CVE-2008-3272

The CVE-2008-3272 issue affects the Linux kernel sound subsystem (sound/core/seq/oss/seq_oss_synth.c). The root cause is that snd_seq_oss_synth_make_info does not verify that the device number lies within the range defined by max_synthdev before returning data, enabling local users to leak sensit...

CVE-2010-4079

CVE-2010-4079 affects the Linux kernel ivtvfb driver (ivtvfb_ioctl in drivers/media/video/ivtv/ivtvfb.c) prior to 2.6.36-rc8. The root cause is failure to initialize a structure member, enabling local users to leak information from kernel stack memory via the FBIOGET_VBLANK ioctl. Affected versio...

CVE-2011-2479

CVE-2011-2479 affects the Linux kernel up to version 2.6.38.x and allows a local user to trigger a denial of service by a crafted MAP_PRIVATE mmap on /dev/zero that causes THP creation to misbehave. The vulnerability is in transparent huge pages handling and can crash the system. A fix exists in ...

CVE-2011-3638

CVE-2011-3638 affects the Linux kernel’s ext4 extents handling. The vulnerability occurs in fs/ext4/extents.c where a modified extent may not be marked_dirty during certain extent-splitting paths, enabling a local attacker to trigger a denial of service (kernel crash) through ext4 unmount/mount o...

CVE-2012-3552

The CVE-2012-3552 issue is a race condition in the Linux kernel IP implementation that exists in versions before 3.0. According to the connected documents, remote attackers could trigger a denial of service (slab corruption and system crash) by sending packets to an application that sets socket o...

CVE-2016-6787

CVE-2016-6787 affects the Linux kernel’s performance subsystem: kernel/events/core.c before 4.0 mismanages locks during certain migrations, allowing local users to gain privileges via a crafted application (Android internal bug 31095224). Impact is local privilege escalation with complete confide...

CVE-2019-16921

In the Linux kernel before 4.17, hns_roce_alloc_ucontext in drivers/infiniband/hw/hns/hns_roce_main.c does not initialize the resp data structure, which may allow attackers to read sensitive information from kernel stack memory (CID-df7e40425813). This CVE affects the kernel code path associated ...

CVE-2021-47169

CVE-2021-47169 : In the Linux kernel, the serial rp2 driver could NULL-dereference if a firmware load via request_firmware_nowait occurred before ports were initialized. The fix was to use a synchronous firmware load (request_firmware) during rp2_probe to ensure interrupts are not handled before ...

CVE-2021-47229

CVE-2021-47229 concerns the Linux kernel PCI aardvark driver. A kernel panic could occur when a new PIO transfer is started before the previous one finished; the kernel will issue an External Abort/SSeror interrupt leading to a reboot. The root cause analysis noted a previously added Trusted Firm...

CVE-2021-47324

CVE-2021-47324 relates to the Linux kernel watchdog driver. The issue is a use-after-free risk in wdt_startup() caused by the remove path calling del_timer() instead of waiting for the timer handler to finish. The timer handler could still be running after the driver’s remove function returns, po...

CVE-2021-47342

CVE-2021-47342 affects the Linux kernel’s ext4 filesystem. A race during remounting a read-only, mmp-protected filesystem can cause a use-after-free (UAF) when the kmmpd thread may exit and leave sbi->s_mmp_tsk pointing at freed memory, triggering an object lifetime dereference in ext4_stop_mm...

CVE-2022-48919

CVE-2022-48919 affects the Linux kernel’s CIFS mount flow. The issue is a double-free race in cifs_get_root() when a mount fails inside cifs_smb3_do_mount(); deactivate_locked_super() leads to delayed_free(), potentially freeing resources twice if code continues to the out: path. The vulnerabilit...

CVE-2022-49106

CVE-2022-49106 affects the Linux kernel (staging: vchiq_arm). The root cause is a potential NULL pointer dereference in vchiq_dump_platform_instances when vchiq_get_state() may return NULL. The vulnerability could impact kernel availability with local access required. A fix is included in upstrea...

