14999 matches found
CVE-2014-5472
The CVE-2014-5472 entry affects the Linux kernel up to 3.16.1, where the parse_rock_ridge_inode_internal function in fs/isofs/rock.c is exploitable by local users via a crafted iso9660 image with a self-referential CL entry to cause a denial-of-service (unkillable mount process). Connected Nessus...
CVE-2024-57857
In CVE-2024-57857, the Linux kernel RDMA/siw subsystem removed a direct per-device net_device link and relies on ib_devices net_device management instead. The change addresses a slab-use-after-free (KASAN) issue observed during siw_query_port() caused by a badly managed local net_device link. Rem...
CVE-2025-21748
CVE-2025-21748 – Linux kernel ksmbd integer overflow (32‑bit) Affected component: ksmbd in the Linux kernel. Description from sources: on 32‑bit systems, additions in ipc_msg_alloc() may overflow, risking memory corruption. A bounds check was introduced using KSMBD_IPC_MAX_PAYLOAD to prevent over...
CVE-2025-21868
CVE-2025-21868 affects the Linux kernel: the issue arises in net/core related to small head cache usage when MAX_SKB_FRAGS is large (example build with MAX_SKB_FRAGS=45). The splat trace points to netif_napi_add_weight_locked and related paths; the advisory notes that the root cause is independen...
CVE-2025-21950
CVE-2025-21950 affects the Linux kernel driver path drivers: virt: acrn: hsm. In pmcmd_ioctl, three kmalloc-allocated memory objects initialized by hcall_get_cpu_state are copied to user space, risking information leakage from uninitialized bytes. The fix uses kzalloc to zero memory, mitigating l...
CVE-2025-21955
The CVE-2025-21955 issue affects the Linux kernel’s ksmbd module. Affected component: ksmbd_work and ksmbd_conn handling during oplock break notification. Root cause described: ksmbd_work could be freed after the connection was released, so the r_count of ksmbd_conn is incremented to indicate req...
CVE-2025-22039
CVE-2025-22039 is a Linux kernel vulnerability in ksmbd where an overflow in the dacloffset bounds check could bypass the DACL checks, causing out-of-bounds access and a kernel crash when dereferencing a DACL pointer. The fix converts dacloffset from int to unsigned int and uses check_add_overflo...
CVE-2025-22050
The CVE-2025-22050 entry concerns the Linux kernel USB networking path. A race between usb_submit_urb and __usbnet_queue_skb occurs due to a missing usbnet_going_away check in usb_submit_urb, while __usbnet_queue_skb performs this validation. This can let a URB proceed while the corresponding SKB...
CVE-2025-22093
Summary (CVE-2025-22093) The Linux kernel DRM for AMD displays had a NULL pointer dereference risk when DMUB is unsupported on the ASIC. Specifically, ctx->dmub_srv could be NULL (tested in dm_dmub_sw_init) but was dereferenced in dmub_hw_lock_mgr_cmd if should_use_dmub_lock returned true. The...
CVE-2025-37754
CVE-2025-37754 affects the Linux kernel i915 HuC path: HuC delayed loading fence was registered in the object tracker during probe but is not unregistered on early-probe errors. Because memory is allocated under devres and later released, the fence can be allocated and reused on subsequent probes...
CVE-2025-37807
CVE-2025-37807 is a Linux kernel issue in the BPF percpu hashmap path where a percpu pointer is stored at an 8-byte aligned location only if the key_size rounds up to 8; otherwise a 4-byte aligned location is used, causing kmemleak to miss the pointer and report a leak. The root cause is an align...
CVE-2025-37844
CVE-2025-37844 refers to a Linux kernel issue in the CIFS subsystem. The vulnerability arises from a NULL pointer dereference in a dbg call path: cifs_server_dbg() could be invoked with a NULL server. The fix moves the dbg call under a conditional so the server is ensured non-NULL before access. ...
CVE-2025-37864
CVE-2025-37864 relates to the Linux kernel DSA subsystem: a cleanup path for FDB, MDB and VLAN entries on unbind was added to fix a scenario where bridge bypass operations could leave stale entries and trigger a leak/warn on unbind. The vulnerability stems from the assumption that higher layers b...
CVE-2025-37879
CVE-2025-37879 affects the Linux kernel 9p/net component. Root cause: in p9_client_write() and p9_client_read_once(), a server could reply with success but a negative count due to signed variable handling, leading to incorrect conclusions about written/read data. The documented fix is to convert ...
CVE-2025-37893
LoongArch LoongArch: BPF vulnerability fixed in arch/loongarch/net/bpf_jit.c: build_prologue() had an off-by-one error in JIT epilogue generation when mixing bpf2bpf and tailcalls. The first pass sets flags, the second emits N+1 instructions instead of N, causing epilogue_offset to be off and pot...
CVE-2025-38248
CVE-2025-38248 : In the Linux kernel, a use-after-free flaw occurs in bridge multicast routing port handling. When per-VLAN multicast snooping is active, per-port multicast context is disabled and ports are removed from the global router port list, but can be re-added, leaving stale entries. This...
