CVE-2024-46772

CVE-2024-46772 affects the Linux kernel (drm/amd/display). The vulnerability arises from not guarding the denominator crb_pipes before use, risking a divide-by-zero. The patch fixes two divide-by-zero issues by ensuring the denominator is checked prior to its use, and is noted as resolved in down...

CVE-2024-46840

CVE-2024-46840 relates to the Linux kernel bug in btrfs where handling for refs == 0 in snapshot delete could yield an incorrect answer because of missing locks. The fix converts BUG_ON(refs == 0) sites in reada, walk_down_proc, and walk_up_proc to proper error handling, returning -EUCLEAN (later...

CVE-2024-46848

CVE-2024-46848 affects the Linux kernel perf/x86/intel Haswell frequency-estimation path. The issue stems from a too-short initial period (1) triggering HW errata HSW11/HSW143; fixes enforce a minimum period (128 for INST_RETIRED.ALL and 32 for other counters) and adjust the frequency-estimation ...

CVE-2024-49898

CVE-2024-49898 affects the Linux kernel’s drm/amd/display component. The root cause is that drr_timing and subvp_pipe are initialized to null and are not consistently re-assigned before being dereferenced, leading to two FORWARD_NULL issues reported by Coverity. The issue is addressed by kernel f...

CVE-2024-49905

CVE-2024-49905 refers to a fix in the Linux kernel’s AMD GPU driver code, specifically for the DRM/AMD display path. The vulnerability arose from using the variable afb in amdgpu_dm_plane_handle_cursor_update without a null check; the commit added a null check to prevent potential null pointer de...

CVE-2024-49921

CVE-2024-49921 concerns the Linux kernel DRM display driver (drm/amd/display) specifically around null-pointer usage; fixes were applied to ensure pointers such as dc->clk_mgr are checked before use, addressing 10 FORWARD_NULL issues reported by Coverity. The connected OSV entries confirm patc...

CVE-2024-49986

CVE-2024-49986 refers to a Linux kernel issue affecting the x86/x86-android-tablets platform. The vulnerability arises during platform_device_register() error handling: x86_android_tablet_remove() frees the pdevs[] array, so the code must not use pdevs[] after its deletion. The fix, as described ...

CVE-2024-50088

CVE-2024-50088 affects the Linux kernel’s Btrfs filesystem code. The issue is in add_inode_ref(), where a name struct is not initialized when declared; if read_one_inode() returns NULL for either parent or inode, name.name is freed during cleanup without being initialized. This uninitialized free...

CVE-2024-50140

CVE-2024-50140 involves a Linux kernel vulnerability in sched/core where page allocation is disabled during task_tick_mm_cid(). With KASAN and PREEMPT_RT enabled, a call to task_work_add() within task_tick_mm_cid() can sleep in an invalid context, triggering a BUG in stack/depot and related alloc...

CVE-2024-50249

Mode C: Concrete details found. The CVE-2024-50249 issue in the Linux kernel arises from a lock-ordering problem in the CPPC/ACPI code: sugov_update_shared acquires a raw_spinlock while cpc_write holds a regular spinlock on cpc_ptr->rmw_lock, potentially causing a deadlock. The remediation is ...

CVE-2024-50255

The CVE CVE-2024-50255 affects the Linux kernel Bluetooth stack. A null-ptr-deref in hci_read_supported_codecs can occur due to __hci_cmd_sync_sk() returning NULL for unknown opcodes and the hci_cmd_complete_evt() assuming status from skb->data[0] when an opcode is missing from hci_cc, trigger...

CVE-2024-50257

CVE-2024-50257 in the Linux kernel: netfilter/get_info() use-after-free (LOCAL, LOW) during concurrent ip6table_nat module unload. Root cause described as a missing refcount fix when locating a table during get_info, leading to a use-after-free of xt_table->me when module exits. Impact is High...

CVE-2024-50274

CVE-2024-50274 affects the Linux kernel IDPF driver. The issue occurred when the device control plane is removed or the platform reboots; on driver reset, resources are freed and the code path could access a released vport pointer while monitoring tools query link settings. The fix moves link_spe...

