CVE-2024-46861

CVE-2024-46861 - Linux kernel USB net driver (usbnet/ipheth) : The issue arises when RX callbacks fail in usbnet ipheth; causes could be payload too short, incorrect payload framing (e.g., bad NCM framing), or memory pressure. These failures previously could cause the driver to seize up. The docu...

CVE-2024-47666

CVE-2024-47666 is a Linux kernel vulnerability in the SCSI pm80xx driver. The bug arises when pm8001_phy_control() stores enable_completion on a stack address, sends resets, waits 300 ms, then returns; if a late PHY control response arrives after the 300 ms, a dangling enable_completion pointer i...

CVE-2024-49905

CVE-2024-49905 refers to a fix in the Linux kernel’s AMD GPU driver code, specifically for the DRM/AMD display path. The vulnerability arose from using the variable afb in amdgpu_dm_plane_handle_cursor_update without a null check; the commit added a null check to prevent potential null pointer de...

CVE-2024-58012

CVE-2024-58012 affects the Linux kernel ASoC: SOF Intel hda-dai path. The vulnerability arises from topologies not creating the correct number of DAI widgets for aggregated amps, allowing a NULL pointer dereference when associating a CPU DAI with a widget. The fixed code adds a validity check to ...

CVE-2025-37807

CVE-2025-37807 is a Linux kernel issue in the BPF percpu hashmap path where a percpu pointer is stored at an 8-byte aligned location only if the key_size rounds up to 8; otherwise a 4-byte aligned location is used, causing kmemleak to miss the pointer and report a leak. The root cause is an align...

CVE-2010-2959

The CVE-2010-2959 issue affects the Linux kernel CAN subsystem, specifically the can/bcm.c implementation, due to an integer overflow vulnerability. This flaw can allow local attackers to execute arbitrary code or cause a system crash (DoS) via crafted CAN traffic. Public advisories confirm vulne...

CVE-2010-3432

CVE-2010-3432 affects the Linux kernel SCTP stack: sctp_packet_config in net/sctp/output.c initializes packet data structures too aggressively in kernels before 2.6.35.6, enabling remote attackers to trigger a denial of service (panic) via a specific SCTP traffic sequence. Affected component: ker...

CVE-2021-47582

CVE-2021-47582 affects the Linux kernel USB core (USBDEVFS_CONTROL/USBDEVFS_BULK) where usb_start_wait_urb() can wait uninterruptibly for a very large timeout. The fix changes do_proc_control() and do_proc_bulk() to use a killable wait and GFP_KERNEL instead of GFP_NOIO. Connected advisories (Mir...

CVE-2022-49135

CVE-2022-49135 : In the Linux kernel, the vulnerability related to a memory leak in the drm/amd/display path has been resolved. The root cause was failure to release resources on the error handling path, leading to a memory leak. The fix adds a kfree call on the error path to ensure proper resour...

CVE-2022-49535

CVE-2022-49535 affects the Linux kernel SCSI lpfc path. The flaw can cause a use-after-free via premature node release when FLOGI/PLOGI handling fails or when non-zero ELS PLOGI status is processed if a dev-loss-evt work is pending. The described root cause is a premature decrementing of the ndlp...

CVE-2023-6039

CVE-2023-6039 : A use-after-free vulnerability in the Linux kernel’s LAN78XX USB Ethernet driver (lan78xx_disconnect in drivers/net/usb/lan78xx.c) can crash the system when a LAN78XX USB device is detached. The issue is local in scope and affects the network sub-system (net/usb/lan78xx). The CVE ...

CVE-2024-44961

Technical specifics for CVE-2024-44961 are not publicly provided in the connected documents. No affected product version, root cause, or fix details are confirmed here. Monitor for updates from vendors and security advisories.

CVE-2024-44962

The CVE affects the Linux kernel Bluetooth btnxpuart driver. Root cause: when unloading btnxpuart, a timer is not reliably shut down, so if the timer is modified during unload it may fire and invoke the timer callback after the driver is gone, causing a kernel panic. The fix is to replace del_tim...

