CVE-2024-36893

CVE-2024-36893 – Linux kernel : A NULL pointer dereference in usb: typec: tcpm due to typec_register_partner() not guaranteeing partner registration. If port->partner is invalid (NULL or an error value) and is not checked before dereferencing, it can crash the kernel (e.g., kernel NULL pointer...

CVE-2024-38381

CVE-2024-38381 affects the Linux kernel vulnerability in the NFC NFC-NCI path. The issue is an uninitialized-value access in nci_rx_work, which parses a received packet from ndev->rx_q without validating header size, payload size, and total packet size before processing. An invalid packet coul...

CVE-2024-38565

CVE-2024-38565 : In the Linux kernel, the issue is “wifi: ar5523: enable proper endpoint verification.” Syzkaller reported a warning about an endpoint in use not having an expected type, and the fix is to validate the existence of all proper endpoints with their corresponding types. The patch is ...

CVE-2024-40916

The CVE-2024-40916 issue concerns the Linux kernel DRM/Exynos HDMI driver. When EDID reading fails and the driver reports no modes, the DRM core previously exposed a 1024x786 mode which some Exynos HDMI variants cannot drive. The fix changes this fallback to a safe 640x480 mode to avoid rendering...

CVE-2024-42311

CVE-2024-42311 relates to the Linux kernel with the HFS filesystem. The issue was that in hfs_alloc_inode(), the fields .tz_secondswest, .cached_start, and .cached_blocks of struct hfs_inode_info were not initialized, potentially allowing uninitialized-value access. The provided documents indicat...

CVE-2024-46692

CVE-2024-46692 affects the Linux kernel firmware: qcom scm path. The root cause is that get_wq_ctx() was configured as a standard SMC call; when two SMCs sleep and one wakes, an interrupted get_wq_ctx() could sleep again while another SMC awaits a waitq context, creating a deadlock. The documente...

CVE-2024-46848

CVE-2024-46848 affects the Linux kernel perf/x86/intel Haswell frequency-estimation path. The issue stems from a too-short initial period (1) triggering HW errata HSW11/HSW143; fixes enforce a minimum period (128 for INST_RETIRED.ALL and 32 for other counters) and adjust the frequency-estimation ...

CVE-2024-47728

CVE-2024-47728 concerns the Linux kernel where a vulnerability in the BPF subsystem could leak memory due to ARG_PTR_TO_{LONG,INT} arguments on error paths. The resolved description indicates the fix zeros the former ARG_PTR_TO_{LONG,INT} inputs for non-tracing helpers when an error occurs, preve...

CVE-2024-49909

The CVE-2024-49909 vulnerability affects the Linux kernel DRM AMD display path (drm/amd/display) specifically in dcn32_set_output_transfer_func, where a null pointer dereference could occur if set_output_gamma is NULL. The issue arises from dereferencing set_output_gamma after a prior NULL check ...

CVE-2024-49986

CVE-2024-49986 refers to a Linux kernel issue affecting the x86/x86-android-tablets platform. The vulnerability arises during platform_device_register() error handling: x86_android_tablet_remove() frees the pdevs[] array, so the code must not use pdevs[] after its deletion. The fix, as described ...

CVE-2024-50156

CVE-2024-50156 affects the Linux kernel’s drm/msm path. A NULL dereference could occur in msm_disp_state_print_regs() if allocation in msm_disp_state_dump_regs() failed and block->state is NULL. The fix prints "Registers not stored" when a NULL is encountered and also modernizes msm_disp_state...

CVE-2024-50224

This CVE affects the Linux kernel SPI driver spi-fsl-dspi, where a crash could occur when GPIO chip select is not used. The root cause is a NULL pointer dereference caused by not validating the return value of spi_get_csgpiod() before passing it to gpiod_direction_output(). The provided details d...

CVE-2024-50244

CVE-2024-50244 affects the Linux kernel ntfs3 driver. Root cause: an additional check added in ni_clear() to validate NTFS_FLAGS_LOG_REPLAYING, preventing access to an uninitialized bitmap during the NTFS replay process. Impact: as described, availability is affected; other confidentiality/integr...

