2327 matches found
CVE-2007-4998
CVE-2007-4998 is a local, user‑assisted vulnerability in cp when preserving symlinks across multiple OSes. The issue allows an attacker to cause a race/symlink attack that can overwrite arbitrary files by crafting directories with multiple source files copied to the same destination. Multiple con...
CVE-2011-1598
CVE-2011-1598 affects the Linux kernel’s CAN subsystem: the bcm_release function in net/can/bcm.c does not validate a socket data structure, enabling a local user to trigger a NULL pointer dereference and cause a denial of service. The affected version range is kernel 2.6.39-rc6 and earlier. Reso...
CVE-2021-47253
CVE-2021-47253 affects the Linux kernel’s DRM/AMD display path, where DMUB hw_init could leak memory on suspend/resume due to kzalloc allocation without guard. The fix ensures the DC wrapper memory is only allocated if it was not previously allocated, avoiding reallocation on suspend/resume. Docu...
CVE-2021-47357
CVE-2021-47357 : In the Linux kernel, the atm: iphase removal path calls del_timer(), which can leave a timer handler running after the driver remove completes, causing a possible use-after-free. The fix uses del_timer_sync() to wait for the timer handler to finish and prevent rescheduling. Conne...
CVE-2021-47380
The CVE-2021-47380 issue affects the Linux kernel's HID AMD SFH driver. The vulnerability arises from a potential NULL pointer dereference when devm_add_action_or_reset() is invoked during registration, because the related data isn’t initialized yet. The provided patches move data initialization ...
CVE-2021-47409
CVE-2021-47409 concerns a Linux kernel vulnerability in the USB: dwc2 subsystem where a NULL return from platform_get_resource() could lead to a NULL pointer dereference. The issue is triggered when the return value is not checked, as described in the CVE entry and echoed in connected advisories ...
CVE-2022-48739
CVE-2022-48739 affects the Linux kernel ASoC hdmi-codec subsystem. The vulnerability arises from out-of-bounds memory accesses during memcpy(), caused by an incorrect size for the iec_status array. The fix aligns the size of iec_status with the status array of struct snd_aes_iec958, eliminating t...
CVE-2022-48852
The CVE (CVE-2022-48852) affects the Linux kernel DRM/VC4 HDMI driver. The issue arises because the HDMI codec device is registered on bind but not unregistered on unbind, causing a device leak. Root cause: unbind path does not unregister the HDMI codec device, leaving orphaned device state. The ...
CVE-2022-49431
CVE-2022-49431 concerns the Linux kernel powerpc iommu: a missing of_node_put in iommu_init_early_dart leads to a refcount leak for the device_node returned by of_find_compatible_node. The issue is local in scope (AV:L, AC:L, PR:L, UI:N) with a high impact on availability and a moderate base scor...
CVE-2022-49521
In CVE-2022-49521, the Linux kernel vulnerability affects the lpfc SCSI path: if lpfc_complete_unsol_iocb() cannot match the rctl of a received frame, the frame is dropped and resources are leaked. The fix returns resources when discarding an unhandled frame type and updates lpfc_fc_frame_check()...
CVE-2022-49741
In the Linux kernel, CVE-2022-49741 affects the fbdev smscufx driver by faulty error handling in ufx_usb_probe, which the advisory and connected Nessus/NASL records describe as causing a memory leak (unreferenced object in ufx_usb_probe). The issue is tied to the ufx_usb_probe error path, includi...
CVE-2022-49979
CVE-2022-49979 concerns a Linux kernel refcount bug in sk_psock_get triggered during an SMC fallback in the connect path, due to a mismatch in the sk_user_data field used by both smc and psock. The root cause is the shared use of sk_user_data by two subsystems; the patch adds a new bit (SK_USER_D...
CVE-2022-50029
CVE-2022-50029 affects the Linux kernel “clk: qcom: ipq8074: dont disable gcc_sleep_clk_src” issue where the USB sleep clock is disabled while the clock framework tries to disable the sleep clock source, causing a failure. The connected advisories (Unity Linux / Astra Linux / SUSE entries) descri...
CVE-2023-0615
CVE-2023-0615 affects the Linux kernel V4L2 and vivid test code paths. The vulnerability is a memory leak with potential divide-by-zero and integer overflow when triggering ioctls such as VIDIOC_S_DV_TIMINGS, which could allow a local user to crash the system if vivid test code is enabled. Public...
CVE-2023-22996
CVE-2023-22996 affects the Linux kernel prior to 5.17.2. In drivers/soc/qcom/qcom_aoss.c, an of_find_device_by_node reference is not released after use (e.g., via put_device), which can lead to a lingering reference. The practical impact and exploitability are not described in the provided docume...
CVE-2023-52737
CVE-2023-52737: In the Linux kernel, when using Btrfs, fiemap could deadlock with an in-flight fsync due to not taking the inode lock (i_mutex) before fiemap operations. The root cause is that fiemap_fill_next_extent() could fault while accessing user space buffers, which creates a lock-order cyc...
