CVE-2013-1943

CVE-2013-1943 affects the KVM subsystem of the Linux kernel prior to 3.0. It arises because memory slots in a guest’s physical address space may be allocated without validating kernel addresses, enabling local users to gain privileges or read kernel memory. Affected components: arch/x86/kvm/pagin...

CVE-2016-6786

CVE-2016-6786 affects the Linux kernel’s performance subsystem: kernel/events/core.c mismanages locks during certain migrations, enabling a local user to escalate privileges. Public documents indicate this vulnerability exists in kernels before 4.0, with several Nessus advisories (Unity Linux/Mir...

CVE-2021-47182

The CVE-2021-47182 entry concerns the Linux kernel scsi_mode_sense() implementation. Affected component: scsi core. Issues: improper handling of the MODE SENSE(10) allocation length field (16-bit, truncating lengths >255) and buffer length adjustments that could corrupt memory when len is too ...

CVE-2021-47362

CVE-2021-47362 affects the Linux kernel’s drm/amd/pm power management code. The vulnerability occurs during DPM initialization when set_power_state reads values from the current state; if current state is not populated, this can lead to a NULL pointer dereference. The ATCS/ACPI path for PCI speed...

CVE-2022-49176

CVE-2022-49176: Linux kernel fix for a use-after-free in bfq_dispatch_request (bfq) causing potential memory corruption in SCSI-mq paths. The issue is addressed by kernel patches referenced in the linked advisories (Unity Linux UTSA updates and Astra/Linux advisories). Exploitation status is not ...

CVE-2022-49312

CVE-2022-49312 (Linux kernel) : The vulnerability concerns a potential memory leak in the rtl8712 staging path. In r871xu_drv_init(), if r8712_init_drv_sw() fails, memory allocated by r8712_alloc_io_queue() in r8712_usb_dvobj_init() is not released because there is no action in r8712_usb_dvobj_de...

CVE-2022-49449

The CVE-2022-49449 issue affects Linux kernel pinctrl: renesas: rzn1. The root cause is a possible null-ptr-deref when using 'res' if platform_get_resource() returns NULL. The patch defers dereferencing 'res' by performing devm_ioremap_resource() first (which validates the resource) and then uses...

CVE-2022-49542

Summary: CVE-2022-49542 affects the Linux kernel SCSI lpfc path. The vulnerability arises in logging code: during an attempt to log a TRACE message, the code could take a hard lockup path due to an unsafe lock acquisition sequence. Root cause (as described): the cfg_log_verbose check was performe...

CVE-2022-49729

CVE-2022-49729 affects the Linux kernel’s nfcmrvl NFC driver. The issue is a memory leak in nfcmrvl_play_deferred caused by submitting deferred URBs directly via usb_submit_urb and then unanchoring them, which could prevent proper unref and leak memory. The fix, as described in connected advisori...

CVE-2023-2430

CVE-2023-2430 concerns the Linux kernel io_uring IOPOLL path. The root cause is a missing lock in io_cqring_event_overflow(), allowing a locally privileged user to trigger a Denial of Service via the io_uring subsystem. Public advisories (Debian, SUSE, Amazon Linux) indicate patches exist in upda...

CVE-2024-36023

CVE-2024-36023 is a Linux kernel vulnerability involving a null pointer dereference. The alteration was reported by Julia Lawall and has been resolved in the kernel code base, as reflected by the linked advisories and the CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) with a base score of 5.5 ...

CVE-2024-42135

CVE-2024-42135 concerns the Linux kernel vhost_task handling of SIGKILL. The connected sources confirm a concrete fix: when a SIGKILL is issued, the kernel now (1) marks the worker as killed to prevent new virtqueue usage and new flush operations, (2) fixes the virtqueue-to-worker mapping to stop...

CVE-2024-46752

CVE-2024-46752 - Mode C (detailed, verified): The vulnerability is in the Linux kernel’s btrfs code path; specifically, update_ref_for_cow() previously used BUG_ON() and now returns an error, logs an error, and aborts the transaction when an extent buffer in the relocation tree lacks the full bac...

