CVE-2007-4998

CVE-2007-4998 is a local, user‑assisted vulnerability in cp when preserving symlinks across multiple OSes. The issue allows an attacker to cause a race/symlink attack that can overwrite arbitrary files by crafting directories with multiple source files copied to the same destination. Multiple con...

CVE-2022-49335

CVE-2022-49335 concerns the Linux kernel DRM/AMDGPU path. The issue arises when a compute submit command (cs) is sent with 0 chunks, which is illegal and leads to a kernel oops later, specifically a NULL pointer dereference in amdgpu_cs_ioctl. Affected evidence shows a crafted 0-chunk submission ...

CVE-2022-49453

Summary (CVE-2022-49453) : In the Linux kernel, the TI SoC power-domain driver (soc: ti: ti_sci_pm_domains) might dereference a NULL pointer if devm_kcalloc returns NULL. The recommended fix is to check the allocation result and return -ENOMEM, mirroring the handling in earlier code paths. The is...

CVE-2022-49501

The Linux kernel contains a vulnerability in the usbnet driver where unregister_netdev() was incorrectly called before unbind(). This was intended to address a use-after-free issue during the disconnection of USB Ethernet adapters , but the implementation created an asymmetry with the binding pro...

CVE-2022-49530

CVE-2022-49530 affects the Linux kernel DRM/AMD power management code. The vulnerability arises in si_parse_power_table() where allocations for adev->pm.dpm.ps and its elements can be followed by a second free in si_dpm_fini() if an allocation fails, causing a potential double-free of adev-&gt...

CVE-2023-23001

CVE-2023-23001 affects Linux kernel prior to 5.16.3, where a misinterpretation of regulator_get’s return value in drivers/scsi/ufs/ufs-mediatek.c treats an error pointer as NULL in the error case. This may lead to improper handling in that path. The vulnerability is addressed by the Linux kernel ...

CVE-2023-53098

CVE-2023-53098 summary (Linux kernel) : The vulnerability resides in the Media driver gpio-ir-recv under media: rc, where an added remove function plus runtime-pm cleanup is required. If runtime PM is enabled, systems must perform runtime PM cleanup to remove a cpu-latency QoS request; otherwise,...

CVE-2024-49970

CVE-2024-49970 affects the Linux kernel DRM AMD display path. The issue is a bounds check failure in dcn401_stream_encoder_create for the DCN401 encoder: the stream_enc_regs array, sized for indices 0–3, could be accessed with eng_id = 5, causing a buffer overflow and undefined behavior. The vuln...

CVE-2025-38068

CVE-2025-38068: In the Linux kernel, the crypto/lzo path fixed a compression buffer overrun by adding a safe compression interface that checks the end of the output buffer before each write and using it in crypto/lzo. This corrects a prior assumption that the caller always provided sufficient buf...

CVE-2025-38078

The CVE-2025-38078 issue affects the Linux kernel ALSA PCM OSS layer. A race occurs when clearing the buffer with silence data during initialization/reconfiguration via snd_pcm_format_set_silence() using runtime->dma_area, which may be freed concurrently outside PCM ops, causing a use-after-fr...

CVE-2010-2955

The CVE-2010-2955 issue affects the Linux kernel before 2.6.36-rc3-next-20100831, specifically the cfg80211_wext_giwessid function in net/wireless/wext-compat.c, which fails to initialize certain structure members. This enables a local attacker to exploit an off-by-one error in ioctl_standard_iw_...

CVE-2010-3861

CVE-2010-3861 affects the Linux kernel up to version 2.6.36. The vulnerability arises in the ethtool_get_rxnfc function in net/core/ethtool.c, which fails to initialize a certain block of heap memory. This can allow a local user to obtain potentially sensitive information via an ETHTOOL_GRXCLSRLA...

