CVE-2024-41006

CVE-2024-41006 : Linux kernel vulnerability where a memory leak in nr_heartbeat_expiry() could occur due to the sock_hold() logic. The fix removes sock_hold() for non-listening sockets and retains it only for listening sockets, addressing a syzkaller-reported leak in nr_create(). The linked advis...

CVE-2024-26970

CVE-2024-26970 affects the Linux kernel clock driver for Qualcomm IPQ6018 (clk: qcom: gcc-ipq6018). Root cause: frequency table arrays lacked a terminating empty element, risking out-of-bounds access when traversed by qcom_find_freq() or qcom_find_freq_floor(). Mitigation: patch adds an empty ter...

CVE-2024-27024

CVE-2024-27024 concerns the Linux kernel vulnerability in net/rds where a WARNING in rds_conn_connect_if_down could cause get_mr() to fail and trigger a connection after get_mr(). This is a local-attack surface (LOCAL) with high impact on confidentiality, integrity, and availability (CVE score in...

CVE-2024-27435

Mode C | CVE-2024-27435: Linux kernel nvme over RDMA reconnection fix for ABBA deadlock due to reserved tag allocation. The Astra/IBM-related sources describe admin_q reconnect failing when rings share tagsets with fabric_q and a keep-alive command held a reserved tag, causing a reconnection dead...

CVE-2024-35951

CVE-2024-35951 concerns a Linux kernel regression in the DRM Panfrost path. The issue arises in panfrost_mmu_map_fault_addr(): when page or sg allocation fails, the code improperly releases a previously acquired page reference, creating unbalanced get/put_pages() calls. The patch fixes the error ...

CVE-2024-38587

CVE-2024-38587 is a Linux kernel vulnerability where the Speakup code used sizeof() on a buf that is actually an array of 256 u16 values. The correct check is to use ARRAY_SIZE(), which yields 256, instead of sizeof() which yielded 512, avoiding a potential out-of-bounds access. The connected Nes...

CVE-2024-43867

The CVE refers to a Linux kernel issue in the DRM Nouveau path: a refcount underflow in nouveau_bo_ref() when nouveau_bo has not been initialized (backing ttm_bo). The vulnerability arises in the unwind path of drm_gem_object_init(); instead of calling nouveau_bo_ref(), code now manually cleans u...

CVE-2024-46681

The CVE-2024-46681 entry affects the Linux kernel pktgen path: within pktgen_pg_net_init, the for_each_online_cpu loop was executed without holding a cpus_read_lock, risking a race that could trigger WARN_ON(smp_processor_id() != cpu) and flood logs. The fix introduces cpus_read_lock()/cpus_read_...

CVE-2024-46762

CVE-2024-46762 affects the Linux kernel xen privcmd path. A race between privcmd_irqfd_assign() and privcmd_irqfd_deassign() can leave a previously freed kirqfd in use, allowing access to a freed kirqfd and causing a kernel oops. The issue is mitigated by applying SRCU locking to irqfds, mirrorin...

CVE-2024-46812

CVE-2024-46812 concerns the Linux kernel DRM/AMD display code. The vulnerability arises from memory access issues addressed by skipping inactive planes in ModeSupportAndSystemConfiguration, as reported by Coverity. The fix is implemented in the kernel to prevent illegal accesses by not processing...

CVE-2024-46840

CVE-2024-46840 relates to the Linux kernel bug in btrfs where handling for refs == 0 in snapshot delete could yield an incorrect answer because of missing locks. The fix converts BUG_ON(refs == 0) sites in reada, walk_down_proc, and walk_up_proc to proper error handling, returning -EUCLEAN (later...

CVE-2024-46848

CVE-2024-46848 affects the Linux kernel perf/x86/intel Haswell frequency-estimation path. The issue stems from a too-short initial period (1) triggering HW errata HSW11/HSW143; fixes enforce a minimum period (128 for INST_RETIRED.ALL and 32 for other counters) and adjust the frequency-estimation ...