CVE-2022-49119

In the Linux kernel, CVE-2022-49119 concerns a memory leak in the SCSI pm8001 path: in pm8001_chip_fw_flash_update_build(), if the build fails, the previously allocated fw_control_ex must be freed. The issue is resolved by applying the fix in the pm8001_chip_fw_flash_update_req/build flow. Affect...

CVE-2022-49137

CVE-2022-49137 concerns a refcount leak in the Linux kernel’s amdgpu_cs_fence_to_handle_ioctl() path. When info->in.what hits the default case, the function returns -EINVAL without decrementing the previously bumped dma_fence refcount, causing leaks. The issue arises from a missing refcount de...

CVE-2022-49178

CVE-2022-49178 affects the Linux kernel memstick driver (memstick/mspro_block). The issue relates to how read-only devices are handled in the mspro_block code path. Root cause: improper propagation of the read-only state through the block layer during open, leading to a potential reference leak w...

CVE-2022-49327

The CVE-2022-49327 issue affects the Linux kernel and is described in multiple advisories (e.g., Unity Linux and SUSE/SUSE-SU family) as a fix for bcached journal no-space deadlock. The vulnerability arises when journal replay during cache set registration can stall if journal buckets are exhaust...

CVE-2022-49527

In CVE-2022-49527, the Linux kernel media/venus/hfi path was fixed to avoid a null-dereference during deinitialization. If venus_probe fails at pm_runtime_put_sync, the error path previously called hfi_destroy (which sets core->ops to NULL) and then attempted hfi_core_deinit, which would deref...

CVE-2022-49568

CVE-2022-49568 affects the Linux kernel KVM code path, where a NULL dereference can occur during cleanup if destroy() is assumed non-NULL but is not (notably for some Book3s KVM devices that use release() instead). The root cause is an assumption in kvm_ioctl_create_device() that destroy() is alw...

CVE-2022-49674

The CVE-2022-49674 issue is a Linux kernel vulnerability in dm-raid where an array (rs->devs) could be accessed beyond its end when the raid_disks-derived count differed from metadata-driven counts during RAID layout changes. The root cause is using rs->raid_disks for iteration instead of t...

CVE-2022-49740

CVE-2022-49740 concerns the Linux kernel brcmfmac driver. The vulnerability arises when the device-provided channel spec count exceeds the allocated list length in brcmf_construct_chaninfo() and brcmf_enable_bw40_2g(), causing slab-out-of-bounds reads. The patch adds bounds checks so these functi...

CVE-2023-0615

CVE-2023-0615 affects the Linux kernel V4L2 and vivid test code paths. The vulnerability is a memory leak with potential divide-by-zero and integer overflow when triggering ioctls such as VIDIOC_S_DV_TIMINGS, which could allow a local user to crash the system if vivid test code is enabled. Public...

CVE-2023-52799

In Linux kernel, CVE-2023-52799 relates to an array-index-out-of-bounds in the JFS path during dmtree_t searches for free blocks (tp->dm_stree). The fix adds a parameter to dbFindLeaf to determine the dmtree type, enabling an out-of-bounds check and preventing access beyond array bounds. Affec...

CVE-2024-26699

CVE-2024-26699 concerns the Linux kernel’s drm/amd/display code, specifically a fix for an array-index-out-of-bounds in dcn35_clkmgr. The root cause is a memory access violation when iterating through the dcn35 clocks array. The documented mitigation is to limit iteration to the array size. Concr...

CVE-2024-26902

CVE-2024-26902 concerns the Linux kernel: a RISCV perf PMU overflow panic when setting bits for overflowed_ctrs due to using (1 <

CVE-2024-35803

CVE-2024-35803 affects the Linux kernel, specifically the x86 efistub in mixed-mode boot handling. The root cause is that EFI boot service calls were made using the decompressor’s 16k boot stack during 32‑bit firmware entry paths, while EFI boot services require a larger (128k) stack. This mismat...

