CVE-2024-50017

CVE-2024-50017 affects the Linux kernel’s identity-mapping code (x86/mm/ident_map). When ident_pud_init() creates identity maps using only GB pages, it can map large address ranges not requested (a 4K request could yield a full 1GB mapping), potentially including BIOS-reserved areas. This enables...

CVE-2024-50286

The CVE-2024-50286 entry concerns the Linux kernel ksmbd subsystem. A race exists between ksmbd_smb2_session_create and ksmbd_expire_session that can lead to a use-after-free in the global sessions table. The fix adds a missing sessions_table_lock when adding or deleting sessions from the global ...

CVE-2024-56692

CVE-2024-56692 concerns the Linux kernel’s f2fs file system. The vulnerability stems from insufficient sanity checks for the nat entry blkaddr used during truncate_node(), which can lead to a system panic when f2fs_invalidate_blocks() processes a corrupted blkaddr (as observed in fuzzing). The ro...

CVE-2025-37742

CVE-2025-37742 : In the Linux kernel, the jfs_imap diMount path allocates imap with kmalloc and fails to initialize it, causing uninit-value usage in hex_dump_to_buffer and a KMSAN report during mount/evict paths. Root cause: imap is not initialized after memory allocation. Remediation: replace k...

CVE-2012-0879

CVE-2012-0879 affects the Linux kernel prior to 2.6.33, where the I/O implementation for block devices mishandles the CLONE_IO feature. Local attackers can create multiple processes sharing an I/O context, causing I/O instability and a denial of service. The vulnerability is evidenced across mult...

CVE-2012-2136

CVE-2012-2136 affects the Linux kernel prior to 3.4.5. The sock_alloc_send_pskb function does not properly validate a length value, enabling a local user to trigger a heap-based overflow that can crash the system or potentially gain privileges via access to a TUN/TAP device. Affected software is ...

CVE-2017-16532

CVE-2017-16532: A vulnerability in the Linux kernel ≤ 4.13.11 affects the get_endpoints function in drivers/usb/misc/usbtest.c, enabling local users to trigger a denial of service via a crafted USB device, through a NULL pointer dereference and potential system crash. The issue is triggered by a ...

CVE-2021-47353

CVE-2021-47353 in the Linux kernel fixes a NULL pointer dereference in the udf_symlink function. The issue arises when udf_tgetblk returns a NULL sb_getblk value and the code uses epos.bh without checking, leading to a possible crash. The fix adds a NULL check for epos.bh before use, mitigating p...

CVE-2022-48947

CVE-2022-48947 is a Linux kernel vulnerability related to Bluetooth L2CAP u8 overflow. By repeatedly sending L2CAP_CONF_REQ, chan->num_conf_rsp could wrap at 255. The fix adds a boundary check using L2CAP_MAX_CONF_RSP to prevent overflow. Connected advisories (e.g., Unity Linux/Astra Linux ent...

CVE-2022-49158

CVE-2022-49158 affects the Linux kernel SCSI driver qla2xxx. The issue is a warning generated when adisc is flushed, where an error code type did not match the expected type. The fix adds translation between error code types to avoid the warning (no documented exploit). The connected advisories c...

CVE-2022-49295

This CVE concerns the Linux kernel nbd subsystem. The root cause is a race between module removal and handling of a netlink command in the nbd_cleanup() path, which could lead to a kernel NULL pointer dereference. The issue is mitigated by ensuring that genl_unregister_family() is called before c...

CVE-2024-46705

CVE-2024-46705 affects the Linux kernel DRM Xe driver. The flaw arises from how mmio mappings are reset to NULL on device removal, intended to prevent rogue MMIO access after a device is removed, but could be misused when unmapped regions are remapped by another component, leading to system disru...

CVE-2024-49891

CVE-2024-49891 : In the Linux kernel, the SCSI lpfc path can NULL-deref when an HBA is resetting or handling an errata event due to hdwq pointers that may have been freed. Fixes add NULL pointer checks before dereferencing hdwq pointers in affected routines (e.g., lpfc_sli_flush_io_rings, lpfc_de...

