CVE-2011-1078

CVE-2011-1078 affects the Linux kernel prior to 2.6.39. The vulnerable code is sco_sock_getsockopt_old in net/bluetooth/sco.c, where a structure used with the SCO_CONNINFO option is not initialized, enabling a local attacker to read potentially sensitive data from kernel stack memory. Exploitatio...

CVE-2011-4330

CVE-2011-4330 describes a stack-based buffer overflow in the Linux kernel 2.6, specifically in hfs_mac2asc (fs/hfs/trans.c). A crafted HFS image len field can be used by a local user to trigger a crash and, per the description, possibly execute arbitrary code. The associated connected documents c...

CVE-2016-0823

The CVE-2016-0823 entry concerns the Linux kernel vulnerability in which pagemap_open (fs/proc/task_mmu.c) on kernels before 3.19.3, including Android 6.0.1 before 2016-03-01, can let a local user read pagemap data to obtain sensitive physical-address information. This is triggered by reading the...

CVE-2016-7917

CVE-2016-7917 affects the Linux kernel’s netfilter: the nfnetlink_rcv_batch() function in net/netfilter/nfnetlink.c does not validate the batch length against the message, enabling a local user with CAP_NET_ADMIN to read kernel memory or trigger a denial of service (infinite loop or out-of-bounds...

CVE-2017-14991

Consolidated details from connected advisories show CVE-2017-14991 affects the Linux kernel sg_ioctl path (drivers/scsi/sg.c) with vulnerable code in sg_get_request_table handling for /dev/sg0. The flaw exists in kernels before 4.13.4, allowing local attackers to read uninitialized kernel heap me...

CVE-2017-18079

CVE-2017-18079 affects the Linux kernel, state: a NULL pointer dereference in drivers/input/serio/i8042.c can crash the system because the port->exists value can change after validation, leading to a denial of service or potentially other impact. Public docs specify the vulnerable condition is...

CVE-2017-18221

CVE-2017-18221 affects the Linux kernel: the __munlock_pagevec function in mm/mlock.c before 4.11.4 can be exploited locally via crafted mlockall/munlockall usage to cause NR_MLOCK accounting corruption and a denial of service. Affected versions are kernel prior to 4.11.4; the issue is mitigated ...

CVE-2018-14611

CVE-2018-14611 affects the Linux kernel up to version 4.17.10. The vulnerability is a use-after-free in try_merge_free_space() when mounting a crafted Btrfs image, caused by missing chunk type flag checks in fs/btrfs/volumes.c via btrfs_check_chunk_valid . In the provided connected documents, Nes...

CVE-2019-10125

CVE-2019-10125 affects the Linux kernel (up to v5.0.4) where aio_poll() in fs/aio.c may release a file by aio_poll_wake() after vfs_poll() returns, causing a use-after-free. Connected advisories (Unity Linux UTSA entries) reproduce the vulnerable description and map the issue to kernel code path ...

CVE-2019-12881

The CVE-2019-12881 entry affects the Linux kernel 4.15.0 on Ubuntu 18.04.2, specifically the i915_gem_userptr_get_pages function in drivers/gpu/drm/i915/i915_gem_userptr.c. It allows local attackers to trigger a NULL pointer dereference and BUG via crafted ioctl calls to /dev/dri/card0, potential...

CVE-2019-19044

CVE-2019-19044 affects the Linux kernel prior to 5.3.11, via two memory leaks in v3d_submit_cl_ioctl() in drivers/gpu/drm/v3d/v3d_gem.c. The leaks can cause memory exhaustion and denial of service when kcalloc() or v3d_job_init() fail. The issue is addressed by upgrading to kernel 5.3.11 or apply...

CVE-2021-47435

CVE-2021-47435 affects the Linux kernel device-mapper (dm) path, causing a crash via a NULL pointer dereference during IO completion. The issue stems from dm_io_dec_pending() calling end_io_acct() before the in-flight pending count is decremented, and a race if a DM table swap happens concurrentl...

