CVE-2023-53058

CVE-2023-53058 – Linux kernel (net/mlx5, E-Switch) . The vulnerability arises when handling errors in the E-Switch error path: the code dereferences the pointer named “vport,” which can lead to an oops. The issue is localized to the kernel, requiring local access with low privileges; no user inte...

CVE-2023-53070

CVE-2023-53070 affects the Linux kernel: when PPTT is absent, multiple CPUs could call acpi_get_pptt() in atomic context, risking a sleep waiting on a mutex and a kernel crash trace. The fix updates acpi_get_pptt() to return NULL if PPTT is not available, avoiding sleeps in atomic context and pre...

CVE-2024-0775

CVE-2024-0775 describes a use-after-free in the Linux kernel’s ext4 remount path: __ext4_remount in fs/ext4/super.c. The flaw lets a local user cause an information leak by freeing old quota file names before a potential failure, resulting in a use-after-free. Relevant connected documents confirm...

CVE-2024-26881

CVE-2024-26881 affects the Linux kernel net driver for HNS3 on HIP08 devices. The issue is a NULL pointer dereference in the receive path when 1588 time-stamp messages are processed while hdev->ptp is NULL (HIP08 devices do not register ptp devices), causing kernel crashes. The vulnerable comp...

CVE-2024-27024

CVE-2024-27024 concerns the Linux kernel vulnerability in net/rds where a WARNING in rds_conn_connect_if_down could cause get_mr() to fail and trigger a connection after get_mr(). This is a local-attack surface (LOCAL) with high impact on confidentiality, integrity, and availability (CVE score in...

CVE-2024-27405

CVE-2024-27405 describes a Linux kernel issue in usb: gadget: ncm where the unwrap logic can drop all datagrams when a second NTB is faulty due to a leftover byte after a proper NTB. The trigger observed during tethering over NCM with Windows 11 host. Root cause: if there are leftover bytes, unwr...

CVE-2024-38659

The CVE-2024-38659 issue affects the Linux kernel enic driver: enic_set_vf_port assumes fixed lengths for nl attributes (IFLA_PORT_PROFILE, IFLA_PORT_INSTANCE_UUID, IFLA_PORT_HOST_UUID) and validates them via nla_policy. The policy uses IFLA_PORT_PROFILE as NLA_STRING, IFLA_PORT_INSTANCE_UUID as ...

CVE-2024-42136

CVE-2024-42136 affects the Linux kernel cdrom subsystem. The issue stems from an arithmetic path in last_media_change that could trigger a signed integer overflow under UBSAN when running syzkaller; the issue is resolved by rearranging the check to avoid any arithmetic, preventing the overflow. T...

CVE-2024-42263

CVE-2024-42263 (Linux kernel) : The drm/v3d component had a memory-leak in the timestamp extension when userspace memory fetch failed in the main loop, leaking drm_syncobjs up to that point due to missing drm_syncobj_put. A fix exports and uses a common cleanup helper to correctly release resourc...

CVE-2024-43867

The CVE refers to a Linux kernel issue in the DRM Nouveau path: a refcount underflow in nouveau_bo_ref() when nouveau_bo has not been initialized (backing ttm_bo). The vulnerability arises in the unwind path of drm_gem_object_init(); instead of calling nouveau_bo_ref(), code now manually cleans u...

CVE-2024-44950

CVE-2024-44950 affects the Linux kernel’s serial driver for sc16is7xx. The issue arises when enabling the special register set: the IRQ path can read the FIFO through RHR at address 0x00, which is actually DLL, causing erroneous FIFO reads and timeouts. Root cause documented as invalid FIFO acces...

CVE-2024-46744

The CVE-2024-46744 issue in the Linux kernel affects Squashfs by failing to sanity-check the symbolic link size read from disk. This causes the size (i_size) to be corrupted, which is later used to derive a length value that overflows a signed int in squashfs_symlink_read_folio(), leading to a po...