CVE-2024-49911

CVE-2024-49911 : In the Linux kernel, the drm/amd/display path (dcn20_set_output_transfer_func) added a null check for the set_output_gamma function pointer to prevent a potential NULL pointer dereference. The fix ensures set_output_gamma is non-NULL before invocation (previously checked only for...

CVE-2024-49912

The CVE-2024-49912 entry concerns a Linux kernel DRM/AMD display issue. A null pointer dereference risk existed in drm/amd/display within planes_changed_for_existing_stream when stream_status could be null. The published fix adds a null check for stream_status in planes_changed_for_existing_strea...

CVE-2024-49931

The CVE-2024-49931 issue in Linux kernel WiFi driver ath12k (SoC stats) is a concrete fix: ath12k_dp_rx_process() previously indexed hal_reo_error with the REO destination SRNG ring ID, which is incorrect and caused an out-of-bounds access. The fix uses the normal ring ID directly to prevent out-...

CVE-2024-49986

CVE-2024-49986 refers to a Linux kernel issue affecting the x86/x86-android-tablets platform. The vulnerability arises during platform_device_register() error handling: x86_android_tablet_remove() frees the pdevs[] array, so the code must not use pdevs[] after its deletion. The fix, as described ...

CVE-2024-50003

CVE-2024-50003 affects the Linux kernel component drm/amd/display. The issue causes a system hang on resume when a Thunderbolt (TBT) monitor is connected, because the HPD during resume triggers drm_client_modeset_probe() while connector->dev->master is NULL, potentially corrupting pipe topo...

CVE-2024-50098

The CVE-2024-50098 issue affects the Linux kernel SCSI UFS core. The root cause was a deadlock during reboot at boot start: SDEV_QUIESCE was set for all logical units, causing an audio-driver thread to wait on blk_mq_submit_bio(), which held a mutex. The fix changes behavior by marking all LUs of...

CVE-2024-50225

CVE-2024-50225 focuses on the Linux kernel, specifically the Btrfs file system. The vulnerability arises in error propagation for split bios via btrfs_bbio_propagate_error(), which is intended to propagate an error from a split bio back to the original btrfs_bio and inform the upper layer. Under ...

CVE-2024-50300

CVE-2024-50300 affects the Linux kernel regulator rtq2208 driver, where an uninitialized use of regulator_config could trigger a kernel error. The issue has been fixed in the kernel (regulator: rtq2208: Fix uninitialized use of regulator_config). Connected sources point to patch commits in stable...

CVE-2024-50303

CVE-2024-50303 affects the Linux kernel: walk_system_ram_res_rev discards resource flags when passing information to the callback, causing IORESOURCE_SYSRAM_DRIVER_MANAGED memory to be selected for kexec buffers if located above normal RAM. This can lead to undefined behavior after reboot or a cr...

CVE-2024-53175

CVE-2024-53175 affects the Linux kernel’s IPC subsystem. The issue arises when percpu memory allocation fails during create_ipc_ns, leading to a memleak because ipc sysctls and mq sysctls are not released on failure. The fix releases these resources on failure to prevent leaks, as illustrated by ...

CVE-2024-56621

CVE-2024-56621 affects the Linux kernel SCSI/UFS subsystem. The root cause was that RTC work was cancelled only during __ufshcd_wl_suspend(), not when ufshcd is removed, allowing RTC work to run on removed internal ufshcd structures and potentially dereference NULL. The fix cancels RTC work durin...

CVE-2024-57936

CVE-2024-57936 affects the Linux kernel RDMA/bnxt_re code and fixes an SGEs handling bug in Work Requests. The issue arises because Gen P7 hardware can report up to 13 SGEs, while the WQE software structure currently supports only 6 SGEs. This mismatch allowed requests with as many as 13 SGEs to ...

CVE-2025-21643

The CVE-2025-21643 entry concerns the Linux kernel netfs path. Affected: kernel components handling asynchronous DIO via bio_vec[] passed to netfs_extract_user_iter(); trigger occurs when CIFS is combined with a loopback blockdev. Root cause: netfs_unbuffered_write_iter_locked() performed a check...

