CVE-2019-14763

CVE-2019-14763 affects the Linux kernel prior to 4.16.4, where a double-locking error in drivers/usb/dwc3/gadget.c may deadlock with f_hid. Exploitation context from connected Nessus advisories links CVE-2019-14763 to kernel fixes (4.16.4) and security advisories (e.g., USN/EulerOS entries). The ...

CVE-2021-47386

The Linux kernel contains a NULL pointer dereference vulnerability in the hwmon (w83791d) driver. The issue occurs when the driver reads a specific value from the device that satisfies the condition (val & 0x08) && (!(val & 0x80)) && ((val & 0x7) == ((val >> 4) & 0x7)), potentially when tmp...

CVE-2022-3107

CVE-2022-3107 affects the Linux kernel (up to 5.16-rc6) and is triggered in the netvsc driver (drivers/net/hyperv/netvsc_drv.c) where netvsc_get_ethtool_stats does not properly check the return value of kvmalloc_array(), leading to a NULL pointer dereference. The connected TencentOS/TSSA advisory...

CVE-2024-26646

CVE-2024-26646 pertains to the Linux kernel’s thermal: intel: hfi subsystem. The vulnerability arises due to how the kernel manages memory buffers used by HFI during boot and resume flows. A second buffer may be allocated by the restore kernel on resume, which can differ from the image kernel’s b...

CVE-2024-35934

The CVE-2024-35934 issue affects the Linux kernel net/smc subsystem. Affected component: smc_pnet-related code in net/smc (pnet IDs list creation). Root cause: excessive RTNL (rtnl) lock pressure during net namespace/pnet initialization, caused by smc_pnet_create_pnetids_list() acquiring rtnl in ...

CVE-2024-36950

CVE-2024-36950 is a Linux kernel vulnerability resolved in the FireWire OHCI driver. The issue occurred in the interrupt handler when a bus reset interrupt could be unmasked and cause a freeze if the bus reset was not yet serviced. The fix masks bus reset interrupts in the IRQ handler and unmasks...

CVE-2024-41005

CVE-2024-41005 involves a race in the Linux kernel netpoll code. The issue stems from netpoll_owner_active reading napi->poll_owner non-atomically to determine lock ownership, allowing a data race between net_rx_action and netpoll_send_skb. The fix replaces the non-atomic check with an atomic ...

CVE-2024-41063

In CVE-2024-41063, the Linux kernel Bluetooth stack (hci_core) fixes a deadlock when unregistering a device. The root cause involves hci_unregister_dev() racing with hci_error_reset() and hdev->req_workqueue/destroy_workqueue(), where pending work items may still be running during destroy. The...

CVE-2024-41065

The CVE-2024-41065 issue is in the Linux kernel’s powerpc/pseries code related to usercopy hardening. When CONFIG_HARDENED_USERCOPY is enabled, reading the dispatch log from /sys/kernel/debug/powerpc/dtl/cpu-* could trigger a kernel BUG in usercopy (mm/usercopy.c). The root cause involves copying...

CVE-2024-46724

CVE-2024-46724 is a Linux kernel vulnerability in drm/amdgpu where an out-of-bounds read of df_v1_7_channel_number could occur. The issue stems from not validating fb_channel_number range, leading to an array read error. A patch/mitigation has been applied in upstream kernel releases, and several...

CVE-2024-47141

CVE-2024-47141 affects the Linux kernel pinctrl/pinmux path. When two processes (A and B) concurrently call pinctrl_select_state() for the same pin, the code may dereference desc->mux_owner as NULL due to a race between updates to desc->mux_usecount and desc->mux_owner. The advisory stat...

CVE-2024-49889

CVE-2024-49889: Linux kernel ext4 uses-after-free in ext4_ext_show_leaf() and related ext4 extents handling. The issue arises when EXT_DEBUG is defined and a saved path pointer may be freed during extent handling, leading to use-after-free in ext4_ext_show_leaf() or during ext4_ext_handle unwritt...

