CVE-2024-41095

CVE-2024-41095 concerns the Linux kernel's DRM Nouveau driver. The root cause is a NULL pointer dereference in nv17_tv_get_ld_modes() when drm_mode_duplicate() fails and its return value is assigned to mode without checking for NULL. The patch adds a guard to prevent the NULL pointer dereference ...

CVE-2024-47659

The CVE-2024-47659 issue is supported by connected advisories (Unity Linux UTSA entries) detailing a kernel-level Smack labeling bug for TCP/IPv4. The vulnerability caused return packets to be labeled with the initiator’s CIPSO label, enabling a labeled peer to write to another label without prop...

CVE-2024-49927

The CVE-2024-49927 entry concerns the Linux kernel x86 IO-APIC code. The connected Astra Linux security bulletin details the vulnerability as: a failure to allocate an irq_pin_list could cause a kernel panic with the message “IO-APIC: failed to add irq-pin,” due to a panicky legacy IO/APIC path d...

CVE-2024-49987

The CVE-2024-49987 issue affects the Linux kernel bpftool component. When netfilter has no entry to display, qsort is called with a NULL pointer and size 0, triggering undefined behavior as UBSan reports. The root cause is a NULL pointer passed to qsort; the advisory notes that the C standard gui...

CVE-2025-21699

CVE-2025-21699 is a Linux kernel issue in the gfs2 component. The flaw arises when truncating an inode’s address space while flipping the GFS2_DIF_JDATA flag; depending on the flag, the pages in the address space are managed either by buffer heads or by iomap_folio_state structs, and the memory m...

CVE-2013-1059

CVE-2013-1059 affects the Linux kernel (net/ceph/auth_none.c) through version 3.10. A remote attacker can trigger a denial of service via an auth_reply message that leads to a NULL pointer dereference and system crash; the content implies possible other impact. In the connected Nessus entries for...

CVE-2014-3122

CVE-2014-3122 affects the Linux kernel local memory-management path. The advisory centers on the try_to_unmap_cluster function in mm/rmap.c, where the code path did not consistently lock pages, enabling a local user to trigger a memory-usage pattern that can force removal of page-table mappings a...

CVE-2017-16994

The CVE-2017-16994 vulnerability affects the Linux kernel’s walk_hugetlb_range function in mm/pagewalk.c, where holes in hugetlb ranges are mishandled. This allows a local attacker to obtain sensitive information from uninitialized kernel memory via a crafted mincore() call. Public sources attrib...

CVE-2024-26659

CVE-2024-26659 (Linux kernel) affects xHCI by mishandling isoc Babble and Buffer Overrun events. The driver could release a multi-TRB TD prematurely when an early TRB reports an error, risking loss of the final completion event and a misleading “Transfer event TRB DMA ptr not part of current TD” ...

CVE-2024-36922

CVE-2024-36922 affects the Linux kernel’s iwlwifi driver (iwl_txq_reclaim) where txq->read_ptr could be read without holding the lock, allowing a race that can reclaim the same entry twice and trigger a WARN_ONCE, potentially causing a service disruption. The issue is fixed by reading txq->...

CVE-2024-41089

CVE-2024-41089 relates to the Linux kernel DRM/Nouveau code path: in nv17_tv_get_hd_modes(), the return of drm_mode_duplicate() (and drm_cvt_mode()) could be NULL on failure, leading to a NULL pointer dereference. The fix adds a NULL check to avoid dereferencing a NULL mode object. Impact is a lo...

CVE-2024-53128

The CVE-2024-53128 issue is in the Linux kernel’s sched/task_stack path: when CONFIG_KASAN_SW_TAGS and CONFIG_KASAN_STACK are enabled, object_is_on_stack() may yield incorrect results because tagged pointers in the object could differ from the untagged stack pointer. The result can trigger warnin...

CVE-2016-7911

CVE-2016-7911: Race condition in get_task_ioprio in block/ioprio.c of the Linux kernel allows local privilege escalation or use-after-free leading to DoS. A crafted ioprio_get system call can trigger the issue. This vulnerability was addressed by kernel patching in the 4.6.6 release; updating to ...