CVE-2025-37882

CVE-2025-37882 relates to a Linux kernel isochronous xHCI Ring handling race. The fix changes how xrun events are processed so that a TD queued at a ring position isn’t prematurely completed or warned about when the event TRB pointer can be NULL or a no-op. Triggering conditions include higher IR...

CVE-2025-37954

CVE-2025-37954 affects the Linux kernel SMB client path, specifically a race in find_or_create_cached_dir/open_cached_dir. A valid cfid returned during find_or_create_cached_dir could race with a lease-break, causing open_cached_dir to treat the cfid as invalid and potentially leak a dentry refer...

CVE-2025-38234

CVE-2025-38234 affects the Linux kernel scheduler, specifically a race in sched/rt: push_rt_task that can mishandle task migration when waking up and queuing on another CPU’s runqueue. The root cause involves find_lock_lowest_rq taking double locks and potential lock drop/reacquisition, creating ...

CVE-2002-2438

CVE-2002-2438 describes a TCP/IP flaw where Linux TCP stack could bypass firewalls by receiving SYN packets that include additional flags (e.g., SYN+RST). The vulnerability arises because such packets were not consistently discarded by some stacks after firewalling, allowing a potential connectio...

CVE-2011-2689

The vulnerability CVE-2011-2689 affects the Linux kernel’s gfs2_fallocate path (fs/gfs2/file.c). It occurs in versions before 3.0-rc1, where the size of a chunk allocation may not be a multiple of the filesystem block size. This can allow a local user to trigger a denial of service and system cra...

CVE-2013-1860

CVE-2013-1860 is a heap-based buffer overflow in the Linux kernel’s wdm_in_callback (drivers/usb/class/cdc-wdm.c) present in versions prior to 3.8.4. The vulnerability allows physically proximate attackers to crash the system or potentially execute arbitrary code through a crafted cdc-wdm USB dev...

CVE-2021-47210

The CVE-2021-47210 issue affects the Linux kernel USB Type-C subsystem (tipd) specifically in tps6598x_block_read. The fix removes a WARN_ON and ensures that calls with length exceeding the allowed maximum return an error instead of triggering a crash under panic-on-warn. This change mitigates lo...

CVE-2021-47275

CVE-2021-47275 concerns the Linux kernel w.r.t. the bcache cache-miss path. In cached_dev_cache_miss(), the calculation of the read size for missing cache data can overflow the 16-bit size field embedded in the bkey (via the sectors value), causing oversized inserts into the internal B+ tree. Thi...

CVE-2021-47547

CVE-2021-47547 is a Linux kernel vulnerability in the tulip de4x5 driver. The fix prevents an out-of-bounds access of the array lp->phy[8] when the loop ends with k==8, which could occur if all ids in lp->phy[8] are non-zero. The connected Astra Linux bulletin mirrors this kernel issue and ...

CVE-2022-3110

CVE-2022-3110 affects the Linux kernel (through 5.16-rc6) and is tied to the r8188eu wireless driver. The vulnerability is in _rtw_init_xmit_priv (drivers/staging/r8188eu/core/rtw_xmit.c), where the return value of rtw_alloc_hwxmits() is not checked, which may lead to a NULL pointer dereference. ...

CVE-2022-48792

CVE-2022-48792 - Linux kernel (scsi: pm8001): A use-after-free can occur when a sas_task is aborted by the upper layer before I/O completion is handled in mpi_ssp_completion() or mpi_sata_completion(). The two steps (inform upper layer with complete() and release resources in pm8001_ccb_task_free...

CVE-2022-49110

CVE-2022-49110 affects Linux kernel netfilter conntrack, where the gc autotuning change (as of commit 4608fdfc07e1) alters conntrack garbage collection frequency from every 2 minutes and changes eviction behavior. In large conntrack hash tables, evictions skew toward the GC path, risking netlink ...