CVE-2024-46716

The CVE-2024-46716 issue affects the Linux kernel dmaengine altera-msgdma, where descriptors were not correctly freed because of the cleanup path. The fix alters the freeing logic to move descriptor ownership from the chan cleanup path to msgdma_free_descriptor: remove the list_del from msgdma_ch...

CVE-2024-46813

CVE-2024-46813 affects the Linux kernel drm/amd/display code. The fix guards against out-of-bounds access by validating link_index before dereferencing dc->links[], where dc->links[] has a max size of MAX_LINKS; the issue could cause 3 overrun conditions and a resource leak, resolved by the...

CVE-2024-49915

CVE-2024-49915 concerns the Linux kernel DRM AMD display driver. A null pointer dereference could occur in drm/amd/display during dcn32_init_hw if dc->clk_mgr is null. The fix adds an explicit NULL check before invoking clk_mgr functions, preventing dereferencing a null pointer. Public referen...

CVE-2024-50012

The CVE-2024-50012 issue is in the Linux kernel cpufreq code. In parse_perf_domain, if of_parse_phandle_with_args returns an error, the initial reference to the CPU device node would not be decremented, potentially leaving a reference handling bug. The fix declares the CPU node variable with a cl...

CVE-2025-21833

CVE-2025-21833 : In the Linux kernel, the vulnerability affects iommu/vt-d logic where a NULL pointer could be dereferenced after a WARN_ON_ONCE if domain_remove_dev_pasid cannot find the pasid. The issue has been resolved in the kernel code path that avoids using a NULL pointer post-WARN_ON_ONCE...

CVE-2010-4080

CVE-2010-4080 affects the Linux kernel: snd_hdsp_hwdep_ioctl in sound/pci/rme9652/hdsp.c does not initialize a structure, enabling local attackers to leak kernel stack information via SNDRV_HDSP_IOCTL_GET_CONFIG_INFO. Affected products/versions: Linux kernel before 2.6.36-rc6. Impact is an inform...

CVE-2022-3113

Summary of CVE-2022-3113 : The issue is in the Linux kernel’s media/vcodec path, specifically mtk_vcodec_fw_vpu_init in drivers/media/platform/mtk-vcodec/mtk_vcodec_fw_vpu.c, where the return value of devm_kzalloc() is not checked, leading to a possible NULL pointer dereference. The vulnerability...

CVE-2022-48827

CVE-2022-48827 (Linux kernel NFSD READ near OFFSET_MAX) : The vulnerability arises when the client-side NFS read request is aligned to a server rsize of 0x1000 due to a buffer alignment change. This can cause a loff_t overflow on the server when reading near the maximum file offset, leading the s...

CVE-2022-48938

CVE-2022-48938 affects the Linux kernel CDC-NCM path. The issue arises when a broken device provides an extreme offset (e.g., 0xFFF0) with a plausible fragment length, allowing an integer overflow in the existing sanity check. The description states that both offset and offset + len must be check...

CVE-2022-49177

CVE-2022-49177 : In the Linux kernel, the cavium hwrng driver fix addresses a NULL pointer dereference in cavium RNG handling. The issue manifested as a NULL dereference of 'pdev' in cavium-rng-vf.c (line 182) when dereferenced, triggering a coccicheck warning. The upstream patch fixes the NULL-d...

CVE-2022-49537

CVE-2022-49537 is related to the Linux kernel SCSI lpfc path with CMF enabled. The issue arises from this_cpu_ptr() using smp_processor_id() in a preemptible context, leading to an invalid call trace (systemd-udevd 31711) and potential preemption-related bugs. The documented fix is to replace thi...

CVE-2023-53089

CVE-2023-53089 affects the Linux kernel ext4/xattr path. The issue occurs during eviction of inodes with extended attributes (EA) where ext4_xattr_delete_inode triggers a hang due to finding an EA inode (ea_inum = 15) that is in I_FREEING state and waiting for the EA inode’s deletion, causing an ...