CVE-2025-38068

CVE-2025-38068: In the Linux kernel, the crypto/lzo path fixed a compression buffer overrun by adding a safe compression interface that checks the end of the output buffer before each write and using it in crypto/lzo. This corrects a prior assumption that the caller always provided sufficient buf...

CVE-2010-2537

CVE-2010-2537 affects the Linux kernel’s btrfs_ioctl_clone path: the btrfs_ioctl_clone function in fs/btrfs/ioctl.c before 2.6.35 allows a local attacker to overwrite an append‑only file when using BTRFS_IOC_CLONE or BTRFS_IOC_CLONE_RANGE with a donor file. Impact is local privilege/unauthorized ...

CVE-2011-2497

CVE-2011-2497 is a Linux kernel Bluetooth L2CAP underflow/overflow issue. The vulnerability arises from an integer underflow in l2cap_config_req in net/bluetooth/l2cap_core.c, enabling remote attackers to trigger a heap memory corruption or buffer overflow via a small command-size value in an L2C...

CVE-2021-47113

CVE-2021-47113 affects the Linux kernel's btrfs code. The issue occurs in btrfs_rename_exchange when inserting inode refs for both sides of a rename; if the second insert fails, the first ref becomes dangling, risking a corrupt filesystem. The fix aborts after the first successful inode ref inser...

CVE-2021-47211

CVE-2021-47211 refers to a Linux kernel vulnerability in ALSA: usb-audio where snd_usb_find_clock_source could return a null cs_desc, risking a null pointer dereference. The fix adds a null check before dereferencing the clock source descriptor. The portrait of affected code points to the ALSA us...

CVE-2021-47339

In CVE-2021-47339, the Linux kernel fix targets media: v4l2-core, addressing uninitialized kernel stack data that could be used as input for driver ioctl handlers due to mistakes in compat ioctl implementation. The resolution requires explicitly clearing the entire ioctl input buffer before conve...

CVE-2021-47622

CVE-2021-47622 affects the Linux kernel SCSI/UFS path. The issue is a deadlock in the error handling flow when all tags are allocated: the SCSI error path triggers ufshcd_eh_host_reset_handler(), which queues work that calls ufshcd_err_handler(), leading to a lockup in the workqueue (ufs_eh_wq_0)...

CVE-2022-48633

CVE-2022-48633: In the Linux kernel, the gma500/psb_gem Unpin path could trigger a WARN_ON (lock->magic != lock) due to ww_mutex being destroyed by drm_gem_object_release(). The fix relocates drm_gem_object_release() to occur after psb_gem_unpin(), preventing the invalid lock state. Affected c...

CVE-2022-48790

CVE-2022-48790 concerns a use-after-free in the Linux kernel nvme path during controller reset while loading, caused by a race between AER submission and ctrl readiness. The fixed patch adds a ctrl state check and ensures the controller state is RESETTING before further AER submissions, along wit...

CVE-2022-48852

The CVE (CVE-2022-48852) affects the Linux kernel DRM/VC4 HDMI driver. The issue arises because the HDMI codec device is registered on bind but not unregistered on unbind, causing a device leak. Root cause: unbind path does not unregister the HDMI codec device, leaving orphaned device state. The ...

CVE-2022-48875

CVE-2022-48875 affects the Linux kernel’s wireless stack (mac80211). The vulnerability arises when AMPDU start handling in the driver path can encounter a NULL sdata during deauthentication, leading to a NULL dereference. Specifically, ieee80211_tx_ba_session_handle_start() may receive NULL for s...

CVE-2022-49472

CVE-2022-49472 affects the Linux kernel PHY Micrel driver: if a .probe is present and .driver_data is missing, a NULL pointer dereference can occur. The fix adds NULL checks for priv->type to allow probing without .driver_data. Connected advisories (Astra/Unity Linux) reference Linux kernel ve...

