CVE-2025-22062

CVE-2025-22062 is a Linux kernel vulnerability where mutual exclusion was missing in proc_sctp_do_udp_port(), risking a crash due to unsynchronized calls to sctp_udp_sock_stop() and sctp_udp_sock_start(). The issue is evidenced by syzbot exposé showing a crash/OOPS from a non-canonical address. T...

CVE-2025-22088

Summary of CVE-2025-22088: In the Linux kernel RDMA erdma driver, the vulnerability is a Use-After-Free (UAF) in erdma_accept_newconn(). After erdma_cep_put(new_cep) frees new_cep, a subsequent dereference could access freed memory. The issue is fixed in the provided updates. The connected docume...

CVE-2025-38575

In CVE-2025-38575, the Linux kernel ksmbd memory handling was corrected: memory allocated by aead_request_alloc() must be freed with aead_request_free() to ensure sensitive crypto data is zeroed before freeing. This resolves a local-attack surface (AV:L/AC:L/PR:L/UI:N/S:U) with a MEDIUM base scor...

CVE-2010-3442

Technical details for CVE-2010-3442 are not publicly provided in the connected documents. The sources reference the CVE and affected kernel versions but do not describe exploitability, impact specifics, or fixes. Monitor for vendor advisories and updates.

CVE-2010-3875

CVE-2010-3875 affects the Linux kernel, specifically the ax25_getname function in net/ax25/af_ax25.c. The root cause is that a structure is not initialized, enabling local users to read a copy of kernel stack memory and potentially obtain sensitive information. The issue is tied to kernels prior ...

CVE-2010-4163

The CVE-2010-4163 issue affects the Linux kernel, where blk_rq_map_user_iov in block/blk-map.c is vulnerable before version 2.6.36.2. A local attacker can trigger a denial of service (kernel panic) by submitting a zero-length I/O request via a device ioctl to a SCSI device. The description explic...

CVE-2014-4171

CVE-2014-4171 affects mm/shmem.c in the Linux kernel up to 3.15.1. The issue is that the interaction between range notification and hole punching is not properly implemented, allowing a local user to cause a denial of service (i_mutex hold) by using mmap to access a hole. Demonstrations in the so...

CVE-2015-1333

CVE-2015-1333 is a memory-leak vulnerability in the Linux kernel prior to 4.1.4. The issue is in the __key_link_end function within security/keys/keyring.c, where adding a key to a keyring via add_key can allow a local attacker to exhaust memory and cause a denial of service. Public advisories an...

CVE-2015-2041

CVE-2015-2041 affects Unity Linux kernels (20.1050e/20.1060e/20.1070e) where the Linux kernel before 3.19 contains an error in net/llc/sysctl_net_llc.c using an incorrect data type in a sysctl table. This local information-disclosure flaw allows an unprivileged local user to read potentially sens...

CVE-2016-3695

CVE-2016-3695 in the Linux kernel relates to the einj_error_inject function (drivers/acpi/apei/einj.c). The issue allows a local user to simulate hardware errors and cause a denial of service by failing to disable APEI error injection via EINJ when securelevel is set. The connected documents show...

CVE-2017-8924

CVE-2017-8924 affects Linux kernel

CVE-2018-12928

CVE-2018-12928 concerns Linux kernel 4.15.0 where a NULL pointer dereference can occur in hfs_ext_read_extent within hfs.ko during mounting a crafted HFS filesystem. Connected advisories note the issue in kernel packages and reference a security update (ELSA) and Nessus entries indicating affecte...

CVE-2022-3104

The CVE-2022-3104 entry concerns the Linux kernel (up to 5.16-rc6) where lkdtm_ARRAY_BOUNDS in drivers/misc/lkdtm/bugs.c does not check the return value of kmalloc(), enabling a NULL pointer dereference. Affected software is the Linux kernel, with root cause in unchecked kmalloc return leading to...

