CVE-2024-44949

CVE-2024-44949 affects the Linux kernel on PA-RISC (parisc) systems. The issue stems from ARCH_DMA_MINALIGN being set to 16, enabling two unrelated 16‑byte allocations to share a cache line and risking DMA/cached writes corrupting the data. The fix updates the alignment: ARCH_DMA_MINALIGN becomes...

CVE-2024-46801

CVE-2024-46801 is a Linux kernel issue in libfs: fix get_stashed_dentry().get_stashed_dentry() may dereference a stashed dentry without proper protection; the fix switches from READ_ONCE() to rcu_dereference() to ensure rcu protection, addressing potential use-after-free. Public documents (includ...

CVE-2024-46812

CVE-2024-46812 concerns the Linux kernel DRM/AMD display code. The vulnerability arises from memory access issues addressed by skipping inactive planes in ModeSupportAndSystemConfiguration, as reported by Coverity. The fix is implemented in the kernel to prevent illegal accesses by not processing...

CVE-2024-47681

CVE-2024-47681 concerns the Linux kernel wifi driver for the mt76 MT7996. The issue is a NULL pointer dereference in the mt7996_mcu_sta_bfer_he routine when adding an STA interface to the MT7996 driver. The description indicates the vulnerability is resolved by fixing the NULL pointer dereference...

CVE-2024-47735

CVE-2024-47735 concerns the Linux kernel: RDMA/hns: Fix spin_unlock_irqrestore() called with IRQs enabled and correct misuse of spin_lock_irq()/spin_unlock_irq() when spin_lock_irqsave()/spin_lock_irqrestore() was held. The description and connected docs show the issue originated from lock debugg...

CVE-2024-48881

CVE-2024-48881 concerns the Linux kernel’s bcache implementation. The issue was a NULL pointer dereference risk in cache_set_flush() caused by a changed check: the code could access c->root when previous registration failed before c->root was allocated. The patch reverts the IS_ERR check to...

CVE-2024-49854

CVE-2024-49854 affects the Linux kernel’s block/bfq path. The root cause was a use-after-free (UAF): after bfq_split_bfqq(), if the current process is the last holder of bfqq, the bfqq can be freed and then bfqq->waker_bfqq could be accessed, with the waker potentially in the merge chain. The ...

CVE-2024-49912

The CVE-2024-49912 entry concerns a Linux kernel DRM/AMD display issue. A null pointer dereference risk existed in drm/amd/display within planes_changed_for_existing_stream when stream_status could be null. The published fix adds a null check for stream_status in planes_changed_for_existing_strea...

CVE-2024-49986

CVE-2024-49986 refers to a Linux kernel issue affecting the x86/x86-android-tablets platform. The vulnerability arises during platform_device_register() error handling: x86_android_tablet_remove() frees the pdevs[] array, so the code must not use pdevs[] after its deletion. The fix, as described ...

CVE-2024-50025

CVE-2024-50025 affects the Linux kernel, specifically the scsi fnic driver. Root cause: in a patch, flush_work initialization was moved into a conditional block, risking dispatching a work item on an uninitialized work queue. Impact: this could cause the queued work to not be processed, which may...

CVE-2024-50207

The CVE-2024-50207 issue affects the Linux kernel’s ring_buffer code (kernel/trace/ring_buffer.c), specifically ring_buffer_subbuf_order_set(). The problem arises because the function updates ring_buffer_per_cpu and installs new sub buffers to match requested page orders without acquiring exclusi...

CVE-2024-53143

CVE-2024-53143 affects the Linux kernel’s fsnotify path, fixing an ordering issue where iput() must complete before decrementing the watched_objects count. The patch ensures the superblock remains alive until iput() is done, preventing a potential use-after-free (UAF) of sb->s_fs_info in tmpfs...

CVE-2024-56613

CVE-2024-56613 : In the Linux kernel, a memory leak in NUMA handling was fixed. Root cause: multiple threads running hackbench could observe vma->numab_state as NULL concurrently, causing vma->numab_state to be overwritten. This could leak memory during NUMA scans when hackbench creates man...

