CVE-2017-17806

CVE-2017-17806 affects the Linux kernel before 4.14.8. The HMAC implementation (crypto/hmac.c) does not validate that the underlying hash algorithm is unkeyed, allowing a local attacker who can use the AF_ALG-based hash interface (CONFIG_CRYPTO_USER_API_HASH) and SHA-3 (CONFIG_CRYPTO_SHA3) to tri...

CVE-2019-19536

CVE-2019-19536 is an info-leak vulnerability in the Linux kernel (<5.2.9) caused by a faulty handling of a malicious USB device in drivers/net/can/usb/peak_usb/pcan_usb_pro.c (CID-ead16e53c2f0). Some public advisories (Unity Linux UTSA-2026-*) reference this CVE and note the issue affects kern...

CVE-2023-1582

CVE-2023-1582 is described in connected documents as a race condition in the Linux kernel's fs/proc/task_mmu.c under the memory management component. It may allow a local privileged user to cause a denial of service. The MiracleLinux advisory block lists the vulnerability and confirms the race co...

CVE-2023-52664

The CVE-2023-52664 issue affects the Linux kernel net: Atlantic driver, where a logic error in ring data allocation/free can lead to a double-free scenario in error handling if memory allocation fails. The root cause is using the ring pointer as a failure indicator, while only ring data is alloca...

CVE-2024-42078

The CVE-2024-42078 issue affects the Linux kernel’s NFS server (nfsd) where nfsd_info.mutex could be dereferenced after a new network namespace is created, potentially causing an oops. The fix, as described in the connected advisories, is to initialize nfsd_info.mutex earlier, before it can be de...

CVE-2024-53194

CVE-2024-53194 is a Linux kernel use-after-free vulnerability in PCI hot‑remove handling. A pci_slot may reference the underlying pci_bus after the bus has been destroyed if pciehp is unbound in the wrong order, causing a use-after-free when slot->bus is accessed. The root cause is missing a r...

CVE-2016-5829

CVE-2016-5829 is a Linux kernel vulnerability in the hiddev driver (hiddev_ioctl_usage in drivers/hid/usbhid/hiddev.c) that allows a local user to trigger heap-based buffer overflows by sending crafted ioctls (HIDIOCGUSAGES or HIDIOCSUSAGES). Affected kernels are up to 4.6.3 (through 4.6.3). The ...

CVE-2017-2618

CVE-2017-2618 is a Linux kernel local vulnerability caused by how SELinux attributes are cleared on /proc/pid/attr. An empty write to that file can crash the system by triggering access to unmapped kernel memory. The connected Nessus entries (Unity Linux, MiracleLinux AXSA advisory, and related p...

CVE-2018-7492

The CVE-2018-7492 entry affects the Linux kernel prior to 4.14.7, where a NULL pointer dereference in net/rds/rdma.c __rds_rdma_map() can be triggered by local attackers via RDS_GET_MR / RDS_GET_MR_FOR_DEST. This leads to a system panic and denial-of-service. Affected versions are exposed to loca...

CVE-2021-20320

CVE-2021-20320 : A flaw in the Linux kernel, specifically in s390 eBPF JIT (bpf_jit_insn in arch/s390/net/bpf_jit_comp.c). The vulnerability could let a local attacker with restricted privileges bypass the verifier and cause a confidentiality impact. Connected advisories (Unity Linux UTSA-2026-00...

CVE-2023-1249

CVE-2023-1249: A use-after-free in the Linux kernel core dump subsystem could allow a local user to crash the system; this requires patch 390031c94211 to be applied to be affected. Technical details are not publicly provided in the supplied documents. Monitor for updates.

CVE-2023-52597

CVE-2023-52597 affects the Linux kernel KVM for s390. The vulnerability arises in kvm_arch_vcpu_ioctl_set_fpu(), which can set the FLOATING-POINT CONTROL (FPC) register of a guest and, due to a test of validity, may corrupt the host process’s fpc if an interrupt occurs during the test. The patch ...

