CVE-2024-54683

CVE-2024-54683 – Linux kernel netfilter IDLETIMER ABBA deadlock : The vulnerability occurs when deleting the last idletimer rule may race with a read of its sysfs file, risking a circular locking dependency between idletimer teardown and kernel lock ownership. A reproduction shows concurrent dele...

CVE-2024-56575

CVE-2024-56575 affects the Linux kernel component media: imx-jpeg. The issue is triggered when power suppliers are detached without proper synchronization with power management callbacks, risking kernel panic from a NULL-pointer dereference during dev_pm_domain_detach(). A fix ensures power suppl...

CVE-2024-56685

Technical details about CVE-2024-56685 are not provided in the connected documents. Public information and exact affected components/versions, exploitation status, and fixes are not available here; monitor for updates and official advisories.

CVE-2024-57874

Mode C — Normal (details available) CVE-2024-57874 affects the Linux kernel on arm64 where the function tagged_addr_ctrl_set() uses a temporary variable that is not initialized when performing a zero-length SETREGSET, potentially leaking memory from the kernel stack (up to 64 bits). The issue ari...

CVE-2025-21832

CVE-2025-21832 - Linux kernel : In blkdev_read_iter(), revert handling for -EIOCBQUEUED caused by not validating blkdev_direct_IO() return before iov_iter_revert(), risking a WARN_ON due to a negative/unsigned mismatch. The patch removes reversion for -EIOCBQUEUED, aligning with other spots and p...

CVE-2025-21978

CVE-2025-21978 – Linux kernel (drm/hyperv): address space leak in Hyper-V DRM device mapping . The vulnerability occurs when a Hyper-V DRM device is probed: the driver allocates MMIO space for VRAM and maps it as cacheable, but on device removal or probing error path the MMIO space is released wi...

CVE-2025-22083

The CVE-2025-22083 issue affects Linux kernel vhost-scsi handling: multiple vhost_scsi_set_endpoint calls without an intervening vhost_scsi_clear_endpoint can trigger three bugs in the vs_tpg lifecycle. 1) Use-after-free when no tpgs are found after a second call, due to freed vs->vs_tpg backi...

CVE-2025-22088

Summary of CVE-2025-22088: In the Linux kernel RDMA erdma driver, the vulnerability is a Use-After-Free (UAF) in erdma_accept_newconn(). After erdma_cep_put(new_cep) frees new_cep, a subsequent dereference could access freed memory. The issue is fixed in the provided updates. The connected docume...

CVE-2025-22108

CVE-2025-22108 affects the Linux kernel Broadcom bnxt_en driver, specifically the TX BD bd_cnt field. The field is 5 bits and should only validly hold 0, with a maximum supported value of 32. If CONFIG_MAX_SKB_FRAGS is modified such that the total number of SKB fragments approaches or exceeds the...

CVE-2025-23151

Technical details for CVE-2025-23151 are not provided in the connected documents. The initial description mentions a Linux kernel fix for an MHI bus/host race, but there are no specifics on affected products, vectors, or remediation in the supplied sources. Monitor for updates.

CVE-2025-37742

CVE-2025-37742 : In the Linux kernel, the jfs_imap diMount path allocates imap with kmalloc and fails to initialize it, causing uninit-value usage in hex_dump_to_buffer and a KMSAN report during mount/evict paths. Root cause: imap is not initialized after memory allocation. Remediation: replace k...

CVE-2025-37771

CVE-2025-37771 affects the Linux kernel (drm/amd/pm) with a division-by-zero flaw when the user sets a speed value greater than UINT_MAX/8. It is a local vulnerability; kernel fixes are referenced in upstream commits (e.g., 6413fed016208171592c88b5df002af8a1387e24 and related edits). The issue ha...

CVE-2025-37786

CVE-2025-37786 affects the Linux kernel's DSA (distributed switch architecture) routing-table handling. When a tree probe completes with complete = true and a later step fails, dst->rtable entries may remain referencing freed ports, causing a use-after-free. The advisory explains that on probe...