CVE-2022-48666

CVE-2022-48666 affects the Linux kernel and is a use-after-free in the SCSI core (scsi: core: Fix a use-after-free). The issue arises from two .exit_cmd_priv implementations that use resources tied to the SCSI host; the fix waits in scsi_remove_host() until the tag set is freed to ensure resource...

CVE-2022-48674

CVE-2022-48674 - erofs use-after-free on UP platforms : Linux kernel patch fixes a race in erofs where erofs_workgroup_unfreeze() doesn’t reset orig_val, allowing a pcluster to be reused after free. This leads to a use-after-free in paths such as z_erofs_do_read_page/z_erofs_readahead under stres...

CVE-2022-49033

CVE-2022-49033 affects the Linux kernel’s btrfs qgroup code, where a sleep was performed in an invalid context during qgroup inheritance. The advisory and connected documents describe the fix as: call qgroup_dirty() on the destination qgroup and update the limit item in btrfs_run_qgroups() later,...

CVE-2022-49086

CVE-2022-49086 affects the Linux kernel Open vSwitch actions: during parsing user-provided actions, the ovs_openvswitch module can allocate memory and leak it when destroying actions due to nested actions not being freed. The root cause is that several actions can hold nested lists of actions and...

CVE-2022-49190

CVE-2022-49190 affects the Linux kernel (kernel/resource). Root cause: boot memory allocated via alloc_resource() may be leaked if callers use kfree directly, causing a kernel BUG; remediation leaks only a few bytes to avoid patching every call site. A fix was applied in the kernel (commit ebff7d...

CVE-2022-49298

CVE-2022-49298 : Linux kernel staging rtl8712 driver fix for uninitialized mac[6] in r871xu_drv_init() after tmpU1b from r8712_read8(padapter, EE_9346CR) == 0. KMSAN reported uninit-value in that function and call chain (usb_intf.c:541; usb_probe_interface; device probing). Concrete details are p...

CVE-2022-49698

CVE-2022-49698 detailed context : In the Linux kernel, a bug in netfilter involves updating per-CPU rnd_state from user context in the local_out path, potentially allowing a local attacker to influence randomness. The recommended fix replaces uses of prandom with get_random_u32, and shifts random...

CVE-2022-49924

CVE-2022-49924 : In the Linux kernel NFC fdp path, fdp_nci_send() calls fdp_nci_i2c_write() which may not free the skb, causing a memory leak when the I2C write completes. The public impact is a potential memory leak affecting kernel availability (CVSS base 5.5, HIGH for availability) with no imp...

CVE-2023-1193

CVE-2023-1193 : A use-after-free in setup_async_work within the Linux kernel’s KSMBD in-kernel Samba/CIFS stack can crash systems via access to freed work. Affected component: Linux kernel (Samba server/CIFS). Root cause: use-after-free in setup_async_work. Impact: potential denial of service thr...

CVE-2023-1194

CVE-2023-1194 detail (Linux kernel KSMBD parse_lease_state) Affected component: Linux kernel with KSMBD in-kernel Samba/CIFS. Root cause: missing validation of NameOffset in parse_lease_state() allows a malformed CREATE payload to reach the create_context object, enabling out-of-bounds memory acc...

CVE-2023-52479

The CVE-2023-52479 issue is in the Linux kernel ksmbd SMB2 oplock handling, where a use-after-free occurs due to not dropping a reference to opinfo after smb20_oplock_break_ack. The provided documents state that the fix is to drop the reference after use of opinfo, resolving the use-after-free. T...

CVE-2023-52933

CVE-2023-52933 affects the Linux kernel Squashfs xattr_ids handling. Two overflow flaws were exposed by a corrupted filesystem: on 64‑bit systems, sign extension of xattr_ids when multiplied by sizeof(struct squashfs_xattr_id) can overflow and yield an incorrect len; on 32‑bit systems, the unsign...