CVE-2024-58053

CVE-2024-58053 is a Linux kernel vulnerability in rxrpc: the fix corrects handling of a received connection abort, propagating the abort to calls on the same connection and ensuring they wake to terminate. The patch also adds tracing for connection aborts. The issue could cause calls to hang when...

CVE-2024-58100

CVE-2024-58100 concerns the Linux kernel BPF verifier: the changes_pkt_data property for global functions/extension programs may cause the verifier to invalidate packet pointers incorrectly when replacing a global sub-program. The referenced commits add a changes_pkt_data flag to bpf_prog_aux, se...

CVE-2025-21685

CVE-2025-21685 : In Linux kernel, a race in platform/x86 lenovo-yoga-tab2-pro-1380-fastcharger was fixed. The yt2_1380_fc_serdev_probe() path called devm_serdev_device_open() before initializing serdev client ops, risking a NULL pointer dereference in the serdev controller’s receive_buf handler w...

CVE-2025-22057

Summary: CVE-2025-22057 affects the Linux kernel networking path for cached destination entries. The upstream fix to move the dst counter decrement from dst_destroy to dst_release was incomplete when CONFIG_DST_CACHE is enabled and OvS+tunnels are used, causing a potential access of freed data. T...

CVE-2025-22069

The CVE-2025-22069 entry concerns a Linux kernel riscv fgraph issue where stack layout for ftrace_return_to_handler argument did not match __arch_ftrace_regs, causing a Bad frame pointer warning. Affected component: riscv ftrace path in kernel/trace/fgraph.c; root cause: mismatch between the cons...

CVE-2025-37781

CVE-2025-37781 affects the Linux kernel involving the i2c Cros EC tunnel. When i2c-cros-ec-tunnel and the EC driver are built-in, the EC parent device may not be found, causing a NULL pointer dereference. The issue can be reproduced by unbinding the controller driver and re-loading the i2c-cros-e...

CVE-2025-37824

CVE-2025-37824 affects the Linux kernel TIPC monitor path. The issue is a NULL pointer dereference in tipc_mon_reinit_self() caused by a race between enabling and disabling the bearer, where mon->self may be NULL during reinitialization. A fix has been applied in tipc_mon_reinit_self() (net/ti...

CVE-2025-38240

The CVE-2025-38240 entry concerns a NULL pointer dereference in Linux kernel Mediatek DP/HPD path (mtk_dp_wait_hpd_asserted) when mtk_dp->drm_dev is not yet assigned, leading to NULL dereferences if drm prints are emitted in the call path. The issue is mitigated by changing error messages to u...

CVE-2025-39682

CVE-2025-39682 affects the Linux kernel TLS receive path . A zero-length record retrieved from the rx_list bypasses the intended recvmsg() record-type handling, causing subsequent TLS records to be processed with incorrect zero-copy and queuing assumptions. CISA rates it CVSS 9.8 (Critical, netwo...

CVE-2026-46323

CVE-2026-46323 affects the Linux kernel’s networking GRO path. The issue occurs in skb_gro_receive() where fragments can be copied between the source and GRO skbs without respecting zerocopy status, notably when SKBFL_MANAGED_FRAG_REFS is set. When this flag is present, pages in shinfo->frags ...

CVE-2009-3080

CVE-2009-3080 affects the Linux kernel gdth driver (gdth_read_event in drivers/scsi/gdth.c). In kernels before 2.6.32-rc8, a negative event index in an IOCTL can allow local users to cause a denial of service or potentially gain privileges. MiracleLinux advisories cite this CVE as part of affecte...

CVE-2009-4538

CVE-2009-4538 affects the Linux kernel e1000e driver (netdev.c) up to and including version 2.6.32.3. The issue is an improper check of the Ethernet frame size when frames exceed the MTU, allowing a remote attacker to influence the system via crafted packets. The impact is described as unspecifie...

