CVE-2024-53099

CVE-2024-53099 refers to a Linux kernel vulnerability in BPF: it checks the validity of link->type in bpf_link_show_fdinfo(), preventing out-of-bounds access when a new link type is added but not invoked via BPF_LINK_TYPE(). Affected: Linux kernel releases prior to the patched version; multipl...

CVE-2015-8785

CVE-2015-8785: The fuse_fill_write_pages function in fs/fuse/file.c of the Linux kernel (versions before 4.4) is exploitable locally to cause a denial of service via a writev call that triggers a zero-length first iov. This is a local, non-privileged issue with an attacker able to induce an infin...

CVE-2023-52588

CVE-2023-52588 represents a Linux kernel vulnerability in the F2FS file system. The issue involves a missing gcing flag on a page during block migration, intended to ensure that migrated data is persisted consistently during checkpoints. Without the gcing flag, data/page persistence could become ...

CVE-2024-43882

CVE-2024-43882 is a Linux kernel race Condition (ToCToU) in exec path: permission checks for a file are done at do_filp_open(), but the metadata (mode/UID/GID) used later in execve() can be changed before execution, enabling potential root privilege escalation. The issue is exploitable in scenari...

CVE-2024-50234

CVE-2024-50234 : A Linux kernel vulnerability affecting Wi‑Fi stack in the iwl4965/iwlegacy path where on resume from hibernation a stale interrupt could be re-enabled, causing a race between resume startup and queued shutdown work and potentially a system hang. The fix, implemented in the kernel...

CVE-2024-56599

CVE-2024-56599 records a Linux kernel vulnerability in the wifi/ath10k SDIO path where rmmod ath10k could panic if CONFIG_INIT_ON_FREE_DEFAULT_ON is enabled. The root cause is a NULL-pointer path involving destroying the sdio workqueue before ath10k_core_destroy frees the wiphy/cfg80211 device, l...

CVE-2019-18885

CVE-2019-18885 affects the Linux kernel (fs/btrfs/volumes.c) with a NULL pointer dereference in btrfs_verify_dev_extents when processing a crafted btrfs image. Root cause: fs_devices->devices is mishandled in find_device, enabling NULL dereferences in btrfs_verify_dev_extents. Impact per publi...

CVE-2022-49316

CVE-2022-49316 affects the Linux kernel’s NFSv4 layout management. The issue arises when performing layoutget as part of an open() compound: locks for the layoutget are held across multiple RPC calls, which can trigger recalls and deadlock. The connected advisories (EulerOS/Unity/Nessus OSS) conf...

CVE-2022-49328

CVE-2022-49328 is a vulnerability in the Linux kernel mt76 driver where a use-after-free can occur in mt76_txq_schedule due to an unprotected wcid pointer (non-RCU). The issue is addressed by guarding the mtxq->wcid with an rcu_lock between mt76_txq_schedule and sta_info_alloc/free, per the re...

CVE-2022-49429

CVE-2022-49429 affects the Linux kernel’s RDMA/hfi1 subsystem. When the hfi1 module is loaded with SDMA disabled (HFI1_CAP_SDMA off), a call to hfi1_write_iter() can dereference a NULL pointer, causing a kernel panic through the I/O path (sdma_select_user_engine → hfi1_user_sdma_process_request →...

CVE-2023-3355

CVE-2023-3355 affects the Linux kernel’s MSM GPU driver, specifically the code path in drivers/gpu/drm/msm/msm_gem_submit.c (submit_lookup_cmds). The vulnerability arises from a NULL pointer dereference due to an missing validation of kmalloc() return value, enabling a local user to crash the sys...

CVE-2024-35934

The CVE-2024-35934 issue affects the Linux kernel net/smc subsystem. Affected component: smc_pnet-related code in net/smc (pnet IDs list creation). Root cause: excessive RTNL (rtnl) lock pressure during net namespace/pnet initialization, caused by smc_pnet_create_pnetids_list() acquiring rtnl in ...

