CVE-2022-48853

The CVE-2022-48853 entry concerns a Linux kernel swiotlb information leak when using DMA_FROM_DEVICE during SCSI SG I/O. The description explains a multi-step scenario where a bounce buffer and swiotlb can expose non-zero data from user space, potentially leaking content when the TUR (Test Unit R...

CVE-2022-49279

CVE-2022-49279 targets the Linux kernel NFSD on 32-bit systems, where the operation len * sizeof(*p) can overflow, potentially causing kernel instability (A high impact/DoS) with local attack capability. Public advisories (Astra Linux, Tencent Linux, etc.) discuss the 32‑bit overflow and show tha...

CVE-2022-49564

CVE-2022-49564 affects the Linux kernel crypto/qat DH path. The vulnerability arises when copying a source scatterlist into a linear buffer, where a source buffer larger than the key size could trigger an integer underflow. The fix adds parameter checks for DH and rejects such requests, mitigatin...

CVE-2022-49885

CVE-2022-49885 is a Linux kernel vulnerability in ACPI APEI where ghes_estatus_pool_init() can overflow due to signed integer math during len calculation (len += (num_ghes * GHES_ESOURCE_PREALLOC_MAX_SIZE)). The root cause is using int for num_ghes, which can overflow and cause subsequent vmalloc...

CVE-2023-51782

The CVE-2023-51782 issue affects the Linux kernel (net/rose/af_rose.c) and is a use-after-free in rose_ioctl caused by a race in rose_accept. Affected versions are before 6.6.8. The vulnerability can lead to local privilege escalation or kernel crash. Mitigation: upgrade to Linux kernel 6.6.8 or ...

CVE-2023-52481

In the Linux kernel, the following vulnerability has been resolved: arm64: errata: Add Cortex-A520 speculative unprivileged load workaround Implement the workaround for ARM Cortex-A520 erratum 2966298. On anaffected Cortex-A520 core, a speculatively executed unprivileged loadmight leak data from ...

CVE-2024-26942

CVE-2024-26942 (Linux kernel) affects the qcom at803x PHY driver (at8031) in the Linux kernel. The root cause is a NULL dereference where the private data (priv) is referenced before it has been allocated during the driver’s rework/split, causing a kernel panic when probing at8031. The fix ensure...

CVE-2024-41078

CVE-2024-41078 (Linux kernel, btrfs qgroup) fixes a quota root leak that occurs if quota disable cleanup fails, leaking the quota root via fs_info->quota_root. The root cause is a missing btrfs_put_root() on the out path when dropping quota root references; a NULL assignment previously happene...

CVE-2024-50285

The CVE-2024-50285 issue affects the ksmbd component of the Linux kernel. When a client sends simultaneous SMB requests to ksmbd, memory can be exhausted via the ksmbd_work_cache, leading to an Out-Of-Memory condition. The root cause is insufficient handling of concurrent SMB operations despite a...

CVE-2024-54458

The CVE-2024-54458 issue is in the Linux kernel, involving the SCSI/ufs subsystem (bsg path). The root cause is not fully described beyond the fix: after removing the bsg_queue, it should be set to NULL to avoid potential use-after-free (UAF). The advisory states this vulnerability has been resol...

CVE-2025-37852

CVE-2025-37852 affects the Linux kernel DRM/AMDGPU stack. The root cause is errors from amdgpu_cgs_create_device() in amd_powerplay_create(), which could lead to a null pointer dereference if not handled. The fix propagates the failure to the caller, releases the hwmgr, and returns -ENOMEM instea...

CVE-2010-3848

CVE-2010-3848 is a Linux kernel vulnerability: a stack-based buffer overflow in econet_sendmsg (net/econet/af_econet.c) when Econet is configured, caused by handling a large number of iovec structures. This allows local privilege escalation. The flaw affects Linux kernels before 2.6.36.2 and is a...

CVE-2010-3877

The CVE-2010-3877 issue affects the Linux kernel (as cited in MiracleLinux AXSA:2011-143:02 and related advisories) where get_name in net/tipc/socket.c does not initialize a structure, enabling local attackers to read uninitialized kernel stack memory and leak information. Impact is a local infor...