CVE-2021-38203

CVE-2021-38203 affects the btrfs component in the Linux kernel, with the issue present in versions before 5.13.4. The root cause is a race condition during allocations of new system chunks when space is scarce in space_info, which can lead to a denial-of-service (deadlock) for local attackers. Pu...

CVE-2021-47185

CVE-2021-47185 is addressed by a Linux kernel fix for a soft lockup in tty_buffer/flush_to_ldisc. In ARM64 when running the ltp pty04 test, a write race between a sender and the flush_to_ldisc workqueue on different cores could cause a long loop and a softlockup in flush_to_ldisc. The patch adds ...

CVE-2022-48747

CVE-2022-48747 affects the Linux kernel in the block.bio_truncate() path. The vulnerability stems from a wrong page offset being used, causing bio_truncate() to clear data outside the last block of a block device and potentially return uninitialized data when both truncated/corrupted FS and users...

CVE-2022-49322

The CVE-2022-49322 issue affects the Linux kernel in PREEMPT_RT builds when bootparams include trace_event=initcall:initcall_start tp_printk=1. In this scenario, output_printk() triggers a sleepable rt-spinlock usage via rt_spin_lock, causing a sleeping function to be called from an invalid conte...

CVE-2023-52920

CVE-2023-52920 concerns the Linux kernel BPF verifier: it fixes a defect that allowed spill/fill of non-r10 registers to stack to be tracked in precision mode. The change introduces per-instruction flags (spi and stack frame info) into the history and uses the instruction history for reliable bac...

CVE-2024-26689

CVE-2024-26689 affects the Linux kernel via the Ceph subsystem: in fs/ceph/caps.c, encode_cap_msg() previously could perform a use-after-free due to a race between refcount increment and free in arg->xattr_buf handling. The race around ceph_buffer_get/ceph_buffer_put(ci->i_xattrs.blob) allo...

CVE-2024-44938

CVE-2024-44938 relates to the Linux kernel JFS code. The issue is a shift-out-of-bounds in dbDiscardAG when BLKSTOL2() returns 0 while seeking the next smaller log2 block, which can yield a negative shift exponent. The patch resolves this by exiting the loop when a negative shift is encountered. ...

CVE-2024-49928

The CVE CVE-2024-49928 affects the Linux kernel wifi: rtW89 driver, where reading TX power FW elements could read past the valid memory due to the loop expression causing an extra copy. The issue is mitigated by moving the entry copy into the loop body, preventing out-of-bounds access. The fix is...

CVE-2024-49929

CVE-2024-49929 affects the Linux kernel wifi: iwlwifi (MVM) code. The vulnerability stems from iwl_mvm_sta_from_mac80211 potentially dereferencing a NULL ieee80211_sta when sta is NULL, leading to a NULL pointer dereference in iwl_mvm_tx_skb_sta() and iwl_mvm_tx_mpdu(). The fix is to validate the...

CVE-2024-53099

CVE-2024-53099 refers to a Linux kernel vulnerability in BPF: it checks the validity of link->type in bpf_link_show_fdinfo(), preventing out-of-bounds access when a new link type is added but not invoked via BPF_LINK_TYPE(). Affected: Linux kernel releases prior to the patched version; multipl...

CVE-2024-53100

CVE-2024-53100 : In the Linux kernel, the nvme: tcp driver had a race between queue_lock and mutex_destroy during error recovery. A mutex_lock added in nvme_tcp_get_address() could race with nvme_tcp_free_queue() and trigger a WARN. The issue has been resolved via a patch that adjusts locking in ...

CVE-2024-56599

CVE-2024-56599 records a Linux kernel vulnerability in the wifi/ath10k SDIO path where rmmod ath10k could panic if CONFIG_INIT_ON_FREE_DEFAULT_ON is enabled. The root cause is a NULL-pointer path involving destroying the sdio workqueue before ath10k_core_destroy frees the wiphy/cfg80211 device, l...