CVE-2024-49901

CVE-2024-49901 concerns the Linux kernel DRM MSM Adreno path. The root cause was a NULL pointer dereference during cleanup when gpu->pdev may still be NULL during early initialization, including cases where speedbin data exists but opp/hw data in DT is missing. The vulnerability was resolved b...

CVE-2024-49922

The CVE-2024-49922 entry concerns the Linux kernel DRM AMD display driver. The issue arises from using pointers that may be NULL in a path where they had been validated earlier in the same function, triggering null-pointer handling after use. The vulnerability is mitigated by a fix that adds null...

CVE-2024-50244

CVE-2024-50244 affects the Linux kernel ntfs3 driver. Root cause: an additional check added in ni_clear() to validate NTFS_FLAGS_LOG_REPLAYING, preventing access to an uninitialized bitmap during the NTFS replay process. Impact: as described, availability is affected; other confidentiality/integr...

CVE-2011-0711

CVE-2011-0711 affects the Linux kernel through the xfs_fs_geometry function in fs/xfs/xfs_fsops.c. The vulnerability arises because a structure member is not initialized, enabling local attackers to read potentially sensitive data from kernel stack memory via the FSGEOMETRY_V1 ioctl. The affected...

CVE-2011-1180

The CVE-2011-1180 issue affects the Linux kernel’s IrDA code, specifically the iriap_getvaluebyclass_indication function in net/irda/iriap.c. It describes multiple stack-based buffer overflows caused by unvalidated length fields for names and attributes, allowing remote attackers to trigger memor...

CVE-2011-2022

The CVE-2011-2022 issue affects the Linux kernel (drivers/char/agp/generic.c) prior to 2.6.38.5. The vulnerability is due to failure to validate a start parameter in the agp_generic_remove_memory function, enabling local users to gain privileges or cause a denial of service (system crash) via a c...

CVE-2011-4330

CVE-2011-4330 describes a stack-based buffer overflow in the Linux kernel 2.6, specifically in hfs_mac2asc (fs/hfs/trans.c). A crafted HFS image len field can be used by a local user to trigger a crash and, per the description, possibly execute arbitrary code. The associated connected documents c...

CVE-2014-3180

CVE-2014-3180 affects the Linux kernel prior to 3.17, specifically the compatibility code path in kernel/compat.c. The vulnerability is an out-of-bounds read where restart_syscall uses uninitialized data when restarting compat_sys_nanosleep. Note: the description states the code path is unreachab...

CVE-2022-49430

The CVE-2022-49430 entry affects the Linux kernel in the gpio_keys controller. The issue arises from canceling a delayed work handle when the gpio_keys module unloads and an interrupt pin is used instead of GPIO; the module initializes delayed work only for GPIO-backed paths and not for interrupt...

CVE-2022-49673

CVE-2022-49673 concerns the Linux kernel where a KASAN warning in raid5_add_disk was mitigated by validating that rdev->saved_raid_disk is within expected limits during LVM tests (dm raid). The fix is described as adjusting the raid5_add_disks path to ensure bound checks, with the associated c...

CVE-2023-35827

CVE-2023-35827 : A use-after-free in the Linux kernel up to version 6.3.8 is reported, specifically in ravb_remove() inside drivers/net/ethernet/renesas/ravb_main.c. The issue arises from a use-after-free in the Renesas AVB/RAVB driver, as described in Astra Linux and Nessus feeds. The vulnerabil...

CVE-2023-52591

CVE-2023-52591 affects the Linux kernel’s reiserfs rename path. The issue arises when renaming a directory where the parent directory does not change; the VFS previously could touch a renamed directory due to lack of proper locking, risking filesystem corruption. The fix adjusts the reiserfs rena...

