CVE-2024-26752

CVE-2024-26752 affects the Linux kernel L2TP/IP6 path: a miscalculated ulen in l2tp_ip6_sendmsg (ulen = len + skb_queue_empty(...) ? transhdrlen : 0) due to operator precedence caused incorrect transport-header accounting, leading to corrupted packets on the wire. The fix adds parentheses to alig...

CVE-2025-37985

CVE-2025-37985 affects the Linux kernel USB wdm subsystem, specifically a race between wdm_open and wdm_wwan_port_stop. The issue arises if WDM_WWAN_IN_USE is not cleared last, allowing opening a chardev whose URBs may still be poisoned. Impact is local, with potential to exploit the race to caus...

CVE-2024-26754

CVE-2024-26754 : In the Linux kernel, a use-after-free and null pointer dereference in gtp_genl_dump_pdp() was fixed. The root cause is that the gtp_net_ops pernet operations structure for the gtp subsystem must be registered before the generic netlink family is registered. Affected code path inv...

CVE-2024-27405

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs It is observed sometimes when tethering is used over NCM with Windows 11as host, at some instances, the gadget_giveback has one byte appended atthe end of a prope...

CVE-2024-27416

CVE-2024-27416 affects the Linux kernel Bluetooth hci_event path, specifically HCI_EV_IO_CAPA_REQUEST handling when a remote feature read is still pending. Root cause: on receiving HCI_EV_IO_CAPA_REQUEST while HCI_OP_READ_REMOTE_EXT_FEATURES has not yet been responded to, the code incorrectly ass...

CVE-2024-27419

CVE-2024-27419 – Linux kernel data race in sysctl_net_busy_read The connected Astra Linux advisory and the initial description confirm a Linux kernel vulnerability: netrom: Fix data-races around sysctl_net_busy_read. The issue involved reading a sysctl value that could be modified concurrently, n...

CVE-2024-35848

CVE-2024-35848 affects the Linux kernel: an eeprom at24 memory corruption race condition occurs when an nvmem device is registered if the eeprom is not accessible. The read can fail and the device may be torn down; if another driver accesses the torn-down nvmem device, it can reference invalid me...

CVE-2024-36914

CVE-2024-36914 refers to a Linux kernel issue in drm/amd/display: writeback paths were incorrectly handled for DRM_MODE_CONNECTOR_WRITEBACK, causing KASAN slab-out-of-bounds messages. The root cause is a dynamic memory safety error detector triggering when writeback connectors do not initialize c...

CVE-2024-38556

CVE-2024-38556 affects the Linux kernel net/mlx5 code. The vulnerability arises from how the command queue semaphore timeout handling can allow an entry to be processed before an index is allocated, risking an out-of-bounds access at idx = -22 if the completion path proceeds without proper synchr...

CVE-2024-38602

The CVE-2024-38602 issue is in the Linux kernel ax25 subsystem, where a reference-count leak on the ax25_dev object was reported. The root causes are: (1) ax25_addr_ax25dev() could increase ax25_dev’s refcount multiple times, risking a memory leak, and (2) ax25_dev_device_down() could drop the re...

CVE-2024-39482

CVE-2024-39482 (Linux kernel) : The vulnerability affects the bcache subsystem, specifically the btree_iter code path. The bug arises from a fixed-length array inside the btree_iter structure that is indexed out-of-bounds when iterators are created with dynamic size, triggering UBSAN complaints. ...

CVE-2024-40914

The CVE-2024-40914 entry concerns a Linux kernel memory management issue in mm/huge_memory. The root cause is that HWPoison could be set for huge_zero_folio without increasing the folio refcount, causing unpoison_memory() to decrement the folio’s refcount as if it were hwpoisoned, triggering VM_B...

CVE-2024-42081

CVE-2024-42081 affects the Linux kernel component drm/ xe/ xe_devcoredump. The root cause was assigning xe_devcoredump_snapshot* and xe_device* unconditionally; the fix adds a NULL check and only assigns these pointers when coredump is not NULL. CVSS: Low-Privilege Local access with Medium overal...