CVE-2022-49199

CVE-2022-49199 affects the Linux kernel RDMA/nldev path. The vulnerability comes from underflow in nldev_stat_set_counter_dynamic_doit() where an “index” is checked for an upper bound but not for negatives. The fix changes the index type to unsigned to prevent underflows. Affected component: RDMA...

CVE-2022-49296

CVE-2022-49296: Linux kernel Ceph deadlock when holding Fwb to get inline_data. The vulnerability arises during cephfs/cephmds inline data handling (inline_version logic) causing a deadlock involving Fwb/Fsr caps during the getattr sequence, potentially locking the system. Connected docs indicate...

CVE-2022-49503

CVE-2022-49503 is a Linux kernel issue in ath9k_htc where rxstatus->rs_keyix can escape bounds when it is passed to test_bit(), risking out-of-bounds access in the bitmap. The condition is triggered in drivers/net/wireless/ath/ath9k/common.c:46 within ath9k_cmn_rx_accept(). The vulnerability s...

CVE-2022-49697

CVE-2022-49697 concerns a leak in the Linux kernel caused by a BPF lookup path that could leak a request_sock. The issue occurs when a BPF program performs a socket lookup that takes a refcnt on the socket and, after locating the child request_socket, returns the parent LISTEN socket via sk_to_fu...

CVE-2023-2006

CVE-2023-2006 describes a race condition in the Linux kernel RxRPC processing of bundles caused by insufficient locking. The issue can allow a local attacker to escalate privileges and execute arbitrary code within the kernel context. The vulnerability is tied to the RxRPC path, and the root caus...

CVE-2023-51042

CVE-2023-51042 affects the Linux kernel up to 6.4.12 where amdgpu_cs_wait_all_fences in drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c may dereference a freed fence (use-after-free). The issue is fixed in ChangeLog-6.4.12; Astra Linux bulletin also notes the same vulnerability. Impact details and remedia...

CVE-2023-52483

CVE-2023-52483 affects the Linux kernel where mctp_route_lookup/mctp_route_lookup_null traverse net->mctp.routes without an RCU read lock, allowing a potential race that could lead to a use-after-free due to a grace period expiry and a kfree while a route pointer is in use. The security adviso...

CVE-2023-53026

CVE-2023-53026 : Linux kernel RDMA/core fix to prevent an integer overflow in the ib block iterator when registering a DMA MR. If an sglist entry and chosen page size align poorly, the 32-bit counter that tracks progress through the sg entry can overflow to or beyond 4 GB, risking an infinite loo...

CVE-2023-6238

CVE-2023-6238 affects the Linux kernel NVMe driver. A buffer overflow allows a privileged user to provide a small meta buffer and trigger a larger DMA into that same buffer, overwriting unrelated kernel memory and causing random kernel crashes/memory corruption. The vulnerability is locally explo...

CVE-2024-25740

CVE-2024-25740 describes a memory leak in the Linux kernel UBI driver (drivers/mtd/ubi/attach.c) up to version 6.7.4 for UBI_IOCATT, where kobj->name is not released. The issue affects the kernel code path used to attach UBI devices and is documented with an impact of high on availability. Con...

CVE-2024-26726

CVE-2024-26726 : In the Linux kernel, a Btrfs bug could panic when writing the free-space inode because the extent map was dropped on a write error and then looked up again, yielding EXTENT_MAP_HOLE on a second pass. The fix removes dropping the extent_map range for the failed free-space cache wr...

CVE-2024-26741

CVE-2024-26741 concerns the Linux kernel DCCP/TCP path: when a connect() on an unbound socket occurs, the kernel searches for an ephemeral port, may reuse a bucket in ehash, and marks inet_num. If a concurrent allocation then fails for the corresponding bhash2 bucket, the code must revert by chec...

CVE-2024-26858

CVE-2024-26858 : The issue is in the Linux kernel, specifically the mlx5e/PTP code. A memory-barrier-based fix was applied to ensure that PTP WQ xmit submission tracking occurs after populating the metadata_map. Merely reordering mlx5e_ptp_metadata_map_put and mlx5e_ptpsq_track_metadata in mlx5e_...