CVE-2023-52754
CVE-2023-52754 is a Linux kernel vulnerability in the imon USB driver. The driver could memory-corrupt by naively assuming the first interface is bound to imon when probing the second interface; a malformed descriptor could bind the first interface to another driver. A patch adds a sanity check a...
CVE-2024-57976
CVE-2024-57976 affects the Linux kernel’s btrfs filesystem. When cow_file_range() returns an error during delalloc handling (ENOSPC), error cleanup clears EXTENT_DELALLOC and dirty flags, but pages can remain dirty, triggering a subsequent COW fixup path and a kernel BUG (extent_writepage_io). Th...
CVE-2025-38384
CVE-2025-38384 affects the Linux kernel’s MTD spinand/ECC engine path. The root cause is a memory leak where ECC engine configuration memory allocated during ECC init is not released during spinand cleanup. The leak trace shows kmemleak reporting an unreferenced object during spinand probe/init p...
CVE-2009-4031
CVE-2009-4031 affects the KVM x86 emulator (arch/x86/kvm/emulate.c) in the Linux kernel prior to 2.6.32-rc8-next-20091125. The do_insn_fetch path could interpret instructions longer than valid, failing to enforce the 15-byte limit per instruction, which guest OS users can abuse to cause a denial ...
CVE-2011-1016
CVE-2011-1016 concerns the Linux kernel Radeon GPU drivers and their DRM subsystem. The affected component is the Radeon GPU driver (radeon/kms) in kernels before 2.6.38-rc5, where data related to the AA resolve registers was not properly validated. This could allow a local user to write to arbit...
CVE-2011-2497
CVE-2011-2497 is a Linux kernel Bluetooth L2CAP underflow/overflow issue. The vulnerability arises from an integer underflow in l2cap_config_req in net/bluetooth/l2cap_core.c, enabling remote attackers to trigger a heap memory corruption or buffer overflow via a small command-size value in an L2C...
CVE-2011-4097
CVE-2011-4097 affects the Linux kernel up to version 3.1.8 on 64-bit systems. The vulnerability is due to an integer overflow in the oom_badness function (mm/oom_kill.c), which can allow a local user to trigger memory exhaustion or terminate processes, resulting in a denial of service. The root c...
CVE-2012-3552
The CVE-2012-3552 issue is a race condition in the Linux kernel IP implementation that exists in versions before 3.0. According to the connected documents, remote attackers could trigger a denial of service (slab corruption and system crash) by sending packets to an application that sets socket o...
CVE-2021-47328
CVE-2021-47328 corresponds to a Linux kernel vulnerability in the SCSI/iSCSI subsystem. The issue is a use-after-free condition in the iscsi_conn structure during resets if an unbind_target call has not occurred, allowing a race where iscsi_conn_teardown frees a connection while EH threads may st...
CVE-2021-47522
CVE-2021-47522 affects the Linux kernel HID bigbenff handling in uhid. When emulating the device, if no output reports exist, report_field may be NULL, risking a NULL pointer dereference. The issue has been resolved in the Linux kernel (as described in connected Astra Linux advisory blocks). Impa...
CVE-2021-47610
CVE-2021-47610: In the Linux kernel, a NULL pointer dereference in the DRM MSM GEM submit path (msm_ioctl_gem_submit) could trigger a kernel panic (Oops) and crash the system. The vulnerability arises from dereferencing a NULL in msm_ioctl_gem_submit, leading to a trace via kref_put and drm ioctl...
CVE-2021-47654
CVE-2021-47654: Linux kernel landlock sandbox fix for a path_list memory leak where path_list allocated in parse_path() is not freed. Description notes a leak warning in sandboxer.c:134 and that path_list is freed by none. No exploitation details or fixes/versions are specified beyond the fix not...
CVE-2022-49174
CVE-2022-49174 affects the Linux kernel ext4 filesystem, specifically the ext4_mb_mark_bb() logic when flex_bg (default enabled) and fast_commit are used. The issue occurs when an inode’s extents span block groups and ext4_mb_mark_bb() reads the starting block group’s bitmap only once; it does no...
CVE-2022-49271
CVE-2022-49271 affects the Linux kernel CIFS/SMB2 code. When smb2_ioctl_query_info() is called with flags=PASSTHRU_FSCTL and output_buffer_length=0, the kernel could copy a bad pointer (buffer) and end up dereferencing NULL, potentially leading to a NULL pointer dereference. The fix also ensures ...
CVE-2022-49337
The CVE-2022-49337 issue affects the Linux kernel OCFS2 DLM: dlmfs user_dlm_destroy_lock error handling could leave flags set, causing unlink to remove inodes while a dlm lock remains linked, risking a user-after-free panic. The advisory states that USER_LOCK_IN_TEARDOWN must be reverted on failu...
CVE-2022-49432
CVE-2022-49432 affects the Linux kernel on PowerPC/xics: a refcount leak in icp_opal_init() was fixed. The root cause is that of_find_compatible_node() returns a node pointer with refcount already incremented, and the fix is to call of_node_put() on it when done. The upstream description notes th...
CVE-2022-49502
CVE-2022-49502 relates to the Linux kernel, specifically the media driver component for the rga (graphics) device. The issue was a memory leak in rga_probe where the rga->m2m_dev could remain allocated if rga_probe failed, and the resolution requires freeing m2m_dev on probe failure. The vulne...