CVE-2024-50280

CVE-2024-50280 : In the Linux kernel, the dm cache feature was fixed to avoid warning in flush_work() when cache creation fails due to destroying an uninitialized delayed_work waker. Root cause: cancel_delayed_work_sync() remained in the error path of cache_create(), risking a WARN_ON in certain ...

CVE-2024-50283

Concrete details found in connected docs: CVE-2024-50283 affects the Linux kernel ksmbd via a slab-use-after-free in smb3_preauth_hash_rsp; the fix changes the call order so ksmbd_user_session_put is invoked under smb3_preauth_hash_rsp() to avoid freeing the session prematurely. The issue is tied...

CVE-2024-53230

CVE-2024-53230 affects the Linux kernel cpufreq CPPC path. The issue is a potential NULL pointer dereference in cppc_get_cpu_cost() when cpufreq_cpu_get_raw() returns NULL for a CPU not present in policy->cpus mask. The fix is to add a NULL check before dereferencing cppc_get_cpu_cost(), mitig...

CVE-2024-54683

CVE-2024-54683 – Linux kernel netfilter IDLETIMER ABBA deadlock : The vulnerability occurs when deleting the last idletimer rule may race with a read of its sysfs file, risking a circular locking dependency between idletimer teardown and kernel lock ownership. A reproduction shows concurrent dele...

CVE-2024-56579

CVE-2024-56579 : In the Linux kernel, the media: amphion driver must set video_drvdata before registering the video device; otherwise video_drvdata() may return NULL in open(), causing an oops. Remediation per the description is to ensure video_drvdata() is set prior to video device registration....

CVE-2024-56613

CVE-2024-56613 : In the Linux kernel, a memory leak in NUMA handling was fixed. Root cause: multiple threads running hackbench could observe vma->numab_state as NULL concurrently, causing vma->numab_state to be overwritten. This could leak memory during NUMA scans when hackbench creates man...

CVE-2024-56626

CVE-2024-56626 is a Linux kernel issue in the ksmbd_vfs_stream_write path. An offset supplied by the client can be negative when the ksmbd.conf setting 'vfs objects = streams_xattr' is used, enabling an out-of-bounds write to the allocated buffer. The vulnerability description notes the condition...

CVE-2025-21767

CVE-2025-21767 is a Linux kernel issue where clocksource_verify_choose_cpus() is invoked with preemption disabled, causing a call to get_random_u32() that can indirectly acquire sleeping locks in PREEMPT_RT contexts. The root cause is using get_random_u32() while preemption is off, leading to an ...

CVE-2025-21878

CVE-2025-21878 relates to the Linux kernel i2c npcm driver. The vulnerability arises from not disabling the interrupt enable bit before calling devm_request_irq, leaving an i2c-related status bit that is read-only and triggers repeated interrupts. This behavior can cause a soft lockup and a reboo...

CVE-2025-21956

CVE-2025-21956 : In the Linux kernel, drm/amd/display incorrectly handled color depth 14, triggering a warning in amdgpu when running on Radeon RX 6600 XT. The issue is resolved by assigning the pixel clock as pix_clk * (14 * 3) / 24, aligning with other color depths, and also fixes indentation i...

CVE-2025-22022

CVE-2025-22022 concerns the Linux kernel USB xHCI driver, where NEC isochronous endpoints with NEC uPD720200 controllers could trigger IOMMU faults due to mis-handling of missed service errors. The description notes a faulty behavior involving transfer descriptors around isochronous rings and a c...

CVE-2025-22053

The CVE-2025-22053 issue affects the Linux kernel’s ibmveth driver, specifically the veth_pool_store path. The root cause is a race/ synchronization gap allowing two or more threads to enter veth_pool_store concurrently (via /sys/devices/vio/30000002/pool*/), which could lead to a hang. The provi...