CVE-2010-4163

The CVE-2010-4163 issue affects the Linux kernel, where blk_rq_map_user_iov in block/blk-map.c is vulnerable before version 2.6.36.2. A local attacker can trigger a denial of service (kernel panic) by submitting a zero-length I/O request via a device ioctl to a SCSI device. The description explic...

CVE-2017-16531

CVE-2017-16531 affects the Linux kernel before 4.13.6, where the driver/usb/core/config.c path allows a local user to trigger an out-of-bounds read via a crafted USB device, related to the USB_DT_INTERFACE_ASSOCIATION descriptor. Exploitation could cause a denial of service (kernel crash) and pot...

CVE-2019-18806

CVE-2019-18806 : A memory leak in the Linux kernel's ql_alloc_large_buffers() (drivers/net/ethernet/qlogic/qla3xxx.c) before 5.3.5 can be triggered by pci_dma_mapping_error() failures, allowing a local attacker to exhaust memory and cause a denial of service. The issue is rooted in qla3xxx leak b...

CVE-2022-34495

CVE-2022-34495: In the Linux kernel, rpmsg_probe in drivers/rpmsg/virtio_rpmsg_bus.c before 5.18.4 is reported to contain a double free. Affected product/version examples include upstream Linux kernels updated to 5.18.4 or later. The connected sources (e.g., Astra Linux security bulletin and vend...

CVE-2022-49298

CVE-2022-49298 : Linux kernel staging rtl8712 driver fix for uninitialized mac[6] in r871xu_drv_init() after tmpU1b from r8712_read8(padapter, EE_9346CR) == 0. KMSAN reported uninit-value in that function and call chain (usb_intf.c:541; usb_probe_interface; device probing). Concrete details are p...

CVE-2022-49311

CVE-2022-49311 concerns a deadlock in the Linux kernel driver rtl8192bs (rtw_joinbss_event_prehandle) where a timer deletion under a spin_lock_bh caused a timer handler to wait on the same lock. The issue manifested as two threads blocking each other, risking an infinite hang. The documented fix ...

CVE-2022-49313

CVE-2022-49313 : Linux kernel patch fixes a deadlock in usb host oxu_bus_suspend(). The issue arises when oxu_bus_suspend() holds oxu->lock while waiting for a timer to stop via del_timer_sync(), but the timer handler also needs the same lock, causing a potential deadlock. The patch removes de...

CVE-2024-26844

Linux kernel vulnerability CVE-2024-26844 was resolved by patching the block layer to address a harmful iov_iter direction issue. A Syzkaller warning reported that an iov_iter could be used in both directions due to a transfer direction SG_DXFER_TO_FROM_DEV, which would copy user buffers into the...

CVE-2024-35935

CVE-2024-35935 – Linux kernel (btrfs: send: handle path ref underflow in header iterate_inode_ref()) Connected documents confirm a concrete fix in the Linux kernel: when building a path buffer for iterate_inode_ref(), a BUG_ON-based path underflow handling was replaced with proper error handling ...

CVE-2024-39468

CVE-2024-39468 : Linux kernel SMB/CIFS client deadlock in smb2_find_smb_tcon() fixed by unlocking cifs_tcp_ses_lock before calling cifs_put_smb_ses(). Affected component is the SMB client in the kernel; deadlock could occur locally via SMB2 TCON handling. Public references point to kernel.org sta...

CVE-2024-40980

CVE-2024-40980 concerns the Linux kernel: in drop_monitor, a spin_lock is used inside trace_drop_common() with preemption disabled, which can sleep in RT contexts. The vulnerability arises from acquiring a spin_lock while in a preempt-disabled/RT path, causing a potential sleeping-in-atomic conte...

CVE-2024-46717

CVE-2024-46717 relates to the Linux kernel mlx5e SHAMPO header handling. The bug caused SHAMPO header pages to be released more than once when a data page was used for a non-SHAMPO header, due to releasing a SHAMPO header page from header_index after a non-header data page was formed into a new s...