CVE-2024-50257

CVE-2024-50257 in the Linux kernel: netfilter/get_info() use-after-free (LOCAL, LOW) during concurrent ip6table_nat module unload. Root cause described as a missing refcount fix when locating a table during get_info, leading to a use-after-free of xt_table->me when module exits. Impact is High...

CVE-2024-53175

CVE-2024-53175 affects the Linux kernel’s IPC subsystem. The issue arises when percpu memory allocation fails during create_ipc_ns, leading to a memleak because ipc sysctls and mq sysctls are not released on failure. The fix releases these resources on failure to prevent leaks, as illustrated by ...

CVE-2024-54683

CVE-2024-54683 – Linux kernel netfilter IDLETIMER ABBA deadlock : The vulnerability occurs when deleting the last idletimer rule may race with a read of its sysfs file, risking a circular locking dependency between idletimer teardown and kernel lock ownership. A reproduction shows concurrent dele...

CVE-2024-56557

The CVE-2024-56557 entry concerns the Linux kernel driver iio: adc: ad7923. The root cause is that when enabling 8-channel support for AD7923, the tx_buf and ring_xfer buffer sizes were not enlarged, enabling a potential buffer overflow in ad7923_update_scan_mode(). The Connected documents confir...

CVE-2024-56613

CVE-2024-56613 : In the Linux kernel, a memory leak in NUMA handling was fixed. Root cause: multiple threads running hackbench could observe vma->numab_state as NULL concurrently, causing vma->numab_state to be overwritten. This could leak memory during NUMA scans when hackbench creates man...

CVE-2024-56692

CVE-2024-56692 concerns the Linux kernel’s f2fs file system. The vulnerability stems from insufficient sanity checks for the nat entry blkaddr used during truncate_node(), which can lead to a system panic when f2fs_invalidate_blocks() processes a corrupted blkaddr (as observed in fuzzing). The ro...

CVE-2024-56717

CVE-2024-56717 affects the Linux kernel ocelot switchdev path (net: mscc: ocelot). The root cause is an incorrect SRC_PORT argument passed to ocelot_ifh_set_basic(), copied from ocelot_xmit_common() as a port mask instead of a single port index. This produces packing failures (Cannot store 0x40 i...

CVE-2024-57936

CVE-2024-57936 affects Linux kernel RDMA/bnxt_re. Gen P7 supports up to 13 SGEs, while WQE software structure can hold only 6, allowing requests up to 13 SGEs. This discrepancy led to traffic failures and potential system crashes. The fix uses a define for the max SGE supported for both static an...

CVE-2024-58053

CVE-2024-58053 is a Linux kernel vulnerability in rxrpc: the fix corrects handling of a received connection abort, propagating the abort to calls on the same connection and ensuring they wake to terminate. The patch also adds tracing for connection aborts. The issue could cause calls to hang when...

CVE-2024-58100

CVE-2024-58100 concerns the Linux kernel BPF verifier: the changes_pkt_data property for global functions/extension programs may cause the verifier to invalidate packet pointers incorrectly when replacing a global sub-program. The referenced commits add a changes_pkt_data flag to bpf_prog_aux, se...

CVE-2025-21826

CVE-2025-21826 affects the Linux kernel nf_tables (netfilter). The issue is a mismatched sum between field_len and set key length in a pipapo-based key, allowing incorrect pipapo width calculation and potential impact on confidentiality, integrity, and availability (as per CVSS data: HIGH). Affec...

CVE-2025-21878

CVE-2025-21878 relates to the Linux kernel i2c npcm driver. The vulnerability arises from not disabling the interrupt enable bit before calling devm_request_irq, leaving an i2c-related status bit that is read-only and triggers repeated interrupts. This behavior can cause a soft lockup and a reboo...

