CVE-2010-4164

CVE-2010-4164 affects the Linux kernel prior to 2.6.36.2, where multiple integer underflows occur in the x25_parse_facilities function (net/x25/x25_facilities.c). This can allow a remote attacker to cause a denial of service (system crash) via malformed X.25 facility data (X25_FAC_CLASS_A/B/C/D)....

CVE-2010-4649

The CVE-2010-4649 issue affects the Linux kernel up to 2.6.37, where an Integer overflow in ib_uverbs_poll_cq (drivers/infiniband/core/uverbs_cmd.c) allows a local user to cause memory corruption and a possible DoS or other unspecified impact when a structure member is large. The vulnerability re...

CVE-2011-1010

Concretely, CVE-2011-1010 is reported in MiracleLinux advisory AXSA:2011-282:05 as affecting kernel-2.6.18-238.2.AXS3. It describes a buffer overflow in the mac_partition function (fs/partitions/mac.c) of the Linux kernel, prior to version 2.6.37.2, which can allow a local user to cause a denial ...

CVE-2011-4330

CVE-2011-4330 describes a stack-based buffer overflow in the Linux kernel 2.6, specifically in hfs_mac2asc (fs/hfs/trans.c). A crafted HFS image len field can be used by a local user to trigger a crash and, per the description, possibly execute arbitrary code. The associated connected documents c...

CVE-2021-47435

CVE-2021-47435 affects the Linux kernel device-mapper (dm) path, causing a crash via a NULL pointer dereference during IO completion. The issue stems from dm_io_dec_pending() calling end_io_acct() before the in-flight pending count is decremented, and a race if a DM table swap happens concurrentl...

CVE-2021-47498

The CVE-2021-47498 issue affects the Linux kernel where Device Mapper requests could be requeued during DM suspend due to blk-mq unquiesce calls from outside events, causing a kernel panic under nr_requests updates. The fix changes behavior to avoid queuing during suspend and to requeue requests ...

CVE-2022-49033

CVE-2022-49033 affects the Linux kernel’s btrfs qgroup code, where a sleep was performed in an invalid context during qgroup inheritance. The advisory and connected documents describe the fix as: call qgroup_dirty() on the destination qgroup and update the limit item in btrfs_run_qgroups() later,...

CVE-2022-49152

CVE-2022-49152 affects the Linux kernel XArray feature, specifically the xas_create_range() path. When an existing entry with order >= XA_CHUNK_SHIFT is present, xas_create_range() can misinterpret it as a node and dereference xa_node->parent, potentially causing a crash (general protection...

CVE-2023-1193

CVE-2023-1193 : A use-after-free in setup_async_work within the Linux kernel’s KSMBD in-kernel Samba/CIFS stack can crash systems via access to freed work. Affected component: Linux kernel (Samba server/CIFS). Root cause: use-after-free in setup_async_work. Impact: potential denial of service thr...

CVE-2023-51782

The CVE-2023-51782 issue affects the Linux kernel (net/rose/af_rose.c) and is a use-after-free in rose_ioctl caused by a race in rose_accept. Affected versions are before 6.6.8. The vulnerability can lead to local privilege escalation or kernel crash. Mitigation: upgrade to Linux kernel 6.6.8 or ...

CVE-2023-52479

The CVE-2023-52479 issue is in the Linux kernel ksmbd SMB2 oplock handling, where a use-after-free occurs due to not dropping a reference to opinfo after smb20_oplock_break_ack. The provided documents state that the fix is to drop the reference after use of opinfo, resolving the use-after-free. T...

CVE-2024-42074

CVE-2024-42074 pertains to the Linux kernel’s ASoC AMD ACP driver. When the acp platform device creation is skipped, chip->chip_pdev can be NULL, leading to a potential NULL pointer dereference in snd_acp_resume. The connected Nessus/NASL entries confirm the root cause and describe the fix: ad...

