CVE-2011-2699

CVE-2011-2699 affects the Linux kernel IPv6 implementation. The vulnerability is that, before version 3.1, Fragment Identification values were not generated separately for each destination, enabling remote attackers to cause a denial of service by sending crafted packets. Connected advisories ref...

CVE-2011-3353

CVE-2011-3353 : In the Linux kernel, a buffer/length handling issue in fuse_notify_inval_entry (fs/fuse/dev.c) before 3.1 can allow a local attacker mounting a FUSE filesystem to trigger a BUG_ON and system crash, i.e., local denial of service. Public advisories (e.g., OpenSUSE, Red Hat/Oracle/Li...

CVE-2014-4655

CVE-2014-4655 affects the Linux kernel ALSA control path: snd_ctl_elem_add in sound/core/control.c does not correctly maintain user_ctl_count, enabling a local DoS via a large number of SNDRV_CTL_IOCTL_ELEM_REPLACE calls to /dev/snd/controlCX. Affected: Linux kernel prior to 3.15.2 (ALSA control ...

CVE-2015-8962

CVE-2015-8962: Double free in sg_common_write (drivers/scsi/sg.c) of the Linux kernel before 4.4. A local user can gain privileges or cause memory corruption/system crash by detaching a device during an SG_IO ioctl. Remediation: upgrade to Linux kernel 4.4+ or apply vendor patch; exploitation con...

CVE-2021-47348

A vulnerability exists in the Linux kernel 's drm/amd/display component, where the code was reading 8 bytes instead of the required 5 bytes from the actual target field. This over-read could lead to data corruption if the trailing 3 bytes were non-zero. The issue is specifically located in the va...

CVE-2022-48951

The CVE-2022-48951 vulnerability is in the Linux kernel ASoC path: snd_soc_put_volsw_sx() does bounds checks only for the first channel, allowing potential out-of-bounds writes to the second channel in stereo controls. This is fixed upstream by adding proper checks (e.g., kernel commits cf611d......

CVE-2022-49035

CVE-2022-49035 in the Linux kernel affects media: s5p_cec by not consistently limiting msg.len to CEC_MAX_MSG_SIZE. Root cause is the len check not enforced in all code paths, potentially enabling a corner-case that could impact availability (per CVSS: LOCAL, HIGH impact to availability; I/I/C = ...

CVE-2023-52561

The Linux kernel contains a vulnerability in the sdm845-db845c component on arm64 architecture. The issue is caused by a missing reserved memory region for the framebuffer memory (the splash memory region established by the bootloader). This defect can trigger a kernel panic (specifically an arm-...

CVE-2024-35936

CVE-2024-35936. In the Linux kernel, the btrfs relocation code (btrfs_relocate_sys_chunks) contains an unhandled corruption case in its chunk-tree lookup loop. The issue arises from two theoretically impossible conditions: (1) an inexact search yields a key with offset -1 for a chunk-tree item, a...

CVE-2024-42083

CVE-2024-42083 concerns the Linux kernel driver for Pensando Ionic NICs. It describes a multi-buffer handling bug in ionic_run_xdp() where jumbo frames with SG pages are not properly unmapped or page pointers reset for XDP_TX/XDP_REDIRECT, risking reuse of SG pages and a kernel panic (general pro...

CVE-2024-46730

CVE-2024-46730 affects the Linux kernel’s drm/amd/display path. The issue arises when an array index tg_inst could be -1 if timing_generator_count equals 0, allowing an overrun to occur. The description in the connected documents confirms the root cause and states that this fix prevents negative ...

CVE-2024-49972

CVE-2024-49972 affects the Linux kernel DRM-AMD display path. The issue arises when creating DML memory during DC state changes: if the DML memory allocation fails, previously allocated memory was not deallocated, leaving an uninitialized, non-NULL structure. The documented fix deallocates the me...

CVE-2024-50243

CVE-2024-50243 affects the Linux kernel ntfs3 path; the issue is a general protection fault in run_is_mapped_full leading to a local denial of service. The fix (and related NTFS attribute handling fix) was committed in the kernel; affected advisories reference kernel 6.1.x updates. Remediation is...

