CVE-2023-34256

CVE-2023-34256 describes an out-of-bounds read in crc16 in lib/crc16.c when invoked from fs/ext4/super.c due to incomplete offset checks in ext4_group_desc_csum, affecting the Linux kernel up to but not including 6.3.3. The issue can enable local denial of service or information leaks via a craft...

CVE-2025-22124

CVE-2025-22124 affects the Linux kernel’s md-bitmap/clustermd write_sb path. The issue was a miscalculation of the bitmap_limit for per-node write-intent bitmaps, which could cause bitmap_limit to be 0 in some cases (e.g., when pg_index equals bitmap->storage.file_pages). This results in md_su...

CVE-2025-37817

Linux kernel vulnerability CVE-2025-37817 involves a double free in the mcb path: in chameleon_parse_gdd(), if mcb_device_register() fails, the code could release mdev via put_device() and then free it again on the error path. The fixed behavior is to return early if mcb_device_register() fails, ...

CVE-2025-37844

CVE-2025-37844 refers to a Linux kernel issue in the CIFS subsystem. The vulnerability arises from a NULL pointer dereference in a dbg call path: cifs_server_dbg() could be invoked with a NULL server. The fix moves the dbg call under a conditional so the server is ensured non-NULL before access. ...

CVE-2025-37889

CVE-2025-37889 : In the Linux kernel’s ASoC code, platform_max was inconsistently interpreted as a control value versus a register value. The patching effort reverts a previous +min shift and updates all code paths to consistently treat platform_max as a control value (customer-facing representat...

CVE-2025-40114

Technical details for CVE-2025-40114 are not publicly provided in the connected documents. The advisories reference the CVE but do not expose specifics here. Monitor official vendor/security bulletins for updates.

CVE-2009-4020

CVE-2009-4020 describes a stack-based buffer overflow in the Linux kernel 2.6.32 hfs subsystem (fs/hfs/dir.c, hfs_readdir). A crafted Hierarchical File System (HFS) filesystem could allow an attacker to achieve an unspecified impact via the HFS filesystem. Several Nessus/GD advisories link this C...

CVE-2010-3859

CVE-2010-3859 stems from multiple signedness errors in the Linux kernel’s TIPC implementation, allowing local privilege escalation via a crafted sendmsg that triggers a heap-based buffer overflow in tipc_msg_build and related iovec handling (verify_iovec). Public sources confirm affected historic...

CVE-2010-3875

CVE-2010-3875 affects the Linux kernel, specifically the ax25_getname function in net/ax25/af_ax25.c. The root cause is that a structure is not initialized, enabling local users to read a copy of kernel stack memory and potentially obtain sensitive information. The issue is tied to kernels prior ...

CVE-2010-4163

The CVE-2010-4163 issue affects the Linux kernel, where blk_rq_map_user_iov in block/blk-map.c is vulnerable before version 2.6.36.2. A local attacker can trigger a denial of service (kernel panic) by submitting a zero-length I/O request via a device ioctl to a SCSI device. The description explic...

CVE-2010-4526

CVE-2010-4526 describes a race condition in the Linux kernel between 2.6.11-rc2 and 2.6.33 in sctp_icmp_proto_unreachable (net/sctp/input.c). An ICMP Unreachable to a socket that is already locked by a user can free the socket and trigger list corruption via sctp_wait_for_connect, enabling remote...

CVE-2015-6252

CVE-2015-6252 refers to a vulnerability in the Linux kernel where the vhost_dev_ioctl path in drivers/vhost/vhost.c allows local users to trigger a denial of service (memory consumption) by issuing a VHOST_SET_LOG_FD ioctl that can cause permanent file-descriptor allocation. The description speci...

CVE-2017-18079

CVE-2017-18079 affects the Linux kernel, state: a NULL pointer dereference in drivers/input/serio/i8042.c can crash the system because the port->exists value can change after validation, leading to a denial of service or potentially other impact. Public docs specify the vulnerable condition is...