CVE-2022-49763
Summary (CVE-2022-49763) In the Linux kernel NTFS code, the use-after-free issue in ntfs_attr_find() stems from missing bounds checks on the attrs_offset field after loading the first MFT record. The vulnerability was exposed by KASAN reports (use-after-free read) during NTFS attribute handling, ...
CVE-2025-37802
CVE-2025-37802 affects the ksmbd path in the Linux kernel. The issue arises when wait_event_timeout() sets the current task state to TASK_UNINTERRUPTIBLE before the condition check, causing a possible blocking operation to occur while the task is not RUNNING, with ksmbd_durable_scavenger_alive() ...
CVE-2025-37877
CVE-2025-37877 : Linux kernel iommu-dma cleanup after iommu_device_register() errors may leave devices connected to iommu-dma, risking crashes in iommu-dma. The fix adds cleaning of the dev->dma_iommu flag along with other cleanup when probe/registration fails. Affected component: kernel IOMMU...
CVE-2025-38061
CVE-2025-38061 (Linux kernel, net: pktgen) is described in connected Nessus/OS advisories as a fix for an out-of-bounds memory access in pktgen_thread_write. The root cause is failing to honor the user-supplied buffer size in strn_len() calls, which could cause memory access outside the buffer. T...
CVE-1999-0656
The CVE-1999-0656 issue affects the ugidd RPC interface and allows remote enumeration of valid usernames by querying arbitrary UIDs mapped to local user/group names. Connected documents indicate affected kernel packages in Linux distributions (e.g., CBL Mariner and Red Hat-sourced advisories) wit...
CVE-2008-2812
CVE-2008-2812 affects the Linux kernel prior to 2.6.25.10, with NULL pointer dereferences in tty handling (notably in drivers/net/ such as hamradio, irda, ppp, slip, wan, and wireless components) potentially enabling local privilege escalation or a system crash. The issue arises from missing chec...
CVE-2010-3297
CVE-2010-3297 affects the Linux kernel net/eql driver; the eql_g_master_cfg function in drivers/net/eql.c did not initialize a structure member, enabling local users to read kernel stack memory via an EQL_GETMASTRCFG ioctl. Affects kernels before 2.6.36-rc5; corrected in subsequent patches (net/e...
CVE-2010-3298
CVE-2010-3298 affects the Linux kernel. The hso_get_count function in drivers/net/usb/hso.c, in kernel builds before 2.6.36-rc5, does not initialize a certain structure member, which allows local users to read potentially sensitive information from kernel stack memory via the TIOCGICOUNT ioctl. T...
CVE-2011-1748
CVE-2011-1748 affects the Linux kernel: the raw_release function in net/can/raw.c fails to validate a socket data structure, enabling local users to trigger a NULL pointer dereference (denial of service) or possibly other impact via a crafted release operation. Affected versions are the kernel be...
CVE-2012-0044
CVE-2012-0044 is an integer overflow in drm_mode_dirtyfb_ioctl() within Linux kernel drivers/gpu/drm/drm_crtc.c, vulnerable before 3.1.5. The flaw allows local users to gain privileges or trigger memory corruption/DoS via a crafted ioctl. Public sources (including MiracleLinux AXSA-2012-646:05) c...
CVE-2014-0203
CVE-2014-0203 affects the Linux kernel up to version 2.6.32.x, where the __do_follow_link function in fs/namei.c mishandles the last pathname component for certain filesystems, enabling a local attacker to trigger a denial of service (incorrect free operations and system crash) via an open() call...
CVE-2016-6787
CVE-2016-6787 affects the Linux kernel’s performance subsystem: kernel/events/core.c before 4.0 mismanages locks during certain migrations, allowing local users to gain privileges via a crafted application (Android internal bug 31095224). Impact is local privilege escalation with complete confide...
CVE-2022-48710
CVE-2022-48710 concerns the Linux kernel Radeon driver. Inradeon_fp_native_mode() , the code assigns the return ofdrm_mode_duplicate() to a mode pointer and may dereference a NULL on failure. The issue is resolved by adding a NULL-pointer check to avoid NP: when drm_mode_duplicate() fails, and th...
CVE-2022-48824
CVE-2022-48824 : In the Linux kernel, the scsi myrs driver can crash during error handling. If privdata->hw_init() fails non‑zero, myrs_detect() leaves cs->disable_intr as NULL and myrs_cleanup() dereferences a NULL pointer, causing a kernel crash with a NULL pointer dereference. The issue ...
CVE-2022-49126
CVE-2022-49126 concerns the Linux kernel component scsi/mpi3mr. The issue is described as memory leaks in the operational reply queue’s memory segments that are not freed when unloading the driver. The entry states a fix for these leaks has been implemented. No exploitation details are provided i...
CVE-2022-49128
The CVE concerns the Linux kernel DRM bridge PM runtime: calling pm_runtime_get_sync() could increment the runtime PM counter even on error, risking a refcount leak. The provided fix replaces this API with pm_runtime_resume_and_get() (which does not change the runtime PM counter on error) and add...