CVE-2025-37938

CVE-2025-37938 involves the Linux kernel tracing subsystem. The vulnerability centers on the trace event verifier, which checks print formats to ensure pointers reference valid memory that is part of the event or data that will be freed. If an event uses the format "%*p.." and the verifier ignore...

CVE-2025-39797

CVE-2025-39797 concerns the Linux kernel xfrm duplicate SPI handling. The vulnerability arises when Strongswan triggers an XFRM_NETLINK_ALLOC_SPI request, enabling xfrm_alloc_spi() to return success for an SPI already in use, causing multiple inbound SAs to share the same SPI (distinguished only ...

CVE-2009-1192

CVE-2009-1192 affects the Linux kernel AGP subsystem (drivers/char/agp/generic.c) where two functions, agp_generic_alloc_page and agp_generic_alloc_pages, do not zero out pages that may later be exposed to a user-space process. This can allow local users to read pages and obtain sensitive informa...

CVE-2010-0415

The CVE-2010-0415 issue affects the Linux kernel before 2.6.33-rc7. The do_pages_move function in mm/migrate.c does not validate node values, allowing local users to read arbitrary kernel memory locations and cause an OOPS, with possible other impacts by specifying a node outside the kernel’s nod...

CVE-2010-4073

CVE-2010-4073 affects the Linux kernel IPC compatibility code: before 2.6.37-rc1, several compat syscall handlers (ipc/compat.c and ipc/compat_mq.c) fail to initialize certain structures, enabling local attackers to read potentially sensitive kernel stack memory via vectors in compat_sys_semctl, ...

CVE-2011-4330

CVE-2011-4330 describes a stack-based buffer overflow in the Linux kernel 2.6, specifically in hfs_mac2asc (fs/hfs/trans.c). A crafted HFS image len field can be used by a local user to trigger a crash and, per the description, possibly execute arbitrary code. The associated connected documents c...

CVE-2014-3688

CVE-2014-3688 affects the Linux kernel SCTP implementation prior to 3.17.4. The vulnerability allows a remote attacker to cause a denial of service via memory consumption by triggering a large number of chunks in an association’s output queue (ASCONF probes), related to net/sctp/inqueue.c and net...

CVE-2014-4654

The CVE-2014-4654 issue affects the Linux kernel ALSA control implementation (snd_ctl_elem_add in sound/core/control.c). The root cause is a lack of authorization checks for SNDRV_CTL_IOCTL_ELEM_REPLACE commands, allowing local attackers with access to /dev/snd/controlX to remove kernel controls....

CVE-2014-5077

CVE-2014-5077 affects the Linux kernel’s SCTP code: the function sctp_assoc_update in net/sctp/associola.c (affected in kernel builds up to 3.15.8) can be triggered when SCTP authentication is enabled. An attacker can cause a denial of service via a NULL pointer dereference and kernel OOPS by ini...

CVE-2016-3695

CVE-2016-3695 in the Linux kernel relates to the einj_error_inject function (drivers/acpi/apei/einj.c). The issue allows a local user to simulate hardware errors and cause a denial of service by failing to disable APEI error injection via EINJ when securelevel is set. The connected documents show...

CVE-2016-6198

CVE-2016-6198 affects the Linux kernel (pre-4.5.5) in its OverlayFS path. The bug occurs when a file under OverlayFS is renamed to a self-hardlink, causing post-rename operations to run and potentially crash the kernel. Local users can trigger a denial of service (system crash) via a rename sysca...

CVE-2017-2584

CVE-2017-2584 affects arch/x86/kvm/emulate.c in the Linux kernel up to version 4.9.3, enabling local users to read kernel memory or cause a use-after-free DoS via a crafted instruction-emulation application targeting fxrstor, fxsave, sgdt, and sidt. Remediation is not specified in the provided do...