CVE-2023-52997

CVE-2023-52997 is a Linux kernel vulnerability affecting ipv4: ip_metrics_convert() where an attacker could exploit speculative execution to leak kernel memory content. The issue arises from using a value as an array index (type) without sufficient protection, allowing a spectre v1 gadget. The de...

CVE-2024-26800

The CVE-2024-26800 entry concerns a Linux kernel TLS use-after-free in backlog decryption. Root cause: when crypto_aead_decrypt returns -EBUSY (not EINPROGRESS), tls_do_decryption waits for async decryptions, but if any completes with a failure, the code releases pages that may still be held by a...

CVE-2024-35821

CVE-2024-35821 relates to the Linux kernel ubifs filesystem. The issue arose because page cache reads are lockless, and the page uptodate flag could be set before the page contained the new data, exposing old data to concurrent readers. The fix moves the SetPageUptodate call into ubifs_write_end(...

CVE-2024-35997

CVE-2024-35997 : In the Linux kernel, the HID i2c-hid driver had I2C_HID_READ_PENDING removed to prevent a lock-up. The flag was used to serialize I2C operations, but I2C core locking is already in place; if the flag is set in i2c_hid_xfer() and an interrupt occurs, i2c_hid_irq could spin in a lo...

CVE-2024-36934

CVE-2024-36934 concerns a Linux kernel vulnerability where a kernel buffer allocated for a userspace copy of nbytes could lack a terminating NUL, causing an out-of-bounds read when sscanf is used on the buffer. The root cause is failing to ensure the copied buffer is NUL-terminated. The fix repla...

CVE-2024-41030

The CVE-2024-41030 vulnerability affects the Linux kernel’s ksmbd server: when opening a directory, write access could be inappropriately granted due to flags from the client, causing ksmbd to become incompatible with FUSE filesystems. The fix discards write access during directory opens, address...

CVE-2024-42110

CVE-2024-42110 affects Linux kernel ntb_netdev when using idxd as the data mover for ntb_transport. The interrupt completion handler uses a threaded interrupt and calls __netif_rx(), which is only valid in interrupt context, causing instability. The recommended fix is to call netif_rx() (or netif...

CVE-2024-43855

CVE-2024-43855 is a Linux kernel vulnerability in the md (RAID) subsystem where a deadlock could occur while an mddev is suspended and a flush bio is in progress. The connected docs describe the root cause as non-atomic increment/decrement of the active_io counter during the md flush sequence, en...

CVE-2024-43861

CVE-2024-43861 affects the Linux kernel (net/usb/qmi_wwan) where a memory leak could occur for non-IP packets due to an unused skb not being freed. The description in Connected documents confirms the fix: freeing the unused skb when non-IP packets arrive. The CIRCL/CVE sighting shows related advi...

CVE-2024-45021

CVE-2024-45021 affects the Linux kernel memcg_write_event_control path. The issue is described as a user-triggerable oops caused by an out-of-bounds/invalid mapping beyond a terminating NUL. A patch addressing this oops is noted in connected advisories, but exploitation status or practical exploi...

CVE-2024-46702

CVE-2024-46702 (Linux kernel) relates to Thunderbolt: when a router is removed, the code previously blocked cleanup of XDomain paths due to tb_disconnect_xdomain_paths() racing with tb_stop() during host router NVM upgrade. The fix marks the XDomain as unplugged during removal, allowing tb_stop()...

CVE-2024-46841

Technical details about CVE-2024-46841 are not publicly available in the provided connected documents. Monitor for updates from official advisories and vendor pages.

CVE-2024-47667

Mode C: The CVE-2024-47667 issue affects the Linux kernel PCI keystone workaround for Errata i2037 on AM65x SR1.0. The workaround limits inbound PCIe TLP read request size and payload to 128 bytes to prevent payload corruption and possible hang when a TLP spans more than two internal AXI 128-byte...

CVE-2024-47675

The connected Nessus advisories confirm CVE-2024-47675 affects the Linux kernel and describes the root cause as a use-after-free in bpf_uprobe_multi_link_attach(). If bpf_link_prime() fails, the error_free path frees the array of bpf_uprobe objects without unregistering them, leaking bpf_uprobe-&...