CVE-2010-4668

CVE-2010-4668 affects the Linux kernel up to 2.6.37-rc7, where blk_rq_map_user_iov in block/blk-map.c allows a local user to trigger a panic/DoS via a zero-length I/O request to a SCSI device, due to an unaligned map. The vulnerability is tied to an incomplete fix for CVE-2010-4163. Affected vers...

CVE-2013-4345

CVE-2013-4345 is an off-by-one vulnerability in the Linux kernel’s crypto/ansi_cprng.c get_prng_bytes function, exploitable through requests for small data blocks up to kernel versions before 3.11.4. The issue allows context-dependent attackers to defeat cryptographic protections by mismanaging t...

CVE-2013-4387

CVE-2013-4387 affects the Linux kernel up to 3.11.4 in the IPv6 path. Specifically, net/ipv6/ip6_output.c does not correctly determine the need for UDP Fragmentation Offload (UFO) processing after queueing a large packet, enabling remote attackers to trigger memory corruption and a system crash v...

CVE-2015-0275

CVE-2015-0275 affects the Linux kernel ext4 subsystem: the ext4_zero_range function in fs/ext4/extents.c allows local users to trigger a denial of service via a crafted fallocate zero-range request. The linked MiracleLinux/Unity Linux Nessus entries reproduce this: the vulnerability is described ...

CVE-2016-9191

CVE-2016-9191 affects the Linux kernel (cgroup offline drain operations) up to version 4.8.11. A local attacker inside a container environment can cause a denial of service (system hang) by crafting an application. The provided documents confirm the vulnerability and affected mechanism but do not...

CVE-2017-16527

CVE-2017-16527 affects the Linux kernel component sound/usb/mixer.c, vulnerable before version 4.13.8. A crafted USB device can trigger a snd_usb_mixer_interrupt use-after-free, causing denial of service or system crash. Exploitation vectors are local to physical USB device interaction. The conne...

CVE-2017-18222

CVE-2017-18222 affects the Linux kernel before 4.12, where the Hisilicon Network Subsystem (HNS) ETH_SS_PRIV_FLAGS handling during sset_count retrieval can cause local denial of service via buffer overflow/memory corruption and potentially other impacts due to incompatibility with ethtool_get_str...

CVE-2021-47094

CVE-2021-47094 is associated with a Linux kernel KVM vulnerability in the x86 MMU. After dropping mmu_lock in the TDP MMU, the code restarts the tdp_iter_next() iterator and must not advance it; otherwise the top-level SPTE and all children can be skipped, which is fatal if any skipped SPTEs were...

CVE-2021-47153

CVE-2021-47153 involves the Linux kernel i2c: i801 driver. The issue occurs when a KILL-recover/bus-reset process triggers an interrupt that the i801_isr cannot handle, potentially causing an out-of-bounds memory access in block transactions. The connected MiracleLinux advisories (AXSA) reference...

CVE-2021-47400

CVE-2021-47400 concerns the Linux kernel HNS3 driver where hns3_nic_net_open() could be invoked repeatedly during concurrent device reset and TC setup, risking a kernel bug via napi_enable being called twice. The fix adds a check for the HNS3_NIC_STATE_DOWN flag and returns early if not set, prev...

CVE-2021-47489

Concretely affected: the Linux kernel AMDGPU display driver code, specifically the drm/amdgpu_dm_debugfs.c path. A heap-based buffer overflow can be triggered by writing a string into the debug filesystem (dp_link_settings_write path), due to missing size checks when copying from userspace into a...

CVE-2022-49253

CVE-2022-49253 affects the Linux kernel in the media: usb: go7007: s2250-board path, where a leak is fixed by calling i2c_unregister_device(audio) on the error path during probe. Connected sources (SUSE Astra Linux advisories) confirm the fix is in this area. The CVE description in the initial do...

