CVE-2021-23134

CVE-2021-23134 is a Linux kernel NFC LLCP use-after-free in nfc sockets (pre-5.12.4). The issue arises from refcount handling during bind/connect fixes, enabling a local attacker with CAP_NET_RAW to trigger a crash or memory corruption. A related CVE discussion confirms the fix: after nfc_llcp_lo...

CVE-2022-42896

CVE-2022-42896 affects the Linux kernel, specifically use-after-free in net/bluetooth/l2cap_core.c (l2cap_connect and l2cap_le_connect_req). A remote Bluetooth proximity attacker could trigger code execution or leak kernel memory. A fix is available by upgrading past the commit 711f8c3fb3db618970...

CVE-2022-30594

The CVE-2022-30594 issue affects the Linux kernel prior to 5.17.2, where the PTRACE_SEIZE path could bypass the PT_SUSPEND_SECCOMP restrictions and allow a local attacker to bypass seccomp-related restrictions. Connected advisories (Astra Linux, AlmaLinux advisories) confirm the same vulnerabilit...

CVE-2020-29374

CVE-2020-29374 affects the Linux kernel and was fixed in 5.7.3. It concerns the get_user_pages (gup) implementation used for copy-on-write pages: when handling read operations, it may grant unintended write access, risking information disclosure or data corruption (COW cross-process leakage). Sev...

CVE-2021-3655

CVE-2021-3655 is a Linux kernel SCTP vulnerability (present in kernels prior to affected fixes) where missing size validations on inbound SCTP packets may allow reading uninitialized memory. The initial description and connected advisories confirm the issue exists in the Linux kernel SCTP impleme...

CVE-2022-0516

CVE-2022-0516 affects the KVM for s390 in the Linux kernel, specifically the arch/s390/kvm/kvm-s390.c function kvm_s390_guest_sida_op. The vulnerability allows a local user with normal privileges to obtain unauthorized memory write access due to an insufficient check in the KVM s390x release_agen...

CVE-2019-15217

The CVE-2019-15217 entry concerns a NULL pointer dereference in the Linux kernel before 5.2.3, triggered by a malicious USB device via the zr364xx USB driver (drivers/media/usb/zr364xx/zr364xx.c). The issue can lead to a denial of service on a physical USB attack vector. Public references indicat...

CVE-2023-4133

CVE-2023-4133 affects the Linux kernel cxgb4 driver; root cause is a use-after-free during detachment when flower_stats_timer is rearmed on the work queue, which can cause local denial of service by crashing the system. The MiracleLinux advisory AXSA:2024-8139:15 references CVE-2023-4133 among af...

CVE-2019-15220

CVE-2019-15220 affects the Linux kernel prior to 5.2.1 and involves a use-after-free in the p54usb.c driver caused by a malicious USB device. The issue can lead to a denial of service via kernel memory corruption when a vulnerable USB device is connected to drivers/net/wireless/intersil/p54. The ...

CVE-2021-43389

CVE-2021-43389 affects the Linux kernel (pre-5.14.15) with an array-index-out-of-bounds flaw in the ISDN CAPI detach_capi_ctr function (kcapi.c). Multiple sources describe this as a local privilege‑escalation/DoS risk, where a privileged attacker could cause memory corruption, DoS, or potentially...

CVE-2020-27170

The CVE-2020-27170 flaw affects the Linux kernel prior to 5.11.8, where in kernel/bpf/verifier.c there is undesirable out-of-bounds speculation on pointer arithmetic. This can enable a side-channel attack that defeats Spectre mitigations and may allow an attacker to obtain sensitive information f...

CVE-2020-10767

CVE-2020-10767 affects the Linux kernel before 5.8-rc1, where Enhanced IBPB mitigation is disabled when STIBP is unavailable or when IBRS is available, enabling a Spectre V2–style attack on local confidentiality. Connected advisories confirm Linux kernel mitigations (IBPB/SSBD) and note a patched...