CVE-2024-49929

CVE-2024-49929 affects the Linux kernel wifi: iwlwifi (MVM) code. The vulnerability stems from iwl_mvm_sta_from_mac80211 potentially dereferencing a NULL ieee80211_sta when sta is NULL, leading to a NULL pointer dereference in iwl_mvm_tx_skb_sta() and iwl_mvm_tx_mpdu(). The fix is to validate the...

CVE-2024-49934

CVE-2024-49934 concerns the Linux kernel vulnerability in the fs/inode path where dump_mapping() could access invalid dentry.d_name.name, potentially causing a crash during hot-remove of a memory device (e.g., hugetlb). The connected documents describe the root cause as unsafe filename retrieval ...

CVE-2024-49938

Linux kernel CVE-2024-49938 affects the ath9k_htc wifi driver. The issue arises from skb_trim() being used on an uninitialised skb length in error paths, leading to an invalid urb reset before resubmission. The patch switches to __skb_set_length(skb, 0) (which already calls skb_reset_tail_pointer...

CVE-2017-11473

CVE-2017-11473 describes a buffer overflow in the Linux kernel, specifically in arch/x86/kernel/acpi/boot.c::mp_override_legacy_irq(), up to version 3.2. An attacker with local access can escalate privileges by presenting a crafted ACPI table. Exploitation is local and does not require user inter...

CVE-2020-27194

CVE-2020-27194 affects the Linux kernel prior to 5.8.15. The issue is in the eBPF verifier: scalar32_min_max_or() incorrectly copies a 64‑bit value into a 32‑bit variable, causing integer truncation and incorrect bounds tracking. This misalignment between verifier time checks and actual execution...

CVE-2022-49323

CVE-2022-49323 affects the Linux kernel IOMMU ARM-SMMU code. The issue is a possible null pointer dereference in arm_smmu_device_probe() when resource retrieval returns NULL, which could occur when using the resource pointer before it is validated. The fix rearranges resource handling by deferrin...

CVE-2024-26903

CVE-2024-26903 (Linux kernel) : Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security. Root cause: after RFCOMM/L2CAP disconnect, the code could dereference a released l2cap_conn, leading to a null pointer access when calling hci_conn_security. Impact per CVSS: Medium (5.5) with high ava...

CVE-2024-36922

CVE-2024-36922 affects the Linux kernel’s iwlwifi driver (iwl_txq_reclaim) where txq->read_ptr could be read without holding the lock, allowing a race that can reclaim the same entry twice and trigger a WARN_ONCE, potentially causing a service disruption. The issue is fixed by reading txq->...

CVE-2024-40988

CVE-2024-40988 affects the Linux kernel DRM/Radeon driver. The issue is a UBSAN warning caused by a missing bounds check in kv_dpm.c (sumo_vid_mapping_entry). The patch adds the necessary bounds check, resolving the UBSAN warning. The description indicates the change is a bounds validation fix ra...

CVE-2024-43882

CVE-2024-43882 is a Linux kernel race Condition (ToCToU) in exec path: permission checks for a file are done at do_filp_open(), but the metadata (mode/UID/GID) used later in execve() can be changed before execution, enabling potential root privilege escalation. The issue is exploitable in scenari...

CVE-2018-18386

The CVE-2018-18386 issue affects the Linux kernel up to version 4.14.10, in drivers/tty/n_tty.c, where an EXTPROC vs ICANON confusion in TIOCINQ allows local attackers with access to pseudo terminals to hang or block further use of any PTY. The root cause is a terminal/TTY handling inconsistency,...

CVE-2023-52811

The Linux kernel contains a vulnerability in the scsi: ibmvfc driver. The issue stems from a historical BUG_ON flag in the ibmvfc_get_event() function which was triggered when an event pool was empty. If the kernel was not configured to crash on panic, this would return a junk event pointer, lead...

CVE-2024-35843

The CVE concerns the Linux kernel IOMMU VT-d path for I/O page fault reporting. The fix replaces pci_get_domain_bus_and_slot() with device_rbtree_find() to locate the target PCI device within the probed device rbtree, reducing search overhead. The I/O page fault is initiated by the device and cur...

