CVE-2021-28039

CVE-2021-28039 affects the Linux kernel 5.9.x–5.11.3 (used with Xen). In some configurations, an x86 PV guest OS user can crash the Dom0 or a driver domain by generating a large amount of I/O. Root cause is the misuse of guest physical addresses when CONFIG_XEN_UNPOPULATED_ALLOC is set but CONFIG...

CVE-2024-42110

CVE-2024-42110 affects the Linux kernel ntb_netdev/ntb_transport path. The root cause is that the idxd DMA engine can complete TX/RX in a threaded IRQ context, but __netif_rx() is only safe from interrupt context. The code previously called __netif_rx() from a completion path and should instead u...

CVE-2024-46772

CVE-2024-46772 affects the Linux kernel (drm/amd/display). The vulnerability arises from not guarding the denominator crb_pipes before use, risking a divide-by-zero. The patch fixes two divide-by-zero issues by ensuring the denominator is checked prior to its use, and is noted as resolved in down...

CVE-2024-46782

CVE-2024-46782 affects Linux kernel’s ila subsystem (net/ipv6/ila/ila_xlat.c, ila_nf_input) where a use-after-free occurs: ila_xlat_exit_net() frees the rhashtable and then nf_unregister_net_hooks() is called. The issue is the hook removal should occur before freeing resources; the fix reorders a...

CVE-2024-46812

CVE-2024-46812 concerns the Linux kernel DRM/AMD display code. The vulnerability arises from memory access issues addressed by skipping inactive planes in ModeSupportAndSystemConfiguration, as reported by Coverity. The fix is implemented in the kernel to prevent illegal accesses by not processing...

CVE-2024-47691

CVE-2024-47691 affects the Linux kernel’s F2FS subsystem, tied to a race condition in f2fs_stop_gc_thread() that can cause a use-after-free in sbi->gc_th. The issue can occur during remount/shutdown scenarios where gc_th is freed, and a guard is needed via sb->s_umount semaphore. The descri...

CVE-2024-49898

CVE-2024-49898 affects the Linux kernel’s drm/amd/display component. The root cause is that drr_timing and subvp_pipe are initialized to null and are not consistently re-assigned before being dereferenced, leading to two FORWARD_NULL issues reported by Coverity. The issue is addressed by kernel f...

CVE-2024-49905

CVE-2024-49905 refers to a fix in the Linux kernel’s AMD GPU driver code, specifically for the DRM/AMD display path. The vulnerability arose from using the variable afb in amdgpu_dm_plane_handle_cursor_update without a null check; the commit added a null check to prevent potential null pointer de...

CVE-2024-49931

The CVE-2024-49931 issue in Linux kernel WiFi driver ath12k (SoC stats) is a concrete fix: ath12k_dp_rx_process() previously indexed hal_reo_error with the REO destination SRNG ring ID, which is incorrect and caused an out-of-bounds access. The fix uses the normal ring ID directly to prevent out-...

CVE-2024-49992

CVE-2024-49992 affects the Linux kernel DRM STM path. Specifically, ltdc_load() calls drm_crtc_init_with_planes(), drm_universal_plane_init(), and drm_encoder_init() with devm_kzalloc()-allocated resources, which can lead to use-after-free in CRTC/plane handling. Root cause: allocations not manag...

CVE-2024-50187

Technical details for CVE-2024-50187 are not provided in the supplied documents; no affected products, impact, or remediation specifics are given. Monitor for official updates.

CVE-2024-56683

Technical details for CVE-2024-56683 are not publicly available in the provided documents. No connected document confirms affected products, root cause, impact, or remediation. Monitor for updates from kernel/changelogs and trusted advisories.

CVE-2024-57857

In CVE-2024-57857, the Linux kernel RDMA/siw subsystem removed a direct per-device net_device link and relies on ib_devices net_device management instead. The change addresses a slab-use-after-free (KASAN) issue observed during siw_query_port() caused by a badly managed local net_device link. Rem...