CVE-2026-53224
The vulnerability CVE-2026-53224 affects the Linux kernel SCTP implementation. The issue arises from insufficient validation of embedded INIT chunks and address list lengths in cookies: sctp_unpack_cookie() may accept a truncated INIT chunk, and the subsequent sctp_process_init() could read INIT ...
CVE-2010-2942
CVE-2010-2942 affects the Linux kernel prior to 2.6.36-rc2. The issue arises in the actions implementation of network queueing: several tcf_*_dump routines (tcf_gact_dump, tcf_mirred_dump, tcf_nat_dump, tcf_simp_dump, tcf_skbedit_dump) do not properly initialize certain structure members during d...
CVE-2011-2482
Mode C (Normal, details available) CVE-2011-2482 is referenced in connected documentation tied to MiracleLinux 3: kernel-2.6.18-274.2.AXS3. The vulnerability affects the Linux kernel as used by that distribution, and stems from a Red Hat patch to the sctp_sock_migrate function in net/sctp/socket....
CVE-2013-2237
CVE-2013-2237 affects the Linux kernel prior to 3.9. The vulnerability arises because key_notify_policy_flush in net/key/af_key.c does not initialize a certain structure member, enabling local attackers to read kernel heap memory via a broadcast message on the IPSec key_socket notify_policy inter...
CVE-2014-3145
CVE-2014-3145 is disclosed in multiple Nessus advisories linked to the Linux kernel up to 3.14.3. The vulnerability resides in the BPF_S_ANC_NLATTR_NEST extension within sk_run_filter() in net/core/filter.c, where a reverse-order subtraction allows a local user to trigger an over-read leading to ...
CVE-2014-3647
CVE-2014-3647 affects the Linux kernel KVM emulation path: arch/x86/kvm/emulate.c. The root cause is improper handling of RIP changes during instruction emulation, enabling a local guest OS user to crash the guest (DoS) with a crafted application in kernels up to 3.17.2. The provided connected do...
CVE-2015-0570
CVE-2015-0570 is a stack-based buffer overflow in the SET_WPS_IE IOCTL in wlan_hdd_hostapd.c of the Linux kernel WLAN driver (3.x/4.x), as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and similar products. Exploitation requires a crafted application with a long ...
CVE-2015-6252
CVE-2015-6252 refers to a vulnerability in the Linux kernel where the vhost_dev_ioctl path in drivers/vhost/vhost.c allows local users to trigger a denial of service (memory consumption) by issuing a VHOST_SET_LOG_FD ioctl that can cause permanent file-descriptor allocation. The description speci...
CVE-2016-2547
The CVE-2016-2547 issue affects Linux kernel sound/core/timer.c prior to 4.4.1. The root cause is a locking approach that ignores slave timer instances, enabling a local attacker to trigger a denial-of-service via a crafted ioctl (race condition/use-after-free leading to system crash). Public adv...
CVE-2016-3136
CVE-2016-3136 affects the Linux kernel up to version 4.5.0, where the mct_u232_msr_to_state function in drivers/usb/serial/mct_u232.c can be triggered by a crafted USB device without two interrupt-in endpoint descriptors. This allows physically proximate attackers to cause a denial of service (NU...
CVE-2016-4580
CVE-2016-4580 affects the Linux kernel up to version 4.5.4 (pre-4.5.5). The vulnerability arises in x25_negotiate_facilities() inside net/x25/x25_facilities.c where a data structure is not properly initialized, enabling an attacker to read sensitive data from kernel stack memory via an X.25 Call ...
CVE-2016-5243
CVE-2016-5243 affects the Linux kernel up to 4.6.3. The tipc_nl_compat_link_dump function in net/tipc/netlink_compat.c does not properly copy a string, enabling a local attacker to read sensitive data from kernel stack memory via a Netlink message. Impact is information disclosure with LOCAL acce...
CVE-2017-15127
CVE-2017-15127 affects the Linux kernel (mm/hugetlb.c: hugetlb_mcopy_atomic_pte). A superfluous implicit page unlock for VM_SHARED hugetlbfs mappings could trigger a local denial of service. Affected: Linux kernel prior to 4.13; the issue is addressed in later kernel versions (see commit 5af10dfd...
CVE-2022-28796
CVE-2022-28796: Linux kernel
CVE-2022-3115
Mode C: CVE-2022-3115 affects the Linux kernel up to 5.16-rc6. The malidp_crtc_reset path in drivers/gpu/drm/arm/malidp_crtc.c does not check kzalloc() return, causing a NULL pointer dereference. Impact is local, potentially enabling kernel denial of service. Public details confirm the exact vuln...
CVE-2022-48666
The CVE-2022-48666 entry concerns the Linux kernel: scsi: core: Fix a use-after-free. The root cause involves two .exit_cmd_priv implementations that use resources tied to the SCSI host; the patch ensures those resources remain valid when exit_cmd_priv is invoked by scsi_remove_host() by waiting ...
CVE-2022-48893
CVE-2022-48893 affects the Linux kernel's drm/i915/gt engine discovery. If driver initialization is aborted mid-gt/engine discovery, some engines stay incompletely set up and leak allocated objects because engine->release may be NULL. The entry notes a fix: drop the destroy_pinned_context() he...