CVE-2020-25284

The CVE-2020-25284 issue concerns the Rados Block Device (rbd) driver in the Linux kernel. Affected code path is in the rbd subsystem (drivers/block/rbd.c) where permission checks to access rbd devices were incomplete, enabling a local attacker to map or unmap rbd block devices. Multiple connecte...

CVE-2022-1184

CVE-2022-1184 affects the Linux kernel ext4 file-system code (fs/ext4/namei.c:dx_insert_block). The flaw is a use-after-free that can be triggered by a local user to cause a denial of service. Astra Linux bulletin also documents this exact issue. The connected documents do not specify a fixed ver...

CVE-2019-19045

CVE-2019-19045 affects the Linux kernel prior to 5.3.11 due to a memory leak in mlx5_fpga_conn_create_cq() (drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c). The issue allows local attackers to cause memory DoS by triggering mlx5_vector2eqn() failures. Ubuntu/Unity/SUSE advisories cite the sa...

CVE-2019-11190

CVE-2019-11190 affects the Linux kernel prior to 4.8. Local users could bypass ASLR on setuid programs (e.g., /bin/su) due to install_exec_creds() being invoked late in load_elf_binary() in fs/binfmt_elf.c, creating a race in ptrace_may_access() when reading /proc/pid/stat. Connected advisories (...

CVE-2021-23133

CVE-2021-23133 is a race condition in the Linux kernel SCTP sockets (net/sctp/socket.c) prior to 5.12-rc8. If sctp_destroy_sock executes without sock_net(sk)->sctp.addr_wq_lock, an element is removed from the auto_asconf_splist list without proper locking, enabling a local attacker with networ...

CVE-2023-2008

The CVE-2023-2008 flaw is in the Linux kernel udmabuf device driver, within its fault handler. It stems from insufficient validation of user-supplied data, allowing a memory access past the end of an array. This can enable local privilege escalation and execution of arbitrary code in the kernel c...

CVE-2019-15090

CVE-2019-15090 affects the Linux kernel driver component drivers/scsi/qedi/qedi_dbg.c, with an out-of-bounds read in the qedi_dbg_* family of functions for versions before 5.1.12. The issue can enable a local attacker to read memory due to improper bounds handling, as described in the CVE entry. ...

CVE-2020-12464

CVE-2020-12464 is a Linux kernel use-after-free in the USB core path. The vulnerability stems from usb_sg_cancel in drivers/usb/core/message.c where a transfer can occur without a proper reference, enabling a local attacker to potentially crash or execute code. Connected documents confirm this is...

CVE-2020-12769

CVE-2020-12769 affects the Linux kernel prior to 5.4.17. The issue is in drivers/spi/spi-dw.c, where concurrent calls to dw_spi_irq and dw_spi_transfer_one can trigger a kernel panic (local exploit). The vulnerability is fixed in Linux kernel 5.4.17 (see ChangeLog-5.4.17). No exploit details are ...

CVE-2020-25212

CVE-2020-25212 affects the NFSv4 client in the Linux kernel and is caused by a TOCTOU mismatch where a size check is performed in fs/nfs/nfs4proc.c instead of fs/nfs/nfs4xdr.c. This can allow a local attacker to corrupt memory or cause unspecified impacts. The issue is addressed in the upstream k...

CVE-2020-14381

CVE-2020-14381 is a vulnerability in the Linux kernel futex implementation. A local attacker can corrupt memory or escalate privileges when creating a futex on a filesystem that is about to be unmounted. The issue is local, with attack vector and conditions described as exploitation requiring loc...

CVE-2023-30456

CVE-2023-30456 affects Linux kernels with arch/x86/kvm/vmx/nested.c pre-6.2.8. The root cause is missing consistency checks for CR0 and CR4 in nVMX on x86_64, which can enable state inconsistency between VMX and guest. Public references indicate this has been addressed by 6.2.8 and via various AL...

CVE-2017-11176

CVE-2017-11176 is a local vulnerability in the Linux kernel’s Netlink mq_notify path. The issue arises because mq_notify does not set the sock pointer to NULL when entering retry logic, enabling a use-after-free scenario during a user-space close of a Netlink socket. Public sources describe poten...

