CVE-2025-21941

Technical details for CVE-2025-21941 are not publicly provided in the supplied documents. Available materials mention a null-pointer guard in drm/amd/display but do not specify affected products, versions, exploitability, or mitigations. Monitor for updates.

CVE-2025-21978

CVE-2025-21978 – Linux kernel (drm/hyperv): address space leak in Hyper-V DRM device mapping . The vulnerability occurs when a Hyper-V DRM device is probed: the driver allocates MMIO space for VRAM and maps it as cacheable, but on device removal or probing error path the MMIO space is released wi...

CVE-2025-22038

CVE-2025-22038 concerns the Linux kernel, specifically the ksmbd path. The issue arises when accessing psid->sub_auth[psid->num_subauth - 1] without ensuring num_subauth is non-zero, which can cause an out-of-bounds read. The provided description states the patch adds a validation step to r...

CVE-2025-22057

Summary: CVE-2025-22057 affects the Linux kernel networking path for cached destination entries. The upstream fix to move the dst counter decrement from dst_destroy to dst_release was incomplete when CONFIG_DST_CACHE is enabled and OvS+tunnels are used, causing a potential access of freed data. T...

CVE-2025-22072

CVE-2025-22072 affects the Linux kernel spufs component, addressing leaks in gang directory lifetimes. The issue: creating a gang returns an opened gang directory that should be removed on close, but if a context belonging to that gang remains alive, removal could fail, causing a leak. The fix de...

CVE-2025-22083

The CVE-2025-22083 issue affects Linux kernel vhost-scsi handling: multiple vhost_scsi_set_endpoint calls without an intervening vhost_scsi_clear_endpoint can trigger three bugs in the vs_tpg lifecycle. 1) Use-after-free when no tpgs are found after a second call, due to freed vs->vs_tpg backi...

CVE-2025-22124

CVE-2025-22124 affects the Linux kernel’s md-bitmap/clustermd write_sb path. The issue was a miscalculation of the bitmap_limit for per-node write-intent bitmaps, which could cause bitmap_limit to be 0 in some cases (e.g., when pg_index equals bitmap->storage.file_pages). This results in md_su...

CVE-2025-37754

CVE-2025-37754 affects the Linux kernel i915 HuC path: HuC delayed loading fence was registered in the object tracker during probe but is not unregistered on early-probe errors. Because memory is allocated under devres and later released, the fence can be allocated and reused on subsequent probes...

CVE-2010-4649

The CVE-2010-4649 issue affects the Linux kernel up to 2.6.37, where an Integer overflow in ib_uverbs_poll_cq (drivers/infiniband/core/uverbs_cmd.c) allows a local user to cause memory corruption and a possible DoS or other unspecified impact when a structure member is large. The vulnerability re...

CVE-2011-2699

CVE-2011-2699 affects the Linux kernel IPv6 implementation. The vulnerability is that, before version 3.1, Fragment Identification values were not generated separately for each destination, enabling remote attackers to cause a denial of service by sending crafted packets. Connected advisories ref...

CVE-2012-4542

CVE-2012-4542 describes a Linux kernel local access issue in block/scsi_ioctl.c (up to kernel 3.8) where SCSI command authorization does not properly account for the SCSI device class, allowing a local attacker to bypass access restrictions via SG_IO ioctl with overlapping opcodes. Public referen...

CVE-2015-3290

The connected Astra Linux bulletin describes CVE-2015-3290 in the Linux kernel context and confirms the vulnerability fix: limiting the Haswell performance counter period to mitigate NMI-related privilege escalation. It documents that the issue stemmed from a too-small initial frequency-estimatio...

CVE-2015-8709

CVE-2015-8709 affects the Linux kernel, specifically the code path in kernel/ptrace.c up to version 4.4.1. The issue arises from how uid and gid mappings are handled when establishing a user namespace, allowing a local user to gain privileges by waiting for a root process to enter that namespace ...

