CVE-2024-36288

CVE-2024-36288 affects the Linux kernel SUNRPC path. The bug is in gss_free_in_token_pages(): the in_token->pages[] array is not NULL-terminated, which can trigger a KASAN memory access issue (wild-memory-access) and, per references, contributes to a high-severity impact. Connected advisories/...

CVE-2024-41014

The CVE CVE-2024-41014 affects the Linux kernel (xfs) and is caused by insufficient bounds checking in xlog_recover_process_data, specifically verifying the space for fixed members of xlog_op_header. A crafted XFS image can trigger an out-of-bounds read by altering the xlog_op_header and xlog_rec...

CVE-2024-50282

The connected Astra Linux entry clarifies CVE-2024-50282 in the Linux kernel: a missing size check in drm/amdgpu_debugfs_gprwave_read() can cause a buffer overflow when size > 4K. The fix (cherry-picked commit f5d873f5825b40d886d03bd2aede91d4cf002434) adds the size check to prevent overflow. N...

CVE-2024-26907

CVE-2024-26907 affects the Linux kernel in the RDMA mlx5 stack. The vulnerability arises from a fortify source warning caused by a field-spanning write to eseg->inline_hdr.start in wr.c (memcpy path) during mlx5_ib_post_send, potentially enabling a local issue if exploited. Affected components...

CVE-2024-40997

CVE-2024-40997 involves a Linux kernel vulnerability where a memory leak in the amd-pstate cpufreq path was fixed. The issue was that kzalloc() allocated cpudata during amd_pstate_epp_cpu_init() but could not be freed in the corresponding exit path, leading to a leak on CPU EPP exit. The primary ...

CVE-2015-3331

CVE-2015-3331 affects the Linux kernel up to 3.19.2, where __driver_rfc4106_decrypt in arch/x86/crypto/aesni-intel_glue.c mishandles memory locations for encrypted data, enabling a context-dependent attacker to trigger a buffer overflow via a crypto API call (e.g., with a libkcapi test program us...

CVE-2018-20511

The CVE-2018-20511 vulnerability affects Linux kernel older than 4.18.11, where ipddp_ioctl in drivers/net/appletalk/ipddp.c allows local users with CAP_NET_ADMIN to read the ipddp_route and next fields via SIOCFINDIPDDPRT, leading to kernel address disclosure (information leakage). Unity/Linux a...

CVE-2021-47432

The Linux kernel is affected by an integer overflow vulnerability in the lib/generic-radix-tree.c file. Specifically, the peek() function (and the __genradix_iter_peek() function in the include/linux/generic-radix-tree.h module) does not properly handle overflows when the system starts assigning ...

CVE-2023-2007

CVE-2023-2007 affects the DPT I2O Controller driver in the Linux kernel. The issue arises from missing locking during object operations, enabling a local attacker to escalate privileges and execute arbitrary code in kernel context. Public references in Unity Linux (UTSA-2026-004778) and multiple ...

CVE-2023-28327

CVE-2023-28327 : A NULL pointer dereference in the Linux kernel’s UNIX protocol (net/unix/diag.c, function unix_diag_get_exact) occurs when the newly allocated skb is created without an associated sk, leaving a NULL sk pointer. This can allow a local attacker to crash the kernel or cause a denial...

CVE-2024-27062

CVE-2024-27062 : In the Linux kernel, the nouveau module (nvkm) has a race condition due to missing locking around the client object tree when adding/removing client objects (notably VRAM bar mappings). This can trigger a general protection fault as vulnerabilities are exercised via nvkm_object_s...

CVE-2024-41060

CVE-2024-41060 is a Linux kernel security issue in the DRM Radeon driver. The root cause is a dereference of bo_va->bo that may be cleared by radeon_vm_clear_freed. The patch adds a NULL check to ensure bo_va->bo is non-NULL before use, preventing a potential NULL dereference crash. The des...