CVE-2024-57916

CVE-2024-57916 affects the Linux kernel component dealing with GPIO IRQ handling (misc: microchip: pci1xxxx). The root cause is improper IRQ handling that could trigger a kernel panic; the fix replaces generic_handle_irq with handle_nested_irq to resolve the issue. Public references indicate upst...

CVE-2025-21832

CVE-2025-21832 - Linux kernel : In blkdev_read_iter(), revert handling for -EIOCBQUEUED caused by not validating blkdev_direct_IO() return before iov_iter_revert(), risking a WARN_ON due to a negative/unsigned mismatch. The patch removes reversion for -EIOCBQUEUED, aligning with other spots and p...

CVE-2025-21854

The CVE-2025-21854 issue affects the Linux kernel sockmap/vsock path. It occurs when a connectible (unconnected) vsock may lose its prior transport, potentially causing a NULL dereference in the BPF recv path and a crash when a listening vsock is present in a sockmap. The root cause is that sockm...

CVE-2025-22072

CVE-2025-22072 affects the Linux kernel spufs component, addressing leaks in gang directory lifetimes. The issue: creating a gang returns an opened gang directory that should be removed on close, but if a context belonging to that gang remains alive, removal could fail, causing a leak. The fix de...

CVE-2025-23156

The CVE-2025-23156 vulnerability affects the Linux kernel’s media: venus: hfi_parser component. It is caused by a potential out-of-bounds access when parsing a payload’s words_count and data pointers; when words_count reaches the last word, data may read beyond the total payload. The issue is mit...

CVE-2025-37780

CVE-2025-37780 — Linux kernel isofs slab-out-of-bounds . The vulnerability occurs in isofs_fh_to_parent when a too-small fid is used: 12 bytes allocated for file_handle->f_handle while accessing parent_block requires at least 16 bytes, causing a potentially dangerous read. The issue was observ...

CVE-2025-37985

CVE-2025-37985 affects the Linux kernel USB wdm subsystem, specifically a race between wdm_open and wdm_wwan_port_stop. The issue arises if WDM_WWAN_IN_USE is not cleared last, allowing opening a chardev whose URBs may still be poisoned. Impact is local, with potential to exploit the race to caus...

CVE-2025-38575

In CVE-2025-38575, the Linux kernel ksmbd memory handling was corrected: memory allocated by aead_request_alloc() must be freed with aead_request_free() to ensure sensitive crypto data is zeroed before freeing. This resolves a local-attack surface (AV:L/AC:L/PR:L/UI:N/S:U) with a MEDIUM base scor...

CVE-2009-1389

CVE-2009-1389 is a vulnerability in the Linux kernel RTL8169 NIC driver (drivers/net/r8169.c). A crafted long Ethernet frame can cause a buffer overflow, leading to kernel memory corruption and a crash (remote DoS) on affected systems. The issue affects kernels before 2.6.30; exploitation require...

CVE-2009-3621

The CVE-2009-3621 issue affects the Linux kernel up to version 2.6.31.4 and earlier, specifically in net/unix/af_unix.c. The vulnerability allows a local attacker to cause a denial of service (system hang) by: (1) creating an abstract-namespace AF_UNIX listening socket, (2) performing a shutdown ...

CVE-2010-3067

CVE-2010-3067 affects the Linux kernel: an integer overflow in do_io_submit (fs/aio.c) in versions before 2.6.36-rc4-next-20100915 allows local users to cause a denial of service or possibly other impact via crafted io_submit usage. The vulnerability is rooted in improper handling within the io_s...

CVE-2010-4080

CVE-2010-4080 affects the Linux kernel: snd_hdsp_hwdep_ioctl in sound/pci/rme9652/hdsp.c does not initialize a structure, enabling local attackers to leak kernel stack information via SNDRV_HDSP_IOCTL_GET_CONFIG_INFO. Affected products/versions: Linux kernel before 2.6.36-rc6. Impact is an inform...