CVE-2024-49926

CVE-2024-49926 affects the Linux kernel’s rcu-tasks path (rcu_tasks_need_gpcb). The root cause is an access to a non-existent percpu rtpcp variable when CONFIG_FORCE_NR_CPUS=y, causing nr_cpu_ids to resolve to NR_CPUS instead of the number of possible CPUs, which can lead to a kernel page fault a...

CVE-2010-2495

CVE-2010-2495 affects the Linux kernel’s L2TP implementation (pppol2tp.c). The vulnerability arises from improper validation of certain interface-related values in pppol2tp_xmit, enabling a NULL pointer dereference and an OOPs that can cause a denial of service via routing-change vectors. The iss...

CVE-2011-2723

CVE-2011-2723 affects the Linux kernel prior to 2.6.39.4 where the skb_gro_header_slow handling under GRO can reset fields incorrectly, enabling remote attackers to cause a denial of service (system crash) via crafted network traffic. Connected advisories confirm this CVE is referenced alongside ...

CVE-2012-1090

CVE-2012-1090 affects the Linux kernel: the cifs_lookup function in fs/cifs/dir.c can trigger a local denial of service (OOPS) when a local user accesses a specially crafted file (e.g., a FIFO). The issue exists in kernel versions prior to 3.2.10. Exploitation requires local access. The documente...

CVE-2021-47576

CVE-2021-47576 concerns the Linux kernel SCSI subsystem, specifically the scsi_debug driver. The issue is a use-after-free (UAF) caused by insufficient validation of the block descriptor length in resp_mode_select(), leading to a KASAN crash (Read of size 1) in resp_mode_select() and related SCSI...

CVE-2023-0160

CVE-2023-0160 corresponds to a deadlock in the Linux kernel BPF subsystem that can be exploited locally to crash the system. Connected documents confirm the issue arises in the kernel’s eBPF/BPF path and affect Linux kernel versions including Astra Linux references to linux-5.10/5.15. The Amazon ...

CVE-2023-52584

A Use-After-Free (UAF) vulnerability exists in the Linux kernel 's spmi: mediatek driver. The issue occurs in the mtk_spmi_remove() function within drivers/spmi/spmi-mtk-pmif.c because the spmi_controller is freed before the devres (including clocks) are cleaned up. This allows the system to acce...

CVE-2024-22705

The CVE CVE-2024-22705 affects ksmbd in the Linux kernel prior to 6.6.10. It is caused by an issue in smb2_get_data_area_len (fs/smb/server/smb2misc.c) where the relationship between Name data and CreateContexts data can lead to an out-of-bounds access in smb_strndup_from_utf16. This is a local i...

CVE-2024-41069

CVE-2024-41069 is a Linux kernel vulnerability in ASoC topology where references to freed memory were fixed. The changelog entries indicate root cause was pointers into topology file contents after parsing and releasing memory; the fix allocates memory via devm_kmemdup() to avoid dereferencing fr...

CVE-2024-44977

In CVE-2024-44977, the Linux kernel module drm/amdgpu is affected by a missing TA binary size validation that could allow an out-of-bounds write. The issue is resolved by adding TA binary size validation to the TA handling path. The fix was cherry-picked from commit c0a04e3570d72aaf090962156ad085...

CVE-2024-46719

CVE-2024-46719 (Linux kernel) addresses a NULL pointer dereference in the USB Type-C UCSI code. The root cause is that ucsi_register_altmode considers NULL a valid alt pointer and, when CONFIG_TYPEC_DP_ALTMODE is disabled, ucsi_register_displayport can return NULL, leading to a NULL pointer deref...

CVE-2025-38234

CVE-2025-38234 affects the Linux kernel scheduler, specifically a race in sched/rt: push_rt_task that can mishandle task migration when waking up and queuing on another CPU’s runqueue. The root cause involves find_lock_lowest_rq taking double locks and potential lock drop/reacquisition, creating ...

