CVE-2025-23147

CVE-2025-23147 : Linux kernel i3c master/IBI handling vulnerability where an IBI can arrive before the target driver is probed, causing a NULL dereference in dev->ibi and a kernel panic. Affected component is the I3C master queue path (i3c_master_queue_ibi()); root cause is uninitialized dev-&...

CVE-2025-23156

The CVE-2025-23156 vulnerability affects the Linux kernel’s media: venus: hfi_parser component. It is caused by a potential out-of-bounds access when parsing a payload’s words_count and data pointers; when words_count reaches the last word, data may read beyond the total payload. The issue is mit...

CVE-2025-37772

CVE-2025-37772 – Linux kernel RDMA CMA workqueue race condition. The vulnerability arises when multiple rapid calls to cma_netevent_callback() enqueue cma_netevent_work_handler() for the same rdma_cm_id, potentially overwriting a previously scheduled work item due to reusing the rdma_cm_id’s net_...

CVE-2025-37824

CVE-2025-37824 affects the Linux kernel TIPC monitor path. The issue is a NULL pointer dereference in tipc_mon_reinit_self() caused by a race between enabling and disabling the bearer, where mon->self may be NULL during reinitialization. A fix has been applied in tipc_mon_reinit_self() (net/ti...

CVE-2025-37889

CVE-2025-37889 : In the Linux kernel’s ASoC code, platform_max was inconsistently interpreted as a control value versus a register value. The patching effort reverts a previous +min shift and updates all code paths to consistently treat platform_max as a control value (customer-facing representat...

CVE-2025-37985

CVE-2025-37985 affects the Linux kernel USB wdm subsystem, specifically a race between wdm_open and wdm_wwan_port_stop. The issue arises if WDM_WWAN_IN_USE is not cleared last, allowing opening a chardev whose URBs may still be poisoned. Impact is local, with potential to exploit the race to caus...

CVE-2025-38089

The CVE-2025-38089 issue affects the Linux kernel sunrpc authentication path. If a RPC reply decoding yields SVC_GARBAGE without setting the rq_accept_statp pointer, a dereference could crash (first-time thread processing) or memory scribble. The fix changes how SVC_GARBAGE is handled: treat it a...

CVE-2025-38575

In CVE-2025-38575, the Linux kernel ksmbd memory handling was corrected: memory allocated by aead_request_alloc() must be freed with aead_request_free() to ensure sensitive crypto data is zeroed before freeing. This resolves a local-attack surface (AV:L/AC:L/PR:L/UI:N/S:U) with a MEDIUM base scor...

CVE-2010-4080

CVE-2010-4080 affects the Linux kernel: snd_hdsp_hwdep_ioctl in sound/pci/rme9652/hdsp.c does not initialize a structure, enabling local attackers to leak kernel stack information via SNDRV_HDSP_IOCTL_GET_CONFIG_INFO. Affected products/versions: Linux kernel before 2.6.36-rc6. Impact is an inform...

CVE-2011-1162

CVE-2011-1162 is a memory-clearing flaw in the Linux kernel 2.6 tpm_read() that can let a local unprivileged user read data from a previous TPM command. The connected advisories (MiracleLinux AXSA entries, Oracle Linux ELSA advisories, and RHSA-2012:0010) explicitly list CVE-2011-1162 among kerne...

CVE-2011-1576

CVE-2011-1576 affects the Linux kernel GRO offload path (napi_reuse_skb) used in Red Hat Enterprise Linux 5 (kernel 2.6.18) and Red Hat Enterprise Linux 6 (kernel 2.6.32) as deployed in RHEV Hypervisor. The advisory notes that remote attackers can trigger VLAN-packet processing to cause a denial ...

CVE-2014-0131

CVE-2014-0131 affects the Linux kernel up to version 3.13.6. The vulnerability is a use-after-free in the skb_segment function within net/core/skbuff.c caused by the absence of a certain orphaning operation. Exploitation details are not provided in the supplied documents. The impact is that an at...