CVE-2025-23158

The CVE-2025-23158 vulnerability affects the Linux kernel media: venus: hfi queue handling, where a firmware-modified large qsize can cause an OOB write when a new_wr_idx is not validated. The issue originates in reading/writing the shared queue (qhdr->q_size) and can lead to an out-of-bounds ...

CVE-2025-37766

CVE-2025-37766 affects the Linux kernel drm/amd/pm component, where the vulnerability stems from a divide-by-zero condition when setting a speed value. If speed exceeds UINT_MAX/8, a division by zero can occur. Multiple connected advisories/plugins (Azure Linux update, Astra Linux page, CIRCL sig...

CVE-2025-37871

CVE-2025-37871 is a Linux kernel vulnerability fixed by changing how sc_count is decremented when a dl_recall queue operation fails for NFS delegations. The described scenario shows a deadlock warning during nfs4_put_stid after a failed dl_recall queue, caused by a potential lock ordering issue w...

CVE-2025-37998

CVE-2025-37998 concerns openvswitch in the Linux kernel where unsafe Netlink attribute parsing in output_userspace() could lead to processing of malformed attributes. The connected documents confirm a patch that replaces the manual Netlink attribute iteration in output_userspace() with nla_for_ea...

CVE-2009-1389

CVE-2009-1389 is a vulnerability in the Linux kernel RTL8169 NIC driver (drivers/net/r8169.c). A crafted long Ethernet frame can cause a buffer overflow, leading to kernel memory corruption and a crash (remote DoS) on affected systems. The issue affects kernels before 2.6.30; exploitation require...

CVE-2009-3621

The CVE-2009-3621 issue affects the Linux kernel up to version 2.6.31.4 and earlier, specifically in net/unix/af_unix.c. The vulnerability allows a local attacker to cause a denial of service (system hang) by: (1) creating an abstract-namespace AF_UNIX listening socket, (2) performing a shutdown ...

CVE-2009-4020

CVE-2009-4020 describes a stack-based buffer overflow in the Linux kernel 2.6.32 hfs subsystem (fs/hfs/dir.c, hfs_readdir). A crafted Hierarchical File System (HFS) filesystem could allow an attacker to achieve an unspecified impact via the HFS filesystem. Several Nessus/GD advisories link this C...

CVE-2011-1080

CVE-2011-1080 affects the Linux kernel prior to 2.6.39 via the do_replace path in net/bridge/netfilter/ebtables.c. The issue: a name field may not end with a null terminator, enabling a local user with CAP_NET_ADMIN to replace a bridge table and read potentially sensitive data from kernel stack m...

CVE-2011-1577

CVE-2011-1577 describes a heap-based buffer overflow in the is_gpt_valid function of fs/partitions/efi.c in Linux kernel 2.6.38 and earlier. This allows physically proximate attackers to cause a denial of service (OOPS) or potentially other impact via a crafted EFI GPT header size on removable me...

CVE-2011-4131

CVE-2011-4131 affects the Linux kernel’s NFSv4 GETACL handling: the NFSv4 implementation does not correctly manage bitmap sizes when replying, allowing a remote NFS server to trigger a denial of service (OOPS) by sending an excessive number of bitmap words. The issue is fixed in or after the 3.2....

CVE-2012-3412

CVE-2012-3412 affects the sfc (Solarflare Solarstorm) driver in the Linux kernel, specifically versions before 3.2.30. The vulnerability allows remote attackers to trigger a denial of service by sending crafted TCP packets that induce a small MSS value, leading to DMA descriptor consumption and n...

CVE-2013-2237

CVE-2013-2237 affects the Linux kernel prior to 3.9. The vulnerability arises because key_notify_policy_flush in net/key/af_key.c does not initialize a certain structure member, enabling local attackers to read kernel heap memory via a broadcast message on the IPSec key_socket notify_policy inter...

CVE-2013-4579

CVE-2013-4579 affects the Linux kernel up to version 3.12, specifically the ath9k_htc_set_bssid_mask function in drivers/net/wireless/ath/ath9k/htc_drv_main.c. The vulnerability uses a BSSID masking approach to determine the set of MAC addresses the Wi‑Fi device listens to, enabling remote attack...