CVE-2010-2524

CVE-2010-2524 affects the Linux kernel CIFS DNS upcall: when CONFIG_CIFS_DFS_UPCALL is enabled, DNS resolution relies on a user keyring via the dns_resolver upcall in the cifs.upcall userspace helper. This allows local privileged or nearby users to spoof DNS query results and mount arbitrary CIFS...

CVE-2010-3080

CVE-2010-3080 is a double-free vulnerability in the Linux kernel’s snd_seq_oss_open() (sound/core/seq/oss/seq_oss_init.c) affecting kernels before 2.6.36-rc4. An unsuccessful open of /dev/sequencer could trigger kernel memory corruption, leading to local denial of service and potentially other im...

CVE-2010-3477

The CVE-2010-3477 issue affects the Linux kernel’s net/sched/act_police.c (tcf_act_police_dump) in versions before 2.6.36-rc4. The root cause is incomplete initialization of certain structure members during dump operations, allowing local users to read potentially sensitive kernel memory. The vul...

CVE-2010-4072

CVE-2010-4072 affects the Linux kernel: the copy_shmid_to_user function in ipc/shm.c (pre-2.6.37-rc1) does not initialize a certain structure, enabling local users to leak potentially sensitive information from kernel stack memory via the shmctl interface and the old shm interface. Affected produ...

CVE-2010-4649

The CVE-2010-4649 issue affects the Linux kernel up to 2.6.37, where an Integer overflow in ib_uverbs_poll_cq (drivers/infiniband/core/uverbs_cmd.c) allows a local user to cause memory corruption and a possible DoS or other unspecified impact when a structure member is large. The vulnerability re...

CVE-2011-2491

The CVE-2011-2491 issue affects the Linux kernel’s NFS client NLM protocol implementation. It allows a local attacker to cause a denial of service (system hang) by abusing a LOCK_UN flock system call. The vulnerability is rooted in the NLM handling in the kernel prior to 3.0. The referenced fix/c...

CVE-2012-6638

CVE-2012-6638 (Linux kernel) affects the tcp_rcv_state_process in net/ipv4/tcp_input.c and can cause a DoS due to a flood of SYN+FIN packets. The vulnerability exists in kernels before 3.2.24 and is fixed in the 3.2.24 update (per ChangeLog-3.2.24). Exploitation is described as remote and results...

CVE-2013-7339

The CVE-2013-7339 issue affects the Linux kernel up to version 3.12.7 (fixed in 3.12.8) where the rds_ib_laddr_check function in net/rds/ib.c allows a local attacker to trigger a NULL pointer dereference via a bind(2) call on an RDS socket on systems without RDS transports. This can cause a denia...

CVE-2014-4652

CVE-2014-4652 affects the Linux kernel ALSA sound subsystem. A race condition in the tlv handler (snd_ctl_elem_user_tlv) within sound/core/control.c before version 3.15.2 allows local users to read kernel memory via /dev/snd/controlCX. Impact is partial confidentiality of kernel memory. The vulne...

CVE-2018-25015

CVE-2018-25015 affects the Linux kernel up to version 4.14.15, with a use-after-free in net/sctp/socket.c when a lock is held after a peel-off (CID-a0ff660058b8). Exploitation details are not provided in the supplied documents, but CVSS v3 indicates a high impact. The ChangeLog entry for 4.14.16 ...

CVE-2022-48628

The CVE-2022-48628 entry concerns a Linux kernel issue in ceph: drop messages from MDS when unmounting. The description in the primary doc states that during unmount, dirty buffers are flushed and after the last OSD request finishes, the last i_count reference is released and dirty caps/snaps are...

CVE-2024-40981

CVE-2024-40981 – Linux kernel batman-adv : The vulnerability centers on batman-adv’s originator handling in batadv_purge_orig_ref(), where empty buckets can lead to soft lockups (CPU 0 stuck for long periods). The root cause is not publicly disclosed in the provided documents, but the fix is desc...

