CVE-2022-49374

CVE-2022-49374 affects the Linux kernel TIPC bearer path. The root cause is improper validation of the TIPC_NLA_BEARER_NAME attribute length in the bearer enable flow (net/tipc/bearer.c), with fixes implemented in the kernel (referenced commits in the advisory). The connected docs describe the sy...

CVE-2022-49389

CVE-2022-49389 concerns a refcount leak in the Linux kernel USB/IP path. The issue arises because usb_get_dev() is called in stub_device_alloc(), and if stub_probe() fails afterward, the reference must be released with usb_put_dev(). The fix moves usb_put_dev() to the sdev_free error path, ensuri...

CVE-2022-49430

The CVE-2022-49430 entry affects the Linux kernel in the gpio_keys controller. The issue arises from canceling a delayed work handle when the gpio_keys module unloads and an interrupt pin is used instead of GPIO; the module initializes delayed work only for GPIO-backed paths and not for interrupt...

CVE-2022-49549

The CVE-2022-49549 entry concerns a Linux kernel memory-leak in the x86 MCE/AMD path: when threshold_create_bank() fails inside mce_threshold_create_device(), the previously allocated threshold banks array (bp) could be leaked because threshold_remove_device() only frees it if the bank creation s...

CVE-2022-49902

CVE-2022-49902 concerns a Linux kernel memory-leak in rq_wb on add_disk failure. kmemleak reported 3 memory-leak instances; the leak stems from memory allocated in wbt_enable_default() not being freed in device_add_disk()’s error path. Normally, del_gendisk()/rq_qos_exit() would free rq_wb memory...

CVE-2023-2006

CVE-2023-2006 describes a race condition in the Linux kernel RxRPC processing of bundles caused by insufficient locking. The issue can allow a local attacker to escalate privileges and execute arbitrary code within the kernel context. The vulnerability is tied to the RxRPC path, and the root caus...

CVE-2023-52846

The CVE-2023-52846 entry concerns a Linux kernel use-after-free in hsr's prp_create_tagged_frame, where prp_fill_rct() may fail and free the skb while the successful path returns the original skb. Impact is described as high for confidentiality, integrity, and availability with local access prere...

CVE-2024-26793

CVE-2024-26793 affects the Linux kernel gtp subsystem. The issue is a use-after-free and null pointer dereference in gtp_newlink() caused by incorrect registration order of gtp_link_ops relative to gtp_net_ops pernet structures. Syzkaller observed a general protection fault in gtp_genl_dump_pdp w...

CVE-2024-27419

CVE-2024-27419 – Linux kernel data race in sysctl_net_busy_read The connected Astra Linux advisory and the initial description confirm a Linux kernel vulnerability: netrom: Fix data-races around sysctl_net_busy_read. The issue involved reading a sysctl value that could be modified concurrently, n...

CVE-2024-38576

CVE-2024-38576 affects the Linux kernel where rcuc: rcu: print_cpu_stall_info() could overflow a buffer when jiffies differences are large. The root cause involved printing an unsigned difference with %ld and a potential buffer overflow, which is fixed by replacing sprintf() with snprintf() and a...

CVE-2024-38621

CVE-2024-38621 affects the Linux kernel media stk1160 driver, specifically the stk1160_copy_video() path. The root cause is an incorrect unsigned subtraction in the overflow check, where the length and bytesused semantics cause an overflow condition to be evaluated as false. The patch fixes the b...

CVE-2024-41015

CVE-2024-41015 involves the Linux kernel OCFS2 subsystem. Connected sources confirm a fixed issue where ocfs2_check_dir_entry() gained bounds checking and additional sanity checks on ocfs2_dir_entry() to ensure members do not access memory outside valid regions. The vulnerability was addressed in...

CVE-2024-42069

CVE-2024-42069 affects the Linux kernel, in the mana network driver. The issue is a double-free in the error path of auxiliary_device_add() when it returns an error and subsequently calls auxiliary_device_uninit(); the callback adev_release frees madev via kfree and the code would free it again. ...