CVE-2024-42107

CVE-2024-42107 affects the Linux kernel ice driver’s PTP support. The issue is a race between ice_ptp_extts_event() and ice_ptp_release() that can dereference a NULL pointer (ptp_clock_event called with NULL) after the PTP clock has been released, causing a kernel panic. The documented fix is to ...

CVE-2024-42259

The CVE-2024-42259 issue affects the Linux kernel DRM/i915 gem memory mapper. The root cause was a miscalculation of the mapped region size when a partial mapping offset is involved, which could permit a page fault on access. The fix changes how the mapping boundaries are computed: the start and ...

CVE-2024-43855

CVE-2024-43855 is a Linux kernel vulnerability in the md (RAID) subsystem where a deadlock could occur while an mddev is suspended and a flush bio is in progress. The connected docs describe the root cause as non-atomic increment/decrement of the active_io counter during the md flush sequence, en...

CVE-2024-44999

CVE-2024-44999 refers to a Linux kernel issue in gtp: pull network headers in gtp_dev_xmit() where syzbot/KMSAN detected uninitialized usage in get_dev_xmit(). The problem required ensuring IPv4/IPv6 headers are pulled into skb->head before accessing their fields. The fix implemented is to use...

CVE-2024-45003

CVE-2024-45003 concerns a Linux kernel vulnerability where inode eviction can deadlock during inode LRU traversal. The issue arises in the inode reclaim path (prune_icache_sb) when reclaiming inodes marks i_freeing and other processes attempt to iget under the same LRU context, risking deadlocks ...

CVE-2024-46705

CVE-2024-46705 affects the Linux kernel DRM Xe driver. The flaw arises from how mmio mappings are reset to NULL on device removal, intended to prevent rogue MMIO access after a device is removed, but could be misused when unmapped regions are remapped by another component, leading to system disru...

CVE-2024-46814

CVE-2024-46814 affects the Linux kernel in the DRM AMD display path. The vulnerability arises from not validating HDCP-related message IDs (msg_id) before processing a transcation, allowing 4 overrun issues to be triggered by an invalid HDCP_MESSAGE_ID (-1) acting as an index. The root cause is a...

CVE-2024-46830

CVE-2024-46830 affects the Linux kernel KVM for x86. The vulnerability arises when acquiring kvm->srcu while handling KVM_SET_VCPU_EVENTS, because KVM will forcibly leave nested VMX/SVM during SMM toggling and leaving nested VMX can read guest memory. The described fix: grab SRCU unconditional...

CVE-2024-49891

CVE-2024-49891 : In the Linux kernel, the SCSI lpfc path can NULL-deref when an HBA is resetting or handling an errata event due to hdwq pointers that may have been freed. Fixes add NULL pointer checks before dereferencing hdwq pointers in affected routines (e.g., lpfc_sli_flush_io_rings, lpfc_de...

CVE-2024-49955

CVE-2024-49955 : In the Linux kernel, ACPI battery handling fixes a crash when unregistering a battery hook. If a battery hook returns an error while adding a battery, the hook is auto-unregistered; the provider cannot detect this, and later calls to battery_hook_unregister() on an already-unregi...

CVE-2024-49992

CVE-2024-49992 affects the Linux kernel DRM STM path. Specifically, ltdc_load() calls drm_crtc_init_with_planes(), drm_universal_plane_init(), and drm_encoder_init() with devm_kzalloc()-allocated resources, which can lead to use-after-free in CRTC/plane handling. Root cause: allocations not manag...

CVE-2024-53065

CVE-2024-53065 concerns the Linux kernel slab allocator (kmem_buckets_create) where a duplicate kmem_cache creation can occur on arm64 when KASAN_HW_TAGS is enabled. The initial description explains that a previous patch reduced ARCH_KMALLOC_MINALIGN to 8, which, with KASAN_HW_TAGS, makes arch_sl...