CVE-2024-41002

The connected documents confirm CVE-2024-41002 affects the Linux kernel crypto path for Hisilicon SEC (AIV resource) where releasing SEC resources could leak memory. The root cause is improper synchronization of AIV release with sec resource cleanup, leading to a memory leak when resources are fr...

CVE-2024-41068

CVE-2024-41068 – Linux kernel (s390 sclp_init cleanup) Affected: Linux kernel on s390. Root cause: sclp_init() could fail and leave sclp_state_change_event entries in sclp_reg_list, causing a list_add double add warning if multiple init attempts occur. Impact: local privilege or denial conditions...

CVE-2024-42076

The CVE-2024-42076 entry relates to the Linux kernel net/can/j1939 path, where j1939_send_one() allocated a full frame but did not initialize unused data, enabling a kernel-infoleak via raw_recvmsg() paths observed by syzbot. The root cause is uninitialized memory in the frame allocation (Bytes 1...

CVE-2024-44963

CVE-2024-44963 — Linux kernel (btrfs): The issue occurs in btrfs_free_tree_block() when freeing a tree block and an error occurs creating a delayed reference. Instead of handling the error, a BUG_ON() could trigger, causing space leakage if memory allocation fails or other errors propagate via bt...

CVE-2024-46803

In the Linux kernel, the drm/amdkfd component exposes a vulnerability where writing dbg_ev_file in interrupt context can execute after debug_trap_disable, risking a NULL pointer dereference. Root cause: the code path does not check debug_trap_enable before the write; the operation is performed vi...

CVE-2024-46811

CVE-2024-46811 affects the Linux kernel in the DRM/AMD display component. A potential out-of-bounds condition arises when accessing bw_params->clk_table.entries (8 entries) if soc.num_states can reach 40; the issue is fixed by asserting when soc.num_states exceeds 8 during fpu_update_bw_boundi...

CVE-2024-46823

CVE-2024-46823 concerns a Linux kernel issue in the kunit/overflow path for overflow_allocation_test. The root cause is that the local variable ‘device_name’ was used as a driver name outside its scope, causing a kernel panic when KASAN is enabled. The documented fix removes the out‑of‑scope usag...

CVE-2024-46832

CVE-2024-46832 involves the Linux kernel, specifically the MIPS cevt-r4k path. The issue arose when get_c0_compare_int was called if a timer IRQ was installed, which could trigger a WARN/BUG: sleeping function called from invalid context on secondary CPU. The patch changes the flow to avoid calli...

CVE-2024-49916

CVE-2024-49916 affects the Linux kernel’s drm/amd/display code (dcn401_init_hw). The root cause is a potential null pointer dereference when dc->clk_mgr or dc->clk_mgr->funcs is null. The fix adds explicit null checks before dereferencing clk_mgr/clk_mgr->funcs, preventing dereference...

CVE-2024-49932

The CVE-2024-49932 issue affects the Linux kernel by mis-handling readahead during Btrfs relocation when RAID stripe trees (RST) are involved. Relocation readahead on the relocation inode can return ENOENT, which is not handled by readahead and can submit invalid reads, triggering a kernel BUG in...

CVE-2024-50177

CVE-2024-50177 concerns the Linux kernel amdgpu display driver (DML2.1). The issue is a UBSAN shift-out-of-bounds triggered when programming phantom pipes and cursor_width is explicitly set to 0, causing an overflow in 32-bit size calculations. The published fix adds a guard to validate cursor wi...

CVE-2010-4157

CVE-2010-4157 involves an integer overflow in the Linux kernel’s GDTH SCSI driver (gdth_ioctl_alloc/ioc_general) on 64-bit platforms. A 32/64-bit mismatch when handling a large argument in an ioctl can cause memory corruption, enabling a local user to trigger a denial of service (and potentially ...

