CVE-2024-40987

Mode C: The CVE-2024-40987 issue affects the Linux kernel's DRM/amdgpu driver, where a UBSAN warning in kv_dpm.c is fixed by adding a bounds check for sumo_vid_mapping_entry. The patch targets the root cause (bounds check failure) and reports the fix as part of the kernel update. Public reference...

CVE-2024-43883

CVE-2024-43883 is a Linux kernel vulnerability in the usb vhci-hcd subsystem. The issue is described as a race where the driver could carry stale references and may drop them before new references are gained. The description states this is resolved in the Linux kernel; the available connected con...

CVE-2024-44969

CVE-2024-44969 affects the Linux kernel, specifically the s390/sclp path. If a task waiting for a Store Data operation is interrupted and the halt attempt fails due to hardware/firmware issues, the SCLP facility might later store data into buffers referenced by the original operation. The fix pre...

CVE-2024-46749

CVE-2024-46749 affects the Linux kernel Bluetooth driver btnxpuart. The vulnerability stems from a NULL pointer dereference in btnxpuart_flush(), which could crash the kernel when removing the driver after a failed or incomplete firmware download. The fix adds a guard before freeing rx->skb in...

CVE-2024-46811

CVE-2024-46811 affects the Linux kernel in the DRM/AMD display component. A potential out-of-bounds condition arises when accessing bw_params->clk_table.entries (8 entries) if soc.num_states can reach 40; the issue is fixed by asserting when soc.num_states exceeds 8 during fpu_update_bw_boundi...

CVE-2024-50091

Summary: CVE-2024-50091 affects the Linux kernel driver path for dm-vdo, where the code may examine a dedupe_context pointer after ownership is lost. The vulnerability arises from not clearing the dedupe_context pointer in data_vio when ownership changes, enabling a potential misuse if the pointe...

CVE-2010-4083

CVE-2010-4083 affects the Linux kernel (pre-2.6.36). The vulnerable code path is copy_semid_to_user() in ipc/sem.c, where a structure is not initialized, enabling local attackers to leak kernel stack memory via semctl commands (IPC_INFO, SEM_INFO, IPC_STAT, SEM_STAT). The issue is mitigated by up...

CVE-2010-4656

CVE-2010-4656 affects the Linux kernel’s USB iowarrior driver (drivers/usb/misc/iowarrior.c). The root cause is improper buffer/memory allocation in iowarrior_write, enabling a heap-based buffer overflow via a long report from a malicious device. This aligns with openSUSE/SUSE advisories noting a...

CVE-2021-4439

Mode C: The connected Nessus/OpenVAS entries confirm CVE-2021-4439 affects the Linux kernel isdn/capi/kcapi.c and relates to cmtp session handling. The root cause is an array-index-out-of-bounds when detaching a controller that is not yet attached, triggering an out-of-bounds access (-1) in a 32-...

CVE-2021-47345

Concrete details found: CVE-2021-47345 affects the Linux kernel’s RDMA/cma path, specifically a memory leak in rdma_resolve_route() when called repeatedly on the same rdma_cm_id. The trigger described in multiple sources is that cma_query_handler() may cause RDMA_CM_EVENT_ROUTE_ERROR, returning t...

CVE-2021-47354

CVE-2021-47354 affects the Linux kernel’s DRM scheduler. The issue arises from not waiting for all dependencies of a job to complete before terminating it, which could lead to data corruption. The published notes describe the vulnerable component as the kernel’s DRM/sched path and the fix as ensu...

CVE-2022-3544

CVE-2022-3544 describes a memory leak in the Linux kernel within Netfilter, specifically the damon_sysfs_add_target function in mm/damon/sysfs.c. The issue is triggered through manipulation of target handling and is described as a vulnerability in the kernel’s Netfilter component. The initial des...

CVE-2022-48628

The CVE-2022-48628 entry concerns a Linux kernel issue in ceph: drop messages from MDS when unmounting. The description in the primary doc states that during unmount, dirty buffers are flushed and after the last OSD request finishes, the last i_count reference is released and dirty caps/snaps are...