CVE-2023-38409

CVE-2023-38409 affects the Linux kernel fbcon subsystem (drivers/video/fbdev/core/fbcon.c). The issue arises in set_con2fb_map: an assignment is performed only for the first virtual console, which can desynchronize fbcon_registered_fb and fbcon_display when fbcon_mode_deleted is invoked, leaving ...

CVE-2018-21008

CVE-2018-21008 affects the Linux kernel up to version 4.16.6, with a use-after-free in rsi_mac80211_detach (drivers/net/wireless/rsi/rsi_91x_mac80211.c). Nessus/nvd-derived docs consistently reference this flaw across Unity Linux advisories and related feeds, confirming the vulnerable component a...

CVE-2020-27786

CVE-2020-27786 affects the Linux kernel MIDI subsystem (rawmidi) with a use-after-free in the MIDI ioctl handling path. A local attacker with access to issue ioctl commands to MIDI devices could trigger memory corruption, potentially enabling privilege escalation. Public documentation in connecte...

CVE-2020-27820

CVE-2020-27820: Linux kernel use-after-free in nouveau's postclose() during device removal (or unbind). Exploitation local; affects nouveau driver paths; impact: high availability risk, no confidentiality/integrity impact per CVSS. Documents indicate a fix exists in kernel patches (e.g., advisori...

CVE-2020-28974

CVE-2020-28974 is a slab-out-of-bounds read in the Linux kernel’s fbcon driver, fixed in kernel 5.9.7. The flaw arises in KD_FONT_OP_COPY within drivers/tty/vt/vt.c and could allow a local attacker to read privileged kernel memory or cause a kernel crash. Several connected documents describe the ...

CVE-2021-33655

CVE-2021-33655 is confirmed in the provided documents as an out-of-bounds memory write triggered by malicious data sent via the framebuffer ioctl FBIOPUT_VSCREENINFO in the Linux kernel framebuffer/console path. The issue allows a local user to crash the system and potentially escalate privileges...

CVE-2018-1068

CVE-2018-1068 affects the Linux kernel: the 32-bit compatibility layer for ebtables did not sufficiently validate offset values in a 64-bit kernel. A local attacker with CAP_NET_ADMIN (in a namespace) could use this to overwrite kernel memory, potentially leading to privilege escalation. Public a...

CVE-2017-6074

CVE-2017-6074 affects the Linux kernel up to 4.9.11, where dccp_rcv_state_process in net/dccp/input.c mishandles DCCP_PKT_REQUEST data in LISTEN state. This can allow a local user to gain root privileges or trigger a denial of service (double free) via an application using IPV6_RECVPKTINFO setsoc...

CVE-2018-5803

CVE-2018-5803 affects the Linux kernel SCTP chunk handling: a length check flaw in _sctp_make_chunk() (net/sctp/sm_make_chunk.c) can trigger a kernel crash/DoS. Affected kernel versions include 4.15.8, 4.14.25, 4.9.87, 4.4.121, 4.1.51, and 3.2.102. Public advisories (Debian, CentOS/Red Hat, Ubunt...

CVE-2022-47929

CVE-2022-47929 is a Linux kernel vulnerability: a NULL pointer dereference in the traffic control subsystem (affecting qdisc_graft in net/sched/sch_api.c) that allows an unprivileged user to trigger a denial of service (system crash) via crafted tc qdisc/class configurations. Exploitation is loca...

CVE-2023-2166

CVE-2023-2166 pertains to a NULL pointer dereference in the Linux kernel CAN protocol (net/can/af_can.c). The issue is that ml_priv may not be initialized in the receive path for CAN frames, enabling a local attacker to crash the system or potentially cause a denial of service via a malformed or ...

CVE-2019-20096

CVE-2019-20096 affects the Linux kernel before 5.1, where a memory leak in __feat_register_sp() (net/dccp/feat.c) can lead to denial of service. The Unity Linux Nessus advisories (UTSA-2026-003899/004383/000228) reference the same description block, confirming the issue and impact. No specific pa...

