CVE-2023-0469

CVE-2023-0469 is a use-after-free in io_uring/filetable.c (io_install_fixed_file) within the Linux kernel’s io_uring subcomponent during call cleanup, potentially enabling a local DoS. Affected: Linux kernel with vulnerable io_uring code. Exploitation details are not provided in the supplied docu...

CVE-2025-22062

CVE-2025-22062 is a Linux kernel vulnerability where mutual exclusion was missing in proc_sctp_do_udp_port(), risking a crash due to unsynchronized calls to sctp_udp_sock_stop() and sctp_udp_sock_start(). The issue is evidenced by syzbot exposé showing a crash/OOPS from a non-canonical address. T...

CVE-2025-22095

CVE-2025-22095 pertains to the Linux kernel PCI subsystem (brcmstb) and fixes an error path in regulator_bulk_get() handling. If regulator_bulk_get() returns an error and no regulators are created, the kernel previously did not set the regulator count to zero, which could cause a kernel panic whe...

CVE-2025-37742

CVE-2025-37742 : In the Linux kernel, the jfs_imap diMount path allocates imap with kmalloc and fails to initialize it, causing uninit-value usage in hex_dump_to_buffer and a KMSAN report during mount/evict paths. Root cause: imap is not initialized after memory allocation. Remediation: replace k...

CVE-2025-37792

The CVE-2025-37792 issue affects the Linux kernel Bluetooth btrtl driver (rtl load file path). root cause: btrtl_initialize() may treat a zero-length rtl_load_file() as non-error, causing an error pointer vs NULL and a subsequent NULL dereference. Severity is MEDIUM (CVSSv3.1 base 5.5), with loca...

CVE-2025-37820

CVE-2025-37820 (Linux kernel – xen-netfront) has a concrete issue: the function xdp_convert_buff_to_frame() may return NULL when failing to convert an XDP buffer to an XDP frame due to memory constraints, internal errors, or invalid data. If the caller does not check for NULL, a NULL pointer dere...

CVE-2025-37871

CVE-2025-37871 is a Linux kernel vulnerability fixed by changing how sc_count is decremented when a dl_recall queue operation fails for NFS delegations. The described scenario shows a deadlock warning during nfs4_put_stid after a failed dl_recall queue, caused by a potential lock ordering issue w...

CVE-2025-37928

CVE-2025-37928 refers to a Linux kernel vulnerability in the dm-bufio path where scheduling in atomic context can occur when try_verify_in_tasklet is enabled and CONFIG_DEBUG_ATOMIC_SLEEP is set. The bug arises from sleeping in an invalid context, potentially enabling local privilege escalation o...

CVE-2025-38004

The CVE-2025-38004 entry affects the Linux kernel CAN BCM subsystem. A race allowed by updates to the currframe/count in bcm_can_tx() could enable user-space-triggered modifications from hrtimer context, leading to a KASAN slab-out-of-bounds read. The patch fixes by moving the count variable into...

CVE-2025-39989

The CVE-2025-39989 issue affects the Linux kernel’s x86 memory error handling (MCE) path. Root cause: a patch series changes the copy-from-user recovery flow by introducing and switching extable fixup types, notably EX_TYPE_EFAULT_REG, instead of handling EX_TYPE_UACCESS for poison found in get_u...

CVE-2009-1895

The vulnerability CVE-2009-1895 affects the Linux kernel’s personality subsystem prior to 2.6.31-rc3, where PER_CLEAR_ON_SETID fails to clear ADDR_COMPAT_LAYOUT and MMAP_PAGE_ZERO when executing a setuid/setgid program. This enables local users to exploit memory‑layout details to perform NULL poi...

CVE-2009-3726

The CVE-2009-3726 issue affects the Linux kernel NFSv4 client (fs/nfs/nfs4proc.c) and is triggered when a remote NFS server returns a crafted response with incorrect file attributes. This can cause a NULL pointer dereference and kernel panic by attempting to use an open file that has no NFSv4 sta...