CVE-2013-6367

CVE-2013-6367 affects the Linux kernel KVM implementation (arch/x86/kvm/lapic.c) up to version 3.12.5. The vulnerability lets guest-OS users cause a denial of service (divide-by-zero, host crash) by crafting modifications to the TMICT value. The MiracleLinux/Unity Linux Nessus entries explicitly ...

CVE-2014-0100

CVE-2014-0100 refers to a race condition in the Linux kernel’s inet_frag_intern function (net/ipv4/inet_fragment.c) that affects kernel versions up to 3.13.6. The vulnerability can be triggered by a large sequence of fragmented ICMP Echo Request packets under heavy CPU load, leading to a use-afte...

CVE-2015-1420

CVE-2015-1420 is a Linux kernel race condition in fs/fhandle.c (handle_to_path) up to version 3.19.1. An attacker could bypass size restrictions by manipulating handle_bytes during handle_to_path execution to trigger reads from additional memory locations, enabling local read access to memory. Th...

CVE-2015-8952

CVE-2015-8952 : The mbcache feature in the Linux kernel’s ext2/ext4 implementations mishandles xattr block caching, enabling a local attacker to cause a denial of service (soft lockup) in environments with many attributes (as demonstrated by Ceph and Samba). The vulnerability is present in kernel...

CVE-2018-1000200

CVE-2018-1000200 (Linux kernel) is detailed in connected Nessus/OpenVAS entries as affecting Linux kernel versions 4.14, 4.15, and 4.16. The vulnerability is a NULL pointer dereference that can trigger an out-of-memory (OOM) kill of large memory-locked (mlocked) processes. The root cause involves...

CVE-2019-15504

CVE-2019-15504 affects the Linux kernel driver at drivers/net/wireless/rsi/rsi_91x_usb.c, with a Double Free vulnerability in versions up to 5.2.9. The issue arises from crafted USB device traffic, which could be delivered locally or remotely via usbip/usbredir, leading to potential memory corrup...

CVE-2019-19069

CVE-2019-19069 affects the Linux kernel fastrpc DMA path. A memory leak in the function fastrpc_dma_buf_attach() (drivers/misc/fastrpc.c) can be triggered by dma_get_sgtable() failures, allowing a potential denial of service through memory consumption. The vulnerability is in kernels before 5.3.9...

CVE-2021-47107

CVE-2021-47107 : In the Linux kernel NFSD, an underflow in buffer sizing for READDIR when a client issues a too-small count can cause writing beyond the allocated buffer via xdr_reserve_space(), enabling a buffer overflow. The root cause was a susceptibility in the READDIR path introduced by newe...

CVE-2021-47566

CVE-2021-47566 involves a Linux kernel vulnerability in proc/vmcore where user-space buffers were cleared improperly (memset) instead of using clear_user(), enabling a supervisor write fault on a vmcore copy scenario. The fix = use clear_user() when handling user buffers; SMAP handling is noted i...

CVE-2021-47572

CVE-2021-47572 affects the Linux kernel net: nexthop when adding an IPv6 nexthop while IPv6 is disabled (CONFIG_IPV6 not set). Root cause: nh_create_ipv6() dereferences ipv6_stub->fib6_nh_release in its error path, leading to a NULL pointer dereference. The fix returns the dummy stub’s -EAFNOS...

CVE-2022-3113

Summary of CVE-2022-3113 : The issue is in the Linux kernel’s media/vcodec path, specifically mtk_vcodec_fw_vpu_init in drivers/media/platform/mtk-vcodec/mtk_vcodec_fw_vpu.c, where the return value of devm_kzalloc() is not checked, leading to a possible NULL pointer dereference. The vulnerability...

CVE-2022-34495

CVE-2022-34495: In the Linux kernel, rpmsg_probe in drivers/rpmsg/virtio_rpmsg_bus.c before 5.18.4 is reported to contain a double free. Affected product/version examples include upstream Linux kernels updated to 5.18.4 or later. The connected sources (e.g., Astra Linux security bulletin and vend...