CVE-2017-18204

CVE-2017-18204 affects the Linux kernel via ocfs2_setattr in fs/ocfs2/file.c, exploitable by local users to cause a denial-of-service (deadlock) when using DIO. The vulnerability exists in kernel versions before 4.14.2; Ubuntu advisories (USN 3617-3 and related) and Unity Linux advisories referen...

CVE-2023-52749

CVE-2023-52749: In the Linux kernel, a race condition can cause a null pointer dereference during resume if a synchronous SPI transfer is active when suspending. The issue arises when a transfer context resumes after cur_msg was reset to NULL during suspend. Public details state a fix: ensure syn...

CVE-2023-52834

CVE-2023-52834: Linux kernel DMA RX overflow issue in atl1c/alx drivers resolved. Root cause: RX overflow caused by problematic skb handling; fix replaces custom allocator with address check and skb_reserve() to steer away from 0x…fc0 addresses. A simpler workaround implemented for the alx driver...

CVE-2024-26719

CVE-2024-26719 involves the Linux kernel nouveau subsystem. The vulnerability description confirms a deadlock between fctx lock and the irq lock. The fix described offloads the processing from the IRQ handler into a workqueue, breaking the deadlock by moving fence uevents work to a separate threa...

CVE-2024-43882

CVE-2024-43882 is a Linux kernel race Condition (ToCToU) in exec path: permission checks for a file are done at do_filp_open(), but the metadata (mode/UID/GID) used later in execve() can be changed before execution, enabling potential root privilege escalation. The issue is exploitable in scenari...

CVE-2024-46723

CVE-2024-46723 is a Linux kernel vulnerability involving the DRM AMDGPU driver: a ucode out-of-bounds read warning that could occur when reading the ucode array. Connected advisories across vendors (Astla/Astra Linux, CIRCL, Debian LTS advisories, Amazon Linux ALAS entries, and Red Hat references...

CVE-2024-46750

CVE-2024-46750 affects the Linux kernel PCI subsystem. The issue is caused by a missing bridge lock in the PCI bus reset path, allowing unlocked secondary bus resets via pci_reset_bus(), while pci_bus_lock() already locks other parts. The fix adds pci_dev_lock() for the upstream bridge (and for @...

CVE-2024-53094

CVE-2024-53094 affects the Linux kernel RDMA/siw driver (InfiniBand) where siw_tcp_sendpages/siw_qp_tx.c processing can mishandle sendpage/MSG_SPLICE_PAGES, caused by insufficient input validation. The published fix adds a sendpage_ok() check to disable MSG_SPLICE_PAGES before entering the networ...

CVE-2014-9529

CVE-2014-9529: A race condition in Linux kernel key garbage collection (key_gc_unused_keys in security/keys/gc.c) up to 3.18.2 can enable local users to cause DoS or memory corruption during key garbage collection via keyctl. Connected advisory confirms kernel upstream fix and lists commit a3a878...

CVE-2022-2318

CVE-2022-2318 is a use-after-free vulnerability in the Linux kernel's Rose (net/rose/rose_timer.c) timer handler that can cause denial of service (crash) with local privileges. Connected advisories confirm the vulnerability affects Linux kernel releases and note fixed versions: Debian security ad...

CVE-2023-3338

CVE-2023-3338: A null pointer dereference in the Linux kernel DECnet protocol could allow remote crash of the system. Connected advisories confirm this affects Linux kernel DECnet with mitigation via status updates and removal of the DECnet protocol in the kernel; Debian/IBM entries note remediat...

CVE-2023-52833

CVE-2023-52833 affects the Linux kernel Bluetooth stack (btusb). The fix, described as adding a NULL check for date->evt_skb in btusb_mtk_hci_wmt_sync, addresses a crash caused by NULL pointer dereferences in Bluetooth shutdown/write paths. The provided crash trace shows a kernel NULL pointer ...