CVE-2009-4537

CVE-2009-4537 concerns the Linux kernel before 2.6.32.3, specifically the r8169 Ethernet driver (drivers/net/r8169.c). The vulnerability arises from not properly checking the size of frames that exceed the MTU, allowing remote attackers to cause a denial of service via crafted packets that exploi...

CVE-2010-1173

CVE-2010-1173 affects Linux kernel SCTP: sctp_process_unk_param in net/sctp/sm_make_chunk.c (kernel 2.6.33.3 and earlier) enables remote attackers to crash the system via SCTPChunkInit with many invalid parameters (high error data). Connected advisories (e.g., MiracleLinux AXSA-2010-377:12 and re...

CVE-2010-3850

CVE-2010-3850: In the Linux kernel, the ec_dev_ioctl function in net/econet/af_econet.c did not require CAP_NET_ADMIN, allowing local users to bypass access restrictions and configure econet addresses via an SIOCSIFADDR ioctl. Documented impact is local privilege/unauthorized configuration; fix a...

CVE-2011-1182

CVE-2011-1182 affects the Linux kernel’s signal handling: kernel/signal.c before 2.6.39 allows local users to spoof the UID and PID of a signal sender via sigqueueinfo. Affected in MiracleLinux 3 (kernel 2.6.18-274.1.AXS3) per AXSA-2011-313:06; the issue is described as a kill-signal spoofing vul...

CVE-2011-1576

CVE-2011-1576 affects the Linux kernel GRO offload path (napi_reuse_skb) used in Red Hat Enterprise Linux 5 (kernel 2.6.18) and Red Hat Enterprise Linux 6 (kernel 2.6.32) as deployed in RHEV Hypervisor. The advisory notes that remote attackers can trigger VLAN-packet processing to cause a denial ...

CVE-2011-3191

CVE-2011-3191 affects the Linux kernel CIFS implementation (fs/cifs/cifssmb.c: CIFSFindNext). It is caused by an integer signedness error, existing in kernels before 3.1, which can allow a remote CIFS server to trigger memory corruption or other impact via a large length value in a directory read...

CVE-2011-4131

CVE-2011-4131 affects the Linux kernel’s NFSv4 GETACL handling: the NFSv4 implementation does not correctly manage bitmap sizes when replying, allowing a remote NFS server to trigger a denial of service (OOPS) by sending an excessive number of bitmap words. The issue is fixed in or after the 3.2....

CVE-2013-0343

CVE-2013-0343 affects the Linux kernel’s IPv6 handling, specifically ipv6_create_tempaddr in net/ipv6/addrconf.c, up to version 3.8. It can allow a remote attacker to cause a denial of service (excessive retries and RA address-generation outage) and potentially obtain sensitive information via IC...

CVE-2014-2678

CVE-2014-2678 affects the Linux kernel (net/rds/iw.c). The rds_iw_laddr_check function can be triggered by a bind() on an RDS socket on systems lacking RDS transports, enabling local attackers to cause a NULL pointer dereference and a system crash (DoS). This is described as affecting kernels up ...

CVE-2014-4653

Summary (CVE-2014-4653) : The ALSA control implementation in the Linux kernel has a race/lock handling issue in sound/core/control.c. It does not ensure possession of a read/write lock, enabling a local attacker to trigger a denial of service (use-after-free) and to potentially read kernel memory...

CVE-2016-8632

CVE-2016-8632 affects the Linux kernel’s tipc_msg_build() in net/tipc/msg.c (up to version 4.8.11). The vulnerability stems from failing to validate the relationship between minimum fragment length and maximum packet size, enabling a local user with CAP_NET_ADMIN to gain privileges or cause a hea...

CVE-2017-16529

CVE-2017-16529 affects the Linux kernel’s snd_usb_create_streams in sound/usb/card.c, allowing a local attacker to trigger an out-of-bounds read and system crash via a crafted USB device, with impact described as a denial of service and potentially other effects. The issue is present in kernels p...