CVE-2022-48789

In CVE-2022-48789, the Linux kernel nvme-tcp transport error_recovery work contained a use-after-free risk caused by a race between submit_async_event and the error_recovery handler when destroying the admin queue. The fix requires flushing async_event_work before continuing to destroy the admin ...

CVE-2022-48829

CVE-2022-48829 is a Linux kernel vulnerability fixed in NFSD for NFSv3 SETATTR/CREATE handling of large file sizes. The issue arises from iattr::ia_size being a loff_t and the potential to pass values larger than s64_max, risking incorrect data if large sizes are silently capped. The fix removes ...

CVE-2022-49611

The CVE-2022-49611 entry refers to a Linux kernel x86 speculation mitigation: Fill RSB on vmexit for IBRS to prevent RSB underflow/poisoning. The description notes mitigation is implemented in the kernel and documents tribal knowledge about RSB attacks. Connected Nessus/OpenVAS entries for EulerO...

CVE-2024-36910

CVE-2024-36910 concerns the Linux kernel’s uio_hv_generic path. The issue arises when CoCo VMs allow set_memory_encrypted() or set_memory_decrypted() to fail, causing the operation to return an error while memory may be shared. The VMBus device UIO driver could then free decrypted/shared pages if...

CVE-2024-38582

CVE-2024-38582 affects the Linux kernel nilfs2, causing a potential hang/deadlock during unmount. The issue arises when nilfs_segctor_sync() tries to synchronize with the log writer thread after nilfs_segctor_destroy() has already terminated that thread, leading to a deadlock path through several...

CVE-2024-47662

The CVE-2024-47662 entry concerns the Linux kernel component drm/amd/display (DCN35 DMCUB diagnostics). The issue is that a diagnostic register read was removed to prevent triggering a security violation when DMCUB timeouts occur, blocking Z8 entry. The fix is to stop reading that register from t...

CVE-2024-49932

The CVE-2024-49932 issue affects the Linux kernel by mis-handling readahead during Btrfs relocation when RAID stripe trees (RST) are involved. Relocation readahead on the relocation inode can return ENOENT, which is not handled by readahead and can submit invalid reads, triggering a kernel BUG in...

CVE-2025-37991

CVE-2025-37991 describes a PA-RISC (parisc) Linux kernel issue where a SIGFPE exception can crash an application if a second SIGFPE is delivered in the signal handler. The root cause is traced to glibc using a double-word floating-point store to atomically update function descriptors, causing a t...

CVE-2010-2226

CVE-2010-2226 affects the Linux kernel: the xfs_swapext function in fs/xfs/xfs_dfrag.c does not properly validate file descriptors passed to the SWAPEXT ioctl, enabling a local user with write access to swap a file into another and gain read access. The issue is present in kernel versions before ...

CVE-2010-3080

CVE-2010-3080 is a double-free vulnerability in the Linux kernel’s snd_seq_oss_open() (sound/core/seq/oss/seq_oss_init.c) affecting kernels before 2.6.36-rc4. An unsuccessful open of /dev/sequencer could trigger kernel memory corruption, leading to local denial of service and potentially other im...

CVE-2010-4165

CVE-2010-4165 affects the Linux kernel prior to 2.6.37-rc2. The do_tcp_setsockopt function does not properly constrain TCP_MAXSEG (MSS) values, allowing a local user to trigger a denial of service via a setsockopt with a small value, leading to a divide-by-zero or signed-integer misuse. Evidence ...

CVE-2011-1082

CVE-2011-1082 affects the Linux kernel prior to 2.6.38. The flaw is in fs/eventpoll.c where epoll file descriptors may be placed inside other epoll data structures without proper validation of closed loops or deep chains. This can let a local user cause a denial of service (deadlock or stack memo...