CVE-2010-4078

CVE-2010-4078 affects the Linux kernel before 2.6.36-rc6, where the sisfb_ioctl function in drivers/video/sis/sis_main.c fails to properly initialize a structure member. This allows local users to leak potentially sensitive information from kernel stack memory via the FBIOGET_VBLANK ioctl. Connec...

CVE-2015-8963

CVE-2015-8963 : The Linux kernel contains a race condition in kernel/events/core.c related to swevent handling during a CPU unplug operation. Affected: Linux kernel versions before 4.4. Impact: local privilege escalation or denial of service (use‑after‑free) as described in the vulnerability entr...

CVE-2021-47086

The CVE-2021-47086 entry concerns the Linux kernel Phonet/pep path. The connected Astra Linux bulletin repeats that the vulnerability arises in an ioctl that refines enabling an unbound pipe, where the socket may not be bound to a valid Phonet object. If the socket is not bound, two issues occur:...

CVE-2021-47113

CVE-2021-47113 affects the Linux kernel's btrfs code. The issue occurs in btrfs_rename_exchange when inserting inode refs for both sides of a rename; if the second insert fails, the first ref becomes dangling, risking a corrupt filesystem. The fix aborts after the first successful inode ref inser...

CVE-2021-47362

CVE-2021-47362 affects the Linux kernel’s drm/amd/pm power management code. The vulnerability occurs during DPM initialization when set_power_state reads values from the current state; if current state is not populated, this can lead to a NULL pointer dereference. The ATCS/ACPI path for PCI speed...

CVE-2021-47434

CVE-2021-47434 concerns the Linux kernel xHCI host controller where command ring pointer corruption could occur while aborting a command. The issue arises because the 64-bit CRCR is written in two 32-bit writes; when the upper 32 bits are not updated (they may remain zero) due to the command ring...

CVE-2021-47552

CVE-2021-47552 affects the Linux kernel’s block multi-queue (blk-mq) I/O scheduling. The root issue was a race where scsi_device could be freed before blk_release_queue() ran, leading to a kernel oops. The fix cancels blk-mq dispatch work in both blk_cleanup_queue() and disk_release(), ensuring I...

CVE-2022-49104

CVE-2022-49104 affects the Linux kernel, specifically the staging/vchiq_core code path. The issue is triggered when find_service_by_handle is given an invalid handle, which can return NULL and lead to a NULL pointer dereference. The description in the provided documents confirms this root cause a...

CVE-2022-49110

CVE-2022-49110 affects Linux kernel netfilter conntrack, where the gc autotuning change (as of commit 4608fdfc07e1) alters conntrack garbage collection frequency from every 2 minutes and changes eviction behavior. In large conntrack hash tables, evictions skew toward the GC path, risking netlink ...

CVE-2023-52805

CVE-2023-52805 affects the Linux kernel/JFS inode allocation. The issue is an array-index-out-of-bounds in diAlloc caused by lack of validation of the iag’s agno during new inode allocation, which could lead to fragmentation. A fix was added to perform the necessary check, and multiple connected ...

CVE-2008-3272

The CVE-2008-3272 issue affects the Linux kernel sound subsystem (sound/core/seq/oss/seq_oss_synth.c). The root cause is that snd_seq_oss_synth_make_info does not verify that the device number lies within the range defined by max_synthdev before returning data, enabling local users to leak sensit...

CVE-2011-3363

The CVE-2011-3363 issue affects the Linux kernel up to version 2.6.38, specifically the setup_cifs_sb function in fs/cifs/connect.c. The root cause is improper handling of DFS referrals, enabling a remote CIFS server to trigger a denial-of-service (system crash) by placing a referral at the root ...

CVE-2011-3637

CVE-2011-3637 is a vulnerability in the Linux kernel where the m_stop function in fs/proc/task_mmu.c can trigger an OOPS via vectors that cause an m_start error. Affected: Linux kernel versions prior to 2.6.39 (i.e., 2.6.38 and earlier). Impact: local denial of service (kernel oops) without remot...