CVE-2016-5412

CVE-2016-5412 affects the Linux kernel on PowerPC with CONFIG_KVM_BOOK3S_64_HV enabled. A guest OS user can trigger a host denial of service (infinite loop) by issuing a H_CEDE hypercall while a transaction is suspended. The description in the supplied documents confirms the affected file and con...

CVE-2016-7915

CVE-2016-7915 affects the Linux kernel, where the hid_input_field function in drivers/hid/hid-core.c (pre-4.6) can be triggered by a physically proximate USB device (e.g., Logitech DJ receiver) to perform an out-of-bounds read, leaking kernel memory or causing a denial of service. The issue arise...

CVE-2018-14616

CVE-2018-14616 involves a NULL pointer dereference in the Linux kernel before 4.17.10. The flaw occurs in fscrypt_do_page_crypto() (fs/crypto/crypto.c) when handling a file inside a corrupted f2fs image. Affects the Linux kernel up to 4.17.10; the issue can cause a kernel crash (availability impa...

CVE-2018-14619

CVE-2018-14619 affects the Linux kernel crypto subsystem prior to version 4.15-rc4: the null skcipher was freed when af_alg_ctxs were freed instead of when the aead_tfm was freed. This can allow a local user to crash the system or potentially escalate privileges. The connected Nessus advisories (...

CVE-2021-47082

CVE-2021-47082 affects the Linux kernel tun/tun.c: a double-free in tun_free_netdev is caused by deferring dev->tstats and tun->security allocations to a new ndo_init routine (tun_net_init) that runs via register_netdevice(). If register_netdevice() fails, the destructor previously would no...

CVE-2021-47287

CVE-2021-47287 affects the Linux kernel. The issue is a memory leak in the auxiliary bus code when driver_register() fails. Specifically, if driver_register() returns an error, memory allocated for auxdrv->driver.name must be freed before returning from __auxiliary_driver_register(). The fix r...

CVE-2021-47459

CVE-2021-47459 describes a use-after-free in the Linux kernel can: j1939: j1939_netdev_start() related to rx_kref of j1939_priv. The issue arises during j1939_sk_bind and netdev_start when rx_kref is accessed without proper synchronization. Public advisories indicate this is fixed by kernel updat...

CVE-2022-0998

CVE-2022-0998 details an integer overflow in the Linux kernel's virtio device driver, specifically in vhost_vdpa_config_validate, permitting a local user to crash the system or potentially escalate privileges. Connected advisories confirm this flaw in the kernel virtio path and reference related ...

CVE-2022-48424

CVE-2022-48424 affects the Linux kernel prior to 6.1.3, where NTFS-3 file system code (fs/ntfs3/inode.c) fails to validate the attribute name offset, leading to an unhandled page fault. Affected component: NTFS-3 support in the kernel; root cause: incomplete validation of attribute name offset in...

CVE-2022-48918

CVE-2022-48918 — Linux kernel iwlwifi/mvm debugfs_dir null-pointer issue . When debugfs=off is passed, the iwiwifi mvm module used an unchecked debugfs_dir pointer, causing a kernel NULL pointer dereference (BUG) as shown in the provided trace (iwl_mvm_dbgfs_register). The issue is resolved by ad...

CVE-2022-48956

The CVE-2022-48956 issue is a Linux kernel use-after-free vulnerability in IPv6 handling, specifically in ip6_fragment() with a problematic assumption about rcu_read_lock() ownership. The flaw enables a use-after-free in the UDP path (ip6_dst_idev and ip6_fragment) as shown in the syzbot KASAN re...

CVE-2022-49204

Summary: CVE-2022-49204 is a Linux kernel vulnerability in the bpf/sockmap path related to uncharged data handling when a tcp_bpf_sendmsg_redir sequence occurs. The root cause is that msg->sg.size can be charged twice across the __SK_REDIRECT path, leading to uncharged memory being left in sk_...