CVE-2025-21830

In CVE-2025-21830, the Linux kernel Landlock feature was updated to handle “weird” files returned by corrupted filesystems (e.g., bcachefs). Previously, such files could bypass a warning and be treated as accessible regular files. The vulnerability is local (local access required) with a low-priv...

CVE-2025-21878

CVE-2025-21878 relates to the Linux kernel i2c npcm driver. The vulnerability arises from not disabling the interrupt enable bit before calling devm_request_irq, leaving an i2c-related status bit that is read-only and triggers repeated interrupts. This behavior can cause a soft lockup and a reboo...

CVE-2025-22022

CVE-2025-22022 concerns the Linux kernel USB xHCI driver, where NEC isochronous endpoints with NEC uPD720200 controllers could trigger IOMMU faults due to mis-handling of missed service errors. The description notes a faulty behavior involving transfer descriptors around isochronous rings and a c...

CVE-2025-22050

The CVE-2025-22050 entry concerns the Linux kernel USB networking path. A race between usb_submit_urb and __usbnet_queue_skb occurs due to a missing usbnet_going_away check in usb_submit_urb, while __usbnet_queue_skb performs this validation. This can let a URB proceed while the corresponding SKB...

CVE-2025-23148

The CVE-2025-23148 issue applies to the Linux kernel: the Samsung Exynos chipid driver (exynos_chipid_probe) now checks soc_dev_attr->revision for NULL to prevent NULL-pointer dereference. This fixes a potential local dereference vulnerability. The fix mirrors a prior NULL-pointer dereference ...

CVE-2025-23156

The CVE-2025-23156 vulnerability affects the Linux kernel’s media: venus: hfi_parser component. It is caused by a potential out-of-bounds access when parsing a payload’s words_count and data pointers; when words_count reaches the last word, data may read beyond the total payload. The issue is mit...

CVE-2026-46195

The CVE-2026-46195 entry concerns a Linux kernel SMB client vulnerability. 32-bit servers can supply a crafted dacloffset that wraps a DACL pointer, allowing dereferencing of DACL fields during chmod/chown if validated only after pointer arithmetic. The flaw occurs in parse_sec_desc(), build_sec_...

CVE-2010-2962

The CVE-2010-2962 issue affects the Intel i915 DRM GEM in the Linux kernel prior to 2.6.36. It arises from insufficient validation of pointers to memory blocks in i915_gem.c, enabling local users to write to kernel memory via crafted ioctl usage (pwrite/pread) and potentially gain privileges.

CVE-2010-3296

CVE-2010-3296 affects the Linux kernel driver cxgb3 (cxgb_extension_ioctl in drivers/net/cxgb3/cxgb3_main.c). The advisory states that the code path in kernels up to 2.6.36-rc5 does not properly initialize a structure member, allowing a local user to potentially read sensitive data from kernel st...

CVE-2010-3859

CVE-2010-3859 stems from multiple signedness errors in the Linux kernel’s TIPC implementation, allowing local privilege escalation via a crafted sendmsg that triggers a heap-based buffer overflow in tipc_msg_build and related iovec handling (verify_iovec). Public sources confirm affected historic...

CVE-2010-4526

CVE-2010-4526 describes a race condition in the Linux kernel between 2.6.11-rc2 and 2.6.33 in sctp_icmp_proto_unreachable (net/sctp/input.c). An ICMP Unreachable to a socket that is already locked by a user can free the socket and trigger list corruption via sctp_wait_for_connect, enabling remote...

CVE-2011-1080

CVE-2011-1080 affects the Linux kernel prior to 2.6.39 via the do_replace path in net/bridge/netfilter/ebtables.c. The issue: a name field may not end with a null terminator, enabling a local user with CAP_NET_ADMIN to replace a bridge table and read potentially sensitive data from kernel stack m...

CVE-2011-4131

CVE-2011-4131 affects the Linux kernel’s NFSv4 GETACL handling: the NFSv4 implementation does not correctly manage bitmap sizes when replying, allowing a remote NFS server to trigger a denial of service (OOPS) by sending an excessive number of bitmap words. The issue is fixed in or after the 3.2....