CVE-2012-1146

The vulnerability CVE-2012-1146 affects the Linux kernel, specifically mem_cgroup_usage_unregister_event in mm/memcontrol.c, when running versions before 3.2.10. The issue arises from how multiple events attached to the same eventfd are handled, enabling a local attacker to trigger a NULL pointer...

CVE-2013-6381

CVE-2013-6381 describes a buffer overflow in the Linux kernel’s qeth_snmp_command function (drivers/s390/net/qeth_core_main.c) up to version 3.12.1, allowing local users to cause a denial of service (and potentially other impact) via an SNMP ioctl with an incompatible length. Connected documents ...

CVE-2021-47280

CVE-2021-47280 is a Linux kernel vulnerability affecting drm_getunique() in the DRM subsystem. A time-of-check-to-time-of-use (TOCTOU) error occurs by reading file_priv->master before acquiring the device master mutex, allowing a master pointer to be used after the original object may have bee...

CVE-2021-47342

CVE-2021-47342 affects the Linux kernel’s ext4 filesystem. A race during remounting a read-only, mmp-protected filesystem can cause a use-after-free (UAF) when the kmmpd thread may exit and leave sbi->s_mmp_tsk pointing at freed memory, triggering an object lifetime dereference in ext4_stop_mm...

CVE-2021-47404

Summary (CVE-2021-47404): The issue stems from a slab-out-of-bounds write in the HID Betop driver (betopff) in the Linux kernel. Syzbot observed a write beyond slab bounds due to assuming an input report exists; malicious devices can violate this assumption. The public advisories, including Astra...

CVE-2021-47600

The CVE-2021-47600 entry concerns a Linux kernel vulnerability in the dm btree code where a use-after-free occurs during rebalance_children. The root cause is described as a use-after-free in the btree remove path, with the fix specified as moving dm_tm_unlock() after dm_tm_dec(). The vulnerabili...

CVE-2022-48704

CVE-2022-48704 affects the Linux kernel’s DRM/Radeon path. The vulnerability stems from a race/flush issue where the radeon lockup work queue may not be fully flushed before the system enters D3hot, potentially leading to a kernel Oops and a stall in GPU work processing. The described fix adds a ...

CVE-2022-49106

CVE-2022-49106 affects the Linux kernel (staging: vchiq_arm). The root cause is a potential NULL pointer dereference in vchiq_dump_platform_instances when vchiq_get_state() may return NULL. The vulnerability could impact kernel availability with local access required. A fix is included in upstrea...

CVE-2022-49303

CVE-2022-49303 concerns a Linux kernel deadlock in the rtl8192eu driver (drivers/staging/rtl8192eu) during rtw_joinbss_event_prehandle. The provided details describe a lock-order issue: thread 1 holds pmlmepriv->lock while waiting on del_timer_sync(), but the timer handler (thread 2) also need...

CVE-2022-49312

CVE-2022-49312 (Linux kernel) : The vulnerability concerns a potential memory leak in the rtl8712 staging path. In r871xu_drv_init(), if r8712_init_drv_sw() fails, memory allocated by r8712_alloc_io_queue() in r8712_usb_dvobj_init() is not released because there is no action in r8712_usb_dvobj_de...

CVE-2022-49449

The CVE-2022-49449 issue affects Linux kernel pinctrl: renesas: rzn1. The root cause is a possible null-ptr-deref when using 'res' if platform_get_resource() returns NULL. The patch defers dereferencing 'res' by performing devm_ioremap_resource() first (which validates the resource) and then uses...

CVE-2022-49523

CVE-2022-49523 affects the Linux kernel component ath11k, specifically the spectral scan path during spectral_deinit. The issue arises when ath11k modules are removed (rmmod) with spectral scan enabled, which can trigger a crash (kernel NULL pointer dereference) as shown by the provided call trac...

CVE-2022-49544

CVE-2022-49544 affects the Linux kernel IPW2X00 stack. The issue is a potential NULL dereference in libipw_xmit() when crypt and crypt->ops could be null. The fix adds null checks before dereferencing these fields. The vulnerability is local with likely crash/denial impact; exploitation status...