CVE-2017-8924

CVE-2017-8924 affects Linux kernel

CVE-2018-1000200

CVE-2018-1000200 (Linux kernel) is detailed in connected Nessus/OpenVAS entries as affecting Linux kernel versions 4.14, 4.15, and 4.16. The vulnerability is a NULL pointer dereference that can trigger an out-of-memory (OOM) kill of large memory-locked (mlocked) processes. The root cause involves...

CVE-2018-14619

CVE-2018-14619 affects the Linux kernel crypto subsystem prior to version 4.15-rc4: the null skcipher was freed when af_alg_ctxs were freed instead of when the aead_tfm was freed. This can allow a local user to crash the system or potentially escalate privileges. The connected Nessus advisories (...

CVE-2019-12881

The CVE-2019-12881 entry affects the Linux kernel 4.15.0 on Ubuntu 18.04.2, specifically the i915_gem_userptr_get_pages function in drivers/gpu/drm/i915/i915_gem_userptr.c. It allows local attackers to trigger a NULL pointer dereference and BUG via crafted ioctl calls to /dev/dri/card0, potential...

CVE-2019-19069

CVE-2019-19069 affects the Linux kernel fastrpc DMA path. A memory leak in the function fastrpc_dma_buf_attach() (drivers/misc/fastrpc.c) can be triggered by dma_get_sgtable() failures, allowing a potential denial of service through memory consumption. The vulnerability is in kernels before 5.3.9...

CVE-2021-47061

CVE-2021-47061 : Concrete details in connected advisories show a Linux kernel/KVM issue where destroying an I/O bus device must occur after unregister, and after SRCU-synchronization. The root cause is a use-after-free risk if devices are destroyed before the bus is nullified, because readers exp...

CVE-2022-48423

CVE-2022-48423 affects the Linux kernel (fs/ntfs3/record.c) prior to version 6.1.3, where resident attribute names are not validated, allowing an out-of-bounds write. Public references in the provided documents cite kernel fixes in 6.1.3 (ChangeLog-6.1.3, commit 54e45702b6…) and related advisorie...

CVE-2022-48666

The CVE-2022-48666 entry concerns the Linux kernel: scsi: core: Fix a use-after-free. The root cause involves two .exit_cmd_priv implementations that use resources tied to the SCSI host; the patch ensures those resources remain valid when exit_cmd_priv is invoked by scsi_remove_host() by waiting ...

CVE-2022-48893

CVE-2022-48893 affects the Linux kernel's drm/i915/gt engine discovery. If driver initialization is aborted mid-gt/engine discovery, some engines stay incompletely set up and leak allocated objects because engine->release may be NULL. The entry notes a fix: drop the destroy_pinned_context() he...

CVE-2022-49535

CVE-2022-49535 affects the Linux kernel SCSI lpfc path. The flaw can cause a use-after-free via premature node release when FLOGI/PLOGI handling fails or when non-zero ELS PLOGI status is processed if a dev-loss-evt work is pending. The described root cause is a premature decrementing of the ndlp...

CVE-2022-49561

CVE-2022-49561 concerns a race in Linux kernel netfilter conntrack handling where, on insertion conflicts, skb->_nfct can be freed and rebound to an already-confirmed conntrack entry. The issue arises because conntrack entries and extension space can be freed after an RCU grace period, and the...

CVE-2022-49606

CVE-2022-49606 affects the Linux kernel RDMA/irdma path. The issue is a sleep (mutex) operation taken to process RoCEv2 QPs on netdev events, which can trigger a BUG: sleeping function called from invalid context in mutex_lock and lead to a kernel crash. The fix removes RoCEv2 handling in irdma_c...