CVE-2024-42237

CVE-2024-42237 - Linux kernel cs_dsp payload length validation Affects: Linux kernel firmware cs_dsp loading paths (cs_dsp_load and cs_dsp_coeff_load).Cause: The block payload length could be used before validating the length, potentially enabling out-of-bounds processing.Fix: Move and perform th...

CVE-2024-43905

CVE-2024-43905 affects the Linux kernel component drm/amd/pm specifically the vega10_hwmgr . The root cause was a potential null pointer dereference arising from insufficient null-check handling. The published fix adds validation of return values and proper null-pointer handling to prevent derefe...

CVE-2024-57798

CVE-2024-57798 affects the Linux kernel drm_dp_mst handling of MST up requests. If another thread removes MST topology during processing, mst_primary could be freed and set to NULL, risking a NULL pointer dereference in drm_dp_mst_handle_up_req(). The fix is to hold a reference to mst_primary whi...

CVE-2025-21969

CVE-2025-21969 is a Linux kernel vulnerability in the Bluetooth stack (L2CAP). The issue is a slab-use-after-free in l2cap_send_cmd when the hci sync path releases l2cap_conn but a worker still references it. The root cause is a race between the hci receive data work queue and the l2cap_conn life...

CVE-2021-20261

CVE-2021-20261 is a local race-condition vulnerability in the Linux kernel floppy disk drive controller (fd0) driver. The issue’s impact is mitigated by default file permissions on /dev/fd0 being root-only; changes to device permissions can greatly increase risk. The initial description notes a l...

CVE-2021-3923

CVE-2021-3923 describes a local information-leak in the Linux kernel RDMA over InfiniBand path. A privileged local attacker can leak kernel stack data when issuing commands to /dev/infiniband/rdma_cm, with the impact noting potential to defeat kernel protections. Remediation/fixes are not detaile...

CVE-2024-35805

CVE-2024-35805 affects the Linux kernel in the dm snapshot code path. The issue was a lockup when exiting a snapshot with many exceptions, resolved by adding a cond_resched in the loop that frees the exceptions in dm_exception_table_exit. The root cause is a lockup during exit of large dm-snapsho...

CVE-2024-42082

CVE-2024-42082 is a Linux kernel vulnerability where a syzkaller-triggered WARN was introduced in __xdp_reg_mem_model() when __mem_id_init_hash_table() failed. The issue arose only from memory allocation failure; a static const rhashtable_params prevented rhashtable_init() misconfiguration. The w...

CVE-2024-50014

CVE-2024-50014 – Linux kernel ext4 replay path issue Affects: Linux kernel ext4 on systems using fast-commit enabled filesystems (replay path). Affected code path is ext4_fc_replay during journal replay; the replay path attempts to lock sbi->s_bdev_wb_lock before it has been initialized. Root ...

CVE-2015-5364

The CVE-2015-5364 issue affects the Linux kernel prior to 4.0.6, where udp_recvmsg/udpv6_recvmsg fail to handle processor yielding correctly, enabling remote attackers to trigger a denial of service (system hang) via UDP packet flood with incorrect checksums. Related CVE-2015-5366 also concerns U...

CVE-2016-10044

CVE-2016-10044 is supported by connected advisories: the Linux kernel up to version 4.7.7 contains a vulnerability in the aio_mount path. Specifically, the aio_mount function in fs/aio.c did not properly restrict execute access, enabling local users to bypass SELinux W^X policy and gain privilege...

CVE-2019-19531

CVE-2019-19531 affects the Linux kernel prior to 5.2.9. The issue is a use-after-free triggered by a malicious USB device in the drivers/usb/misc/yurex.c component (CID-fc05481b2fca). Exploitation would occur locally (physical access) via crafted USB input, with the kernel potentially resolving t...

CVE-2022-48695

CVE-2022-48695 is a Linux kernel vulnerability in the scsi: mpt3sas driver that results in a use-after-free (refcount_t underflow) observed during controller reset. The issue is fixed in the kernel by the referenced commits listed in the connected sources. The vulnerability is described as a loca...