CVE-2022-49115

CVE-2022-49115 is a Linux kernel vulnerability in the PCI: endpoint subsystem where a misused goto label could lead to a memory leak. The description across connected advisories reiterates the same root cause and states that a fix was applied in the kernel (commit history referenced in the linked...

CVE-2022-49318

CVE-2022-49318 pertains to the Linux kernel f2fs subsystem. The vulnerability arises when Syzbot-triggered WARN_ONs in f2fs_is_valid_blkaddr (and __is_bitmap_valid) are triggered for DATA_GENERIC_ENHANCE or DATA_GENERIC_ENHANCE_READ when blkaddr is out of the expected range. The issue was resolve...

CVE-2022-49523

CVE-2022-49523 affects the Linux kernel component ath11k, specifically the spectral scan path during spectral_deinit. The issue arises when ath11k modules are removed (rmmod) with spectral scan enabled, which can trigger a crash (kernel NULL pointer dereference) as shown by the provided call trac...

CVE-2023-4394

CVE-2023-4394 is a local-use-after-free in the Linux kernel’s btrfs subsystem, specifically in btrfs_get_dev_args_from_path (fs/btrfs/volumes.c). The flaw allows a local attacker with special privileges to crash the system or leak internal kernel information. The vulnerability is documented acros...

CVE-2024-36911

CVE-2024-36911 affects the Linux kernel hv_netvsc (Hyper-V host/guest networking). The root cause is that in CoCo VMs, a failure of set_memory_encrypted() or set_memory_decrypted() could cause memory to be shared and not properly freed. The netvsc driver could frees decrypted/shared pages if set_...

CVE-2010-4248

The CVE-2010-4248 issue affects the Linux kernel prior to 2.6.37-rc2. It is a race condition in the __exit_signal function (kernel/exit.c) that can be triggered by multithreaded exec paths, with related dynamics involving a thread group leader in kernel/posix-cpu-timers.c and the reassignment of ...

CVE-2014-1690

The vulnerability CVE-2014-1690 affects the Linux kernel’s net/netfilter/nf_nat_irc.c before 3.12.8. An IRC DCC session with incorrect NAT mangle data can allow a remote attacker to read kernel memory. Impact is information disclosure; exploitation context is remote over the network. The fixed ve...

CVE-2021-47149

The CVE-2021-47149 entry concerns a Linux kernel vulnerability in the Fujitsu net driver where fmvj18x_get_hwinfo() dereferences NULL if ioremap fails. The fix adds a check on the ioremap return value and returns -1 to the caller on failure, preventing a NULL pointer dereference. Public details i...

CVE-2021-47280

CVE-2021-47280 is a Linux kernel vulnerability affecting drm_getunique() in the DRM subsystem. A time-of-check-to-time-of-use (TOCTOU) error occurs by reading file_priv->master before acquiring the device master mutex, allowing a master pointer to be used after the original object may have bee...

CVE-2021-47323

CVE-2021-47323 affects the Linux kernel watchdog driver sc520_wdt: use-after-free can occur if timer removal uses del_timer() during device removal. The issue is addressed by replacing del_timer() with del_timer_sync() to ensure the timer handler finishes before teardown, preventing potential use...

CVE-2021-47374

CVE-2021-47374 concerns the Linux kernel DMA debugging code (kernel/dma/debug.c). The issue arises when drivers using the DMA API emit an error condition frequently, causing a flood of printk messages that can drive CPU usage to 100%. The documented fix switches handling from simple rate limiting...

CVE-2021-47550

CVE-2021-47550 corresponds to a memleak in the Linux kernel DRM/AMD amdgpu path. Specifically, amdgpu_get_xgmi_hive may leak if kobject_init_and_add fails and kobject_put is not called. The connected Nessus/OpenVAS advisories reproduce this description and reference kernel-level fixes in the amdg...

CVE-2021-47552

CVE-2021-47552 affects the Linux kernel’s block multi-queue (blk-mq) I/O scheduling. The root issue was a race where scsi_device could be freed before blk_release_queue() ran, leading to a kernel oops. The fix cancels blk-mq dispatch work in both blk_cleanup_queue() and disk_release(), ensuring I...