CVE-2011-2517

The vulnerability CVE-2011-2517 affects the Linux kernel (pre-2.6.39.2) where multiple buffer overflows in net/wireless/nl80211.c can allow local users to gain privileges by exploiting a long SSID during scan operations when CAP_NET_ADMIN is available. Impact is local privilege escalation with co...

CVE-2013-2237

CVE-2013-2237 affects the Linux kernel prior to 3.9. The vulnerability arises because key_notify_policy_flush in net/key/af_key.c does not initialize a certain structure member, enabling local attackers to read kernel heap memory via a broadcast message on the IPSec key_socket notify_policy inter...

CVE-2013-4579

CVE-2013-4579 affects the Linux kernel up to version 3.12, specifically the ath9k_htc_set_bssid_mask function in drivers/net/wireless/ath/ath9k/htc_drv_main.c. The vulnerability uses a BSSID masking approach to determine the set of MAC addresses the Wi‑Fi device listens to, enabling remote attack...

CVE-2015-4167

The CVE-2015-4167 issue affects the Linux kernel UDF code: udf_read_inode in fs/udf/inode.c fails to validate certain length values, enabling local attackers with crafted UDF filesystems to trigger DoS (incorrect data representation or integer overflow, OOPS). Impact is local access with potentia...

CVE-2016-3136

CVE-2016-3136 affects the Linux kernel up to version 4.5.0, where the mct_u232_msr_to_state function in drivers/usb/serial/mct_u232.c can be triggered by a crafted USB device without two interrupt-in endpoint descriptors. This allows physically proximate attackers to cause a denial of service (NU...

CVE-2018-12928

CVE-2018-12928 concerns Linux kernel 4.15.0 where a NULL pointer dereference can occur in hfs_ext_read_extent within hfs.ko during mounting a crafted HFS filesystem. Connected advisories note the issue in kernel packages and reference a security update (ELSA) and Nessus entries indicating affecte...

CVE-2021-47107

CVE-2021-47107 : Linux kernel NFSD is affected by a buffer overflow in READDIR handling. If a client sends a very small READDIR count (e.g., 0), the new init_dirlist logic can underflow the buffer size calculation, causing XDR writing to exceed the allocated space. This underflow was exposed by a...

CVE-2021-47572

CVE-2021-47572 affects the Linux kernel net: nexthop when adding an IPv6 nexthop while IPv6 is disabled (CONFIG_IPV6 not set). Root cause: nh_create_ipv6() dereferences ipv6_stub->fib6_nh_release in its error path, leading to a NULL pointer dereference. The fix returns the dummy stub’s -EAFNOS...

CVE-2021-47582

CVE-2021-47582 affects the Linux kernel USB core (USBDEVFS_CONTROL/USBDEVFS_BULK) where usb_start_wait_urb() can wait uninterruptibly for a very large timeout. The fix changes do_proc_control() and do_proc_bulk() to use a killable wait and GFP_KERNEL instead of GFP_NOIO. Connected advisories (Mir...

CVE-2022-28796

CVE-2022-28796: Linux kernel

CVE-2022-49263

The CVE-2022-49263 case concerns a Linux kernel flaw in the brcmfmac: pcie path. The vulnerability is described as a memory-leak in the error path of brcmf_pcie_setup where firmware release occurs after brcmf_chip_get_raminfo fails; the CLM blob is released in the device remove path. Connected ad...

CVE-2022-49280

Summary of CVE-2022-49280 (Linux kernel) : Affected component is NFSD in the Linux kernel, specifically nfssvc_decode_writeargs(). The root cause was an underflow risk from treating a length as signed, allowing an issue where args->len had no lower bound. The fix implemented across sources is ...

CVE-2023-52735

The CVE-2023-52735 entry concerns a Linux kernel vulnerability in bpf/sockmap where sock_map_{close,destroy,unhash} could call themselves, risking a recursive loop and potential stack overflow. The design should prevent sock_map proto callbacks from calling themselves; the fix breaks recursive ca...