CVE-2024-46856

Summary of CVE-2024-46856 : In the Linux kernel, the net: phy: dp83822: Fix NULL pointer dereference on DP83825 devices vulnerability was addressed by ensuring all PHY models have a valid private data pointer. The issue arose because probe() was only used for DP83822 and DP83826 PHY, leaving the ...

CVE-2024-49893

CVE-2024-49893 affects the Linux kernel DRM display path (drm/amd/display). The issue arises when dc_state_get_stream_status can return NULL, so stream_status must be checked before use. The patch fixes a NULL_RETURNS issue reported by Coverity by adding a NULL check before accessing stream_statu...

CVE-2024-50079

CVE-2024-50079 affects the Linux kernel io_uring/sqpoll path. When sqpoll exits and cancels pending work items, it may call task_work from within io_uring_cancel_generic() while the task is not TASK_RUNNING, risking a scheduler splat as the ring mutex is grabbed in an interruptible state. The roo...

CVE-2024-50118

CVE-2024-50118 relates to the Linux kernel Btrfs remount/RW reconfiguration path. The issue arises during mounting different subvolumes with conflicting RO/RW flags: an initial read-only mount (ro) followed by an attempt to remount a subvolume as read/write, with options/feature checks being skip...

CVE-2024-50140

CVE-2024-50140 involves a Linux kernel vulnerability in sched/core where page allocation is disabled during task_tick_mm_cid(). With KASAN and PREEMPT_RT enabled, a call to task_work_add() within task_tick_mm_cid() can sleep in an invalid context, triggering a BUG in stack/depot and related alloc...

CVE-2024-50185

The CVE-2024-50185 entry concerns the Linux kernel mptcp subsystem, where a bug in peer implementations could send corrupted DSS options, triggering warnings in the data path. The issue is addressed by making mptcp handle DSS corruption more consistently, including assertion-based protections and...

CVE-2024-50193

CVE-2024-50193 affects the Linux kernel on x86. The vulnerability is in x86/entry_32 where CPU buffers were cleared after exc_nmi but before restoring registers. The fix moves CLEAR_CPU_BUFFERS to after RESTORE_ALL_NMI, addressing RDFS mitigation requirements. Public metrics show CVSS v3.1 base s...

CVE-2024-50250

The CVE-2024-50250 issue affects the Linux kernel fsdax code: dax_unshare_iter copies data from srcmap to iomap and previously did not align copy_pos/copy_len to a page boundary, allowing misalignment when iter->pos and length are not page-aligned. The bug can cause data corruption (when iter-...

CVE-2024-53106

CVE-2024-53106 concerns the Linux kernel ima subsystem: a buffer overrun in ima_eventdigest_init_common triggered by HASH_ALGO__LAST indexing hash_digest_size[]. Root cause is inadequate handling of HASH_ALGO__LAST; a conditional prevents the overread. A fix is included in kernel updates (commit ...

CVE-2024-56620

In CVE-2024-56620, the Linux kernel fix targets the SCSI: ufs: qcom path. The bug occurs when platform MSI resources are freed even if ESI is not enabled, leading to a NULL pointer dereference (Unable to handle kernel NULL pointer dereference at 0x8) during device removal. The impact is a local f...

CVE-2024-56622

Summary: CVE-2024-56622 is a Linux kernel vulnerability in the SCSI UFS core sysfs path that can trigger a division by zero when monitoring is disabled. The issue is tracked across multiple vendors/distros with fixed releases: Debian LTS advisory DLA-4076-1 notes a fix in linux-6.1-6.1.6.1.128-1~...

CVE-2024-56635

CVE-2024-56635 (Linux kernel) : A race between device and NETNS dismantles could cause a use‑after‑free in __dev_get_by_index accessed via default_operstate(), as syzbot observed a KASAN UAF. The root cause is a race after __rtnl_unlock() when netns/device lifetimes may not be alive; mitigation d...

CVE-2025-21643

The CVE-2025-21643 entry concerns the Linux kernel netfs path. Affected: kernel components handling asynchronous DIO via bio_vec[] passed to netfs_extract_user_iter(); trigger occurs when CIFS is combined with a loopback blockdev. Root cause: netfs_unbuffered_write_iter_locked() performed a check...