CVE-2024-27416

CVE-2024-27416 is a Linux kernel vulnerability: Bluetooth hci_event handling of HCI on_IO_CAPA_REQUEST when Read Remote Extended Features is pending could lead to an incorrect assumption that the remote supports SSP. The issue is addressed in kernel code by fixing the HCI_EV_IO_CAPA_REQUEST handl...

CVE-2024-35828

CVE-2024-35828 concerns the Linux kernel libertas WiFi code (lbs_allocate_cmd_buffer). In the for loop, if cmdarray[i].cmdbuf allocation fails, both cmdarray and cmdarray[i].cmdbuf must be freed, otherwise memory leaks occur in lbs_allocate_cmd_buffer(). The connected documents confirm a fix was ...

CVE-2024-35911

CVE-2024-35911 (Linux kernel, ice driver) : Addresses a memory-corruption panic in the ice NIC driver during suspend/rebuild. The issue occurred because, after reset, code referenced num_q_vectors before it was safely reinitialized by ice_vsi_cfg_def(), which could lead to a zero-length buffer al...

CVE-2024-38545

CVE-2024-38545 : In the Linux kernel, RDMA/hns CQ destruction can race with asynchronous events, leading to a use-after-free if the CQ refcount is released concurrently. The issue is fixed by protecting the CQ refcount with a lock (xa_lock). Astra Linux’s security bulletin confirms the same vulne...

CVE-2024-38565

CVE-2024-38565 : In the Linux kernel, the issue is “wifi: ar5523: enable proper endpoint verification.” Syzkaller reported a warning about an endpoint in use not having an expected type, and the fix is to validate the existence of all proper endpoints with their corresponding types. The patch is ...

CVE-2024-38589

CVE-2024-38589 : In the Linux kernel netrom subsystem, a deadlock can occur in nr_rt_ioctl due to a circular locking dependency between nr_node_list_lock and nr_node_lock. Syzbot identified a possible deadlock when attempting to acquire nr_node_lock while already holding nr_node_list_lock, with t...

CVE-2024-38667

CVE-2024-38667 affects the Linux kernel on RISC‑V: secondary idle threads can have their top‑of‑stack overlap with pt_regs, risking corruption of pt_regs and potentially saving/restoring a non‑existent V context. The issue mirrors a fix for the primary hart and was not propagated to secondary har...

CVE-2024-40905

CVE-2024-40905 refers to a Linux kernel vulnerability where a race in ipv6 handling via __fib6_drop_pcpu_from() could allow a NULL read of *ppcpu_rt if another CPU clears the value in rt6_get_pcpu_route(). The issue was mitigated by adding a READ_ONCE() around the read and by surrounding derefere...

CVE-2024-41096

CVE-2024-41096 : In the Linux kernel, KFENCE reported a use-after-free in PCI MSI handling during msi_capability_init. The root cause is an error-path path that unmasks a descriptor after it may have been freed, propagating a failure from __msi_domain_alloc_locked() back to pci_alloc_irq_vectors ...

CVE-2024-42069

CVE-2024-42069 is a Linux kernel vulnerability: the net: mana double-free in an error path was fixed. When auxiliary_device_add() fails and calls auxiliary_device_uninit(), the adev_release callback could free makedev twice via kfree(madev). The fix prevents this by setting madev to NULL in the e...

CVE-2024-42160

Summary (CVE-2024-42160): In the Linux kernel, the f2fs subsystem had a validation gap in fault attribute handling. Specifically, fault attrs were not validated in parse_options(), and the patch adds a check in f2fs_build_fault_attr() and switches to using f2fs_build_fault_attr() in __sbi_store()...

CVE-2024-44961

Technical specifics for CVE-2024-44961 are not publicly provided in the connected documents. No affected product version, root cause, or fix details are confirmed here. Monitor for updates from vendors and security advisories.