CVE-2022-49903

CVE-2022-49903 affects the Linux kernel IPv6 routing: during ip6_route_net_init_late(), if the files ipv6_route or rt6_stats fail to be created, initialization may complete and later removing the proc entries could trigger a WARNING about the missing rt6_stats. The issue is a local-privilege-cont...

CVE-2023-1583

CVE-2023-1583 : A NULL pointer dereference in io_uring/filetable.c (io_file_bitmap_get) can be triggered after unregistration of fixed files when IORING_FILE_INDEX_ALLOC is used. The root cause is that context data (file_alloc_start/end and alloc_hint) is not cleared, allowing an unprivileged loc...

CVE-2023-20842

CVE-2023-20842 affects MediaTek devices via the core component described as /imgs y s_cmdq/ . The vulnerability is an out-of-bounds write caused by missing valid range checking in imgsys_cmdq, which can enable local privilege escalation with System execution privileges after user interaction. No ...

CVE-2023-32252

CVE-2023-32252 affects the Linux kernel ksmbd (the in-kernel SMB server). The flaw occurs in the handling of SMB2_LOGOFF commands due to improper validation of a pointer before access. This can allow an attacker to trigger a denial-of-service on the affected system. The description and connected ...

CVE-2023-3397

CVE-2023-3397 is a race between lmLogClose and txEnd in the Linux kernel’s JFS, allowing a local attacker to crash the system or leak kernel info. Connected entries show Root:Debian-13, -11, -12 patches for rootio-linux with multiple fixed versions; patches indicate remediation has been applied i...

CVE-2023-52484

CVE-2023-52484 affects the Linux kernel in iommu/arm-smmu-v3 where arm_smmu_mm_invalidate_range (renamed to arm_smmu_mm_arch_invalidate_secondary_tlbs since 6.6-rc1) can trigger a soft lockup during SVA-case TLBI range notifs. The issue is linked to not checking MAX_TLBI_OPS and near MMU tlb flus...

CVE-2023-52586

CVE-2023-52586 : In the Linux kernel DRM MSM DPU, a race between vblank enable/disable from different threads existed due to missing synchronization. The fix adds a mutex around control vblank IRQ handling (and removes vblank_ctl_lock usage), replacing an atomic refcount with a simple int counter...

CVE-2023-52773

CVE-2023-52773 concerns a NULL pointer dereference in the Linux kernel’s DRM/AMD display path. The issue is in amdgpu_dm_i2c_xfer(), which can dereference a null pointer when performing a DDC/I2C transfer. The description states that on ddc_service_construct(), the code now checks both the link t...

CVE-2023-52974

CVE-2023-52974: Linux kernel scsi: iscsi_tcp fix UAF during login when accessing the shost ipaddress. If iscsi_sw_tcp_session_create() fails and userspace reads the host ipaddress during session teardown, a use-after-free occurs. The fix delays freeing by setting tcp_sw_host->session only afte...

CVE-2023-52997

CVE-2023-52997 is a Linux kernel vulnerability affecting ipv4: ip_metrics_convert() where an attacker could exploit speculative execution to leak kernel memory content. The issue arises from using a value as an array index (type) without sufficient protection, allowing a spectre v1 gadget. The de...

CVE-2023-53028

CVE-2023-53028 (Linux kernel) affects the mac80211 wireless stack. The issue stems from a memory-leak fix in ieee80211_if_add() that was reverted, with ieee80211_if_free() already invoked from free_netdev(ndev) when ndev->priv_destructor == ieee80211_if_free. The provided exploit/debug traces ...

CVE-2023-53145

In the Linux kernel, the Bluetooth driver subsystem btsdio is affected by a use-after-free race in btsdio_remove. In btsdio_probe, data->work is bound to btsdio_work and started via btsdio_send_frame. If btsdio_remove executes while the work is unfinished, hdev could be freed but still used by...

CVE-2023-6560

CVE-2023-6560 corresponds to an out-of-bounds memory access in the Linux kernel io_uring subsystem (SQ/CQ rings) that can allow a local user to crash the system. Affected component is the io_uring handling code, specifically the __io_uaddr_map() path. The vulnerability is local in scope with the ...