CVE-2017-16643

CVE-2017-16643 affects the Linux kernel, specifically the parse_hid_report_descriptor function in drivers/input/tablet/gtco.c, with exploitation possible via a crafted USB device. It allows a local user to trigger an out-of-bounds read and system crash (DoS) and potentially other impacts. The iss...

CVE-2017-7261

CVE-2017-7261 affects the Linux kernel driver vmwgfx. The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c does not check for a zero value of certain levels data, allowing a local user to cause a denial of service (ZERO_SIZE_PTR dereference, GP fault, and potentially a...

CVE-2021-47284

CVE-2021-47284 (Linux kernel) relates to isdn: mISDN: netjet crash in nj_probe. The issue occurs when nj_setup may fail with -EIO, leaving card->irq initialized and >0; a subsequent nj_release frees an IRQ that wasn’t requested. The fix deletes the prior assignment to card->irq and keeps...

CVE-2021-47489

Concretely affected: the Linux kernel AMDGPU display driver code, specifically the drm/amdgpu_dm_debugfs.c path. A heap-based buffer overflow can be triggered by writing a string into the debug filesystem (dp_link_settings_write path), due to missing size checks when copying from userspace into a...

CVE-2021-47646

CVE-2021-47646 (Linux kernel) involves a crash triggered by interactions around block, bfq: honor already-setup queue merges. The vulnerability arose when the commit 2d52c58b9c9b was merged and later reverted by ebc69e897e17; that revert did not introduce the bug, but actually exposed a UAF cause...

CVE-2022-48424

CVE-2022-48424 affects the Linux kernel prior to 6.1.3, where NTFS-3 file system code (fs/ntfs3/inode.c) fails to validate the attribute name offset, leading to an unhandled page fault. Affected component: NTFS-3 support in the kernel; root cause: incomplete validation of attribute name offset in...

CVE-2022-48638

CVE-2022-48638 pertains to the Linux kernel cgroup subsystem. The issue stems from cgroup_get_from_id() not validating that the looked-up kn is a directory, which must be a kernfs directory. If the id supplied by userspace points to a non-directory, it can trigger a kernel panic. The connected As...

CVE-2022-48976

The CVE-2022-48976 case concerns Linux kernel netfilter flowtable_offload. A preemptible path used __this_cpu_add in flow_offload_queue_work(), which could trigger a BUG when called from a workqueue without bh disabled. The fix replaces __this_cpu_add with NF_FLOW_TABLE_STAT_INC_ATOMIC() in flow_...

CVE-2022-49253

CVE-2022-49253 affects the Linux kernel in the media: usb: go7007: s2250-board path, where a leak is fixed by calling i2c_unregister_device(audio) on the error path during probe. Connected sources (SUSE Astra Linux advisories) confirm the fix is in this area. The CVE description in the initial do...

CVE-2022-49305

CVE-2022-49305 affects the Linux kernel driver path drivers/staging/rtl8192u where a deadlock in ieee80211_beacons_stop() could occur. The root cause is a lock-order interaction: del_timer_sync() waited while holding ieee->beacon_lock in ieee80211_beacons_stop(), but the timer handler also nee...

CVE-2022-49546

Technical details (affected product/version, root cause, impact, fix specifics) are not publicly provided in the connected documents. Monitor for updates.

CVE-2022-49671

CVE-2022-49671 affects the Linux kernel RDMA/CM component. The issue is a memory leak in ib_cm_insert_listen where cm_id_priv resources allocated by cm_alloc_id_priv() are not freed if cm_init_listen() fails; an error unwind was missing and has been added to fix the leak. Connected sources refere...

CVE-2022-49759

The CVE-2022-49759 entry concerns the Linux kernel vmw_vmci/VMCI path: the vmci_dispatch_dgs() tasklet calls vmci_read_data(), which uses wait_event() and can sleep in atomic context, risking deadlock. The fix replaces tasklets with threaded IRQs and removes tasklets usage entirely. Impact center...