CVE-2013-2237

CVE-2013-2237 affects the Linux kernel prior to 3.9. The vulnerability arises because key_notify_policy_flush in net/key/af_key.c does not initialize a certain structure member, enabling local attackers to read kernel heap memory via a broadcast message on the IPSec key_socket notify_policy inter...

CVE-2013-6367

CVE-2013-6367 affects the Linux kernel KVM implementation (arch/x86/kvm/lapic.c) up to version 3.12.5. The vulnerability lets guest-OS users cause a denial of service (divide-by-zero, host crash) by crafting modifications to the TMICT value. The MiracleLinux/Unity Linux Nessus entries explicitly ...

CVE-2014-2706

CVE-2014-2706 describes a race condition in the Linux kernel’s mac80211 subsystem (sta_info.c and tx.c) that, when handling network traffic in conjunction with the WLAN_STA_PS_STA (power-save) state, can cause a remote denial of service (system crash). The issue affects kernel versions prior to 3...

CVE-2014-3145

CVE-2014-3145 is disclosed in multiple Nessus advisories linked to the Linux kernel up to 3.14.3. The vulnerability resides in the BPF_S_ANC_NLATTR_NEST extension within sk_run_filter() in net/core/filter.c, where a reverse-order subtraction allows a local user to trigger an over-read leading to ...

CVE-2014-3601

CVE-2014-3601 is a Linux kernel/KVM issue affecting the kvm_iommu_map_pages function in virt/kvm/iommu.c up to kernel 3.16.1. The vulnerability arises from miscalculating the number of pages during a mapping failure, allowing a guest OS user to trigger either host memory corruption (denial of ser...

CVE-2015-6252

CVE-2015-6252 refers to a vulnerability in the Linux kernel where the vhost_dev_ioctl path in drivers/vhost/vhost.c allows local users to trigger a denial of service (memory consumption) by issuing a VHOST_SET_LOG_FD ioctl that can cause permanent file-descriptor allocation. The description speci...

CVE-2015-8551

CVE-2015-8551 affects the Xen PCI backend driver (pciback) when Xen runs on x86 with a Linux 3.1.x–4.3.x driver domain. The issue arises from missing sanity checks in XEN_PCI_OP_* operations, allowing a local guest administrator with access to a passed-through MSI/MSI-X PCI device to trigger BUG ...

CVE-2015-8787

The CVE-2015-8787 entry concerns the Linux kernel, specifically the nf_nat_redirect_ipv4() function in net/netfilter/nf_nat_redirect.c. The vulnerability arises in kernel builds before 4.4, where remote attackers can send IPv4 packets to an incompletely configured interface to trigger a NULL poin...

CVE-2015-8952

CVE-2015-8952 : The mbcache feature in the Linux kernel’s ext2/ext4 implementations mishandles xattr block caching, enabling a local attacker to cause a denial of service (soft lockup) in environments with many attributes (as demonstrated by Ceph and Samba). The vulnerability is present in kernel...

CVE-2017-8064

The CVE refers to Linux kernel 4.9.x and 4.10.x before 4.10.12 where the DVB-USB core (drivers/media/usb/dvb-usb-v2/dvb_usb_core.c) interacts incorrectly with CONFIG_VMAP_STACK. This can allow a local attacker to cause a denial of service (system crash or memory corruption) or other impact by abu...

CVE-2018-14614

CVE-2018-14614 concerns a Linux kernel issue up to version 4.17.10 where mounting an f2fs image triggers an out-of-bounds access in __remove_dirty_segment() within fs/f2fs/segment.c. Publicly documented details identify the affected component as the kernel’s f2fs filesystem driver, with a local a...

CVE-2019-16229

CVE-2019-16229 affects the Linux kernel (example: kernel version 5.2.14) where a NULL pointer dereference can occur because kfd_interrupt.c in amdkfd does not check the return value of alloc_workqueue. The Unity Nessus advisory reiterates this description and notes the security community disputes...