CVE-2023-22998

CVE-2023-22998 affects the Linux kernel prior to 6.0.3. The vulnerability stems from drivers/gpu/drm/virtio/virtgpu_object.c misinterpreting the drm_gem_shmem_get_sg_table return value (treating an error pointer as NULL). This can allow a remote authenticated attacker on the local network to caus...

CVE-2023-52831

CVE-2023-52831 (Linux kernel) : The issue resides in cpu/hotplug logic when CPUs are isolated with isolcpus=. Offline-ing the last non-isolated (housekeeping) CPU can cause a WARN_ON in build_sched_domains and a subsequent panic due to an empty CPU mask in partition_sched_domains_locked(), leadin...

CVE-2024-26686

CVE-2024-26686 refers to a Linux kernel issue where lock_task_sighand could trigger a hard lockup if NR_CPUS threads execute do_task_stat concurrently while a process has NR_THREADS. The fix changes do_task_stat() to gather thread/child statistics using sig->stats_lock outside the sighand lock...

CVE-2024-35925

The CVE-2024-35925 issue concerns the Linux kernel blk_rq_stat_sum() path. The root cause is a potential division by zero when computing stats, caused by the expression dst->nr_samples + src->nr_samples reaching zero due to overflow. Multiple connected advisories (Unity Linux security updat...

CVE-2024-49960

CVE-2024-49960 concerns ext4 on the Linux kernel. The issue is a timer use-after-free during failed mounts: the s_err_report timer can remain active while sbi is freed, because ext4_handle_error re-arms the timer before kfree(sbi). The root cause is not canceling the s_err_report timer after ext4...

CVE-2010-4258

The CVE-2010-4258 issue affects the Linux kernel versions prior to 2.6.36.2. The do_exit function in kernel/exit.c mishandles a KERNEL_DS get_fs value, bypassing access_ok checks and enabling local privilege escalation by overwriting arbitrary kernel memory. Exploitation vectors include use of th...

CVE-2022-48655

CVE-2022-48655 in the Linux kernel: vulnerability in the SCMI firmware path (arm_scmi) where reset domains descriptors could be accessed by index, risking out-of-bounds due to SCMI driver misbehavior. The root cause is lack of an internal consistency check before domain descriptor accesses. The f...

CVE-2023-34324

The CVE describes a deadlock in Linux kernel Xen event channel handling when a close operation is performed in parallel with a Xen console action/interrupt in an unprivileged Xen guest. The issue occurs during removal of a paravirtual device or similar event-channel close, with 32-bit Arm guests ...

CVE-2024-42225

CVE-2024-42225 : Linux kernel WiFi mt76 vulnerability due to reusing uninitialized data in the MT76 path; root cause is use of uninitialized skb data. A remote attacker could execute arbitrary code. A fix replaces skb_put with skb_put_zero in wifi: mt76, and patches are available in the cited ker...

CVE-2024-46743

CVE-2024-46743 affects the Linux kernel’s interrupt/IRQ handling in the of_irq_parse_raw path. When a device address is smaller than the interrupt parent node (involving #address-cells), KASAN detects a slab-out-of-bounds read while populating the initial match table during interrupt map walk. Th...

CVE-2024-49994

CVE-2024-49994 : A Linux kernel vulnerability in the block layer (BLKSECDISCARD) is resolved. The flaw arises from an integer overflow in the discard path, causing a near-infinite loop inside blkdev_issue_secure_erase() when a crafted 64-bit range (e.g., r = {512, 18446744073709551104}) is passed...

CVE-2014-9322

CVE-2014-9322 affects the Linux kernel pre-3.17.5 where arch/x86/kernel/entry_64.S mishandles faults on the Stack Segment (SS) during IRET, allowing a local user to escalate privileges by accessing a GS Base address from the wrong space. Public PoC/exploitation (BadIRET) exists, illustrating loca...

CVE-2023-35824

CVE-2023-35824 is a Linux kernel use-after-free in the dm1105_remove path (drivers/media/pci/dm1105/dm1105.c), fixed by Linux kernel 6.3.2 (ChangeLog-6.3.2). The Astra Linux bulletin and related sources confirm the same issue affecting kernel before 6.3.2 and cite the same function/file, indicati...