CVE-2014-2678

CVE-2014-2678 affects the Linux kernel (net/rds/iw.c). The rds_iw_laddr_check function can be triggered by a bind() on an RDS socket on systems lacking RDS transports, enabling local attackers to cause a NULL pointer dereference and a system crash (DoS). This is described as affecting kernels up ...

CVE-2014-3611

CVE-2014-3611 corresponds to a race condition in the Linux kernel’s KVM PIT emulation: the __kvm_migrate_pit_timer function in arch/x86/kvm/i8254.c, with affected versions up to and including 3.17.2. The vulnerability allows a guest OS user to trigger a host OS crash via incorrect PIT emulation. ...

CVE-2014-3646

CVE-2014-3646 affects the Linux kernel’s KVM implementation: arch/x86/kvm/vmx.c lacks an exit handler for the INVVPID instruction, enabling a local guest-user to crash the guest OS (DoS) via a crafted application. Public remote advisories in connected Nessus plugins confirm the issue exists in ke...

CVE-2014-4508

CVE-2014-4508 affects the Linux kernel on 32-bit x86 (arch/x86/kernel/entry_32.S) up to version 3.15.1. When syscall auditing is enabled and the sep CPU feature flag is set, a local user can trigger a denial-of-service (OOPS and crash) by using an invalid syscall number (demonstrated with number ...

CVE-2014-4656

CVE-2014-4656 affects the Linux kernel ALSA sound control (sound/core/control.c). The vulnerability arises from multiple integer overflows in ALSA control handling, exploitable by local users via /dev/snd/controlCX to cause a denial of service. The issue is tied to (1) index values in snd_ctl_add...

CVE-2016-3138

CVE-2016-3138 : The Linux kernel’s acm_probe in drivers/usb/class/cdc-acm.c is vulnerable before 4.5.1. A USB device with no both a control and a data endpoint descriptor can trigger a NULL pointer dereference, enabling a physically proximate attacker to crash the system. Impact is denial of serv...

CVE-2018-16597

CVE-2018-16597 affects the Linux kernel prior to version 4.8. The issue is an incorrect access check in overlayfs mounts, which could allow a local attacker to modify or truncate files on the underlying filesystem. The connected Nessus/OpenVAS advisories reference kernel updates to fix this vulne...

CVE-2020-36784

CVE-2020-36784 affects the Linux kernel i2c Cadence driver. The vulnerability arises because pm_runtime_get_sync incorrectly increments the PM usage counter even when the operation fails in cdns_i2c_master_xfer and cdns_reg_slave, causing a reference leak. The fix is to replace the finalization w...

CVE-2021-47078

Concrete details available: CVE-2021-47078 affects the Linux kernel’s RDMA/rxe driver. The flaw occurs in rxe_qp_do_cleanup() when rxe_qp_from_init() has failed, causing QP fields to be garbage-collected and leading to a refcount underflow and a use-after-free condition. This can enable local exp...

CVE-2021-47582

CVE-2021-47582 affects the Linux kernel USB core (USBDEVFS_CONTROL/USBDEVFS_BULK) where usb_start_wait_urb() can wait uninterruptibly for a very large timeout. The fix changes do_proc_control() and do_proc_bulk() to use a killable wait and GFP_KERNEL instead of GFP_NOIO. Connected advisories (Mir...

CVE-2022-3534

CVE-2022-3534 affects the libbpf component (function btf_dump_name_dups in tools/lib/bpf/btf_dump.c) with a use-after-free in Linux kernel/libbpf. Debian and other sources report a patch and version bumps: Debian DLA fixes libbpf to 0.3-2+deb11u1 (and related packages), and ALT Linux notes a fix ...

CVE-2022-3577

CVE-2022-3577 is an out-of-bounds memory write flaw in the Linux kernel HID driver for Kid-friendly Wired Controller (bigben) in bigben_probe (drivers/hid/hid-bigbenff.c). A malicious or defunct bigben device could trigger an out-of-bounds write, potentially crashing the system or allowing local ...