CVE-2024-26776

CVE-2024-26776 pertains to the Linux kernel SPI driver for Hisilicon SFC v3xx. The issue arises when the interrupt handler receives an empty interrupt, leading to a NULL pointer dereference. The fix is to return IRQ_NONE when no interrupt is detected, thereby preventing the NULL dereference. Impa...

CVE-2024-26986

CVE-2024-26986 Root cause: In the Linux kernel’s DRM AMD/KFD path, a memory leak was introduced via a leaked mmget reference on the error path when creating KFD processes while a GPU reset is in progress. Impact: Memory leak in create_process failure for KFD, potentially exhausting memory or reso...

CVE-2024-27403

CVE-2024-27403 affects the Linux kernel and is described in connected Astra Linux advisory as: netfilter nft_flow_offload: reset dst in the route object after setting up a flow. The dst is moved to the flow object; the route object no longer owns it. If flow_offload_add() fails, the error path ma...

CVE-2024-35806

The CVE-2024-35806 entry concerns the Linux kernel vulnerability in soc: fsl: qbman where IRQs must be disabled when taking cgr_lock to avoid deadlocks. The description states that smp_call_function_single already disables IRQs in the affected code path and that qman_update_cgr and qman_delete_cg...

CVE-2024-35821

CVE-2024-35821 relates to the Linux kernel ubifs filesystem. The issue arose because page cache reads are lockless, and the page uptodate flag could be set before the page contained the new data, exposing old data to concurrent readers. The fix moves the SetPageUptodate call into ubifs_write_end(...

CVE-2024-37078

CVE-2024-37078 - Linux kernel nilfs2 writeback fix Affected component: the Linux kernel filesystem nilfs2.Root cause: during log writer writebacks for segment summaries or super root blocks, the code did not wait for ongoing folio/page writebacks on the backing device’s page cache, creating an in...

CVE-2024-39495

The CVE-2024-39495 issue is a Linux kernel use-after-free in greybus gb_interface_release caused by a race with gb_interface_mode_switch_work. The fix, confirmed by multiple sources (e.g., Astra Linux advisory reflecting the same description), is to cancel the scheduled work before freeing the ob...

CVE-2024-40932

CVE-2024-40932 affects the Linux kernel DRM Exynos VIDI driver. The issue is a memory leak in .get_modes() where a duplicated EDID is never freed, leading to potential memory exhaustion. The provided connected advisories confirm the root cause and the fix: a memory leak in drm/exynos/vidi: get_mo...

CVE-2024-40942

CVE-2024-40942 corresponds to a Linux kernel vulnerability involving the wifi/mac80211 mesh code. The issue was a leak of mesh_preq_queue objects that are stored in a per-mesh interface list to track path resolution. When an mpath is deleted or a mesh interface is removed, entries in this preq_qu...

CVE-2024-42262

CVE-2024-42262 relates to the Linux kernel’s DRM/V3D subsystem. The issue is a memory leak in the main loop: if fetching userspace memory fails, all drm_syncobjs looked up up to that point are leaked due to a missing drm_syncobj_put. The defect was fixed by exporting and using a common cleanup he...

CVE-2024-42288

CVE-2024-42288 affects the Linux kernel SCSI qla2xxx driver. The root cause is an incorrect dereference of the Init Control Block (ICB), which could enable memory corruption. The fix Correctly dereferences the ICB to prevent memory corruption, as documented in the vulnerability description. The l...

CVE-2024-46678

CVE-2024-46678 affects the Linux kernel bonding subsystem. The issue arises from bond->ipsec_lock being a spin lock used to protect ipsec_list, which can sleep in xdo_dev_state_add/delete during active-slave changes, triggering scheduling while atomic. The fix replaces the spin lock with a mut...