CVE-2022-49902

CVE-2022-49902 concerns a Linux kernel memory-leak in rq_wb on add_disk failure. kmemleak reported 3 memory-leak instances; the leak stems from memory allocated in wbt_enable_default() not being freed in device_add_disk()’s error path. Normally, del_gendisk()/rq_qos_exit() would free rq_wb memory...

CVE-2023-52479

The CVE-2023-52479 issue is in the Linux kernel ksmbd SMB2 oplock handling, where a use-after-free occurs due to not dropping a reference to opinfo after smb20_oplock_break_ack. The provided documents state that the fix is to drop the reference after use of opinfo, resolving the use-after-free. T...

CVE-2023-52617

CVE-2023-52617 : Linux kernel PCI: switchtec device crash on surprise hot-remove fixed. The issue occurred when a PCI device was hot-removed while stdev->cdev was open; stdev_release() ran after switchtec_pci_remove(), risking a fatal page fault in DMA mode and a stale dev pointer during dma_f...

CVE-2023-52988

CVE-2023-52988 — Linux kernel ALSA: hda/via : The issue arises in the HDA VIA path where snd_hda_get_connections() may return a negative error code, allowing an array access with a negative index in add_secret_dac_path(). This can lead to out-of-bounds access of the conn array, with potential imp...

CVE-2023-53024

The CVE-2023-53024 entry concerns the Linux kernel BPF subsystem. Root cause: speculative store bypass (SSB) can cause a stack slot initially containing a pointer to be overwritten by a scalar without a subsequent lfence, enabling a potential speculative-pointer‑as‑scalar leak. The mitigation add...

CVE-2023-53026

CVE-2023-53026 — Linux kernel RDMA/core overflow in ib block iterator . The issue occurs when registering a DMA memory region (MR) after choosing a best-aligned page size, while iterating the sglist to split entries into DMA blocks. If the sg entry size and page size match in a way that the total...

CVE-2023-53121

The CVE-2023-53121 vulnerability affects the Linux kernel where tcp_rtx_synack() can be invoked from process context, allowing tcp_make_synack() to touch per-CPU data with preemption enabled and trigger a BUG: using __this_cpu_add() in preemptible code. The root cause is a context-inappropriate c...

CVE-2024-26793

CVE-2024-26793 affects the Linux kernel gtp subsystem. The issue is a use-after-free and null pointer dereference in gtp_newlink() caused by incorrect registration order of gtp_link_ops relative to gtp_net_ops pernet structures. Syzkaller observed a general protection fault in gtp_genl_dump_pdp w...

CVE-2024-27407

CVE-2024-27407 : In the Linux kernel, a vulnerability in the NTFS3 file system was fixed by adding an overflow check in mi_enum_attr() within fs/ntfs3. The issue was identified as a local, high-severity impact and is addressed by applying the patch described in the Ubuntu USN-7726-1 advisory, whi...

CVE-2024-27419

CVE-2024-27419 – Linux kernel data race in sysctl_net_busy_read The connected Astra Linux advisory and the initial description confirm a Linux kernel vulnerability: netrom: Fix data-races around sysctl_net_busy_read. The issue involved reading a sysctl value that could be modified concurrently, n...

CVE-2024-35826

CVE-2024-35826 — Linux kernel: fix page refcounts for unaligned buffers in __bio_release_pages(). This patch corrects the number of pages released for buffers that do not start at the beginning of a page, addressing a vulnerability in block I/O handling. Impact, as described in the FP: local acce...

CVE-2024-36946

CVE-2024-36946 is a Linux kernel local denial of service issue related to phonet: rtm_phonet_notify() skb allocation. The root cause is that fill_route() stores three components in the skb (rtmsg, RTA_DST, RTA_OIF) and rtm_phonet_notify() should allocate space via NLMSG_ALIGN(sizeof(struct rtmsg)...

CVE-2024-36959

In CVE-2024-36959, the Linux kernel pinctrl subsystem fixed a refcount leak in pinctrl_dt_to_map() when propname allocation fails. The code now drops the recently taken reference by calling pinctrl_dt_free_maps() directly to avoid leak and potential exploitation via local access. Affected: Linux ...