CVE-2024-43855

CVE-2024-43855 is a Linux kernel vulnerability in the md (RAID) subsystem where a deadlock could occur while an mddev is suspended and a flush bio is in progress. The connected docs describe the root cause as non-atomic increment/decrement of the active_io counter during the md flush sequence, en...

CVE-2024-46702

CVE-2024-46702 (Linux kernel) relates to Thunderbolt: when a router is removed, the code previously blocked cleanup of XDomain paths due to tb_disconnect_xdomain_paths() racing with tb_stop() during host router NVM upgrade. The fix marks the XDomain as unplugged during removal, allowing tb_stop()...

CVE-2024-46804

CVE-2024-46804 affects the Linux kernel’s DRM/AMD display path, specifically HDCP DDC access. The vulnerability stems from an array index overrun due to not validating the index, which could lead to overrun/W earlier reports. The fix adds proper checks: validate the message id (msg_id) and ensure...

CVE-2024-46813

CVE-2024-46813 affects the Linux kernel drm/amd/display code. The fix guards against out-of-bounds access by validating link_index before dereferencing dc->links[], where dc->links[] has a max size of MAX_LINKS; the issue could cause 3 overrun conditions and a resource leak, resolved by the...

CVE-2024-46818

CVE-2024-46818 affects the Linux kernel’s DRM/AMD display driver. The root cause is using GPIO_ID_UNKNOWN (-1) as an array index; a patch adds a pre-check before indexing the gpio_id, fixing 5 Coverity-reported overrun issues. The vulnerability is addressed in kernel updates that include the drm/...

CVE-2024-49988

The CVE-2024-49988 issue concerns the ksmbd kernel SMB server: during an oplock break, opinfo->conn could be used after ksmbd_conn is freed in multichannel scenarios. The fix adds a reference count to ksmbd_conn to ensure it is not freed while still in use. This is a Linux kernel-level vulnera...

CVE-2025-22037

CVE-2025-22037 affects the Linux kernel’s ksmbd component. The issue is a null pointer dereference in alloc_preauth_hash triggered when a client sends a malformed SMB2 negotiate request, allowing a subsequent session setup before conn->preauth_info is allocated. A patch introduces KSMBD_SESS_N...

CVE-2025-37805

CVE-2025-37805 (Linux kernel) : The issue arises in sound/virtio (virtio_snd) during probe/remove sequences, where uninitialized sub-structures could trigger cancel_work_sync on an uninitialized work_struct, leading to a warning trace in kernel/workqueue.c. The fix (as discussed in the connected ...

CVE-2009-3002

CVE-2009-3002 affects the Linux kernel prior to 2.6.31-rc7, where getname() implementations for IrDA, AppleTalk DDP, NET/ROM, and ROSE (and related sockets) did not initialize certain data structures before copying to user-space. This allowed a local user to leak information by calling getsocknam...

CVE-2010-3698

The CVE-2010-3698 entry concerns the KVM implementation in Linux kernels prior to 2.6.36. The root cause is that the kernel does not properly reload the FS and GS segment registers when handling KVM_RUN with a modified Local Descriptor Table (LDT). Impact: host OS users can cause a denial of serv...

CVE-2010-3848

CVE-2010-3848 is a Linux kernel vulnerability: a stack-based buffer overflow in econet_sendmsg (net/econet/af_econet.c) when Econet is configured, caused by handling a large number of iovec structures. This allows local privilege escalation. The flaw affects Linux kernels before 2.6.36.2 and is a...

CVE-2011-2699

CVE-2011-2699 affects the Linux kernel IPv6 implementation. The vulnerability is that, before version 3.1, Fragment Identification values were not generated separately for each destination, enabling remote attackers to cause a denial of service by sending crafted packets. Connected advisories ref...

CVE-2015-3290

The connected Astra Linux bulletin describes CVE-2015-3290 in the Linux kernel context and confirms the vulnerability fix: limiting the Haswell performance counter period to mitigate NMI-related privilege escalation. It documents that the issue stemmed from a too-small initial frequency-estimatio...