CVE-2024-41095

CVE-2024-41095 concerns the Linux kernel's DRM Nouveau driver. The root cause is a NULL pointer dereference in nv17_tv_get_ld_modes() when drm_mode_duplicate() fails and its return value is assigned to mode without checking for NULL. The patch adds a guard to prevent the NULL pointer dereference ...

CVE-2024-44938

CVE-2024-44938 relates to the Linux kernel JFS code. The issue is a shift-out-of-bounds in dbDiscardAG when BLKSTOL2() returns 0 while seeking the next smaller log2 block, which can yield a negative shift exponent. The patch resolves this by exiting the loop when a negative shift is encountered. ...

CVE-2024-49936

CVE-2024-49936 concerns a use-after-free in the Linux kernel net/xen-netback path (xenvif_flush_hash) during an RCU iteration. The bug happens when kfree_rcu is invoked inside the RCU read-critcal section, causing an access to head->next after the entry is freed, leading to UAF. The mitigation...

CVE-2024-50048

CVE-2024-50048 (Linux kernel fbcon NULL pointer dereference) : A NULL pointer dereference in fbcon_putcs was triggered after using fbcon via FBIOPUT_CON2FBMAP and TIOCLINUX, due to an uninitialized ops->putcs path. Reproducer shows set_con2fb_map -> con2fb_init_display -> fbcon_set_disp ...

CVE-2016-3841

CVE-2016-3841 affects the Linux kernel IPv6 stack before 4.3.3. A crafted sendmsg can mishandle options data, allowing local users to gain privileges or cause a denial of service via a use-after-free leading to a system crash. Public documents (e.g., MiracleLinux AXSA-2016-1135:09 and Unity Linux...

CVE-2019-19076

CVE-2019-19076 concerns a memory leak in the Linux kernel function nfp_abm_u32_knode_replace() in drivers/net/ethernet/netronome/nfp/abm/cls.c, before version 5.3.6. The issue can allow a remote attacker to cause a denial of service via memory consumption. The upstream commit 78beef629fd9 was rev...

CVE-2022-48804

CVE-2022-48804 is resolved in the Linux kernel’s vt_ioctl/vt_setactivate path. The vulnerability stems from an array_index_nospec handling that could allow a transient integer underflow when an out-of-bounds value is decremented after zero, specifically affecting vsa.console handling. The descrip...

CVE-2023-52632

CVE-2023-52632 describes a Linux kernel lockdep warning in drm/amdkfd where a potential circular locking dependency can occur between srcu and a work-queue based lock. The provided details show a chain: srcu -> info->lock#2 -> (work_completion) svms->deferred_list_work, with the risk ...

CVE-2024-47670

This CVE (CVE-2024-47670) affects the Linux kernel OCFS2 subsystem. The vulnerability arises from insufficient bounds checking in ocfs2_xattr_find_entry(), allowing potential out-of-bounds memory access while scanning for a match in OCFS2 extended attributes. The advisory states that a paranoia c...

CVE-2024-53133

CVE-2024-53133 concerns the Linux kernel DRM/AMD display driver. The vulnerability arises when a dml allocation fails, causing the current state’s dml contexts to become invalid. Subsequent calls to dc_state_copy_internal could shallow-copy these invalid pointers, and releasing the new state coul...

CVE-2024-57809

Technical details about CVE-2024-57809 are not provided in the supplied documents. No affected products/versions or remediation steps are present. Monitor for vendor advisories for confirmation of impact and fixes.

CVE-2012-6701

CVE-2012-6701 : An integer overflow in fs/aio.c of the Linux kernel before 3.4.1 allows local users to trigger a denial of service (and possibly other impact) via a large AIO iovec. Public sources describe exploitation locally and indicate a fix was applied in 3.4.1 (Linux kernel changelog refere...

CVE-2017-7187

The CVE-2017-7187 issue affects the Linux kernel sg_ioctl in drivers/scsi/sg.c, where a large SG_NEXT_CMD_LEN ioctl can trigger a stack-based buffer overflow, leading to a DoS or potentially other impact via out-of-bounds writes in sg_write. Descriptions across connected sources (CNVD-2017-03858)...