CVE-2024-42093

CVE-2024-42093 – Linux kernel vulnerability in net/dpaa2: cpumask allocation on stack. For CONFIG_CPUMASK_OFFSTACK=y, explicit allocation of cpumask on the stack can overflow the stack. The fix is to use the *cpumask_var API(s) to allocate cpumask variables in a config-neutral way, leaving alloca...

CVE-2024-46733

The CVE-2024-46733 issue is in the Linux kernel, specifically the btrfs qgroup reserve leaks in cow_file_range during buffered writes. The root cause is that in the dirty page path the qgroup reserve remains owned until an ordered_extent is created; if an error occurs before allocation of the ord...

CVE-2024-47728

CVE-2024-47728 concerns the Linux kernel where a vulnerability in the BPF subsystem could leak memory due to ARG_PTR_TO_{LONG,INT} arguments on error paths. The resolved description indicates the fix zeros the former ARG_PTR_TO_{LONG,INT} inputs for non-tracing helpers when an error occurs, preve...

CVE-2024-49854

CVE-2024-49854 affects the Linux kernel’s block/bfq path. The root cause was a use-after-free (UAF): after bfq_split_bfqq(), if the current process is the last holder of bfqq, the bfqq can be freed and then bfqq->waker_bfqq could be accessed, with the waker potentially in the merge chain. The ...

CVE-2024-49868

CVE-2024-49868 : Linux kernel (btrfs) vulnerability causing a NULL pointer dereference in btrfs_update_reloc_root during balance/relocation cleanup. Root cause: a window where fs_info->reloc_ctl can be NULL between set_reloc_contrl() andunset_reloc_control(), leading to dereferencing NULL in c...

CVE-2024-49877

CVE-2024-49877 : In the Linux kernel, OCFS2 may dereference a NULL pointer during cleanup in ocfs2_set_buffer_uptodate() when bh is NULL and flags do not include OCFS2_BH_READAHEAD. This can trigger a NULL pointer dereference in the investigated code path. The CVE is characterized as a local, low...

CVE-2024-50001

The CVE 2024-50001 entry affects the Linux kernel, specifically the net/mlx5 multi-packet WQE transmit path. The code that obtains a DMA mapping for the skb may fail under memory pressure; in the error path it erroneously unmaps one entry from the sq’s FIFO list of active mappings. Since the mapp...

CVE-2024-50003

CVE-2024-50003 affects the Linux kernel component drm/amd/display. The issue causes a system hang on resume when a Thunderbolt (TBT) monitor is connected, because the HPD during resume triggers drm_client_modeset_probe() while connector->dev->master is NULL, potentially corrupting pipe topo...

CVE-2024-50025

CVE-2024-50025 affects the Linux kernel, specifically the scsi fnic driver. Root cause: in a patch, flush_work initialization was moved into a conditional block, risking dispatching a work item on an uninitialized work queue. Impact: this could cause the queued work to not be processed, which may...

CVE-2024-50031

CVE-2024-50031 affects the Linux kernel DRM/V3D perfmon handling. When kmscube runs with GALLIUM_HUD and perfmon monitors are destroyed, v3d->active_perfmon may be left as a stale pointer, causing a kernel panic on subsequent runs as the driver attempts to stop a non-existent perfmon. The prov...

CVE-2024-50207

The CVE-2024-50207 issue affects the Linux kernel’s ring_buffer code (kernel/trace/ring_buffer.c), specifically ring_buffer_subbuf_order_set(). The problem arises because the function updates ring_buffer_per_cpu and installs new sub buffers to match requested page orders without acquiring exclusi...

CVE-2024-50274

CVE-2024-50274 affects the Linux kernel IDPF driver. The issue occurred when the device control plane is removed or the platform reboots; on driver reset, resources are freed and the code path could access a released vport pointer while monitoring tools query link settings. The fix moves link_spe...