CVE-2023-52810

CVE-2023-52810 refers to a Linux kernel issue in fs/jfs where l2nbperpage could become negative, causing a shift-out-of-bounds UBSAN failure in jfs_dmap.c. Reports indicate UBSAN: shift-out-of-bounds with shift exponent -16777216 and that the fix adds a validity check for negative db_l2nbperpage ...

CVE-2023-53089

CVE-2023-53089 affects the Linux kernel ext4/xattr path. The issue occurs during eviction of inodes with extended attributes (EA) where ext4_xattr_delete_inode triggers a hang due to finding an EA inode (ea_inum = 15) that is in I_FREEING state and waiting for the EA inode’s deletion, causing an ...

CVE-2024-26710

CVE-2024-26710 affects the Linux kernel on PowerPC with KASAN. The issue was that KASAN’s thread stack size increase was doubled, which could push a 32KB stack to 64KB and trigger build errors (arch/powerpc/kernel/switch.S). The resolved approach limits the stack size increase to cases where the ...

CVE-2024-27435

CVE-2024-27435 refers to a Linux kernel issue where NVMe over RDMA reconnection could fail forever due to an ABBA deadlock caused by reserved tag allocation in the admin queue. The root cause was a single reserved tag held by a keep-alive operation, which blocked a required tag for the connect co...

CVE-2024-36894

CVE-2024-36894 relates to a race in the Linux kernel USB gadget stack (usb: gadget: f_fs) between aio_cancel() and AIO completion for FFS-based USB requests on the UDC. The issue could cause a stale/hanging pointer when a completion runs concurrently with an aio_cancel, as io_data->req may be ...

CVE-2024-38560

The CVE-2024-38560 entry concerns Linux kernel SCSI (bfa) code. A vulnerable path copies nbytes from userspace into a kernel buffer without guaranteeing a NUL terminator, enabling an OOB read when sscanf is applied. The issue is fixed by replacing memdup_user with memdup_user_nul to ensure proper...

CVE-2024-39277

In CVE-2024-39277, the Linux kernel vulnerability arises when dma-mapping benchmark bound to NUMA_NO_NODE triggers UBSAN array-index-out-of-bounds in arch/x86/topology.h. The root cause is calling cpumask_of_node() for NUMA_NO_NODE inside do_map_benchmark(), leading to an invalid cpumask[-1] acce...

CVE-2024-39482

CVE-2024-39482 (Linux kernel) : The vulnerability affects the bcache subsystem, specifically the btree_iter code path. The bug arises from a fixed-length array inside the btree_iter structure that is indexed out-of-bounds when iterators are created with dynamic size, triggering UBSAN complaints. ...

CVE-2024-41081

CVE-2024-41081 is addressed in newer Linux kernel packages for Amazon Linux 2 - Kernel-5.15 Extra. The advisory documents a race in ila_output() where ila_output() may be invoked under rc u_read_lock() and potentially interrupted by softirq, risking corruption of dst_cache data structures. The fi...

CVE-2024-42107

CVE-2024-42107 affects the Linux kernel ice driver’s PTP support. The issue is a race between ice_ptp_extts_event() and ice_ptp_release() that can dereference a NULL pointer (ptp_clock_event called with NULL) after the PTP clock has been released, causing a kernel panic. The documented fix is to ...

CVE-2024-43855

CVE-2024-43855 is a Linux kernel vulnerability in the md (RAID) subsystem where a deadlock could occur while an mddev is suspended and a flush bio is in progress. The connected docs describe the root cause as non-atomic increment/decrement of the active_io counter during the md flush sequence, en...

CVE-2024-44962

The CVE affects the Linux kernel Bluetooth btnxpuart driver. Root cause: when unloading btnxpuart, a timer is not reliably shut down, so if the timer is modified during unload it may fire and invoke the timer callback after the driver is gone, causing a kernel panic. The fix is to replace del_tim...