CVE-2022-1198

CVE-2022-1198 is a Linux kernel use-after-free in drivers/net/hamradio/6pack.c (AX.25/6pack driver). A local attacker could crash the kernel or potentially escalate privileges by simulating an AX.25 device from user space. Public connected sources confirm the flaw and that patches exist in update...

CVE-2022-2380

CVE-2022-2380 concerns the Silicon Motion SM712 framebuffer driver in the Linux kernel. The issue is an out-of-bounds memory access in drivers/video/fbdev/sm712fb.c:smtcfb_read(), which could allow a locally authenticated attacker to crash the kernel. The description and linked advisories consist...

CVE-2022-2905

CVE-2022-2905 is an out-of-bounds memory read in the Linux kernel’s BPF subsystem, exploitable by a local user via bpf_tail_call with a map key larger than max_entries. The Debian LTS advisory DLA-3173-1 (linux-5.10) lists CVE-2022-2905 among others and notes that an update to linux-5.10-149-2~de...

CVE-2022-48747

CVE-2022-48747 affects the Linux kernel in the block.bio_truncate() path. The vulnerability stems from a wrong page offset being used, causing bio_truncate() to clear data outside the last block of a block device and potentially return uninitialized data when both truncated/corrupted FS and users...

CVE-2022-49707

CVE-2022-49707 concerns a Linux kernel ext4 resize bug where a NULL pointer dereference could occur when resizing a corrupted ext4 image with resize_inode previously cleared. The root cause is that during ext4_resize_fs() transitioning to meta_bg mode, es->s_reserved_gdt_blocks was not reduced...

CVE-2023-52834

CVE-2023-52834: Linux kernel DMA RX overflow issue in atl1c/alx drivers resolved. Root cause: RX overflow caused by problematic skb handling; fix replaces custom allocator with address check and skb_reserve() to steer away from 0x…fc0 addresses. A simpler workaround implemented for the alx driver...

CVE-2024-26719

CVE-2024-26719 involves the Linux kernel nouveau subsystem. The vulnerability description confirms a deadlock between fctx lock and the irq lock. The fix described offloads the processing from the IRQ handler into a workqueue, breaking the deadlock by moving fence uevents work to a separate threa...

CVE-2024-44960

The CVE-2024-44960 entry concerns a Linux kernel issue in usb gadget core where a descriptor may be unset, causing a null pointer panic. The resolution involves ensuring the descriptor is set before inspecting maxpacket, addressing cases where an endpoint for the current speed is not properly con...

CVE-2024-46750

CVE-2024-46750 affects the Linux kernel PCI subsystem. The issue is caused by a missing bridge lock in the PCI bus reset path, allowing unlocked secondary bus resets via pci_reset_bus(), while pci_bus_lock() already locks other parts. The fix adds pci_dev_lock() for the upstream bridge (and for @...

CVE-2024-49927

The CVE-2024-49927 entry concerns the Linux kernel x86 IO-APIC code. The connected Astra Linux security bulletin details the vulnerability as: a failure to allocate an irq_pin_list could cause a kernel panic with the message “IO-APIC: failed to add irq-pin,” due to a panicky legacy IO/APIC path d...

CVE-2024-50191

Mode C: The CVE-2024-50191 entry concerns ext4 in the Linux kernel. The issue was that when a filesystem was mounted with errors=remount-ro, the kernel incorrectly set SB_RDONLY after errors, potentially confusing the filesystem freeze logic. The fix removes the SB_RDONLY modification and relies ...

CVE-2024-50196

CVE-2024-50196 affects the Linux kernel pinctrl/ocelot subsystem. The issue causes a system hang when a GPIO interrupt is configured in level mode while the parent interrupt is configured in edge mode, because chained_irq_enter() may not be called if the GPIO interrupt is cleared before the paren...

CVE-2024-50247

CVE-2024-50247 affects the Linux kernel ntfs3 path where an incorrectly formatted chunk may decompress to more than LZNT_CHUNK_SIZE bytes, causing an index out of bounds in s_max_off. The Connected documents confirm this CVE is included in multiple advisories (e.g., ALAS2023LIVEPATCH advisories) ...