CVE-2025-22083

The CVE-2025-22083 issue affects Linux kernel vhost-scsi handling: multiple vhost_scsi_set_endpoint calls without an intervening vhost_scsi_clear_endpoint can trigger three bugs in the vs_tpg lifecycle. 1) Use-after-free when no tpgs are found after a second call, due to freed vs->vs_tpg backi...

CVE-2025-22108

CVE-2025-22108 affects the Linux kernel Broadcom bnxt_en driver, specifically the TX BD bd_cnt field. The field is 5 bits and should only validly hold 0, with a maximum supported value of 32. If CONFIG_MAX_SKB_FRAGS is modified such that the total number of SKB fragments approaches or exceeds the...

CVE-2025-23147

CVE-2025-23147 : Linux kernel i3c master/IBI handling vulnerability where an IBI can arrive before the target driver is probed, causing a NULL dereference in dev->ibi and a kernel panic. Affected component is the I3C master queue path (i3c_master_queue_ibi()); root cause is uninitialized dev-&...

CVE-2025-23158

The CVE-2025-23158 vulnerability affects the Linux kernel media: venus: hfi queue handling, where a firmware-modified large qsize can cause an OOB write when a new_wr_idx is not validated. The issue originates in reading/writing the shared queue (qhdr->q_size) and can lead to an out-of-bounds ...

CVE-2025-37740

The CVE-2025-37740 entry concerns the Linux kernel JFS code: a zero AG width in dmapctl can cause a divide error when computing the control page level in dbAllocAG. The vulnerability is fixed by adding a sanity check for agwidth in dbAllocAG (to avoid division by zero). Affected component: JFS in...

CVE-2025-37766

CVE-2025-37766 affects the Linux kernel drm/amd/pm component, where the vulnerability stems from a divide-by-zero condition when setting a speed value. If speed exceeds UINT_MAX/8, a division by zero can occur. Multiple connected advisories/plugins (Azure Linux update, Astra Linux page, CIRCL sig...

CVE-2026-46054

CVE-2026-46054 affects the Linux kernel SELinux overlayfs access checks for mmap() and mprotect(). The issue arises from insufficient enforcement of backing-file access between the user file and backing file, potentially bypassing policies. A patch introduces security_mmap_backing_file() to enfor...

CVE-2009-3080

CVE-2009-3080 affects the Linux kernel gdth driver (gdth_read_event in drivers/scsi/gdth.c). In kernels before 2.6.32-rc8, a negative event index in an IOCTL can allow local users to cause a denial of service or potentially gain privileges. MiracleLinux advisories cite this CVE as part of affecte...

CVE-2013-2164

The CVE-2013-2164 issue affects the Linux kernel (mmc_ioctl_cdrom_read_data in drivers/cdrom/cdrom.c) and allows local users to read kernel memory from a malfunctioning CD-ROM. Affected context: Linux kernel up to version 3.10; exploitation requires local access. Impact per sources: local informa...

CVE-2014-0131

CVE-2014-0131 affects the Linux kernel up to version 3.13.6. The vulnerability is a use-after-free in the skb_segment function within net/core/skbuff.c caused by the absence of a certain orphaning operation. Exploitation details are not provided in the supplied documents. The impact is that an at...

CVE-2014-3646

CVE-2014-3646 affects the Linux kernel’s KVM implementation: arch/x86/kvm/vmx.c lacks an exit handler for the INVVPID instruction, enabling a local guest-user to crash the guest OS (DoS) via a crafted application. Public remote advisories in connected Nessus plugins confirm the issue exists in ke...

CVE-2014-9420

CVE-2014-9420 affects the Linux kernel iso9660 isofs rock.c: rock_continue does not bound the number of Rock Ridge continuation entries, allowing a local attacker crafting an ISO image to trigger an infinite loop and cause DoS (system hang/crash) on kernels up to 3.18.1. Public advisories from Ce...