CVE-2022-49280
Summary of CVE-2022-49280 (Linux kernel) : Affected component is NFSD in the Linux kernel, specifically nfssvc_decode_writeargs(). The root cause was an underflow risk from treating a length as signed, allowing an issue where args->len had no lower bound. The fix implemented across sources is ...
CVE-2022-49306
CVE-2022-49306 affects the Linux kernel USB subsystem (usb: dwc3: host). The issue arises from stop setting the ACPI companion for the DWC3 host; the sysdev pointer is now used when assigning ACPI companions to xHCI ports and USB devices. Assigning the ACPI companion previously could replace the ...
CVE-2022-49535
CVE-2022-49535 affects the Linux kernel SCSI lpfc path. The flaw can cause a use-after-free via premature node release when FLOGI/PLOGI handling fails or when non-zero ELS PLOGI status is processed if a dev-loss-evt work is pending. The described root cause is a premature decrementing of the ndlp...
CVE-2022-49860
CVE-2022-49860 : The provided connected documents describe a Linux kernel vulnerability in the dmaengine: ti: k3-udma-glue subsystem, where a memory leak could occur if device_register() fails. The root cause is that, on failure, the code should call put_device() to release a reference, and the n...
CVE-2023-1194
CVE-2023-1194 detail (Linux kernel KSMBD parse_lease_state) Affected component: Linux kernel with KSMBD in-kernel Samba/CIFS. Root cause: missing validation of NameOffset in parse_lease_state() allows a malformed CREATE payload to reach the create_context object, enabling out-of-bounds memory acc...
CVE-2023-20842
CVE-2023-20842 affects MediaTek devices via the core component described as /imgs y s_cmdq/ . The vulnerability is an out-of-bounds write caused by missing valid range checking in imgsys_cmdq, which can enable local privilege escalation with System execution privileges after user interaction. No ...
CVE-2023-53089
CVE-2023-53089 affects the Linux kernel ext4/xattr path. The issue occurs during eviction of inodes with extended attributes (EA) where ext4_xattr_delete_inode triggers a hang due to finding an EA inode (ea_inum = 15) that is in I_FREEING state and waiting for the EA inode’s deletion, causing an ...
CVE-2024-26694
CVE-2024-26694 affects the Linux kernel wifi iwlwifi driver. The vulnerability arises from improper handling of TLV PC register data: the data storage in drv->fw area is freed without clearing the pointer, risking a double-free if a subsequent free occurs (e.g., when a file load fails after pa...
CVE-2024-26783
CVE-2024-26783 is a Linux kernel issue where, under NUMA balancing, wakeup_kswapd() could be invoked with an invalid zone index (-1) causing a page fault oops. The fix adds an index check before wakeup_kswapd() in mm/vmscan.c (resolved in the Linux kernel commit cited in the vulnerability descrip...
CVE-2024-26822
CVE-2024-26822 relates to the Linux kernel SMB client handling of multiuser automounts. The issue occurs when uid, gid and cruid are not provided; the filesystem context used for automounts may reuse values from the parent mount, leading to incorrect ownership/context. The available connected doc...
CVE-2024-27435
CVE-2024-27435 refers to a Linux kernel issue where NVMe over RDMA reconnection could fail forever due to an ABBA deadlock caused by reserved tag allocation in the admin queue. The root cause was a single reserved tag held by a keep-alive operation, which blocked a required tag for the connect co...
CVE-2024-35992
CVE-2024-35992 : Linux kernel vulnerability in marvell a3700-comphy driver exposes an out-of-bounds read of gbe_phy_init_fix[fix_idx].addr; after fix_idx reaches ARRAY_SIZE(gbe_phy_init_fix), an iteration may read beyond, unless gbe_phy_init[addr] is used when all elements of gbe_phy_init_fix are...
CVE-2024-38578
The CVE-2024-38578 issue is a Linux kernel vulnerability in ecryptfs: the buffer for the TAG 66 packet was 3 bytes too small, causing a potential write past the end (KASAN slab-out-of-bounds). The fix increases the allocation size to ensure the entire packet fits, addressing the bug described in ...
CVE-2024-39495
The CVE-2024-39495 issue is a Linux kernel use-after-free in greybus gb_interface_release caused by a race with gb_interface_mode_switch_work. The fix, confirmed by multiple sources (e.g., Astra Linux advisory reflecting the same description), is to cancel the scheduled work before freeing the ob...
CVE-2024-40932
CVE-2024-40932 affects the Linux kernel DRM Exynos VIDI driver. The issue is a memory leak in .get_modes() where a duplicated EDID is never freed, leading to potential memory exhaustion. The provided connected advisories confirm the root cause and the fix: a memory leak in drm/exynos/vidi: get_mo...
CVE-2024-40990
CVE-2024-40990 relates to the Linux kernel RDMA mlx5 subsystem where the srq max_sge attribute, provided by the user, was inserted/used without proper validation. The issue is resolved by adding a check to ensure max_sge does not exceed the maximum allowed before use. Affects the mlx5 SRQ handlin...