CVE-2024-47668

CVE-2024-47668 concerns the Linux kernel’s lib/generic-radix-tree.c, where a rare race in __genradix_ptr_alloc() can occur when the tree depth is increased. If a second thread increases the depth first, a preallocated node may be retained and later used, leaving it with a pointer to the old root ...

CVE-2024-49962

CVE-2024-49962 : In the Linux kernel, ACPICA toolchain fix guards against NULL returns from ACPI_ALLOCATE_ZEROED() in acpi_db_convert_to_package(). If ACPI_ALLOCATE_ZEROED() fails, elements may be NULL, leading to a NULL pointer dereference. The linked Astra/IBM bulletins reference the same root ...

CVE-2024-56759

CVE-2024-56759 concerns the Linux kernel: when Btrfs COWs a tree block with tracing enabled (trace_btrfs_cow_block) and preemption is on, a use-after-free can occur on the COWed extent buffer. The root cause is that tracepoint handling could observe a buffer after it is freed via RCUs, if preempt...

CVE-2018-6555

CVE-2018-6555 is a Linux kernel local use-after-free via the irda_setsockopt path in irda/af_irda.c (and later in staging/irda), potentially causing memory corruption, denial of service, or a system crash. Affected trees reference IRDA socket usage as the attack vector. The vulnerability is addre...

CVE-2023-52607

In the Linux kernel, the following vulnerability has been resolved: powerpc/mm: Fix null-pointer dereference in pgtable_cache_add kasprintf() returns a pointer to dynamically allocated memorywhich can be NULL upon failure. Ensure the allocation was successfulby checking the pointer validity.

CVE-2024-35864

CVE-2024-35864 is a Linux kernel SMB client issue. The root cause is a use-after-free in smb2_is_valid_lease_break() that can occur while handling SMB2 lease breaks, with sessions in SES_EXITING state skipped to avoid UAF. The vulnerability is linked to local attack vectors and a highImpact scena...

CVE-2024-40972

CVE-2024-40972 : In the Linux kernel, the ext4_xattr_set_entry() path creates new EA inodes while holding the external xattr block’s buffer lock, nesting allocation locks and risking deadlock. The fix moves EA inode allocation out of ext4_xattr_set_entry() to the callers, preventing lock nesting....

CVE-2024-42228

CVE-2024-42228 : Linux kernel vulnerability involving the AMDGPU driver. The issue arises from using an uninitialized value (*size) when calling amdgpu_vce_cs_reloc, which can lead to arbitrary code execution or denial of service via a crafted relocation path. The fix initializes the size prior t...

CVE-2024-49859

The CVE-2024-49859 entry concerns the Linux kernel file system f2fs. The vulnerability arises from ioctl interfaces (notably f2fs_ioc_set_pin_file(), f2fs_move_file_range(), and f2fs_defragment_range()) failing to consistently check the atomic_write status, which may enable a race condition. The ...

CVE-2024-56757

CVE-2024-56757 affects the Linux kernel btusb Mediatek driver; root cause is not releasing the special USB ISO data interface before unregistering the HCI device on USB disconnect, risking kernel panic. A fix has been implemented in the kernel (references to commits in stable trees); impact is lo...

CVE-2021-4090

CVE-2021-4090 : A Linux kernel NFSD out-of-bounds write in nfsd4_decode_bitmap4 (fs/nfsd/nfs4xdr.c) can be triggered by a missing sanity check, allowing a local privileged user to access out-of-bounds memory and threaten system integrity and confidentiality. Multiple connected sources confirm the...

CVE-2021-47378

CVE-2021-47378 affects the Linux kernel nvme-rdma code: destroying cm_id before destroying the qp can cause a use-after-free in RDMA error flow. The fix documented in multiple sources is to always destroy cm_id before destroying the qp, with qp subsequently destroyed in nvme_rdma_alloc_queue() af...