CVE-2024-42253

CVE-2024-42253 affects the Linux kernel driver gpio/pca953x. The root cause is a race in pca953x_irq_bus_sync_unlock where the i2c_lock may not be held when setting the interrupt latch and mask, risking a miswrite to registers and potentially incorrect GPIO state during race conditions (observed ...

CVE-2024-53133

CVE-2024-53133 concerns the Linux kernel DRM/AMD display driver. The vulnerability arises when a dml allocation fails, causing the current state’s dml contexts to become invalid. Subsequent calls to dc_state_copy_internal could shallow-copy these invalid pointers, and releasing the new state coul...

CVE-2017-7487

The CVE-2017-7487 issue is in the Linux kernel net/ipx/af_ipx.c ipxitf_ioctl: reference count mishandling causes a use-after-free via a failed SIOCGIFADDR on an IPX interface, enabling local denial of service. Evidence in connected Nessus advisories confirms the vulnerability and that it affects ...

CVE-2022-48619

CVE-2022-48619 : A local Linux kernel vulnerability in drivers/input/input.c (input_set_capability) can panic the kernel when an event code falls outside the bitmap. Affected: Linux kernel versions before 5.17.10. Root cause: mishandling in input_set_capability for out-of-bitmap event codes. Impa...

CVE-2024-39292

The CVE-2024-39292 issue concerns the Linux kernel UML subsystem. The vulnerability arises in the winch handling path: registering a winch IRQ can race with the winch being added to the winch_handlers list, potentially allowing an interrupt to occur before the winch is tracked, which could lead t...

CVE-2024-41082

CVE-2024-41082 : The Linux kernel nvme-fabrics issue can exhaust admin_q tags when many nvme commands are issued, causing a reconnect/update failure and potential kernel hang after a reset/timeouts. The connected MiracleLinux/Nessus entry notes a mitigation by letting reg_read32()/reg_read64()/re...

CVE-2024-43914

CVE-2024-43914 : In the Linux kernel md/raid5 code, the issue arises when --revert-reshape is used during a reshape; updating the raid from 5 to 4 disks while a reshape position is still set caused a mismatch where the old reshape position influenced writepos checks, triggering a panic. The fix c...

CVE-2024-44960

The CVE-2024-44960 entry concerns a Linux kernel issue in usb gadget core where a descriptor may be unset, causing a null pointer panic. The resolution involves ensuring the descriptor is set before inspecting maxpacket, addressing cases where an endpoint for the current speed is not properly con...

CVE-2024-49936

CVE-2024-49936 concerns a use-after-free in the Linux kernel net/xen-netback path (xenvif_flush_hash) during an RCU iteration. The bug happens when kfree_rcu is invoked inside the RCU read-critcal section, causing an access to head->next after the entry is freed, leading to UAF. The mitigation...

CVE-2024-50191

Mode C: The CVE-2024-50191 entry concerns ext4 in the Linux kernel. The issue was that when a filesystem was mounted with errors=remount-ro, the kernel incorrectly set SB_RDONLY after errors, potentially confusing the filesystem freeze logic. The fix removes the SB_RDONLY modification and relies ...

CVE-2024-53052

Mode C: CVE-2024-53052 affects the Linux kernel io_uring rw path. The issue was a missing IOCB_NOWAIT handling for O_DIRECT start_write, causing a deadlock with the filesystem freezer when a write blocks on kiocb_start_write() while the mount is being frozen. The fix makes the io_uring side honor...

CVE-2019-15223

CVE-2019-15223 affects the Linux kernel up to version 5.1.7 where a NULL pointer dereference can be triggered by a malicious USB device in the sound/usb/line6/driver.c driver. This is a local physical attack vector through USB, potentially causing a kernel crash by dereferencing a NULL pointer. T...

CVE-2023-30772

CVE-2023-30772 is a Linux kernel race condition leading to a use-after-free in drivers/power/supply/da9150-charger.c when a nearby attacker unplugs a device. The issue affects kernels prior to 6.2.9; security advisories from Astra Linux and Debian Mageia indicate this vulnerability, with fixes co...