CVE-2015-1420

CVE-2015-1420 is a Linux kernel race condition in fs/fhandle.c (handle_to_path) up to version 3.19.1. An attacker could bypass size restrictions by manipulating handle_bytes during handle_to_path execution to trigger reads from additional memory locations, enabling local read access to memory. Th...

CVE-2015-5707

CVE-2015-5707 affects the Linux kernel sg.c sg_start_req function (drivers/scsi/sg.c) where an integer overflow can occur in write requests with a large iov_count, allowing a local attacker to cause a denial of service or potentially other impact on kernel memory. Affected are kernel versions 2.6...

CVE-2016-2053

CVE-2016-2053: The Linux kernel’s asn1_ber_decoder in lib/asn1_decoder.c is vulnerable to denial-of-service (panic) via a crafted ASN.1 BER file that lacks a public key. The issue occurs in kernel builds prior to 4.3. Consequence is a local DoS without authenticated user interaction. Affected com...

CVE-2021-46283

CVE-2021-46283 affects the Linux kernel’s nf_tables_newset in nf_tables_api.c, where missing initialization of nft_set_elem_expr_alloc can trigger a NULL pointer dereference/GPF when a local user creates a netfilter table expression in their namespace, leading to a denial of service. The vulnerab...

CVE-2021-46988

The CVE-2021-46988 entry concerns a Linux kernel issue in userfaultfd where a page allocated during shmem_mfill_atomic_pte() may not be released if a copy_from_user() fails and accounting subsequently fails, triggering a BUG_ON in the caller. The connected Astra/Linux bulletin and Nessus/OpenVAS ...

CVE-2021-47304

CVE-2021-47304 : Linux kernel fix for tcp_init_transfer() resetting icsk_ca_initialized, which could cause double-initializations of congestion-control modules (e.g., CDG) and memory leaks. Root cause: after tcp_init_transfer(), icsk_ca_initialized could be reset to 0 without a prior cc->relea...

CVE-2021-47400

CVE-2021-47400 concerns the Linux kernel HNS3 driver where hns3_nic_net_open() could be invoked repeatedly during concurrent device reset and TC setup, risking a kernel bug via napi_enable being called twice. The fix adds a check for the HNS3_NIC_STATE_DOWN flag and returns early if not set, prev...

CVE-2022-0264

CVE-2022-0264 : The Linux kernel eBPF verifier has a vulnerability in how it handles internal data structures, allowing leakage of internal kernel memory to userspace when eBPF code is inserted into the kernel. A local attacker with insertion privileges could exploit this to access kernel memory ...

CVE-2022-3543

CVE-2022-3543 affects the Linux kernel BPF component: the memory leak occurs in the unix_sock_destructor/unix_release_sock paths in net/unix/af_unix.c. The issue is localized to the BPF code handling UNIX sockets, and the vulnerability can lead to memory consumption/leaf exhaustion. A patch is av...

CVE-2022-49046

CVE-2022-49046 affects the Linux kernel i2c subsystem, specifically the dev: how the device name is set. The root cause is a missing check of the return value from dev_set_name(); if dev_set_name() fails, dev_name() may be null, leading to a potential null pointer dereference. The connected advis...

CVE-2022-49297

CVE-2022-49297 is a Linux kernel vulnerability related to the NBD (network block device) disconnect flow that could cause IO hangs when a device is disconnected. The issue occurs in the NBD path during disconnect and socket clearing, with inflight requests potentially not completing due to how NB...

CVE-2022-49389

CVE-2022-49389 concerns a refcount leak in the Linux kernel USB/IP path. The issue arises because usb_get_dev() is called in stub_device_alloc(), and if stub_probe() fails afterward, the reference must be released with usb_put_dev(). The fix moves usb_put_dev() to the sdev_free error path, ensuri...

CVE-2022-49426

CVE-2022-49426 : Linux kernel iommu/arm-smmu-v3-sva had a use-after-free when freeing the MM context because arm64_mm_context_put() ran without a held reference. The root cause is not holding a reference to the MM during unpinning, allowing it to be freed prematurely. The fix is to call mmgrab()/...