CVE-2021-4203

CVE-2021-4203 is a Linux kernel use-after-free read flaw in sock_getsockopt() triggered by a race between SO_PEERCRED/SO_PEERGROUPS and listen()/connect(). An authenticated local attacker could crash the system or leak kernel information. The connected IBM advisories document affected products (I...

CVE-2021-3444

CVE-2021-3444 affects the Linux kernel’s eBPF verifier, where mod32 destination register truncation can be mishandled when the source is known to be zero. This enables a local attacker loading BPF programs to read kernel memory (information disclosure) and potentially perform out-of-bounds writes...

CVE-2021-3772

CVE-2021-3772 affects the Linux kernel SCTP stack: a blind attacker who knows IPs/ports and can spoof packets can kill an existing SCTP association by sending invalid chunks. The connected advisories confirm the issue and point to a patch in the Linux kernel (commit 32f8807a48ae55be0e76880cfe8607...

CVE-2021-30002

The CVE-2021-30002 issue affects the Linux kernel prior to 5.11.3. It is caused by a memory leak in video_usercopy inside drivers/media/v4l2-core/v4l2-ioctl.c when handling large webcam arguments. This memory leak can lead to memory exhaustion on affected systems. Connected advisories (e.g., Debi...

CVE-2022-1508

The CVE-2022-1508 entry describes an out-of-bounds read in the Linux kernel io_uring module triggered by certain parameters to io_read(), enabling a local user with low privileges and no user interaction to read memory out of bounds. The provided data notes a MEDIUM base score (6.1, CVSS 3.1) wit...

CVE-2024-0340

CVE-2024-0340 is confirmed in the Linux kernel, affecting the vhost_new_msg path in drivers/vhost/vhost.c. The issue arises from memory not being properly initialized when building messages exchanged between virtual guests and the host via /dev/vhost-net, enabling local privileged users to read k...

CVE-2019-19533

CVE-2019-19533 affects the Linux kernel prior to 5.3.4 and is caused by an info-leak in the ttusb_dec.c USB driver (drivers/media/usb/ttusb-dec/ttusb_dec.c) when handling a malicious USB device. The vulnerability can lead to partial information disclosure (confidentiality impact). Public referenc...

CVE-2021-29647

CVE-2021-29647 affects the Linux kernel (qrtr_recvmsg in net/qrtr/qrtr.c). The issue is an information disclosure via a partially uninitialized data structure, enabling a local attacker to read kernel memory. Root cause: partially uninitialized data in QRTR IPC router handling. Public references ...

CVE-2022-1789

CVE-2022-1789 targets KVM in the Linux kernel. With shadow paging enabled, INVPCID can lead to a NULL pointer dereference when CR0.PG=0, because the invlpg callback is not set, causing a crash in kvm_mmu_invpcid_gva. The same issue is echoed in Astra Linux and AlmaLinux advisories, which list KVM...

CVE-2018-10853

CVE-2018-10853: A security flaw in the Linux kernel KVM hypervisor (pre-4.18) where emulation of certain unprivileged instructions (sgdt, sidt, fxsave, fxrstor) did not check CPL, potentially allowing an unprivileged guest process to escalate privileges inside the guest. The CVE is linked to comm...

CVE-2021-38204

CVE-2021-38204 affects the Linux kernel MAX-3421 host USB controller driver (drivers/usb/host/max3421-hcd.c). The flaw allows a physically proximate attacker to trigger a use-after-free and cause a denial of service (system panic) by removing a MAX-3421 USB device in certain situations. A fix is ...

CVE-2019-13233

CVE-2019-13233 affects Linux kernel arch/x86/lib/insn-eval.c with a use-after-free in LDT entry access caused by a race between modify_ldt() and a #BR exception for an MPX bounds violation. F5 advisory notes the vulnerability in Linux kernel before 5.1.9 and cites the ChangeLog-5.1.9 as the fix. ...

CVE-2022-1353

CVE-2022-1353 — pfkey_register (net/key/af_key.c, Linux kernel) : A local, unprivileged user can gain access to kernel memory due to a flaw in pfkey_register. The vulnerability can lead to a system crash or leakage of internal kernel information. The Connected documents reference Linux kernel adv...