CVE-2024-36893

CVE-2024-36893 – Linux kernel : A NULL pointer dereference in usb: typec: tcpm due to typec_register_partner() not guaranteeing partner registration. If port->partner is invalid (NULL or an error value) and is not checked before dereferencing, it can crash the kernel (e.g., kernel NULL pointer...

CVE-2024-46751

CVE-2024-46751 affects the Linux kernel btrfs path where a 0 reference count could trigger a BUG_ON() in btrfs_lookup_extent_info(). The vulnerability arises from the incorrect BUG_ON() and is fixed by changing the code to return -EUCLEAN, abort the transaction, and log an error instead. This red...

CVE-2024-49912

The CVE-2024-49912 entry concerns a Linux kernel DRM/AMD display issue. A null pointer dereference risk existed in drm/amd/display within planes_changed_for_existing_stream when stream_status could be null. The published fix adds a null check for stream_status in planes_changed_for_existing_strea...

CVE-2025-22037

CVE-2025-22037 affects the Linux kernel’s ksmbd component. The issue is a null pointer dereference in alloc_preauth_hash triggered when a client sends a malformed SMB2 negotiate request, allowing a subsequent session setup before conn->preauth_info is allocated. A patch introduces KSMBD_SESS_N...

CVE-2025-22038

CVE-2025-22038 concerns the Linux kernel, specifically the ksmbd path. The issue arises when accessing psid->sub_auth[psid->num_subauth - 1] without ensuring num_subauth is non-zero, which can cause an out-of-bounds read. The provided description states the patch adds a validation step to r...

CVE-2025-37862

CVE-2025-37862 affects the Linux kernel HID PIDFF code. The vulnerability is a NULL pointer dereference in pidff_find_fields (and pidff_find_special_field) when searching for a report not implemented on the device, potentially triggering a crash. The issue could occur for both optional and requir...

CVE-2010-3432

CVE-2010-3432 affects the Linux kernel SCTP stack: sctp_packet_config in net/sctp/output.c initializes packet data structures too aggressively in kernels before 2.6.35.6, enabling remote attackers to trigger a denial of service (panic) via a specific SCTP traffic sequence. Affected component: ker...

CVE-2014-0069

The CVE-2014-0069 entry affects the Linux kernel (fs/cifs/file.c: cifs_iovec_write) up to version 3.13.5. The vulnerability stems from improper handling of uncached write operations that copy fewer bytes than requested, enabling local users to read kernel memory (information disclosure), cause me...

CVE-2014-4653

Summary (CVE-2014-4653) : The ALSA control implementation in the Linux kernel has a race/lock handling issue in sound/core/control.c. It does not ensure possession of a read/write lock, enabling a local attacker to trigger a denial of service (use-after-free) and to potentially read kernel memory...

CVE-2014-4654

The CVE-2014-4654 issue affects the Linux kernel ALSA control implementation (snd_ctl_elem_add in sound/core/control.c). The root cause is a lack of authorization checks for SNDRV_CTL_IOCTL_ELEM_REPLACE commands, allowing local attackers with access to /dev/snd/controlX to remove kernel controls....

CVE-2021-47284

CVE-2021-47284 (Linux kernel) relates to isdn: mISDN: netjet crash in nj_probe. The issue occurs when nj_setup may fail with -EIO, leaving card->irq initialized and >0; a subsequent nj_release frees an IRQ that wasn’t requested. The fix deletes the prior assignment to card->irq and keeps...

CVE-2021-47435

CVE-2021-47435 affects the Linux kernel device-mapper (dm) path, causing a crash via a NULL pointer dereference during IO completion. The issue stems from dm_io_dec_pending() calling end_io_acct() before the in-flight pending count is decremented, and a race if a DM table swap happens concurrentl...

CVE-2021-47646

CVE-2021-47646 (Linux kernel) involves a crash triggered by interactions around block, bfq: honor already-setup queue merges. The vulnerability arose when the commit 2d52c58b9c9b was merged and later reverted by ebc69e897e17; that revert did not introduce the bug, but actually exposed a UAF cause...