CVE-2024-53119

CVE-2024-53119 affects the Linux kernel virtio/vsock code and fixes a memory-leak in the accept_queue during socket destruction. The root cause is that accept_queue entries enqueued after a flush could be left behind before SOCK_DONE is set, causing leaks when sockets are torn down. The fix intro...

CVE-2024-53206

CVE-2024-53206 affects the Linux kernel TCP stack. The vulnerability is a use-after-free of the nreq in reqsk_timer_handler(), triggered when a reqsk is migrated and a retry occurs (e.g., on timeout). The cited fix replaces inet_csk_reqsk_queue_drop_and_put() with __inet_csk_reqsk_queue_drop() an...

CVE-2024-57936

CVE-2024-57936 affects Linux kernel RDMA/bnxt_re. Gen P7 supports up to 13 SGEs, while WQE software structure can hold only 6, allowing requests up to 13 SGEs. This discrepancy led to traffic failures and potential system crashes. The fix uses a define for the max SGE supported for both static an...

CVE-2025-21872

CVE-2025-21872 – Linux kernel (EFI/MOKVAR handling) : The vulnerability arises from how the kernel validates the EFI MOKvar table. In older code, the mokvar table was fully remapped on each iteration to determine its size, which could fail if the table grew large due to early_memmap limitations, ...

CVE-2025-21878

CVE-2025-21878 relates to the Linux kernel i2c npcm driver. The vulnerability arises from not disabling the interrupt enable bit before calling devm_request_irq, leaving an i2c-related status bit that is read-only and triggers repeated interrupts. This behavior can cause a soft lockup and a reboo...

CVE-2025-21908

CVE-2025-21908 concerns the Linux kernel NFS subsystem. The issue arises when nfs_release_folio() can deadlock during writeback initiated by kcompactd, triggering a recursive path through NFS and the NFSD loopback on the same host. The patch adds PF_KCOMPACTD and a current_is_kcompactd() helper t...

CVE-2025-22038

CVE-2025-22038 concerns the Linux kernel, specifically the ksmbd path. The issue arises when accessing psid->sub_auth[psid->num_subauth - 1] without ensuring num_subauth is non-zero, which can cause an out-of-bounds read. The provided description states the patch adds a validation step to r...

CVE-2025-22095

CVE-2025-22095 pertains to the Linux kernel PCI subsystem (brcmstb) and fixes an error path in regulator_bulk_get() handling. If regulator_bulk_get() returns an error and no regulators are created, the kernel previously did not set the regulator count to zero, which could cause a kernel panic whe...

CVE-2025-22124

CVE-2025-22124 affects the Linux kernel’s md-bitmap/clustermd write_sb path. The issue was a miscalculation of the bitmap_limit for per-node write-intent bitmaps, which could cause bitmap_limit to be 0 in some cases (e.g., when pg_index equals bitmap->storage.file_pages). This results in md_su...

CVE-2025-37768

The CVE-2025-37768 entry concerns the Linux kernel DRM-AMD PM component. Public docs confirm the vulnerability is in drm/amd/pm: a division by zero can occur when the user sets a speed value greater than UINT_MAX/8, allowing a local attacker to trigger a crash. The issue has been resolved in the ...

CVE-2025-37792

The CVE-2025-37792 issue affects the Linux kernel Bluetooth btrtl driver (rtl load file path). root cause: btrtl_initialize() may treat a zero-length rtl_load_file() as non-error, causing an error pointer vs NULL and a subsequent NULL dereference. Severity is MEDIUM (CVSSv3.1 base 5.5), with loca...

CVE-2025-37839

CVE-2025-37839 (Linux kernel) fixes a journal-related logic flaw in jbd2. The root cause was the incorrect use of sb->s_sequence to determine journal emptiness; it should rely on sb->s_start, which is set earlier. Since 0 is a valid transaction ID, the previous check could spuriously trigge...