CVE-2024-53094

CVE-2024-53094 affects the Linux kernel RDMA/siw driver (InfiniBand) where siw_tcp_sendpages/siw_qp_tx.c processing can mishandle sendpage/MSG_SPLICE_PAGES, caused by insufficient input validation. The published fix adds a sendpage_ok() check to disable MSG_SPLICE_PAGES before entering the networ...

CVE-2013-1059

CVE-2013-1059 affects the Linux kernel (net/ceph/auth_none.c) through version 3.10. A remote attacker can trigger a denial of service via an auth_reply message that leads to a NULL pointer dereference and system crash; the content implies possible other impact. In the connected Nessus entries for...

CVE-2016-7911

CVE-2016-7911: Race condition in get_task_ioprio in block/ioprio.c of the Linux kernel allows local privilege escalation or use-after-free leading to DoS. A crafted ioprio_get system call can trigger the issue. This vulnerability was addressed by kernel patching in the 4.6.6 release; updating to ...

CVE-2021-47185

CVE-2021-47185 is addressed by a Linux kernel fix for a soft lockup in tty_buffer/flush_to_ldisc. In ARM64 when running the ltp pty04 test, a write race between a sender and the flush_to_ldisc workqueue on different cores could cause a long loop and a softlockup in flush_to_ldisc. The patch adds ...

CVE-2022-27950

CVE-2022-27950 : A memory leak exists in Linux kernel drivers/hid/hid-elo.c for a hid_parse error condition, affecting kernels before 5.16.11. Exploitation details are not provided in the documents. A fix is in kernel 5.16.11 (and later). Recommendation: upgrade to a version containing the patch ...

CVE-2022-49349

CVE-2022-49349 is a Linux kernel vulnerability in the ext4 filesystem where a use-after-free occurs in ext4_rename_dir_prepare. The issue arises during ext4 directory block reads when a directory entry with an invalid rec_len can lead to a stale parent reference being used, enabling a use-after-f...

CVE-2023-52634

Summary (CVE-2023-52634) : In the Linux kernel, the DRM/AMD display driver had a logic issue in the disable_otg_wa path that could cause a system hang during HDMI mode switches due to simultaneous FIFO/HPO state changes. The root cause was that enabling/disabling FIFO could affect multiple regist...

CVE-2023-52749

CVE-2023-52749: In the Linux kernel, a race condition can cause a null pointer dereference during resume if a synchronous SPI transfer is active when suspending. The issue arises when a transfer context resumes after cur_msg was reset to NULL during suspend. Public details state a fix: ensure syn...

CVE-2024-35870

CVE-2024-35870: In the Linux kernel, smb2_reconnect_server() can UAF a session being torn down by another thread, leading to a crash (general protection fault) when a session is in an inconsistent state. The root cause is a race where a session could be accessed after __cifs_put_smb_ses() begins ...

CVE-2024-42253

CVE-2024-42253 affects the Linux kernel driver gpio/pca953x. The root cause is a race in pca953x_irq_bus_sync_unlock where the i2c_lock may not be held when setting the interrupt latch and mask, risking a miswrite to registers and potentially incorrect GPIO state during race conditions (observed ...

CVE-2024-46723

CVE-2024-46723 is a Linux kernel vulnerability involving the DRM AMDGPU driver: a ucode out-of-bounds read warning that could occur when reading the ucode array. Connected advisories across vendors (Astla/Astra Linux, CIRCL, Debian LTS advisories, Amazon Linux ALAS entries, and Red Hat references...

CVE-2024-53114

CVE-2024-53114 affects Linux kernel components related to x86 virtualization (VMLOAD/VMSAVE) on Zen4 client hardware. The vulnerability has been addressed in Root’s rootio-linux package for Ubuntu 22.04 (Root-OS-UBUNTU-2204-CVE-2024-53114) with multiple fixed versions available, and similarly pat...