CVE-2025-21808

Technical details for CVE-2025-21808 (affected product/version, root cause, exploit info) are not provided in the connected documents. The Initial Description is present, but mode C cannot be applied without corroborating specifics. Monitor for updates.

CVE-2025-21830

In CVE-2025-21830, the Linux kernel Landlock feature was updated to handle “weird” files returned by corrupted filesystems (e.g., bcachefs). Previously, such files could bypass a warning and be treated as accessible regular files. The vulnerability is local (local access required) with a low-priv...

CVE-2025-22039

CVE-2025-22039 is a Linux kernel vulnerability in ksmbd where an overflow in the dacloffset bounds check could bypass the DACL checks, causing out-of-bounds access and a kernel crash when dereferencing a DACL pointer. The fix converts dacloffset from int to unsigned int and uses check_add_overflo...

CVE-2025-37772

CVE-2025-37772 – Linux kernel RDMA CMA workqueue race condition. The vulnerability arises when multiple rapid calls to cma_netevent_callback() enqueue cma_netevent_work_handler() for the same rdma_cm_id, potentially overwriting a previously scheduled work item due to reusing the rdma_cm_id’s net_...

CVE-2025-38089

The CVE-2025-38089 issue affects the Linux kernel sunrpc authentication path. If a RPC reply decoding yields SVC_GARBAGE without setting the rq_accept_statp pointer, a dereference could crash (first-time thread processing) or memory scribble. The fix changes how SVC_GARBAGE is handled: treat it a...

CVE-2025-38416

Mode C: CVE-2025-38416 affects the Linux kernel NFC: nci: uart path. The vulnerability arises from setting tty->disc_data before the NCI device open/driver request succeeds, creating a small window where the device may start sending data and leaving state inconsistent on error paths. The fix e...

CVE-2026-31664

The CVE-2026-31664 issue resides in the Linux kernel xfrm subsystem: build_polexpire() fails to clear trailing padding in struct xfrm_user_polexpire, leaving uninitialized heap bytes that are sent to userspace via netlink multicast (XFRMNLGRP_EXPIRE). The consequence is potential leakage of kerne...

CVE-2010-3015

CVE-2010-3015 exists in the Linux kernel before 2.6.34: an integer overflow in ext4_ext_get_blocks() within fs/ext4/extents.c allows local users to trigger a denial of service (BUG and system crash) by performing a write to the last block of a large file, followed by a sync. Affected component: L...

CVE-2013-4348

CVE-2013-4348 affects the Linux kernel (up to 3.12) via skb_flow_dissect in net/core/flow_dissector.c. A crafted small IHL value in IPIP-encapsulated packets can trigger an infinite loop, enabling remote denial of service. The connected Nessus advisories reproduce the same description for Unity L...

CVE-2013-6367

CVE-2013-6367 affects the Linux kernel KVM implementation (arch/x86/kvm/lapic.c) up to version 3.12.5. The vulnerability lets guest-OS users cause a denial of service (divide-by-zero, host crash) by crafting modifications to the TMICT value. The MiracleLinux/Unity Linux Nessus entries explicitly ...

CVE-2013-7421

CVE-2013-7421 : Linux kernel Crypto API flaw allows a local user to load arbitrary kernel modules via a bind() on an AF_ALG socket with a salg_name, in kernels before 3.18.5. This is the same class as CVE-2014-9644 and is addressed by the 3.18.5 fix (ChangeLog-3.18.5). Connected IBM and vendor ad...

CVE-2014-3145

CVE-2014-3145 is disclosed in multiple Nessus advisories linked to the Linux kernel up to 3.14.3. The vulnerability resides in the BPF_S_ANC_NLATTR_NEST extension within sk_run_filter() in net/core/filter.c, where a reverse-order subtraction allows a local user to trigger an over-read leading to ...

CVE-2014-3601

CVE-2014-3601 is a Linux kernel/KVM issue affecting the kvm_iommu_map_pages function in virt/kvm/iommu.c up to kernel 3.16.1. The vulnerability arises from miscalculating the number of pages during a mapping failure, allowing a guest OS user to trigger either host memory corruption (denial of ser...