CVE-2011-2213

The CVE-2011-2213 issue concerns the Linux kernel vulnerability in inet_diag_bc_audit (net/ipv4/inet_diag.c) present before 2.6.39.3. Affected component audits INET_DIAG bytecode and, when processing crafted INET_DIAG_REQ_BYTECODE messages (e.g., an INET_DIAG_BC_JMP with a zero yes value), allows...

CVE-2014-1739

CVE-2014-1739 affects the Linux kernel before 3.14.6, where the function media_device_enum_entities in drivers/media/media-device.c fails to initialize a data structure. This leads to an information disclosure vulnerability: a local attacker with access to /dev/media0 can read kernel memory throu...

CVE-2017-10662

The CVE-2017-10662 issue affects the Linux kernel’s F2FS implementation: the sanity_check_raw_super function in fs/f2fs/super.c fails to validate the segment count, enabling local privilege escalation. Concretely, affected versions are before 4.11.1. Several connected advisories (e.g., UTSA/Euler...

CVE-2017-18224

CVE-2017-18224 : The Linux kernel before 4.15 contains a race condition in the ocfs2 extent-tree path. Specifically, in fs/ocfs2/aops.c, a semaphore is omitted during read operations in DIRECT mode, enabling a local attacker to trigger a denial of service by modifying the e_cpos field. The connec...

CVE-2021-47267

CVE-2021-47267 affects the Linux kernel USB gadget code: if a gadget driver calls usb_assign_descriptors() with a NULL super-speed-plus descriptor and the system runs at 10Gbps, a null pointer dereference can crash the kernel when a 10Gbps device port, cable, and host port are detected. The docum...

CVE-2022-49155

Summary (CVE-2022-49155): The Linux kernel’s scsi/qla2xxx path (qla2xxx_create_qpair) was patched to suppress a kernel complaint arising from using smp_processor_id() in preemptible code (as seen in systemd-udevd). The connected advisories confirm the issue is addressed in the kernel and referenc...

CVE-2022-49326

CVE-2022-49326 affects RTL818x wireless in Linux kernel (rtl8180/rtl8185/rtl8187se family). The issue arises from using not initialized tx queues, where reading ring->entries when zero can crash the kernel. The fix patches the driver to ignore priority for cards with a single TX queue and to p...

CVE-2023-2019

CVE-2023-2019 : A flaw in the Linux kernel netdevsim device driver’s event scheduling due to improper management of a reference count. This can enable a local attacker to cause a denial-of-service on the system. The description and references in the connected docs point to a kernel-level issue; n...

CVE-2023-52818

CVE-2023-52818 affects the Linux kernel: drm/amd/ SMU7 UBSAN array-index-out-of-bounds due to pptable structs with flexible array sizes. The fix changes pptable structs to use flexible arrays. Impact is high with local, low-privilege exploitation potential as per the description. Remediation: app...

CVE-2024-40981

CVE-2024-40981 – Linux kernel batman-adv : The vulnerability centers on batman-adv’s originator handling in batadv_purge_orig_ref(), where empty buckets can lead to soft lockups (CPU 0 stuck for long periods). The root cause is not publicly disclosed in the provided documents, but the fix is desc...

CVE-2024-42286

CVE-2024-42286 affects the Linux kernel SCSI QLA2XXX driver, where nvme_local_port validation was incorrect. The issue could lead to a NULL pointer dereference and a kernel crash (workqueue qla2xxx, nvme_fc_register_remote). Public docs confirm a resolution via upstream kernel fixes (scsi: qla2xx...

CVE-2024-46727

CVE-2024-46727 detail (mode C): Affects Linux kernel’s drm/amd/display path, specifically resource_log_pipe_topology_update. The issue arises from a missing NULL check on otg_master, which could trigger a NULL_RETURN path. A fix was implemented by adding an otg_master NULL check to prevent the NU...

CVE-2024-46773

The CVE-2024-46773 issue in the Linux kernel concerns the drm/amd/display path where a division could be performed with a zero denominator (pbn_div). The root cause is a denominator that could be zero; upstream patch adds a check before use to prevent a DIVIDE_BY_ZERO. Public documents confirm th...