CVE-2022-49332

CVE-2022-49332 relates to the Linux kernel SCSI lpfc path. The vulnerability is a NULL pointer dereference in starget_to_rport() where calls may return NULL and the code could dereference a NULL rport. The described root cause is lack of a NULL check before dereferencing the rport, with the cited...

CVE-2022-49370

The CVE-2022-49370 issue affects the Linux kernel component handling firmware dmi-sysfs, where a memory leak occurs due to improper cleanup in dmi_sysfs_register_handle when kobject_init_and_add() returns an error. The documented fix is to call kobject_put() to release memory in that failure path...

CVE-2023-3220

CVE-2023-3220 affects the Linux kernel (through 6.1-rc8) in the MSM DPU path: dpu_crtc_atomic_check in drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c does not validate kzalloc() return, causing a NULL pointer dereference. Impact is local attacker could crash the system; no remote code execution indicat...

CVE-2023-52699

In CVE-2023-52699, the Linux kernel SysV locking flaw caused sleep in atomic context because sb_bread() was invoked with pointers_lock held. The root cause spans historical locking changes: replacing BKL with a sysvfs-private rwlock (Linux 2.5.12) introduced a write_lock → read_lock deadlock; the...

CVE-2023-52932

The CVE-2023-52932 issue concerns the Linux kernel mm/swapfile get_swap_pages(), where a plist_for_each_entry_safe() loop could loop tens of thousands of times under memory pressure, risking soft lockup. The fix adds cond_resched() into get_swap_pages() when space isn’t found, addressing softlock...

CVE-2023-53114

CVE-2023-53114 - In the Linux kernel, the i40e Intel XL710 Ethernet driver had a crash during reboot when the firmware is in recovery mode. The root cause was that during recovery mode, the probe skipped pci_set_drvdata(), which later caused a NULL dereference in i40e_shutdown() during shutdown/r...

CVE-2024-26694

CVE-2024-26694 affects the Linux kernel wifi iwlwifi driver. The vulnerability arises from improper handling of TLV PC register data: the data storage in drv->fw area is freed without clearing the pointer, risking a double-free if a subsequent free occurs (e.g., when a file load fails after pa...

CVE-2024-36894

CVE-2024-36894 (Linux kernel) : A race in usb: gadget: f_fs between AIO cancellation and AIO completion for FFS UDC USB requests could lead to use-after-free of io_data->req. The issue occurs when an aio_cancel() from the FFS app overlaps with the UDC soft-disconnect path (notably in DWC3-base...

CVE-2024-38633

CVE-2024-38633 affects the Linux kernel serial MAX3100 driver. The issue arises when the last MAX3100 device is removed, as the global state tracking the UART driver registration is not updated, leading to a NULL pointer dereference during driver re-insertion (insmod/rmmod/insmod cycle). The docu...

CVE-2024-42074

CVE-2024-42074 pertains to the Linux kernel’s ASoC AMD ACP driver. When the acp platform device creation is skipped, chip->chip_pdev can be NULL, leading to a potential NULL pointer dereference in snd_acp_resume. The connected Nessus/NASL entries confirm the root cause and describe the fix: ad...

CVE-2024-42297

CVE-2024-42297 concerns a Linux kernel f2fs issue where inodes are marked dirty during operations on a readonly filesystem, triggering a kernel panic during unmount. Root cause chain: do_sys_open -> f2fs_lookup -> __f2fs_find_entry -> f2fs_i_depth_write -> f2fs_mark_inode_dirty_sync -...

CVE-2024-46678

CVE-2024-46678 affects the Linux kernel bonding subsystem. The root cause was ipsec_lock being a spin lock used to protect ipsec_list, but bond’s xfrm operations may sleep, triggering scheduling-while-atomic. The patch changes bond->ipsec_lock from a spin lock to a mutex, ensuring xdo_dev_stat...

CVE-2024-46804

CVE-2024-46804 affects the Linux kernel’s DRM/AMD display path, specifically HDCP DDC access. The vulnerability stems from an array index overrun due to not validating the index, which could lead to overrun/W earlier reports. The fix adds proper checks: validate the message id (msg_id) and ensure...