CVE-2019-20422

The CVE-2019-20422 issue affects the Linux kernel prior to 5.3.4, where fib6_rule_lookup in net/ipv6/ip6_fib.c mishandles the RT6_LOOKUP_F_DST_NOREF flag in a reference-count decision, potentially causing a crash identified by syzkaller (CID-7b09c2d052db). The vulnerability arises from incorrect ...

CVE-2021-47082

CVE-2021-47082 affects the Linux kernel tun/tun.c: a double-free in tun_free_netdev is caused by deferring dev->tstats and tun->security allocations to a new ndo_init routine (tun_net_init) that runs via register_netdevice(). If register_netdevice() fails, the destructor previously would no...

CVE-2023-4458

CVE-2023-4458 affects the Linux kernel ksmbd module, specifically in the parsing of extended attributes. The flaw stems from insufficient validation of user-supplied data, allowing an out-of-bounds read (read past the end of an allocated buffer) and enabling information disclosure on affected sys...

CVE-2023-52699

In CVE-2023-52699, the Linux kernel SysV locking flaw caused sleep in atomic context because sb_bread() was invoked with pointers_lock held. The root cause spans historical locking changes: replacing BKL with a sysvfs-private rwlock (Linux 2.5.12) introduced a write_lock → read_lock deadlock; the...

CVE-2023-52932

The CVE-2023-52932 issue concerns the Linux kernel mm/swapfile get_swap_pages(), where a plist_for_each_entry_safe() loop could loop tens of thousands of times under memory pressure, risking soft lockup. The fix adds cond_resched() into get_swap_pages() when space isn’t found, addressing softlock...

CVE-2024-35875

CVE-2024-35875 concerns the Linux kernel’s x86/coco RNG seeding feature. The affected area requires seeding the RNG with 256 bits of RDRAND data at boot for CoCo systems, because the CoCo threat model assumes an untrusted host and limited entropy sources. If RDRAND is broken or unavailable, the i...

CVE-2024-42297

CVE-2024-42297 affects the Linux kernel’s f2fs filesystem. The root cause is a path that dirties an inode (FI_DIRTY_INODE) during operations on a read‑only filesystem, leading to a kernel panic in f2fs_evict_inode when unmounting. The provided details trace the sequence from do_sys_open → f2fs_lo...

CVE-2024-46815

CVE-2024-46815 affects the Linux kernel's DRM/AMD display code. The issue arises when accessing reader_wm_sets[] without validating num_valid_sets, which could yield a negative index and an OVERRUN. The description and connected advisories consistently state the fix was to check num_valid_sets be...

CVE-2024-49906

CVE-2024-49906 has concrete remediation on Root OS (rootio-linux) for Ubuntu 22.04 and Debian 11/12. The OSV entries indicate Root has patched CVE-2024-49906 in the rootio-linux package across multiple distributions with multiple fixed versions available. Ubuntu Security Notices and Debian/Ubuntu...

CVE-2025-37801

Summary: CVE-2025-37801 affects the Linux kernel driver for SPI on i.MX cores. The root cause is that after spi_imx_setupxfer() returns an error, spi_imx->rx and spi_imx->tx function pointers may be NULL, leading to a NULL pointer dereference during SPI transfers (spi_imx_pio_transfer , etc...

CVE-2010-2495

CVE-2010-2495 affects the Linux kernel’s L2TP implementation (pppol2tp.c). The vulnerability arises from improper validation of certain interface-related values in pppol2tp_xmit, enabling a NULL pointer dereference and an OOPs that can cause a denial of service via routing-change vectors. The iss...

CVE-2010-3849

CVE-2010-3849 affects the Linux kernel’s econet_sendmsg path (net/econet/af_econet.c) prior to 2.6.36.2, when an Econet address is configured. A local user can trigger a denial of service by issuing a sendmsg with a NULL remote address, causing a NULL pointer dereference and OOPS. The correspondi...