CVE-2022-49605

Summary: CVE-2022-49605 concerns the igc Linux kernel driver. The issue arose because the IGC_REMOVED macro was not implemented, unlike the similar E1000/IGB patterns, allowing a PCIe detach scenario to trigger NULL dereferences after an 0xffffffff MMIO read. The connected documents describe the ...

CVE-2022-49691

CVE-2022-49691 describes a Linux kernel vulnerability in ERSPAN handling where code incorrectly assumes skb_transport_header is always set, affecting ip6erspan_tunnel_xmit() and erspan_fb_xmit(). The issue can impact packet transmission in ERSPAN-related paths when the transport header is not pre...

CVE-2022-49750

CVE-2022-49750 affects the Linux kernel CPPC support in cpufreq. The root cause is that the _CPC object fields are unsigned 32-bit values, which could overflow. The fix is to add u64 casts to these values to prevent overflow when used. Documented impact indicates potential availability impact (A)...

CVE-2023-38432

CVE-2023-38432 affects the Linux kernel prior to 6.3.10. The KSMBD SMB2 server (fs/smb/server/smb2misc.c) does not validate the relationship between the SMB command payload size and RFC1002 length, causing an out-of-bounds read. Impact: potential information disclosure or crash as stated by affec...

CVE-2023-52689

CVE-2023-52689 affects the Linux kernel ALSA scarlett2 meter control: scarlett2_meter_ctl_get() accesses meter_level_map[] without holding data_mutex. The fix adds a mutex around get_meter_levels to protect the shared data and prevent use of an uninitialized resource. References point to kernel p...

CVE-2023-52773

CVE-2023-52773 concerns a NULL pointer dereference in the Linux kernel’s DRM/AMD display path. The issue is in amdgpu_dm_i2c_xfer(), which can dereference a null pointer when performing a DDC/I2C transfer. The description states that on ddc_service_construct(), the code now checks both the link t...

CVE-2023-53002

CVE-2023-53002 concerns the Linux kernel DRM/I915 memory leak when mmap_offset is reused. The root cause is that drm_vma_node_allow() and drm_vma_node_revoke() were not called in balanced pairs: allow is invoked once per-file per mmap_offset, while revoke was only called per-file per mmap_offset,...

CVE-2023-53006

The CVE-2023-53006 issue is a Linux kernel CIFS (smbd) reconnect bug. The root cause is an uncleared server->smbd_conn pointer in reconnection logic, which can lead to oops if reconnection occurs after the smbd_connection struct is freed. The connected advisories describe that in smbd_destroy(...

CVE-2023-53121

The CVE-2023-53121 vulnerability affects the Linux kernel where tcp_rtx_synack() can be invoked from process context, allowing tcp_make_synack() to touch per-CPU data with preemption enabled and trigger a BUG: using __this_cpu_add() in preemptible code. The root cause is a context-inappropriate c...

CVE-2023-6200

The CVE describes a race condition in the Linux kernel that allows an unauthenticated attacker on an adjacent network to send ICMPv6 router advertisement packets to achieve arbitrary code execution. The impact is documented as high (C/H/I/A) with an adjacent network location and no user interacti...

CVE-2024-26754

CVE-2024-26754 : In the Linux kernel, a use-after-free and null pointer dereference in gtp_genl_dump_pdp() was fixed. The root cause is that the gtp_net_ops pernet operations structure for the gtp subsystem must be registered before the generic netlink family is registered. Affected code path inv...

CVE-2024-27405

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs It is observed sometimes when tethering is used over NCM with Windows 11as host, at some instances, the gadget_giveback has one byte appended atthe end of a prope...

CVE-2024-27416

CVE-2024-27416 affects the Linux kernel Bluetooth hci_event path, specifically HCI_EV_IO_CAPA_REQUEST handling when a remote feature read is still pending. Root cause: on receiving HCI_EV_IO_CAPA_REQUEST while HCI_OP_READ_REMOTE_EXT_FEATURES has not yet been responded to, the code incorrectly ass...