CVE-2024-46813

CVE-2024-46813 affects the Linux kernel drm/amd/display code. The fix guards against out-of-bounds access by validating link_index before dereferencing dc->links[], where dc->links[] has a max size of MAX_LINKS; the issue could cause 3 overrun conditions and a resource leak, resolved by the...

CVE-2024-46815

CVE-2024-46815 affects the Linux kernel's DRM/AMD display code. The issue arises when accessing reader_wm_sets[] without validating num_valid_sets, which could yield a negative index and an OVERRUN. The description and connected advisories consistently state the fix was to check num_valid_sets be...

CVE-2024-47666

CVE-2024-47666 is a Linux kernel vulnerability in the SCSI pm80xx driver. The bug arises when pm8001_phy_control() stores enable_completion on a stack address, sends resets, waits 300 ms, then returns; if a late PHY control response arrives after the 300 ms, a dangling enable_completion pointer i...

CVE-2024-49978

In CVE-2024-49978, the Linux kernel fix addresses UDP GSO fraglist segmentation after fragmentation remains in frag_list. The issue involved valid SKB_GSO_FRAGLIST skbs with specific geometry and invariants; datapath hooks like NAT/BPF can break these invariants. Under certain conditions, UDP cou...

CVE-2024-50031

CVE-2024-50031 affects the Linux kernel DRM V3D component (Raspberry Pi) where closing the kmscube fd does not stop the active perfmon, leaving v3d->active_perfmon as a stale pointer. This can lead to a kernel panic (Oops) when a new kmscube runs and attempts to stop the perfmon. The root caus...

CVE-2024-50139

CVE-2024-50139 affects the Linux kernel’s KVM ARM64 implementation. The bug arises from a UBSAN-shift-out-of-bounds condition (shift exponent 33 is too large for a 32-bit int) encountered when running a VM with MTE enabled on the host. The vulnerability can cause a UBSAN crash/abort within arch/a...

CVE-2024-50198

CVE-2024-50198 affects the Linux kernel IIO driver for the veml6030 (iio: light). The dev pointer passed to in_illuminance_period_available_show incorrectly referenced the embedded IIO device instead of the associated I2C client, causing a NULL indio_dev and a segmentation fault when reading the ...

CVE-2024-53046

CVE-2024-53046 affects Linux kernel ARM64 in the imx8ulp device tree to correct the flexspi compatible string. The issue arises because imx8ulp flexspi supports 16 LUTs whereas imx8mm supports 32 LUTs, causing a startup warning if the string is incorrect. The fix updates arm64/dts: imx8ulp to ens...

CVE-2024-56538

Technical details for CVE-2024-56538 (Linux kernel drm: zynqmp_kms unplug before removal) are not publicly provided in the connected documents. Monitor for updates; none of the OpenVAS/USN entries include exact exploit specifics, affected versions, or fixes beyond referencing the CVE.

CVE-2024-56550

The CVE-2024-56550 affects the Linux kernel (s390 architecture). The underlying issue was a return statement in arch_stack_walk_user_common() that could be executed when store_ip() fails, instead of a break. This could skip pagefault_enable(), causing subsequent page faults to be mishandled and p...

CVE-2024-56622

Summary: CVE-2024-56622 is a Linux kernel vulnerability in the SCSI UFS core sysfs path that can trigger a division by zero when monitoring is disabled. The issue is tracked across multiple vendors/distros with fixed releases: Debian LTS advisory DLA-4076-1 notes a fix in linux-6.1-6.1.6.1.128-1~...

CVE-2024-57935

The CVE-ID describes a Linux kernel flaw in RDMA/hns: when destroying a QP, an invalid dip_ctx pointer could be accessed if the QP could not be modified to RTR, due to the dip_ctx not being attached. This is a local-attack surface with potential kernel access to cause a denial of service or crash...