CVE-2014-4652

CVE-2014-4652 affects the Linux kernel ALSA sound subsystem. A race condition in the tlv handler (snd_ctl_elem_user_tlv) within sound/core/control.c before version 3.15.2 allows local users to read kernel memory via /dev/snd/controlCX. Impact is partial confidentiality of kernel memory. The vulne...

CVE-2017-15102

CVE-2017-15102 originates from the Linux kernel prior to 4.8.1, where the tower_probe function in drivers/usb/misc/legousbtower.c can be exploited locally by a near-physically proximate attacker via a crafted USB device. The issue is triggered by a write-what-where condition that arises after a r...

CVE-2022-49300

CVE-2022-49300 affects the Linux kernel nbd subsystem. A race occurs when the nbd module is removed: nbd_genl_connect() may call nbd_alloc_config() concurrently, and although try_module_get() can fail, nbd_alloc_config() previously did not handle that. This can cause leakage of nbd_config and rel...

CVE-2022-49301

CVE-2022-49301 : In the Linux kernel, the staging rtl8712 USB driver has a bug where, if r8712_usbctrl_vendorreq() returns a negative value, data in usb_read8/16/32 is not initialized, triggering KMSAN uninitialized-value reports. Connected advisories reference fixes in the kernel (e.g., commits ...

CVE-2023-52586

CVE-2023-52586 : In the Linux kernel DRM MSM DPU, a race between vblank enable/disable from different threads existed due to missing synchronization. The fix adds a mutex around control vblank IRQ handling (and removes vblank_ctl_lock usage), replacing an atomic refcount with a simple int counter...

CVE-2024-35949

CVE-2024-35949 affects the Linux kernel's btrfs subsystem. The root cause was that WRITTEN was not ensured on all metadata blocks, allowing potential corruption if extended leaf checks were skipped for blocks without WRITTEN. The fix adds checks to ensure WRITTEN is set and guarantees that __btrf...

CVE-2024-38661

CVE-2024-38661 is a Linux kernel vulnerability affecting the s390/ap subsystem. The issue stems from using signed int for internal bitmap-related variables in ap_parse_bitmap_str, allowing overflow during updates to /sys/bus/ap/apmask and related fields, which could trigger a kernel panic (panic_...

CVE-2024-42161

Technical details about CVE-2024-42161 are not publicly provided in the connected documents. The description mentions a Linux kernel BPF_CORE_READ_BITFIELD uninitialized value fix and a patch to initialize val, but there are no explicit affected products/versions or remediation steps beyond the p...

CVE-2024-43913

The CVE pertains to the Linux kernel nvme apple driver, where improper device reference counting caused a memory leak on a tagset failure. The issue is resolved by correcting the flow: drivers must call nvme_uninit_ctrl after a successful nvme_init_ctrl, and the allocation path was split to simpl...

CVE-2024-46714

CVE-2024-46714 in the Linux kernel is addressed by a fix in the DRM/AMD display path: the code now skips the wbscl_set_scaler_filter when the filter is null, preventing a potential NULL return from wbscl_get_filter_coeffs_16p from causing a null dereference. A null check was added to ensure filte...

CVE-2024-46716

The CVE-2024-46716 issue affects the Linux kernel dmaengine altera-msgdma, where descriptors were not correctly freed because of the cleanup path. The fix alters the freeing logic to move descriptor ownership from the chan cleanup path to msgdma_free_descriptor: remove the list_del from msgdma_ch...

CVE-2024-49918

CVE-2024-49918 relates to a Linux kernel issue in the AMD display path (drm/amd/display) where dcn32_acquire_idle_pipe_for_head_pipe_in_layer could dereference a null head_pipe. The fix adds a null check and returns NULL if head_pipe is null, preventing a potential NPE. Connected sources corrobor...

CVE-2024-49940

CVE-2024-49940 (Linux kernel) affects the l2tp code path and describes a tunnel refcount underflow window during session creation and tunnel refcount handling. Root cause details: a backpointer from a session to its tunnel is set in l2tp_session_create before the tunnel refcount is incremented by...