CVE-2017-2634

CVE-2017-2634 affects the Linux kernel DCCP implementation prior to 2.6.22.17, where the IPv4-only inet_sk_rebuild_header() function was used for both IPv4 and IPv6 DCCP connections. This can result in memory corruptions and allows a remote attacker to crash the system. Connected advisories confi...

CVE-2021-47203

CVE-2021-47203 concerns the Linux kernel SCSI lpfc driver. The description details a corruption in the lpfc_drain_txq() path where, if an adapter send fails, a local fail_msg is set and jobs are added to a completions list. Processing of subsequent jobs continues, and because fail_msg remains set...

CVE-2022-48982

CVE-2022-48982 affects the Linux kernel Bluetooth subsystem, specifically CSR fake controllers. The issue arises when a CSR 5.0 clone causes the suspend notifier to be registered twice, which can lead to a kernel panic during Bluetooth device probing (btusb/hci stack). The connected advisories an...

CVE-2022-49611

The CVE-2022-49611 entry refers to a Linux kernel x86 speculation mitigation: Fill RSB on vmexit for IBRS to prevent RSB underflow/poisoning. The description notes mitigation is implemented in the kernel and documents tribal knowledge about RSB attacks. Connected Nessus/OpenVAS entries for EulerO...

CVE-2023-52825

CVE-2023-52825 involves a race condition in the Linux kernel’s DRM/AMDKFD svm code where vram buffer unref (prange->svm_bo) can occur concurrently in mmu callbacks and a post-migrate callback to system RAM. The race may lead to use-after-free if the unref is performed unsafely across async tas...

CVE-2024-43883

CVE-2024-43883 is a Linux kernel vulnerability in the usb vhci-hcd subsystem. The issue is described as a race where the driver could carry stale references and may drop them before new references are gained. The description states this is resolved in the Linux kernel; the available connected con...

CVE-2024-46720

CVE-2024-46720 affects the Linux kernel; the issue is in the DRM AMDGPU path where a dereference after a null pointer check was fixed. The description from the initial document notes “drm/amdgpu: fix dereference after null check” and “check the pointer hive before use.” The connected Azure Linux ...

CVE-2024-50178

Technical details (affected component, root cause, versions, or exploit status) are not provided in the connected documents; the initial description summarizes the fix but lacks vendor/product specifics in the supplied material. Monitor for authoritative advisories for updates.

CVE-2025-21750

CVE-2025-21750 affects the Linux kernel wifi driver brcmfmac. The issue results from not validating the return value of of_property_read_string_index(), which can leave tmp uninitialized when a property is missing, leading to a kernel crash (BUG/OOPS) from passing a random pointer to devm_kstrdup...

CVE-2010-0307

CVE-2010-0307 affects the Linux kernel (x86_64) prior to 2.6.32.8 where load_elf_binary in fs/binfmt_elf.c may call SET_PERSONALITY before confirming the ELF interpreter exists, enabling a local DoS via a 32-bit process launching a 64-bit one and triggering a segmentation fault (flush_old_exec re...

CVE-2010-4083

CVE-2010-4083 affects the Linux kernel (pre-2.6.36). The vulnerable code path is copy_semid_to_user() in ipc/sem.c, where a structure is not initialized, enabling local attackers to leak kernel stack memory via semctl commands (IPC_INFO, SEM_INFO, IPC_STAT, SEM_STAT). The issue is mitigated by up...

CVE-2011-1044

CVE-2011-1044 affects the Linux kernel (pre-2.6.37) and is caused by ib_uverbs_poll_cq in drivers/infiniband/core/uverbs_cmd.c not initializing a certain response buffer. This allows local attackers to read potentially sensitive data from kernel memory via vectors that fill the buffer only partia...

CVE-2019-20422

The CVE-2019-20422 issue affects the Linux kernel prior to 5.3.4, where fib6_rule_lookup in net/ipv6/ip6_fib.c mishandles the RT6_LOOKUP_F_DST_NOREF flag in a reference-count decision, potentially causing a crash identified by syzkaller (CID-7b09c2d052db). The vulnerability arises from incorrect ...