CVE-2010-3698

The CVE-2010-3698 entry concerns the KVM implementation in Linux kernels prior to 2.6.36. The root cause is that the kernel does not properly reload the FS and GS segment registers when handling KVM_RUN with a modified Local Descriptor Table (LDT). Impact: host OS users can cause a denial of serv...

CVE-2010-3849

CVE-2010-3849 affects the Linux kernel’s econet_sendmsg path (net/econet/af_econet.c) prior to 2.6.36.2, when an Econet address is configured. A local user can trigger a denial of service by issuing a sendmsg with a NULL remote address, causing a NULL pointer dereference and OOPS. The correspondi...

CVE-2010-4075

The CVE-2010-4075 entry affects the Linux kernel module code: uart_get_count (drivers/serial/serial_core.c) in versions prior to 2.6.37-rc1. The vulnerability arises from not properly initializing a certain structure member, enabling local users to read potentially sensitive information from kern...

CVE-2010-4164

CVE-2010-4164 affects the Linux kernel prior to 2.6.36.2, where multiple integer underflows occur in the x25_parse_facilities function (net/x25/x25_facilities.c). This can allow a remote attacker to cause a denial of service (system crash) via malformed X.25 facility data (X25_FAC_CLASS_A/B/C/D)....

CVE-2011-1010

Concretely, CVE-2011-1010 is reported in MiracleLinux advisory AXSA:2011-282:05 as affecting kernel-2.6.18-238.2.AXS3. It describes a buffer overflow in the mac_partition function (fs/partitions/mac.c) of the Linux kernel, prior to version 2.6.37.2, which can allow a local user to cause a denial ...

CVE-2017-15102

CVE-2017-15102 originates from the Linux kernel prior to 4.8.1, where the tower_probe function in drivers/usb/misc/legousbtower.c can be exploited locally by a near-physically proximate attacker via a crafted USB device. The issue is triggered by a write-what-where condition that arises after a r...

CVE-2021-47379

The CVE-2021-47379 entry describes a kernel vulnerability in the Linux blk-cgroup subsystem related to a use-after-free (UAF) in the block I/O scheduler. The issue arises when destroying the blkcg policy hierarchy, where the BFQ/BLK MQ path can trigger a use-after-free during queue initialization...

CVE-2022-49325

CVE-2022-49325 (Linux kernel) : The vulnerability concerns the TCP path where tp->snd_cwnd can be illegal (zero or negative) values. The fix adds accessors to read/set tp->snd_cwnd to catch illegal values earlier; syzbot previously triggered WARN_ON_ONCE(!tp->prior_cwnd) in a commit that...

CVE-2023-52789

CVE-2023-52789 : In the Linux kernel, the vulnerability affects the tty/vcc path (vcc_probe). The root cause is failure to check the return value of kstrdup(), risking a NULL pointer dereference. The fix adds a check for kstrdup() and returns an error if it fails. This resolves the issue by preve...

CVE-2023-52818

CVE-2023-52818 affects the Linux kernel: drm/amd/ SMU7 UBSAN array-index-out-of-bounds due to pptable structs with flexible array sizes. The fix changes pptable structs to use flexible arrays. Impact is high with local, low-privilege exploitation potential as per the description. Remediation: app...

CVE-2024-46842

CVE-2024-46842 is a Linux kernel SCSI lpfc issue. The mailbox command cleanup in lpfc_get_sfp_info does not correctly handle MBX_TIMEOUT, causing the same mailbox memory region to reference freed memory if firmware provides SFP information later. The root cause is failure to properly handle MBX_T...

CVE-2025-37948

CVE-2025-37948 affects the Linux kernel arm64 and is fixed by adding a BHB mitigation in the epilogue of BPF programs (cBPF) loaded via seccomp. The vulnerability arises when a classic cBPF program manipulates the branch history to influence speculative execution. The published details indicate t...

CVE-2010-3880

CVE-2010-3880 affects the Linux kernel (net/ipv4/inet_diag.c) prior to 2.6.37-rc2. The issue is improper auditing of INET_DIAG bytecode, enabling a local user to trigger a kernel infinite loop and cause a denial of service via crafted INET_DIAG_REQ_BYTECODE instructions in a netlink message conta...