CVE-2024-46827

The CVE-2024-46827 entry describes a Linux kernel fix for ath12k Wi‑Fi: when an association request contains an Extended HE Capabilities Element with an invalid MCS-NSS, the driver passes a zero peer_nss to firmware, potentially crashing it. The remediation implements validation of peer_nss and f...

CVE-2024-53098

CVE-2024-53098 affects the Linux kernel DRM XE ufence path. The root cause is that access_ok() only checks for addr overflow and may also read the user-supplied address to catch invalid addresses, coupled with prefetching ufence addresses to detect bogus ones. The issue is remedied by a kernel fi...

CVE-2025-38064

The CVE-2025-38064 entry concerns the Linux kernel virtio subsystem, specifically virtio-console, where devices continue to write to MMIO after the underlying virtio-pci device is reset, causing hangs in kexec-in-VM scenarios. The issue is mitigated by the kernel fix that breaks all virtio device...

CVE-2010-2492

CVE-2010-2492 affects the Linux kernel’s eCryptfs component: a buffer overflow in the ecryptfs_uid_hash macro (fs/ecryptfs/messaging.c) could allow local privilege escalation or a denial of service. The MiracleLinux AXSA advisory lists this CVE among kernel issues and specifies the flaw occurs in...

CVE-2011-3359

CVE-2011-3359 affects the Linux kernel (pre-2.6.39), specifically the b43 wireless driver. The dma_rx path does not allocate receive buffers properly, enabling remote attackers to crash the system via a crafted frame (DoS). Affected code is in drivers/net/wireless/b43/dma.c. Remediation: upgrade ...

CVE-2021-47372

CVE-2021-47372 is a Linux kernel use-after-free in the macb driver. The issue arises from plat_dev->dev->platform_data being released by platform_device_unregister() and subsequently using pclk and hclk, leading to use-after-free in macb_remove. The fixed sequence avoids using the clk devic...

CVE-2022-48794

CVE-2022-48794 affects the Linux kernel wireless stack for the IEEE 802.15.4 at86rf230 driver. On error, ieee802154_xmit_complete() is not invoked and skb structures are leaked after manual wake_queue() calls in Tx paths. The fix described in the sources is to free the skb upon error before retur...

CVE-2022-49315

CVE-2022-49315 concerns a deadlock in the Linux kernel, specifically in the staging driver rtl8192e (rtllib_beacons_stop). The issue arises when rtllib_beacons_stop() holds ieee->beacon_lock while calling del_timer_sync(), while the timer handler (rtllib_send_beacon_cb) needs the same lock, ca...

CVE-2022-49622

CVE-2022-49622 (Linux kernel) describes a use-after-free risk in nf_tables when verdict is NF_STOLEN in netfilter, where skb freeing may have occurred. The fix prevents illegal skb access by: (1) caching skb->nf_trace in the trace state and refreshing it when verdict != STOLEN; (2) skipping sk...

CVE-2023-46343

CVE-2023-46343 concerns the Linux kernel up to version 6.5.9, with a NULL pointer dereference in send_acknowledge (net/nfc/nci/spi.c). Affected component: kernel. Root cause: NULL pointer dereference in send_acknowledge. Explicit impact details in the provided metrics show Confidentiality and Int...

CVE-2023-52511

CVE-2023-52511 (Linux kernel, spi sun6i) : The issue stems from RX SPI transfers with DMA enabled where data could be corrupted during DMA to memory when transfers span more than a single byte. The fix reduces the width of each DMA read to the RX FIFO to a single byte, mitigating data loss. Publi...

CVE-2023-52642

CVE-2023-52642 concerns a Linux kernel issue in the media: rc subsystem where attaching/detaching BPF programs could require write permission, with an auxiliary CAP_NET_ADMIN requirement. The main impact described across multiple advisories is a locally exploitable condition in kernel space that ...