CVE-2024-0775

CVE-2024-0775 describes a use-after-free in the Linux kernel’s ext4 remount path: __ext4_remount in fs/ext4/super.c. The flaw lets a local user cause an information leak by freeing old quota file names before a potential failure, resulting in a use-after-free. Relevant connected documents confirm...

CVE-2024-26644

CVE-2024-26644 : Linux kernel Btrfs snapshot logic fails when the source is a deleted subvolume. The code copies the source root item (including refs) to the new root item; since refs is 0 for a deleted subvolume, btrfs_get_new_fs_root() returns -ENOENT and the snapshot creation aborts. The docum...

CVE-2024-39495

The CVE-2024-39495 issue is a Linux kernel use-after-free in greybus gb_interface_release caused by a race with gb_interface_mode_switch_work. The fix, confirmed by multiple sources (e.g., Astra Linux advisory reflecting the same description), is to cancel the scheduled work before freeing the ob...

CVE-2024-42288

CVE-2024-42288 affects the Linux kernel SCSI qla2xxx driver. The root cause is an incorrect dereference of the Init Control Block (ICB), which could enable memory corruption. The fix Correctly dereferences the ICB to prevent memory corruption, as documented in the vulnerability description. The l...

CVE-2024-43913

The CVE pertains to the Linux kernel nvme apple driver, where improper device reference counting caused a memory leak on a tagset failure. The issue is resolved by correcting the flow: drivers must call nvme_uninit_ctrl after a successful nvme_init_ctrl, and the allocation path was split to simpl...

CVE-2024-46715

CVE-2024-46715: Linux kernel vulnerability in iio_info callback access where certain callbacks could be accessed without checks, leading to a NULL pointer dereference and potential kernel oops if a driver does not implement callbacks. The issue was fixed by adding missing validation for iio_info ...

CVE-2024-46744

The CVE-2024-46744 issue in the Linux kernel affects Squashfs by failing to sanity-check the symbolic link size read from disk. This causes the size (i_size) to be corrupted, which is later used to derive a length value that overflows a signed int in squashfs_symlink_read_folio(), leading to a po...

CVE-2024-46818

CVE-2024-46818 affects the Linux kernel’s DRM/AMD display driver. The root cause is using GPIO_ID_UNKNOWN (-1) as an array index; a patch adds a pre-check before indexing the gpio_id, fixing 5 Coverity-reported overrun issues. The vulnerability is addressed in kernel updates that include the drm/...

CVE-2024-49893

CVE-2024-49893 affects the Linux kernel DRM display path (drm/amd/display). The issue arises when dc_state_get_stream_status can return NULL, so stream_status must be checked before use. The patch fixes a NULL_RETURNS issue reported by Coverity by adding a NULL check before accessing stream_statu...

CVE-2024-49898

CVE-2024-49898 affects the Linux kernel’s drm/amd/display component. The root cause is that drr_timing and subvp_pipe are initialized to null and are not consistently re-assigned before being dereferenced, leading to two FORWARD_NULL issues reported by Coverity. The issue is addressed by kernel f...

CVE-2024-49908

CVE-2024-49908: In the Linux kernel, the AMDGPU display driver (amdgpu_dm) had a missing null check for theafb in amdgpu_dm_update_cursor, risking a null pointer dereference. The fix adds a null check and moves the check to the point of use (line where afb is accessed). Affects drm/amd/display co...

CVE-2024-49921

CVE-2024-49921 concerns the Linux kernel DRM display driver (drm/amd/display) specifically around null-pointer usage; fixes were applied to ensure pointers such as dc->clk_mgr are checked before use, addressing 10 FORWARD_NULL issues reported by Coverity. The connected OSV entries confirm patc...