CVE-2021-45402

CVE-2021-45402 affects the Linux kernel where check_alu_op() in kernel/bpf/verifier.c does not update bounds properly when handling mov32, enabling local attackers to leak potentially sensitive addresses (pointer leak). The description is consistently cited across multiple connected advisories (e...

CVE-2024-56602

CVE-2024-56602 is confirmed by connected advisories as a Linux kernel issue in net: ieee802154: do not leave a dangling sk pointer in ieee802154_create(), where sock_init_data() attaches a sk to sock and on error the sk remains dangling, allowing use-after-free. The Astra Linux bulletin lists aff...

CVE-2024-35995

CVE-2024-35995 describes a Linux kernel issue where the ACPI CPPC code misread system memory by relying on bit_width, risking incorrect memory access. The fix switches to using access_width for size calculation and reads/writes using an offset and width, with a fallback to bit_width if access_wid...

CVE-2021-20261

CVE-2021-20261 is a local race-condition vulnerability in the Linux kernel floppy disk drive controller (fd0) driver. The issue’s impact is mitigated by default file permissions on /dev/fd0 being root-only; changes to device permissions can greatly increase risk. The initial description notes a l...

CVE-2021-3923

CVE-2021-3923 describes a local information-leak in the Linux kernel RDMA over InfiniBand path. A privileged local attacker can leak kernel stack data when issuing commands to /dev/infiniband/rdma_cm, with the impact noting potential to defeat kernel protections. Remediation/fixes are not detaile...

CVE-2024-42301

CVE-2024-42301 affects the Linux kernel’s dev/parport component, where an array out-of-bounds risk was introduced. The vulnerability was addressed by replacing unsafe data copying (sprintf) with snprintf to prevent buffer overflow. The initial report includes a kernel stack and Do_Hardware_Base_A...

CVE-2024-43904

CVE-2024-43904 is a Linux kernel issue affecting the AMD display pipeline. The vulnerability stemmed from missing null checks in drm/amd/display code, where the variables stream and plane could be dereferenced without verifying non-null values in dcn30_apply_idle_power_optimizations, risking a nu...

CVE-2024-53146

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent a potential integer overflow If the tag length is >= U32_MAX - 3 then the "length + 4" additioncan result in an integer overflow. Address this by splitting thedecoding into several steps so that decode_cb_compoun...

CVE-2010-4258

The CVE-2010-4258 issue affects the Linux kernel versions prior to 2.6.36.2. The do_exit function in kernel/exit.c mishandles a KERNEL_DS get_fs value, bypassing access_ok checks and enabling local privilege escalation by overwriting arbitrary kernel memory. Exploitation vectors include use of th...

CVE-2014-9940

CVE-2014-9940 affects the Linux kernel regulator_ena_gpio_free function in drivers/regulator/core.c, with exploitation possible through local access to gain privileges or cause a denial of service via a use-after-free. Affected condition is kernel versions before 3.19. Impact per sources is high ...

CVE-2019-20806

CVE-2019-20806 affects the Linux kernel up to version 5.1 (i.e., before 5.2). The issue is a NULL pointer dereference in tw5864_handle_frame() (drivers/media/pci/tw5864/tw5864-video.c) that can lead to denial of service. The connected Nessus advisories reiterate the same root cause and state affe...

CVE-2024-35946

CVE-2024-35946 affects the Linux kernel’s wifi rt89 (rtw89) driver, where a null pointer dereference could occur during abort/cancel of a scan because the code might reference a vif that wasn’t scanning. The public description and connected advisories confirm the issue and cite resolving it by en...

CVE-2024-42265

CVE-2024-42265 pertains to the Linux kernel and was resolved by protecting the fetch of ->fd[fd] in do_dup2() from mispredictions. The issue arose when a mispredicted path could cause tofree = fdt->fd[fd] to be speculatively executed, which is incorrect for bounds reasons. The documented fi...