CVE-2022-49524

CVE-2022-49524 relates to the Linux kernel media driver for cx23885 (pci) where the error path in cx23885_initdev() did not release I2C-related resources when dma_set_mask() failed. The concrete details describe that a failed dma_set_mask() leads to a use-after-free in __process_removed_driver, t...

CVE-2022-49727

CVE-2022-49727 : In the Linux kernel, the vulnerability affects the IPv6 L2TP send path (ipv6_sendmsg) where a signed integer overflow can occur when len >= INT_MAX - transhdrlen, causing ulen = len + transhdrlen to overflow. The fix mirrors the approach used in udpv6 by subtracting transhdrle...

CVE-2022-49977

Summary (CVE-2022-49977): The Linux kernel vulnerability arises from ftrace registration handling when ftrace_startup_enable fails. If disabled and not rolled back, an op may remain in ftrace_ops_list, leading to a NULL dereference in is_ftrace_trampoline via ftrace_ops_trampoline. The concrete f...

CVE-2023-53038

CVE-2023-53038 concerns the Linux kernel: in scsi lpfc, the function lpfc_sli4_cgn_params_read() may encounter a kzalloc() failure, after which lpfc_read_object() dereferences pdata without a NULL check. The published fix changes the error code path from -ENODEV to -ENOMEM to reflect allocation f...

CVE-2024-36909

CVE-2024-36909 : In the Linux kernel, Drivers: hv: vmbus: Don’t free ring buffers that couldn’t be re-encrypted. In CoCo VMs, an untrusted host can cause set_memory_encrypted()/set_memory_decrypted() to fail, leading to decrypted/shared memory being returned to the page allocator. The VMBus ring ...

CVE-2024-37354

CVE-2024-37354 : In the Linux kernel, the vulnerability is described as a crash in the Btrfs file system caused by a race between fsync and size-extending writes into preallocated extents. The crash manifests as a BUG in btrfs_set_item_key_safe, triggered by overlapping preallocated extents (e.g....

CVE-2024-44956

CVE-2024-44956 — Linux kernel (drm/xe/preempt_fence): The vulnerability relates to enlarging the fence critical section to cover the entire preempt_fence_work_func callback. This change aims to improve lockdep understanding when signaling fences, potentially avoiding races with vm->lock. The i...

CVE-2024-47683

CVE-2024-47683 affects the Linux kernel’s DRM/AMD display path. The issue is a NULL pointer dereference during MST/DSC setup when a mode change is not detected; the fix is to skip recomputing DSC parameters if there is no stream on the link, with further checks to confirm whether the stream is al...

CVE-2009-0322

CVE-2009-0322 affects the Linux kernel Dell RBU (Remote BIOS Update) driver: reading zero bytes from image_type or packet_size under /sys/devices/platform/dell_rbu/ can cause a local DoS (system crash). Concrete references in connected advisories show affected kernels include 2.6.27.x (before 2.6...

CVE-2011-1573

CVE-2011-1573: Linux kernel SCTP (net/sctp/sm_make_chunk.c) can OOPs DoS when addip_enable and auth_enable are used because INIT/INIT-ACK length calculation ignores zero padding. Affects kernels before 2.6.34; patch/fix shipped in 2.6.34+. vulnerable component/file: sm_make_chunk.c; impact: denia...

CVE-2011-1598

CVE-2011-1598 affects the Linux kernel’s CAN subsystem: the bcm_release function in net/can/bcm.c does not validate a socket data structure, enabling a local user to trigger a NULL pointer dereference and cause a denial of service. The affected version range is kernel 2.6.39-rc6 and earlier. Reso...

CVE-2011-1771

CVE-2011-1771 affects the Linux kernel up to version 2.6.38, specifically the cifs_close function in fs/cifs/file.c. If a local user opens a CIFS file with the O_DIRECT flag, it can trigger a NULL pointer dereference (and BUG), causing a denial of service or unspecified impact. Mitigation: upgrad...