CVE-2021-47178

CVE-2021-47178 : Linux kernel vulnerability in SCSI target code where smp_processor_id() was used in preemptible code. The issue manifested as a BUG message in preemptible kernel paths (TCMU/target_core_mod) and during shutdown, triggered by commands queued to TCMU devices using certain backends....

CVE-2021-47566

CVE-2021-47566 involves a Linux kernel vulnerability in proc/vmcore where user-space buffers were cleared improperly (memset) instead of using clear_user(), enabling a supervisor write fault on a vmcore copy scenario. The fix = use clear_user() when handling user buffers; SMAP handling is noted i...

CVE-2022-0400

The CVE-2022-0400 entry concerns an out-of-bounds read in the Linux kernel’s SMC protocol stack that can enable remote denial of service. Connected sources (NVD, OSV, Debian-related OSV entries) confirm the affected component and impact but do not provide a patched version or explicit remediation...

CVE-2022-48976

The CVE-2022-48976 case concerns Linux kernel netfilter flowtable_offload. A preemptible path used __this_cpu_add in flow_offload_queue_work(), which could trigger a BUG when called from a workqueue without bh disabled. The fix replaces __this_cpu_add with NF_FLOW_TABLE_STAT_INC_ATOMIC() in flow_...

CVE-2022-49090

The CVE-2022-49090 entry concerns Linux kernel arch/arm64: Fix topology initialization for core scheduling. The issue arises when store_cpu_topology() does not call update_siblings_masks() before notify_cpu_starting(), causing core scheduling data structures to reflect an incorrect topology. If s...

CVE-2022-49301

CVE-2022-49301 : In the Linux kernel, the staging rtl8712 USB driver has a bug where, if r8712_usbctrl_vendorreq() returns a negative value, data in usb_read8/16/32 is not initialized, triggering KMSAN uninitialized-value reports. Connected advisories reference fixes in the kernel (e.g., commits ...

CVE-2022-49347

CVE-2022-49347 concerns a Linux kernel issue in ext4 where a bug_on can trigger during ext4_writepages in delay allocation mode when inline data has been converted to an extent. The root cause described across the provided documents is a race: inline data may be destroyed before ext4_writepages r...

CVE-2022-49430

The CVE-2022-49430 entry affects the Linux kernel in the gpio_keys controller. The issue arises from canceling a delayed work handle when the gpio_keys module unloads and an interrupt pin is used instead of GPIO; the module initializes delayed work only for GPIO-backed paths and not for interrupt...

CVE-2022-49531

The CVE-2022-49531 issue concerns the Linux kernel loop driver’s handling of the lo_device stored in gendisk private data. The vulnerability fix updates the lifecycle so that the lo_device remains valid until the gendisk is freed, addressing a potential deadlock by relaxing safety checks in loop....

CVE-2022-49578

CVE-2022-49578 concerns a data race in the Linux kernel related to sysctl_ip_prot_sock. The root cause is concurrent access to sysctl_ip_prot_sock, causing load/store tearing unless proper synchronization is used. The vulnerability affects the kernel’s IP/sysctl handling and is stated as resolved...

CVE-2022-49612

CVE-2022-49612 discusses a Linux kernel vulnerability in the power: supply: core interpolation logic. The issue lies in boundary handling within power_supply_temp2resist_simple and power_supply_ocv2cap_simple, introduced by a4585ba2050f460f749bbaf2b67bd56c41e30283 (power: supply: core: Use librar...

CVE-2022-49616

CVE-2022-49616 affects Linux kernel ASoC Realtek rt7*-sdw headset codecs. The rt700, rt711, and rt711-sdca drivers lacked a null check on the card pointer in jack_detect_handler, allowing potential NULL dereferences during driver bind/unbind tests. Patch/mitigation involves hardened jack_detect_h...