CVE-2014-7145

CVE-2014-7145 affects the Linux kernel SMB2_tcon() in fs/cifs/smb2pdu.c, where remote CIFS servers can trigger a NULL pointer dereference by deleting the IPC$ share during DFS referrals, potentially causing a denial of service. The issue is fixed in kernel 3.16.3 (per ChangeLog-3.16.3). Connected...

CVE-2015-2041

CVE-2015-2041 affects Unity Linux kernels (20.1050e/20.1060e/20.1070e) where the Linux kernel before 3.19 contains an error in net/llc/sysctl_net_llc.c using an incorrect data type in a sysctl table. This local information-disclosure flaw allows an unprivileged local user to read potentially sens...

CVE-2017-6345

CVE-2017-6345 targets the LLC subsystem of the Linux kernel prior to 4.9.13, where a destructor is not guaranteed to exist in certain paths, enabling local users to trigger a denial-of-service (BUG_ON) or potentially other impact via crafted system calls. The vulnerability is fixed by the kernel ...

CVE-2021-4148

CVE-2021-4148 : Linux kernel vulnerability in the function block_invalidatepage (fs/buffer.c) where a missing sanity check can allow a local user with privileges to cause a denial of service. The connected advisories corroborate a local DoS impact but do not provide vendor-specific patch details ...

CVE-2021-47050

CVE-2021-47050 affects the Linux kernel memory/ Renesas Renesas-rpc-if path. The issue is a NULL pointer dereference: platform_get_resource_byname() can return NULL, and the code would immediately dereference it in resource_size(). The vulnerability’s root cause is dereferencing an unchecked NULL...

CVE-2021-47082

CVE-2021-47082 affects the Linux kernel tun/tun.c: a double-free in tun_free_netdev is caused by deferring dev->tstats and tun->security allocations to a new ndo_init routine (tun_net_init) that runs via register_netdevice(). If register_netdevice() fails, the destructor previously would no...

CVE-2021-47435

CVE-2021-47435 affects the Linux kernel device-mapper (dm) path, causing a crash via a NULL pointer dereference during IO completion. The issue stems from dm_io_dec_pending() calling end_io_acct() before the in-flight pending count is decremented, and a race if a DM table swap happens concurrentl...

CVE-2021-47566

CVE-2021-47566 involves a Linux kernel vulnerability in proc/vmcore where user-space buffers were cleared improperly (memset) instead of using clear_user(), enabling a supervisor write fault on a vmcore copy scenario. The fix = use clear_user() when handling user buffers; SMAP handling is noted i...

CVE-2022-0433

CVE-2022-0433 is a local denial-of-service vulnerability in the Linux kernel’s BPF subsystem. The issue is a NULL pointer dereference in the map_get_next_key function of the BPF bloom filter, allowing a local user to crash the system. Affected software: Linux kernel versions prior to 5.17-rc1. Ro...

CVE-2022-48674

CVE-2022-48674 - erofs use-after-free on UP platforms : Linux kernel patch fixes a race in erofs where erofs_workgroup_unfreeze() doesn’t reset orig_val, allowing a pcluster to be reused after free. This leads to a use-after-free in paths such as z_erofs_do_read_page/z_erofs_readahead under stres...

CVE-2022-48687

CVE-2022-48687 affects the Linux kernel SRv6 HMAC configuration. The vulnerability stems from the SECRETLEN length being decoupled from SECRET, allowing invalid combinations (e.g., secret="", secretlen=64) that an attacker can craft via netlink to trigger an out-of-bounds read of up to 64 bytes p...

CVE-2022-49177

CVE-2022-49177 : In the Linux kernel, the cavium hwrng driver fix addresses a NULL pointer dereference in cavium RNG handling. The issue manifested as a NULL dereference of 'pdev' in cavium-rng-vf.c (line 182) when dereferenced, triggering a coccicheck warning. The upstream patch fixes the NULL-d...