CVE-2022-49301

CVE-2022-49301 : In the Linux kernel, the staging rtl8712 USB driver has a bug where, if r8712_usbctrl_vendorreq() returns a negative value, data in usb_read8/16/32 is not initialized, triggering KMSAN uninitialized-value reports. Connected advisories reference fixes in the kernel (e.g., commits ...

CVE-2023-53117

CVE-2023-53117 refers to a vulnerability in the Linux kernel related to the fs subsystem, specifically an out-of-bounds array speculation issue when closing a file descriptor. The connected advisories (EulerOS, Unity Linux) explicitly identify CVE-2023-53117 and describe the affected area as the ...

CVE-2023-53146

The CVE-2023-53146 issue affects the Linux kernel’s media driver for the dw2102 I2C transfer path. In dw2102_i2c_transfer, the code can read msg[i].buf even when it is null if msg[i].len is zero, allowing a null pointer dereference before the fix. The vulnerability is mitigated by adding a check ...

CVE-2024-42069

CVE-2024-42069 affects the Linux kernel, in the mana network driver. The issue is a double-free in the error path of auxiliary_device_add() when it returns an error and subsequently calls auxiliary_device_uninit(); the callback adev_release frees madev via kfree and the code would free it again. ...

CVE-2024-42093

CVE-2024-42093 – Linux kernel vulnerability in net/dpaa2: cpumask allocation on stack. For CONFIG_CPUMASK_OFFSTACK=y, explicit allocation of cpumask on the stack can overflow the stack. The fix is to use the *cpumask_var API(s) to allocate cpumask variables in a config-neutral way, leaving alloca...

CVE-2024-42098

The CVE-2024-42098 entry concerns the Linux kernel crypto/ecdh logic, where private_key can remain partially overwritten when a caller-supplied or newly generated key is shorter than the previous one. The documented fix explicitly zeroizes the entire private_key array before writing new material,...

CVE-2024-42311

CVE-2024-42311 relates to the Linux kernel with the HFS filesystem. The issue was that in hfs_alloc_inode(), the fields .tz_secondswest, .cached_start, and .cached_blocks of struct hfs_inode_info were not initialized, potentially allowing uninitialized-value access. The provided documents indicat...

CVE-2024-46707

CVE-2024-46707 affects the Linux kernel KVM for arm64. When a guest is configured without vGICv3 and the host cannot emulate GICv2, writes to ICC_SGI EL1 are trapped to EL2, leading to an attempted SGI emulation that dereferences a NULL interrupt pointer. The public details confirm the root cause...

CVE-2024-49868

CVE-2024-49868 : Linux kernel (btrfs) vulnerability causing a NULL pointer dereference in btrfs_update_reloc_root during balance/relocation cleanup. Root cause: a window where fs_info->reloc_ctl can be NULL between set_reloc_contrl() andunset_reloc_control(), leading to dereferencing NULL in c...

CVE-2024-49909

The CVE-2024-49909 vulnerability affects the Linux kernel DRM AMD display path (drm/amd/display) specifically in dcn32_set_output_transfer_func, where a null pointer dereference could occur if set_output_gamma is NULL. The issue arises from dereferencing set_output_gamma after a prior NULL check ...

CVE-2025-21786

CVE-2025-21786 concerns a Linux kernel workqueue use-after-free. The issue arises from a patch that reap workers via kthread_stop() and detaches the rescuer, but incorrectly does not preserve the rescuer’s reference to the pool and removes the code waiting for the rescuer in put_unbound_pool(). T...

CVE-2025-21912

CVE-2025-21912 describes a Linux kernel issue in the Renesas GPIO driver (gpio_rcar) where register access was not properly protected, leading to spurious “Invalid wait context” messages when spinlock debugging is enabled. The patch switches protection to a raw_spinlock to serialize register acce...