CVE-2022-49902

CVE-2022-49902 concerns a Linux kernel memory-leak in rq_wb on add_disk failure. kmemleak reported 3 memory-leak instances; the leak stems from memory allocated in wbt_enable_default() not being freed in device_add_disk()’s error path. Normally, del_gendisk()/rq_qos_exit() would free rq_wb memory...

CVE-2023-1193

CVE-2023-1193 : A use-after-free in setup_async_work within the Linux kernel’s KSMBD in-kernel Samba/CIFS stack can crash systems via access to freed work. Affected component: Linux kernel (Samba server/CIFS). Root cause: use-after-free in setup_async_work. Impact: potential denial of service thr...

CVE-2023-52670

CVE-2023-52670 is a Linux kernel issue affecting rpmsg: virtio where driver_override is freed only partially during rpmsg_remove, causing a memory leak for an unreferenced object (size 128, shown in the backtrace). The vulnerability was resolved in the Linux kernel by freeing driver_override duri...

CVE-2023-52857

Technical details about CVE-2023-52857 are not publicly provided in the supplied documents. Monitor for updates from vendors and advisories.

CVE-2024-26726

CVE-2024-26726 : In the Linux kernel, a Btrfs bug could panic when writing the free-space inode because the extent map was dropped on a write error and then looked up again, yielding EXTENT_MAP_HOLE on a second pass. The fix removes dropping the extent_map range for the failed free-space cache wr...

CVE-2024-35849

CVE-2024-35849 affects the Linux kernel btrfs_ioctl_logical_to_ino path. The issue is an information leak: a struct btrfs_data_container allocated with kvmalloc() is copied back to user space without zero-filling, exposing uninitialized memory (Bytes 40-65535) to user-space. The root cause is lac...

CVE-2024-35907

Mode C: The CVE-2024-35907 issue affects the mlxbf_gige driver in the Linux kernel (BlueField-3 SmartNIC). The root cause is a NULL pointer dereference in mlxbf_gige_open() when kdump is enabled, traced to a pending RX interrupt that fires before request_irq(RX IRQ) is called, causing an interrup...

CVE-2024-35951

CVE-2024-35951 affects the Linux kernel's DRM Panfrost driver (panfrost_mmu_map_fault_addr). The patch fixes the error path when page/SGT allocations fail: it should not prematurely release page references; instead, leave state in place for the BO release function to cleanup or for the fault hand...

CVE-2024-36893

CVE-2024-36893 – Linux kernel : A NULL pointer dereference in usb: typec: tcpm due to typec_register_partner() not guaranteeing partner registration. If port->partner is invalid (NULL or an error value) and is not checked before dereferencing, it can crash the kernel (e.g., kernel NULL pointer...

CVE-2024-38587

The CVE-2024-38587 entry covers a Linux kernel issue in the speakup component where a buf is declared as an array of 16-bit values. The root cause is using sizeof() instead of ARRAY_SIZE() to determine the buffer length; ARRAY_SIZE() evaluates to 256, while sizeof() yields 512, which can lead to ...

CVE-2024-38589

CVE-2024-38589 : In the Linux kernel netrom subsystem, a deadlock can occur in nr_rt_ioctl due to a circular locking dependency between nr_node_list_lock and nr_node_lock. Syzbot identified a possible deadlock when attempting to acquire nr_node_lock while already holding nr_node_list_lock, with t...

CVE-2024-38621

CVE-2024-38621 affects the Linux kernel media stk1160 driver, specifically the stk1160_copy_video() path. The root cause is an incorrect unsigned subtraction in the overflow check, where the length and bytesused semantics cause an overflow condition to be evaluated as false. The patch fixes the b...

CVE-2024-38630

The CVE-2024-38630 issue affects Linux kernel watchdog code (watchdog: cpu5wdt.c) where del_timer() may fail to stop a running timer during module removal, allowing a use-after-free when a released port region is accessed by cpu5wdt_trigger(). The vulnerability is mitigated by switching the timer...