CVE-2024-53174

CVE-2024-53174 concerns a Linux kernel SUNRPC use-after-free in the cache path: c_show could dereference a freed cache entry due to RC ul protection when reading via cache_show. The fix uses cache_get_rcu to ensure the cache entry (cp) remains active while accessed, preventing a refcount UAF. Aff...

CVE-2025-21776

CVE-2025-21776 affects the Linux kernel USB hub driver where non‑compliant hubs with more than one config/interface can trigger a crash (usb_hub_to_struct_hub dereference). A fix exists: the driver now refuses hubs violating USB spec (more than one configuration or interface). Connected advisorie...

CVE-2015-5364

The CVE-2015-5364 issue affects the Linux kernel prior to 4.0.6, where udp_recvmsg/udpv6_recvmsg fail to handle processor yielding correctly, enabling remote attackers to trigger a denial of service (system hang) via UDP packet flood with incorrect checksums. Related CVE-2015-5366 also concerns U...

CVE-2017-12193

CVE-2017-12193 affects the Linux kernel: the function assoc_array_insert_into_terminal_node in lib/assoc_array.c mishandles node splitting, leading to a NULL pointer dereference and kernel panic via a crafted application. The vulnerability is in kernels prior to 4.13.11, enabling local attackers ...

CVE-2024-26906

CVE-2024-26906 : In the Linux kernel, x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault(). A bpf program reading the vsyscall page with bpf_probe_read_kernel() can trigger copy_from_kernel_nofault(), which calls __get_user_asm() and may fault because the vsyscall page is not readab...

CVE-2024-39474

CVE-2024-39474 involves a Linux kernel vmalloc regression where __GFP_NOFAIL allocations may return NULL, due to a race with OOM-killer flow and GFP_KERNEL handling. The fix updates vm_area_alloc_pages() to not check fatal_signal_pending() when __GFP_NOFAIL is set, preventing a NULL vmalloc() ret...

CVE-2024-41014

The CVE CVE-2024-41014 affects the Linux kernel (xfs) and is caused by insufficient bounds checking in xlog_recover_process_data, specifically verifying the space for fixed members of xlog_op_header. A crafted XFS image can trigger an out-of-bounds read by altering the xlog_op_header and xlog_rec...

CVE-2023-2007

CVE-2023-2007 affects the DPT I2O Controller driver in the Linux kernel. The issue arises from missing locking during object operations, enabling a local attacker to escalate privileges and execute arbitrary code in kernel context. Public references in Unity Linux (UTSA-2026-004778) and multiple ...

CVE-2023-22998

CVE-2023-22998 affects the Linux kernel prior to 6.0.3. The vulnerability stems from drivers/gpu/drm/virtio/virtgpu_object.c misinterpreting the drm_gem_shmem_get_sg_table return value (treating an error pointer as NULL). This can allow a remote authenticated attacker on the local network to caus...

CVE-2023-35824

CVE-2023-35824 is a Linux kernel use-after-free in the dm1105_remove path (drivers/media/pci/dm1105/dm1105.c), fixed by Linux kernel 6.3.2 (ChangeLog-6.3.2). The Astra Linux bulletin and related sources confirm the same issue affecting kernel before 6.3.2 and cite the same function/file, indicati...

CVE-2024-40997

CVE-2024-40997 involves a Linux kernel vulnerability where a memory leak in the amd-pstate cpufreq path was fixed. The issue was that kzalloc() allocated cpudata during amd_pstate_epp_cpu_init() but could not be freed in the corresponding exit path, leading to a leak on CPU EPP exit. The primary ...

CVE-2024-41064

In the Linux kernel, the following vulnerability has been resolved: powerpc/eeh: avoid possible crash when edev->pdev changes If a PCI device is removed during eeh_pe_report_edev(), edev->pdevwill change and can cause a crash, hold the PCI rescan/remove lockwhile taking a copy of edev->p...