CVE-2024-53065

CVE-2024-53065 concerns the Linux kernel slab allocator (kmem_buckets_create) where a duplicate kmem_cache creation can occur on arm64 when KASAN_HW_TAGS is enabled. The initial description explains that a previous patch reduced ARCH_KMALLOC_MINALIGN to 8, which, with KASAN_HW_TAGS, makes arch_sl...

CVE-2024-53206

CVE-2024-53206 affects the Linux kernel TCP stack. The vulnerability is a use-after-free of the nreq in reqsk_timer_handler(), triggered when a reqsk is migrated and a retry occurs (e.g., on timeout). The cited fix replaces inet_csk_reqsk_queue_drop_and_put() with __inet_csk_reqsk_queue_drop() an...

CVE-2024-53230

CVE-2024-53230 affects the Linux kernel cpufreq CPPC path. The issue is a potential NULL pointer dereference in cppc_get_cpu_cost() when cpufreq_cpu_get_raw() returns NULL for a CPU not present in policy->cpus mask. The fix is to add a NULL check before dereferencing cppc_get_cpu_cost(), mitig...

CVE-2024-56546

CVE-2024-56546 affects the Linux kernel in drivers/soc/xilinx, specifically xlnx_add_cb_for_suspend. The issue arises if kmalloc fails to allocate cb_data, because the error path does not free eve_data (missing kfree), potentially causing a memory leak and impacting availability. The patch adds t...

CVE-2024-56613

CVE-2024-56613 : In the Linux kernel, a memory leak in NUMA handling was fixed. Root cause: multiple threads running hackbench could observe vma->numab_state as NULL concurrently, causing vma->numab_state to be overwritten. This could leak memory during NUMA scans when hackbench creates man...

CVE-2024-56749

Technical details for CVE-2024-56749 are not publicly provided in the supplied documents; no vendor names, affected products, or remediation specifics are present. Monitor for official advisories and patches.

CVE-2024-57841

CVE-2024-57841 concerns a Linux kernel memory leak in tcp_conn_request() where dst memory allocated in af_ops->route_req is not freed if inet_csk_reqsk_queue_hash_add() fails, as shown by the kmemleak stack. The vulnerability is in the path that leads to tcp_conn_request() and may leak memory ...

CVE-2024-58053

CVE-2024-58053 is a Linux kernel vulnerability in rxrpc: the fix corrects handling of a received connection abort, propagating the abort to calls on the same connection and ensuring they wake to terminate. The patch also adds tracing for connection aborts. The issue could cause calls to hang when...

CVE-2025-21643

The CVE-2025-21643 entry concerns the Linux kernel netfs path. Affected: kernel components handling asynchronous DIO via bio_vec[] passed to netfs_extract_user_iter(); trigger occurs when CIFS is combined with a loopback blockdev. Root cause: netfs_unbuffered_write_iter_locked() performed a check...

CVE-2025-21720

CVE-2025-21720 : Linux kernel xfrm: delete intermediate secpath entry in packet offload mode. When IP forwarding is enabled, secpath may not be removed, causing offloaded packets to re-enter the TX path with xfrm_offload set and can trigger a kernel NULL pointer dereference kernel panic in mlx5. ...

CVE-2025-21832

CVE-2025-21832 - Linux kernel : In blkdev_read_iter(), revert handling for -EIOCBQUEUED caused by not validating blkdev_direct_IO() return before iov_iter_revert(), risking a WARN_ON due to a negative/unsigned mismatch. The patch removes reversion for -EIOCBQUEUED, aligning with other spots and p...

CVE-2025-21872

CVE-2025-21872 – Linux kernel (EFI/MOKVAR handling) : The vulnerability arises from how the kernel validates the EFI MOKvar table. In older code, the mokvar table was fully remapped on each iteration to determine its size, which could fail if the table grew large due to early_memmap limitations, ...

CVE-2025-21956

CVE-2025-21956 : In the Linux kernel, drm/amd/display incorrectly handled color depth 14, triggering a warning in amdgpu when running on Radeon RX 6600 XT. The issue is resolved by assigning the pixel clock as pix_clk * (14 * 3) / 24, aligning with other color depths, and also fixes indentation i...