CVE-2025-37893

LoongArch LoongArch: BPF vulnerability fixed in arch/loongarch/net/bpf_jit.c: build_prologue() had an off-by-one error in JIT epilogue generation when mixing bpf2bpf and tailcalls. The first pass sets flags, the second emits N+1 instructions instead of N, causing epilogue_offset to be off and pot...

CVE-2025-37914

CVE-2025-37914 is a Linux kernel network scheduler vulnerability in net_sched: ets where a netem child qdisc can trigger reentrant enqueue, causing the same classifier to be added twice to the active_list and potentially memory corruption. The patch adds an active check (cl_is_active) and guards ...

CVE-2025-38085

The CVE-2025-38085 entry concerns a race in the Linux kernel mm/hugetlb path. Specifically, huge_pmd_unshare() could drop a reference on a page table that might already be shared across processes, potentially turning it into a normal page table in another process and allowing unrelated VMAs to be...

CVE-2025-38089

The CVE-2025-38089 issue affects the Linux kernel sunrpc authentication path. If a RPC reply decoding yields SVC_GARBAGE without setting the rq_accept_statp pointer, a dereference could crash (first-time thread processing) or memory scribble. The fix changes how SVC_GARBAGE is handled: treat it a...

CVE-2026-23272

CVE-2026-23272 affects the Linux kernel netfilter nf_tables component. The issue arises when inserting into a full set: the code increments set->nelems and publishes a new element before the RCU grace period, allowing an RCU reader to observe a partially updated element. The description notes ...

CVE-2010-3850

CVE-2010-3850: In the Linux kernel, the ec_dev_ioctl function in net/econet/af_econet.c did not require CAP_NET_ADMIN, allowing local users to bypass access restrictions and configure econet addresses via an SIOCSIFADDR ioctl. Documented impact is local privilege/unauthorized configuration; fix a...

CVE-2012-3400

CVE-2012-3400 describes a heap-based buffer overflow in the udf_load_logicalvol function (fs/udf/super.c) of the Linux kernel up to version 3.4.5. The flaw allows remote attackers to cause a denial of service (system crash) or potentially other impact via a crafted UDF filesystem. Connected advis...

CVE-2013-0343

CVE-2013-0343 affects the Linux kernel’s IPv6 handling, specifically ipv6_create_tempaddr in net/ipv6/addrconf.c, up to version 3.8. It can allow a remote attacker to cause a denial of service (excessive retries and RA address-generation outage) and potentially obtain sensitive information via IC...

CVE-2013-7263

The CVE-2013-7263 issue affects the Linux kernel before 3.12.4, where certain length values are updated before kernel data structures are initialized, enabling local attackers to read sensitive information from kernel stack memory via recvfrom, recvmmsg, or recvmsg. Connected Nessus entries (Unit...

CVE-2014-2309

CVE-2014-2309 affects the Linux kernel (net/ipv6/route.c, function ip6_route_add) up to version 3.13.6. It causes memory exhaustion via a flood of ICMPv6 Router Advertisement packets, enabling a remote attacker to trigger DoS. The connected Nessus/OpenVAS advisories reference Unity Linux security...

CVE-2015-3212

CVE-2015-3212: Race condition in net/sctp/socket.c in the Linux kernel before 4.1.2 allows local users to cause a denial of service (list corruption and panic) via a rapid series of socket-related system calls (notably setsockopt). Affected component is the SCTP implementation in the kernel; impa...

CVE-2016-9083

CVE-2016-9083 affects the Linux kernel VFIO PCI driver. The vulnerability is a state machine confusion bug in vfio_pci.c that lets a local attacker bypass integer overflow checks and trigger memory corruption, potentially causing a denial of service. Root cause is related to VFIO_DEVICE_SET_IRQS ...

CVE-2017-15116

CVE-2017-15116 affects the Linux kernel rngapi_reset() in crypto/rng.c, vulnerable before version 4.2. The issue allows a local attacker to trigger a NULL pointer dereference, causing a denial of service. Connected Nessus advisories (Unity Linux and EulerOS entries) reiterate the same description...