CVE-2024-50193

CVE-2024-50193 affects the Linux kernel on x86. The vulnerability is in x86/entry_32 where CPU buffers were cleared after exc_nmi but before restoring registers. The fix moves CLEAR_CPU_BUFFERS to after RESTORE_ALL_NMI, addressing RDFS mitigation requirements. Public metrics show CVSS v3.1 base s...

CVE-2024-50242

CVE-2024-50242 affects the Linux kernel ntfs3 implementation. The issue is described as an “Additional check in ntfs_file_release” in the ntfs_file_release path, with CVSSv3.1: LOCAL, Low attack complexity, Low privileges required, UI: None, S:U, and metrics indicating high confidentiality, integ...

CVE-2025-37882

CVE-2025-37882 relates to a Linux kernel isochronous xHCI Ring handling race. The fix changes how xrun events are processed so that a TD queued at a ring position isn’t prematurely completed or warned about when the event TRB pointer can be NULL or a no-op. Triggering conditions include higher IR...

CVE-2009-4067

CVE-2009-4067 : A buffer overflow in the Auerswald Linux USB driver (function auerswald_probe ) for the Linux kernel is exploitable on kernel versions before 2.6.27. The vulnerability allows physically proximate attackers to execute arbitrary code, cause a denial of service, or take full control ...

CVE-2014-0069

The CVE-2014-0069 entry affects the Linux kernel (fs/cifs/file.c: cifs_iovec_write) up to version 3.13.5. The vulnerability stems from improper handling of uncached write operations that copy fewer bytes than requested, enabling local users to read kernel memory (information disclosure), cause me...

CVE-2014-9644

CVE-2014-9644 affects the Linux kernel Crypto API prior to 3.18.5. It allows a local user to load arbitrary kernel modules by abusing a bind() call on an AF_ALG socket with a module template expression (eg, vfat(aes)) in salg_name. This is a local, privilege-related issue, separate from CVE-2013-...

CVE-2017-16529

CVE-2017-16529 affects the Linux kernel’s snd_usb_create_streams in sound/usb/card.c, allowing a local attacker to trigger an out-of-bounds read and system crash via a crafted USB device, with impact described as a denial of service and potentially other effects. The issue is present in kernels p...

CVE-2021-47082

CVE-2021-47082 affects the Linux kernel tun/tun.c: a double-free in tun_free_netdev is caused by deferring dev->tstats and tun->security allocations to a new ndo_init routine (tun_net_init) that runs via register_netdevice(). If register_netdevice() fails, the destructor previously would no...

CVE-2022-48893

CVE-2022-48893 affects the Linux kernel's drm/i915/gt engine discovery. If driver initialization is aborted mid-gt/engine discovery, some engines stay incompletely set up and leak allocated objects because engine->release may be NULL. The entry notes a fix: drop the destroy_pinned_context() he...

CVE-2022-49297

CVE-2022-49297 is a Linux kernel vulnerability related to the NBD (network block device) disconnect flow that could cause IO hangs when a device is disconnected. The issue occurs in the NBD path during disconnect and socket clearing, with inflight requests potentially not completing due to how NB...

CVE-2022-49504

The CVE-2022-49504 issue affects the Linux kernel SCSI lpfc path, where after an external loopback test the system oopsed in llpfc_set_rrq_active() due to a mismanaged ABTS completion and ref counting. The root cause was a mixup in completing the new FLOGI/ABTS flow, causing the original ABTS to ...

CVE-2023-0240

CVE-2023-0240 relates to a logic error in Linux kernel io_uring that can trigger a use-after-free, enabling local privilege escalation. Specifically, in io_prep_async_work, the code may incorrectly use the init_cred or a previous identity if the final io_grab_identity returns false, causing refer...

CVE-2024-42097

CVE-2024-42097 relates to Linux kernel ALSA emux: patch ioctl data validation. The connected Nessus entries confirm the vulnerability and describe the fix as tightening validation in load_data() and length checks in load_guspatch() to ensure the specified patch length matches the data provided. T...