CVE-2024-44962

The CVE affects the Linux kernel Bluetooth btnxpuart driver. Root cause: when unloading btnxpuart, a timer is not reliably shut down, so if the timer is modified during unload it may fire and invoke the timer callback after the driver is gone, causing a kernel panic. The fix is to replace del_tim...

CVE-2024-46686

CVE-2024-46686 (Linux kernel) : The vulnerability lies in the SMBv2 read path where smb2_new_read_req() can dereference rdata=NULL when SMB2_read() is used with RDMA and the rdma_readwrite_threshold is reached. This affects the Linux kernel smb client code and is triggered from the SMB2_read() fl...

CVE-2024-46737

CVE-2024-46737 is a Linux kernel vulnerability tied to nvmet-tcp. The issue occurs when nvmet_tcp_alloc_cmds() fails to allocate commands, causing a NULL pointer dereference in nvmet_tcp_release_queue_work() and kernel crash. The provided fix sets queue->nr_cmds to zero if nvmet_tcp_alloc_cmd(...

CVE-2024-46772

CVE-2024-46772 affects the Linux kernel (drm/amd/display). The vulnerability arises from not guarding the denominator crb_pipes before use, risking a divide-by-zero. The patch fixes two divide-by-zero issues by ensuring the denominator is checked prior to its use, and is noted as resolved in down...

CVE-2024-49898

CVE-2024-49898 affects the Linux kernel’s drm/amd/display component. The root cause is that drr_timing and subvp_pipe are initialized to null and are not consistently re-assigned before being dereferenced, leading to two FORWARD_NULL issues reported by Coverity. The issue is addressed by kernel f...

CVE-2024-49905

CVE-2024-49905 refers to a fix in the Linux kernel’s AMD GPU driver code, specifically for the DRM/AMD display path. The vulnerability arose from using the variable afb in amdgpu_dm_plane_handle_cursor_update without a null check; the commit added a null check to prevent potential null pointer de...

CVE-2024-49921

CVE-2024-49921 concerns the Linux kernel DRM display driver (drm/amd/display) specifically around null-pointer usage; fixes were applied to ensure pointers such as dc->clk_mgr are checked before use, addressing 10 FORWARD_NULL issues reported by Coverity. The connected OSV entries confirm patc...

CVE-2024-50088

CVE-2024-50088 affects the Linux kernel’s Btrfs filesystem code. The issue is in add_inode_ref(), where a name struct is not initialized when declared; if read_one_inode() returns NULL for either parent or inode, name.name is freed during cleanup without being initialized. This uninitialized free...

CVE-2024-50140

CVE-2024-50140 involves a Linux kernel vulnerability in sched/core where page allocation is disabled during task_tick_mm_cid(). With KASAN and PREEMPT_RT enabled, a call to task_work_add() within task_tick_mm_cid() can sleep in an invalid context, triggering a BUG in stack/depot and related alloc...

CVE-2024-50249

Mode C: Concrete details found. The CVE-2024-50249 issue in the Linux kernel arises from a lock-ordering problem in the CPPC/ACPI code: sugov_update_shared acquires a raw_spinlock while cpc_write holds a regular spinlock on cpc_ptr->rmw_lock, potentially causing a deadlock. The remediation is ...

CVE-2024-50255

The CVE CVE-2024-50255 affects the Linux kernel Bluetooth stack. A null-ptr-deref in hci_read_supported_codecs can occur due to __hci_cmd_sync_sk() returning NULL for unknown opcodes and the hci_cmd_complete_evt() assuming status from skb->data[0] when an opcode is missing from hci_cc, trigger...

CVE-2024-50257

CVE-2024-50257 in the Linux kernel: netfilter/get_info() use-after-free (LOCAL, LOW) during concurrent ip6table_nat module unload. Root cause described as a missing refcount fix when locating a table during get_info, leading to a use-after-free of xt_table->me when module exits. Impact is High...