CVE-2023-22996

CVE-2023-22996 affects the Linux kernel prior to 5.17.2. In drivers/soc/qcom/qcom_aoss.c, an of_find_device_by_node reference is not released after use (e.g., via put_device), which can lead to a lingering reference. The practical impact and exploitability are not described in the provided docume...

CVE-2023-52754

CVE-2023-52754 is a Linux kernel vulnerability in the imon USB driver. The driver could memory-corrupt by naively assuming the first interface is bound to imon when probing the second interface; a malformed descriptor could bind the first interface to another driver. A patch adds a sanity check a...

CVE-2024-36911

CVE-2024-36911 affects the Linux kernel hv_netvsc (Hyper-V host/guest networking). The root cause is that in CoCo VMs, a failure of set_memory_encrypted() or set_memory_decrypted() could cause memory to be shared and not properly freed. The netvsc driver could frees decrypted/shared pages if set_...

CVE-2024-42151

The CVE-2024-42151 entry concerns the Linux kernel and a BPF-related test: test_1 in bpf_dummy_struct_ops has a first parameter that can be NULL. The vulnerability arises because the verifier could skip a NULL check, leading to a NULL pointer dereference under certain conditions when state is NUL...

CVE-2025-38425

CVE-2025-38425 affects the Linux kernel i2c: tegra SMBUS block read path. Root cause: SMBUS block read reads the device-provided length without proper validation, continuing reads when length is 0 or exceeds allowed bytes. The vulnerability allows local attackers with lower privileges to potentia...

CVE-2010-0410

CVE-2010-0410 affects the Linux kernel up to version 2.6.32.7, via drivers/connector/connector.c, allowing local users to cause memory exhaustion and a system crash by flooding NETLINK_CONNECTOR messages. The MiracleLinux advisories (AXSA:2010-285:05 and AXSA:2010-323:11) explicitly include CVE-2...

CVE-2010-4082

CVE-2010-4082 affects the Linux kernel prior to 2.6.36-rc5, where viafb_ioctl_get_viafb_info in drivers/video/via/ioctl.c fails to initialize a structure member. This can allow local users to leak potentially sensitive information from kernel stack memory via a VIAFB_GET_INFO ioctl call. The issu...

CVE-2010-4347

CVE-2010-4347 affects the Linux kernel’s ACPI subsystem. The vulnerability arises in the debugfs interface (custom_method file) which, due to world-writable 0222 permissions, lets a local user place a custom ACPI method in interpreter tables via acpi_debugfs_init in drivers/acpi/debugfs.c. This c...

CVE-2021-47116

CVE-2021-47116 concerns the Linux kernel ext4 memory leak. According to the primary description, the vulnerability is triggered when memory leaks on the error path of ext4_mb_init_backend, occurring if a filesystem is corrupted with an illegally large s_log_groups_per_flex. The issue is resolved ...

CVE-2021-47229

CVE-2021-47229 concerns the Linux kernel PCI aardvark driver. A kernel panic could occur when a new PIO transfer is started before the previous one finished; the kernel will issue an External Abort/SSeror interrupt leading to a reboot. The root cause analysis noted a previously added Trusted Firm...

CVE-2022-48633

CVE-2022-48633: In the Linux kernel, the gma500/psb_gem Unpin path could trigger a WARN_ON (lock->magic != lock) due to ww_mutex being destroyed by drm_gem_object_release(). The fix relocates drm_gem_object_release() to occur after psb_gem_unpin(), preventing the invalid lock state. Affected c...

CVE-2022-49102

CVE-2022-49102 affects the Linux kernel. The issue, resolved by a patch from habanalabs, fixes a memory leak in the MMU DR finalization path when the host-resident shadow is NULL, which can occur because the DR and HR are not dependent. The patch addresses a copy-paste error and prevents the leak...