CVE-2021-47612

CVE-2021-47612 (Linux kernel) — A vulnerability in nf cGenl dump paths can cause a null-pointer dereference and kernel crash when kmalloc in nfc_genl_dump_devices() fails, leading to a segfault in nfc_genl_dump_devices_done and related netlink/worker threads. The issue is fixed in the Linux kerne...

CVE-2021-47641

CVE-2021-47641 (Linux kernel) affects the video fbdev Cirrus driver (cirrusfb) within the kernel’s fbdev subsystem. The issue arises in cirrusfb_check_pixclock when pixclock can be zero, causing a divide by zero that Syzkaller reported. The driver then rounds up pixclock to approximate maxclock, ...

CVE-2022-48634

Summary of CVE-2022-48634 (Linux kernel) : Affects the gma500/GPU path in the Linux kernel. The fault was that gma_crtc_page_flip() held the event_lock spinlock while calling crtc_funcs->mode_set_base(), which takes ww_mutex, creating a sleeping context in an invalid path. The unlock should oc...

CVE-2022-48791

The CVE-2022-48791 issue in the Linux kernel relates to scsi: pm8001 use-after-free for aborted TMF sas_task. The problem occurs when a TMF sas_task is aborted due to a timeout and the task is freed in pm8001_exec_internal_tmf_task() while IO completion occurs later. The IO completion may still t...

CVE-2022-48858

CVE-2022-48858 - Linux kernel mlx5 race (net/mlx5): The vulnerability results from a race on command flush, causing a refcount use-after-free when a command is freed while another process may still access it. The root cause is improper synchronization around command entry refcount, leading to a p...

CVE-2022-49007

CVE-2022-49007 affects the Linux kernel/NILFS2. A NULL pointer dereference in nilfs_palloc_commit_free_entry() could occur during DAT metadata handling when a lower-level DAT block’s entry is clobbered during commit, leading to a crash. The fix adds NULL checks in nilfs_dat_commit_free() for req-...

CVE-2022-49102

CVE-2022-49102 affects the Linux kernel. The issue, resolved by a patch from habanalabs, fixes a memory leak in the MMU DR finalization path when the host-resident shadow is NULL, which can occur because the DR and HR are not dependent. The patch addresses a copy-paste error and prevents the leak...

CVE-2022-49131

CVE-2022-49131 concerns a Linux kernel kernel-panic in the ath11k driver while unloading/loading modules on some ARM platforms. The root cause is a dereference path leading to an OOPS in napi_by_id during netif_napi_add, which could occur over repeated unload/load cycles. The fixed fix is to call...

CVE-2022-49420

CVE-2022-49420 documents a data race in the Linux kernel involving UDP path: UDP sendmsg() reads sk->sk_bound_dev_if while it can be changed by another thread, and UDP wake/receive paths around __ip6_datagram_connect and udpv6_sendmsg. The issue is in net/ipv6/udp.c and related dgram/connect c...

CVE-2022-49544

CVE-2022-49544 affects the Linux kernel IPW2X00 stack. The issue is a potential NULL dereference in libipw_xmit() when crypt and crypt->ops could be null. The fix adds null checks before dereferencing these fields. The vulnerability is local with likely crash/denial impact; exploitation status...

CVE-2022-49936

Summary (CVE-2022-49936) In the Linux kernel, the USB core vulnerable path is “Prevent nested device-reset calls.” The accompanying analysis shows a recursive locking violation in usb-storage when a nested reset occurs during device removal, caused by a reset being invoked while another is in pro...

CVE-2023-52500

CVE-2023-52500 concerns the Linux kernel’s SCSI pm80xx driver. The issue was an information leakage risk where tags allocated for the OPC_INB_SET_CONTROLLER_CONFIG command were not freed when the response was processed, potentially exposing tag-related data. The connected advisories (e.g., Tencen...