CVE-2025-22038

CVE-2025-22038 concerns the Linux kernel, specifically the ksmbd path. The issue arises when accessing psid->sub_auth[psid->num_subauth - 1] without ensuring num_subauth is non-zero, which can cause an out-of-bounds read. The provided description states the patch adds a validation step to r...

CVE-2025-22057

Summary: CVE-2025-22057 affects the Linux kernel networking path for cached destination entries. The upstream fix to move the dst counter decrement from dst_destroy to dst_release was incomplete when CONFIG_DST_CACHE is enabled and OvS+tunnels are used, causing a potential access of freed data. T...

CVE-2025-22108

CVE-2025-22108 affects the Linux kernel Broadcom bnxt_en driver, specifically the TX BD bd_cnt field. The field is 5 bits and should only validly hold 0, with a maximum supported value of 32. If CONFIG_MAX_SKB_FRAGS is modified such that the total number of SKB fragments approaches or exceeds the...

CVE-2025-22124

CVE-2025-22124 affects the Linux kernel’s md-bitmap/clustermd write_sb path. The issue was a miscalculation of the bitmap_limit for per-node write-intent bitmaps, which could cause bitmap_limit to be 0 in some cases (e.g., when pg_index equals bitmap->storage.file_pages). This results in md_su...

CVE-2025-23158

The CVE-2025-23158 vulnerability affects the Linux kernel media: venus: hfi queue handling, where a firmware-modified large qsize can cause an OOB write when a new_wr_idx is not validated. The issue originates in reading/writing the shared queue (qhdr->q_size) and can lead to an out-of-bounds ...

CVE-2025-37740

The CVE-2025-37740 entry concerns the Linux kernel JFS code: a zero AG width in dmapctl can cause a divide error when computing the control page level in dbAllocAG. The vulnerability is fixed by adding a sanity check for agwidth in dbAllocAG (to avoid division by zero). Affected component: JFS in...

CVE-2025-37985

CVE-2025-37985 affects the Linux kernel USB wdm subsystem, specifically a race between wdm_open and wdm_wwan_port_stop. The issue arises if WDM_WWAN_IN_USE is not cleared last, allowing opening a chardev whose URBs may still be poisoned. Impact is local, with potential to exploit the race to caus...

CVE-2026-46116

CVE-2026-46116 affects the Linux kernel xfrm subsystem (xfrm_state). The root cause is a local-use-after-free in __xfrm_state_delete due to unsafe deletions from byseq/byspi hash chains. The patch changes deletions to hlist_del_init_rcu and uses hlist_unhashed() checks, preventing writes after LI...

CVE-2011-1182

CVE-2011-1182 affects the Linux kernel’s signal handling: kernel/signal.c before 2.6.39 allows local users to spoof the UID and PID of a signal sender via sigqueueinfo. Affected in MiracleLinux 3 (kernel 2.6.18-274.1.AXS3) per AXSA-2011-313:06; the issue is described as a kill-signal spoofing vul...

CVE-2011-1746

The CVE affects the Linux kernel prior to 2.6.38.5, specifically the AGP subsystem in drivers/char/agp/generic.c. It is caused by multiple integer overflows in the functions agp_allocate_memory and agp_create_user_memory, allowing local users to trigger buffer overflows and potentially crash the ...

CVE-2011-3191

CVE-2011-3191 affects the Linux kernel CIFS implementation (fs/cifs/cifssmb.c: CIFSFindNext). It is caused by an integer signedness error, existing in kernels before 3.1, which can allow a remote CIFS server to trigger memory corruption or other impact via a large length value in a directory read...

CVE-2011-4086

The CVE-2011-4086 vulnerability affects the Linux kernel prior to 3.3.1, where journal_unmap_buffer in fs/jbd2/transaction.c mishandles _Delay and _Unwritten journal buffer head states. This can crash the system (local DoS) when an ext4 filesystem is mounted with a journal. Remediation: upgrade t...