CVE-2024-35870

CVE-2024-35870: In the Linux kernel, smb2_reconnect_server() can UAF a session being torn down by another thread, leading to a crash (general protection fault) when a session is in an inconsistent state. The root cause is a race where a session could be accessed after __cifs_put_smb_ses() begins ...

CVE-2024-41093

CVE-2024-41093 – Linux kernel drm/amdgpu null framebuffer object fix : The vulnerability arises in the kernel’s DRM/amdgpu path where code could dereference a null framebuffer object when accessing state->fb->obj[0]. The patch changes the access to obtain the framebuffer object via drm_gem_...

CVE-2024-46722

CVE-2024-46722 is a Linux kernel vulnerability affecting the DRM AMDGPU driver where a read of mc_data[i-1] could go out of bounds. The connected Astra/DEBIAN/CBLMARINER advisories reference the same issue in the kernel and confirm a fix was applied in the AMDGPU/mc_data path to address the out-o...

CVE-2024-47660

CVE-2024-47660 : Linux kernel fsnotify race causing lock contention. When removing watches on a directory with many dentries, __fsnotify_update_child_dentry_flags() races with __fsnotify_parent() on children, risking softlockup reports. The fix, per the bulletin, is to set PARENT_WATCHED only whe...

CVE-2024-50006

CVE-2024-50006 (Linux kernel): Affects ext4 with an i_data_sem unlock order issue during ext4_ind_migrate() causing a potential deadlock in jbd2_log_wait_commit when EXT4_IOC_MIGRATE is used with O_SYNC. The deadlock occurs if EXT4_IOC_MIGRATE races with write(2) and CONFIG_PROVE_LOCKING is enabl...

CVE-2025-21821

CVE-2025-21821 affects the Linux kernel; specifically the fbdev/omap framebuffer code. The issue arises when using touchscreen with framebuffer, causing a crash (scheduling while atomic) in the driver path related to LCD DMA. The provided advisory notes the root cause is tied to IRQ handling for ...

CVE-2016-10741

CVE-2016-10741 – Linux kernel local DoS (xfs_aops race) Affected: Linux kernel before 4.9.3. Issue: a race between direct I/O and memory-mapped I/O (hole handling) in fs/xfs/xfs_aops.c is incorrectly handled with BUG_ON, leading to a system crash under local access. Impact: denial of service via ...

CVE-2023-52834

CVE-2023-52834: Linux kernel DMA RX overflow issue in atl1c/alx drivers resolved. Root cause: RX overflow caused by problematic skb handling; fix replaces custom allocator with address check and skb_reserve() to steer away from 0x…fc0 addresses. A simpler workaround implemented for the alx driver...

CVE-2023-52920

CVE-2023-52920 concerns the Linux kernel BPF verifier: it fixes a defect that allowed spill/fill of non-r10 registers to stack to be tracked in precision mode. The change introduces per-instruction flags (spi and stack frame info) into the history and uses the instruction history for reliable bac...

CVE-2024-43900

CVE-2024-43900 affects the Linux kernel’s media: xc2028 path. A worker thread can dereference a freed dvb_frontend object after tuner_probe() allocates a tuner and module removal frees the dvb_frontend, leading to a use-after-free in load_firmware_cb() triggered by request_firmware_work_func. The...

CVE-2024-56775

CVE-2024-56775 concerns the Linux kernel DRM/AMD display stack. The issue is in the plane state backup/restore flow where the plane refcount is not preserved, risking memory leaks if the refcount should decrease or double frees/invalid memory accesses if it should increase during state transition...

CVE-2021-3411

CVE-2021-3411 describes a memory access violation in the Linux kernel prior to 5.10, caused by a padding int3 check during linking. The flaw can affect data confidentiality, integrity, and system availability. A Nessus Unity Linux advisory references this vulnerability (UTSA-2026-004638) and reit...

CVE-2022-49492

The CVE-2022-49492 issue affects the Linux kernel nvme-pci path. In nvme_alloc_admin_tags, admin_q can be set to an error (e.g., -ENOMEM) and, after returning, the flow may quiesce a non-existent admin queue, leading to a bad NULL pointer dereference. The vulnerability is a local issue with HIGH ...