CVE-2022-48638

CVE-2022-48638 pertains to the Linux kernel cgroup subsystem. The issue stems from cgroup_get_from_id() not validating that the looked-up kn is a directory, which must be a kernfs directory. If the id supplied by userspace points to a non-directory, it can trigger a kernel panic. The connected As...

CVE-2022-48659

CVE-2022-48659 is a Linux kernel issue localized to mm/slub where kmalloc() can fail with an OOM, and the fix ensures create_unique_id() returns a proper errno instead of triggering BUG_ON(). The result is a kernel BUG at mm/slub.c:5893 in the failing path, with the stack showing sysfs_slab_add →...

CVE-2022-48757

In the Linux kernel vulnerability CVE-2022-48757, information leakage occurs in /proc/net/ptype: within one net namespace, a packet socket created without binding to a device can expose the new packet_type to other namespaces by reading /proc/net/ptype. The fix adds a net pointer in packet_type t...

CVE-2022-49046

CVE-2022-49046 affects the Linux kernel i2c subsystem, specifically the dev: how the device name is set. The root cause is a missing check of the return value from dev_set_name(); if dev_set_name() fails, dev_name() may be null, leading to a potential null pointer dereference. The connected advis...

CVE-2022-49057

The CVE-2022-49057 issue occurs in the Linux kernel’s block/null_blk path where a timed-out poll request is removed from the poll list but not completed, causing a leak and preventing completion. The vulnerability is triggered when a poll request times out and is not finalized, leaving it in an i...

CVE-2022-49109

CVE-2022-49109 concerns the Linux kernel ceph subsystem. The provided text describes a leak: when ceph_get_inode() searches for or inserts an inode into the hash for a given vino, it returns a reference to the inode and may consume that reference if new is non-NULL. If error handling does not rel...

CVE-2022-49248

CVE-2022-49248 relates to the Linux kernel ALSA: firewire-lib, where the deferrable AV/C transaction flag could be left uninitialized for non-control/notify AV/C transactions. UBSAN reported an invalid-load in fcp.c when handling AV/C responses, with the status flag being read as a boolean. The i...

CVE-2022-49258

The CVE-2022-49258 issue is in the Linux kernel crypto/ccree: a use-after-free in cc_cipher_exit() where ctx_p->user.key is freed by kfree_sensitive() but still used on the following line. The fix prevents UAF by moving kfree_sensitive(ctx_p->user.key) after dev_dbg(), effectively ensuring ...

CVE-2022-49378

CVE-2022-49378 concerns a Linux kernel driver issue in the sfc/efx10 path where TX queue initialization can fail when modparam efx_separate_tx_channels=1 causes some channels to have only RX or only TX queues. The root cause is an incorrect determination of whether a channel has TX queues, which ...

CVE-2022-49398

CVE-2022-49398 relates to the Linux kernel’s USB DWC3 gadget path. The vulnerability arises when traversing the cancelled_list during dwc3_gadget_ep_cleanup_cancelled_requests() while a pull-up disable sequence runs in parallel, causing a window where removing an item (n) and then the next item (...

CVE-2022-49426

CVE-2022-49426 : Linux kernel iommu/arm-smmu-v3-sva had a use-after-free when freeing the MM context because arm64_mm_context_put() ran without a held reference. The root cause is not holding a reference to the MM during unpinning, allowing it to be freed prematurely. The fix is to call mmgrab()/...

CVE-2022-49546

Technical details (affected product/version, root cause, impact, fix specifics) are not publicly provided in the connected documents. Monitor for updates.

CVE-2022-49584

CVE-2022-49584 is a Linux kernel issue in the ixgbe driver where disabling SR-IOV (setting sriov_numvfs to zero) can race with the PF driver, potentially causing a kernel panic. The root cause is a lack of locking during the disable path, allowing VF mailbox communication to proceed concurrently....

CVE-2022-49759

The CVE-2022-49759 entry concerns the Linux kernel vmw_vmci/VMCI path: the vmci_dispatch_dgs() tasklet calls vmci_read_data(), which uses wait_event() and can sleep in atomic context, risking deadlock. The fix replaces tasklets with threaded IRQs and removes tasklets usage entirely. Impact center...