CVE-2024-43899

CVE-2024-43899 affects the Linux kernel’s DRM AMD display path. The vulnerability is a NULL pointer dereference in dcn20_resource.c that can cause a hang when MPV runs on a DCN401 dGPU, specifically during fullscreen playback after enabling fullscreen (double click). Affected component/function c...

CVE-2023-51780

CVE-2023-51780: Linux kernel before 6.6.8 contains a use-after-free in do_vcc_ioctl (net/atm/ioctl.c) caused by a vcc_recvmsg race, enabling local exploitation. Affected: Linux kernel versions prior to 6.6.8. Root cause: race between vcc_recvmsg and do_vcc_ioctl leading to use-after-free. Impact:...

CVE-2024-56623

CVE-2024-56623 : In the Linux kernel, the qla2xxx SCSI driver contains a use-after-free during unload, causing a system crash with a stack trace in SLUB. The root cause is a double-thread termination signal: an UNLOADING flag may race with kthread_stop, leading to use-after-free on cleanup. The f...

CVE-2024-35937

CVE-2024-35937 affects the Linux kernel wifi stack: cfg80211 A-MSDU handling can read data out of bounds if a subframe header appears but is not fully present. The vulnerability root cause is insufficient validation of A-MSDU subframes; the fix tightens checks to ensure a subframe header can actu...

CVE-2024-56595

CVE-2024-56595 concerns the Linux kernel JFS (Journaling File System) code path in dbAdjTree. The issue is an array-index-out-of-bounds that can occur when lp is 0 at the start of a for loop, which may become negative on the next assignment if not bailed out. The available connected documents con...

CVE-2016-4565

CVE-2016-4565 affects the Linux kernel InfiniBand (IB) stack prior to 4.5.3, where certain IB interfaces improperly rely on write() semantics via a uAPI interface. This could allow a local unprivileged user to cause a denial of service (kernel memory write) and potentially other impact/escalation...

CVE-2022-48655

CVE-2022-48655 in the Linux kernel: vulnerability in the SCMI firmware path (arm_scmi) where reset domains descriptors could be accessed by index, risking out-of-bounds due to SCMI driver misbehavior. The root cause is lack of an internal consistency check before domain descriptor accesses. The f...

CVE-2023-28327

CVE-2023-28327 : A NULL pointer dereference in the Linux kernel’s UNIX protocol (net/unix/diag.c, function unix_diag_get_exact) occurs when the newly allocated skb is created without an associated sk, leaving a NULL sk pointer. This can allow a local attacker to crash the kernel or cause a denial...

CVE-2023-52752

CVE-2023-52752 (Linux kernel) is backed by concrete fix details in connected docs: a use-after-free in the SMB/CIFS client code path (cifs_debug_data_proc_show) when reading /proc/fs/cifs/DebugData during mount/umount. The fix adds a check to skip SMB sessions that are tearing down (ses_status ==...

CVE-2024-36288

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix loop termination condition in gss_free_in_token_pages() The in_token->pages[] array is not NULL terminated. This results inthe following KASAN splat: KASAN: maybe wild-memory-access in range [0x04a2013400000008-0x0...

CVE-2015-8543

CVE-2015-8543 affects the Linux kernel networking stack (up to version 4.3.3 as used in Android and others). The issue: the networking implementation does not validate protocol identifiers for certain protocol families, enabling local users to cause a NULL pointer dereference and system crash, wi...

CVE-2018-25020

Summary of CVE-2018-25020 (Linux kernel BPF): The vulnerability is in the BPF subsystem where a long jump over an instruction sequence can cause an overflow. It specifically affects the kernel's BPF implementations in files kernel/bpf/core.c and net/core/filter.c, for Linux kernels prior to 4.17....

CVE-2022-48695

CVE-2022-48695 is a Linux kernel vulnerability in the scsi: mpt3sas driver that results in a use-after-free (refcount_t underflow) observed during controller reset. The issue is fixed in the kernel by the referenced commits listed in the connected sources. The vulnerability is described as a loca...