CVE-2022-49707

CVE-2022-49707 concerns a Linux kernel ext4 resize bug where a NULL pointer dereference could occur when resizing a corrupted ext4 image with resize_inode previously cleared. The root cause is that during ext4_resize_fs() transitioning to meta_bg mode, es->s_reserved_gdt_blocks was not reduced...

CVE-2023-52819

The Linux kernel contains an array-index-out-of-bounds vulnerability in the drm/amd component, specifically affecting Polaris and Tonga hardware. The root cause is the improper use of structures for pptable that utilize flexible array sizes; the fix involves correctly using flexible arrays. This ...

CVE-2024-40977

CVE-2024-40977 is described in connected MiracleLinux advisory as a Linux kernel fix for the wifi: mt76: mt7921s: fix potential hung tasks during chip recovery. The root cause is a deadlock during chip recovery where kernel worker reset_work waits for stat_worker which itself waits for the same l...

CVE-2024-47670

This CVE (CVE-2024-47670) affects the Linux kernel OCFS2 subsystem. The vulnerability arises from insufficient bounds checking in ocfs2_xattr_find_entry(), allowing potential out-of-bounds memory access while scanning for a match in OCFS2 extended attributes. The advisory states that a paranoia c...

CVE-2024-49987

The CVE-2024-49987 issue affects the Linux kernel bpftool component. When netfilter has no entry to display, qsort is called with a NULL pointer and size 0, triggering undefined behavior as UBSan reports. The root cause is a NULL pointer passed to qsort; the advisory notes that the C standard gui...

CVE-2024-53099

CVE-2024-53099 refers to a Linux kernel vulnerability in BPF: it checks the validity of link->type in bpf_link_show_fdinfo(), preventing out-of-bounds access when a new link type is added but not invoked via BPF_LINK_TYPE(). Affected: Linux kernel releases prior to the patched version; multipl...

CVE-2024-56599

CVE-2024-56599 records a Linux kernel vulnerability in the wifi/ath10k SDIO path where rmmod ath10k could panic if CONFIG_INIT_ON_FREE_DEFAULT_ON is enabled. The root cause is a NULL-pointer path involving destroying the sdio workqueue before ath10k_core_destroy frees the wiphy/cfg80211 device, l...

CVE-2014-9529

CVE-2014-9529: A race condition in Linux kernel key garbage collection (key_gc_unused_keys in security/keys/gc.c) up to 3.18.2 can enable local users to cause DoS or memory corruption during key garbage collection via keyctl. Connected advisory confirms kernel upstream fix and lists commit a3a878...

CVE-2021-38202

CVE-2021-38202 affects the Linux kernel before 5.13.4, where fs/nfsd/trace.h can allow remote attackers to trigger a denial-of-service via an out-of-bounds read in strlen when the trace event framework is used for nfsd. The vulnerability is triggered by NFS traffic sent over the network. A fix wa...

CVE-2021-47495

CVE-2021-47495 involves the Linux kernel usbnet vulnerability where a zero maxpacket caused an invalid division and a kernel oops. The description notes a sanity check for maxpacket and that a 0 value is nonsensical, leading to a failure to divide by it. The accompanying notes indicate a fix was ...

CVE-2022-49429

CVE-2022-49429 affects the Linux kernel’s RDMA/hfi1 subsystem. When the hfi1 module is loaded with SDMA disabled (HFI1_CAP_SDMA off), a call to hfi1_write_iter() can dereference a NULL pointer, causing a kernel panic through the I/O path (sdma_select_user_engine → hfi1_user_sdma_process_request →...

CVE-2024-41089

CVE-2024-41089 relates to the Linux kernel DRM/Nouveau code path: in nv17_tv_get_hd_modes(), the return of drm_mode_duplicate() (and drm_cvt_mode()) could be NULL on failure, leading to a NULL pointer dereference. The fix adds a NULL check to avoid dereferencing a NULL mode object. Impact is a lo...