CVE-2023-3397

CVE-2023-3397 is a race between lmLogClose and txEnd in the Linux kernel’s JFS, allowing a local attacker to crash the system or leak kernel info. Connected entries show Root:Debian-13, -11, -12 patches for rootio-linux with multiple fixed versions; patches indicate remediation has been applied i...

CVE-2023-52629

CVE-2023-52629 – Linux kernel use-after-free fixed Root cause: in switch_drv_remove(), the worker (flush_work) could be rescheduled by switch_timer, causing a use-after-free when the code frees psw after timer or worker cleanup. Consequence: a potentially exploitable use-after-free condition with...

CVE-2023-52741

CVE-2023-52741 is a Linux kernel vulnerability affecting the CIFS implementation. The flaw is a use-after-free in rdata->read_into_pages() that can occur when reading data from a server during unstable network conditions, manifested as a use-after-free in readpages_fill_pages. The issue is dem...

CVE-2023-6039

CVE-2023-6039 : A use-after-free vulnerability in the Linux kernel’s LAN78XX USB Ethernet driver (lan78xx_disconnect in drivers/net/usb/lan78xx.c) can crash the system when a LAN78XX USB device is detached. The issue is local in scope and affects the network sub-system (net/usb/lan78xx). The CVE ...

CVE-2023-6679

CVE-2023-6679 is a NULL pointer dereference in the Linux kernel DPLL netlink code (dpll_pin_parent_pin_set in drivers/dpll/dpll_netlink.c). The vulnerability allows local attackers to trigger a denial of service. Connected advisories (Red Hat, Oracle, MiracleLinux) indicate kernel updates/fixes a...

CVE-2024-26710

CVE-2024-26710 affects the Linux kernel on PowerPC with KASAN. The issue was that KASAN’s thread stack size increase was doubled, which could push a 32KB stack to 64KB and trigger build errors (arch/powerpc/kernel/switch.S). The resolved approach limits the stack size increase to cases where the ...

CVE-2024-27405

CVE-2024-27405 describes a Linux kernel issue in usb: gadget: ncm where the unwrap logic can drop all datagrams when a second NTB is faulty due to a leftover byte after a proper NTB. The trigger observed during tethering over NCM with Windows 11 host. Root cause: if there are leftover bytes, unwr...

CVE-2024-27416

CVE-2024-27416 affects the Linux kernel Bluetooth hci_event path, specifically HCI_EV_IO_CAPA_REQUEST handling when a remote feature read is still pending. Root cause: on receiving HCI_EV_IO_CAPA_REQUEST while HCI_OP_READ_REMOTE_EXT_FEATURES has not yet been responded to, the code incorrectly ass...

CVE-2024-35821

CVE-2024-35821 relates to the Linux kernel ubifs filesystem. The issue arose because page cache reads are lockless, and the page uptodate flag could be set before the page contained the new data, exposing old data to concurrent readers. The fix moves the SetPageUptodate call into ubifs_write_end(...

CVE-2024-35830

The CVE-2024-35830 issue concerns the Linux kernel media driver tc358743. Concrete details from connected advisories show the vulnerability arises when the v4l2 async device is registered before the device is fully set up. The fix is to register the v4l2 async device only after successful setup, ...

CVE-2024-35849

CVE-2024-35849 affects the Linux kernel btrfs_ioctl_logical_to_ino path. The issue is an information leak: a struct btrfs_data_container allocated with kvmalloc() is copied back to user space without zero-filling, exposing uninitialized memory (Bytes 40-65535) to user-space. The root cause is lac...

CVE-2024-36957

CVE-2024-36957 affects the Linux kernel driver octeontx2-af. The vulnerability is due to an off-by-one read from userspace when attempting to copy count + 1 bytes (memdup_user(buffer, count + 1)), while the userspace buffer only contains count bytes. The fix prevents this by using memdup_user_nul...