CVE-2024-49893

CVE-2024-49893 affects the Linux kernel DRM display path (drm/amd/display). The issue arises when dc_state_get_stream_status can return NULL, so stream_status must be checked before use. The patch fixes a NULL_RETURNS issue reported by Coverity by adding a NULL check before accessing stream_statu...

CVE-2024-49915

CVE-2024-49915 concerns the Linux kernel DRM AMD display driver. A null pointer dereference could occur in drm/amd/display during dcn32_init_hw if dc->clk_mgr is null. The fix adds an explicit NULL check before invoking clk_mgr functions, preventing dereferencing a null pointer. Public referen...

CVE-2024-50025

CVE-2024-50025 affects the Linux kernel, specifically the scsi fnic driver. Root cause: in a patch, flush_work initialization was moved into a conditional block, risking dispatching a work item on an uninitialized work queue. Impact: this could cause the queued work to not be processed, which may...

CVE-2024-53106

CVE-2024-53106 concerns the Linux kernel ima subsystem: a buffer overrun in ima_eventdigest_init_common triggered by HASH_ALGO__LAST indexing hash_digest_size[]. Root cause is inadequate handling of HASH_ALGO__LAST; a conditional prevents the overread. A fix is included in kernel updates (commit ...

CVE-2024-57841

CVE-2024-57841 concerns a Linux kernel memory leak in tcp_conn_request() where dst memory allocated in af_ops->route_req is not freed if inet_csk_reqsk_queue_hash_add() fails, as shown by the kmemleak stack. The vulnerability is in the path that leads to tcp_conn_request() and may leak memory ...

CVE-2024-57857

In CVE-2024-57857, the Linux kernel RDMA/siw subsystem removed a direct per-device net_device link and relies on ib_devices net_device management instead. The change addresses a slab-use-after-free (KASAN) issue observed during siw_query_port() caused by a badly managed local net_device link. Rem...

CVE-2024-58016

CVE-2024-58016 (Linux kernel) fixes a safesetid vulnerability where syzbot could cause a kmalloc warning by writing an oversized buffer to a sysfs entry; the vulnerability arises from insufficient validation of write buffer sizes in handle_policy_update() and policy writes. The fix is to validate...

CVE-2025-21685

CVE-2025-21685 : In Linux kernel, a race in platform/x86 lenovo-yoga-tab2-pro-1380-fastcharger was fixed. The yt2_1380_fc_serdev_probe() path called devm_serdev_device_open() before initializing serdev client ops, risking a NULL pointer dereference in the serdev controller’s receive_buf handler w...

CVE-2025-21705

CVE-2025-21705 affects the Linux kernel MPTCP implementation (mptcp: handle fastopen disconnect correctly). Root cause: internal disconnect() during FASTOPEN errors was not properly accounted, risking data stream corruption. Fix: increase the socket disconnect counter so other threads waiting on ...

CVE-2025-21748

CVE-2025-21748 – Linux kernel ksmbd integer overflow (32‑bit) Affected component: ksmbd in the Linux kernel. Description from sources: on 32‑bit systems, additions in ipc_msg_alloc() may overflow, risking memory corruption. A bounds check was introduced using KSMBD_IPC_MAX_PAYLOAD to prevent over...

CVE-2025-21869

Summary: CVE-2025-21869 is tied to a Linux kernel PowerPC code-patching issue where KASAN reports could trigger during patching on certain hardware (Talos II with kernel 6.13). Root cause: patching instructions could write into user-address-space memory under KASAN instrumentation, causing a KASA...

CVE-2025-21936

CVE-2025-21936 affects the Linux kernel Bluetooth subsystem. The vulnerability arises from not checking the return value of mgmt_alloc_skb() in mgmt_device_connected(), leading to a potential null pointer dereference. The connected Azure/Tenable Nessus entries reference the advisory and state tha...