue where ubuf->pagecount could be zero if user-space passes list.size==0, leading kmalloc_array() to return ZERO_PTR and triggering a GPF in sg_alloc_append_table_from_pages(). The vulnerability arises from pagecount derived from user...

CVE-2022-3629

CVE-2022-3629 affects the Linux kernel’s vsock_connect in net/vmw_vsock/af_vsock.c, causing a memory leak. The issue is described as a local problem with low overall severity (CVSS 3.1: low, availability impact), and exploitation is not trivial but feasible locally. The primary remediation guidan...

CVE-2022-48742

The CVE-2022-48742 entry relates to the Linux kernel’s rtnetlink handling. Technical details in connected documents show that the vulnerability arises from the replay logic in __rtnl_newlink(), where not refreshing master_dev/m_ops could trigger a use-after-free during a replay path. The confirme...

CVE-2022-48884

CVE-2022-48884 affects the Linux kernel in the mlx5 driver stack. The root cause is a NULL pointer dereference that can occur when command stats are freed and reallocated during a mlx5 devlink reload, causing a crash if a command is issued while reinitialization is incomplete. The concrete fix im...

CVE-2022-49228

CVE-2022-49228 relates to the Linux kernel and a bug in BTF decl_tag handling during function tagging in BPF. The issue arises when btf_decl_tag_resolve() checks a function type’s func_proto; the code attempted to access func_proto’s vlen for a type 3 function prototype, which was out of range an...

CVE-2022-49329

CVE-2022-49329: In the Linux kernel (vdpa/vduse), a NULL pointer dereference can occur when reading the control device’s msg_timeout attribute via sysfs because the control device lacks drvdata. The fix, per the provided description, is to stop creating the unneeded attribute for the control devi...

CVE-2022-49394

The CVE-2022-49394 entry describes a Linux kernel vulnerability in blk-iolatency where inflight IO counters could become imbalanced and IOs hang when a cgroup with iolatency is offline or disabled. The root cause is that enabled counters could be manipulated in iolatency_set_limit() and iolatency...

CVE-2022-49515

The CVE-2022-49515 issue affects the Linux kernel ASoC driver for cs35l41. It is caused by an out-of-bounds access in otp_packed_element_t where CS35L41_NUM_OTP_ELEM is defined as 100 but only 99 entries exist in otp_map_1/2[CS35L41_NUM_OTP_ELEM], triggering UBSAN shift-out-of-bounds warnings in ...

CVE-2022-49637

CVE-2022-49637 affects the Linux kernel: a data race in ipv4 sysctl_fib_sync_mem when read while written. Root cause is concurrent access to sysctl_fib_sync_mem; fix is to add READ_ONCE() around reads. Impact is local (kernel-level) with potential availability disruption; remediation is applying ...

CVE-2022-49663

CVE-2022-49663 affects the Linux kernel in the tunneling path used by Genefe/IPv4 tunnels. The root cause is an assumption that skb->mac_header is set in skb_tunnel_check_pmtu(); debug added in a kernel commit triggered a warning in ndo_start_xmit() paths, since skb->data should point to th...

CVE-2022-49687

CVE-2022-49687 documents a Linux kernel vulnerability in virtio_net where suspend/resume can trigger a driver bug warning due to xdp_rxq_info not being unregistered/registered during freeze/restore. The root cause is that virtnet_freeze() frees the receive_queue (including xdp_rxq_info) without c...

CVE-2023-52483

CVE-2023-52483 affects the Linux kernel where mctp_route_lookup/mctp_route_lookup_null traverse net->mctp.routes without an RCU read lock, allowing a potential race that could lead to a use-after-free due to a grace period expiry and a kfree while a route pointer is in use. The security adviso...

CVE-2023-52591

CVE-2023-52591 affects the Linux kernel’s reiserfs rename path. The issue arises when renaming a directory where the parent directory does not change; the VFS previously could touch a renamed directory due to lack of proper locking, risking filesystem corruption. The fix adjusts the reiserfs rena...

CVE-2023-52593

CVE-2023-52593 concerns a potential NULL pointer dereference in the Linux kernel’s wifi driver wfx. The issue arises because ieee80211_beacon_get() can return NULL, and wfx_set_mfp_ap() did not validate this before inspecting skb data. The fix converts wfx_set_mfp_ap() to return an error code whe...

CVE-2023-52913

CVE-2023-52913 concerns the Linux kernel DRM/i915 context UAF race: gem_context_register() makes the context visible to userspace, and a separate thread can trigger I915_GEM_CONTEXT_DESTROY, potentially using the ctx pointer after it's been exposed. The mitigation is to ensure that the ctx pointe...

CVE-2023-5972

CVE-2023-5972 concerns a null pointer dereference in the netfilter nft_inner.c path of the Linux kernel. A local attacker could crash the system or escalate privileges via improper handling of nft_inner_num/nft_inner_expr_name attributes in inner tunnel netlink attributes, as described in the CVE...

CVE-2024-35819

CVE-2024-35819 affects the Linux kernel subsystem soc: fsl: qbman, where smp_call_function is used and can run callbacks in hard IRQ context; to prevent potential sleeping-task issues on PREEMPT_RT, the advisory specifies using a raw spinlock for cgr_lock. The root cause is that smp_call_function...

CVE-2024-38543

CVE-2024-38543 : In the Linux kernel, a vulnerability in lib/test_hmm.c arose from allocation failures for src_pfns/dst_pfns. If kcalloc() returns NULL, dereferencing these pointers could trigger a null pointer dereference, especially as the device could be evicted. Remediation implemented: add a...

CVE-2024-39496

CVE-2024-39496 affects the Linux kernel, specifically the btrfs: zoned code path. The issue is a use-after-free caused by a race between loading a zone’s info during block group creation and an ongoing device replacement; if the device being loaded is the source of the replacement, the device can...

CVE-2024-39498

CVE-2024-39498 (Linux kernel) resolves a NULL pointer dereference in the DRM MST path during payload handling. The issue stemmed from an overwrite in a refactored payload allocation/removal flow, which regressed when two commits touched in drm_dp_add_payload_part2 used/modified the state input. T...

CVE-2024-40943

CVE-2024-40943 concerns the Linux kernel ocfs2 subsystem where races between hole punching and asynchronous I/O (AIO) and direct I/O (DIO) could cause on-disk extent inconsistencies. The description and connected advisories indicate the issue is rooted in concurrency between fallocate/punch_hole ...

CVE-2024-41096

CVE-2024-41096 : In the Linux kernel, KFENCE reported a use-after-free in PCI MSI handling during msi_capability_init. The root cause is an error-path path that unmasks a descriptor after it may have been freed, propagating a failure from __msi_domain_alloc_locked() back to pci_alloc_irq_vectors ...