CVE-2024-26620

CVE-2024-26620 affects the Linux kernel’s s390 VFIO AP mediated devices (vfio-ap). The issue stems from vfio_ap_mdev_filter_matrix: when a new adapter or domain is assigned to an mdev, only the APID/APQI for the new item was inspected. This could leave AP queues bound to no driver exposed to a gu...

CVE-2024-26936

CVE-2024-26936 affects the Linux kernel component ksmbd. The issue arises because the response buffer is allocated in smb2_allocate_rsp_buf() only after validating the request, while the patch shows that fields in the payload and the SMB2 header are used within smb2_allocate_rsp_buf(), enabling a...

CVE-2024-26621

The CVE-2024-26621 vulnerability affects the Linux kernel’s memory management (mm: huge_memory) where 32-bit/compat systems were incorrectly forced to align large anonymous mappings to THP boundaries. This was fixed by reverting the forcing of huge page alignment on 32-bit systems (commit efa7df3...

CVE-2024-26990

CVE-2024-26990 affects the Linux kernel KVM x86/mmu code. The vulnerability concerns write-protecting L2 SPTEs in the TDP MMU when clearing dirty status. The fix ensures kvm_mmu_page_ad_need_write_protect() accounts for role-specific reasons for disabling D-bit dirty logging, so TDP MMU SPTEs are...

CVE-2024-27398

CVE-2024-27398 – Linux kernel Bluetooth SCO use-after-free . The vulnerability stems from a use-after-free in sco_sock_timeout: after a SCO connection is established, releasing the SCO socket may schedule timeout_work, but the socket can be freed yet still dereferenced by sco_sock_timeout, leadin...

CVE-2024-41090

CVE-2024-41090 and CVE-2024-41091 pertain to the Linux kernel’s handling of short frames in TAP/TUN paths. The bug stems from missing verification of frame length in the tap_get_user_xdp() path (CVE-2024-41090) and in the tun_xdp_one()/ETH header handling (CVE-2024-41091), potentially allowing a ...

CVE-2021-47035

The CVE-2021-47035 entry concerns a Linux kernel IOMMU VT-d issue. The vulnerability was in how second-level paging entries were assigned permissions for IOVA translation: Write-Only permission was still being treated inconsistently with the first-level mappings. The fix removes the Write-Only co...

CVE-2024-41091

CVE-2024-41091, in the Linux kernel, is due to missing verification of frame length in the tun_xdp_one() path. This can allow a skb with insufficient Ethernet header length to be processed, risking out-of-bounds access or header-length inconsistencies in subsequent processing. A related path (tun...

CVE-2021-46955

CVE-2021-46955 affects the Linux kernel in combination with Open vSwitch. The issue arises in IPv4 packet fragmentation within ovs_fragment(), where a temporary dst_entry is misused as an rtable pointer during the ip_do_fragment() -> ip_skb_dst_mtu() -> ip_dst_mtu_maybe_forward() -> ip_m...

CVE-2021-47017

The CVE-2021-47017 vulnerability is in the Linux kernel's ath10k_htc_send_bundle path, where a use-after-free could occur if bundle_skb is freed by dev_kfree_skb_any(bundle_skb) but later accessed via bundle_skb->len. The patch mitigates this by updating skb_len after freeing bundle_skb. Affec...

CVE-2024-26931

The CVE-2024-26931 issue affects the Linux kernel’s qla2xxx SCSI driver. Under memory pressure, the driver could not allocate an SRB to perform error recovery during a cable pull, causing a flush failure and the upper layer to modify scsi_cmnd. When memory frees up, another cable-pull flush could...

CVE-2024-26954

CVE-2024-26954 (Linux kernel) is tied to a slab-out-of-bounds read in ksmbd during smb2_create_req processing. The issue arises when smb2_create_req’s NameOffset is smaller than its Buffer offset, allowing slab-out-of-bounds reads from smb2_open. The patch fixes this by enforcing a minimum value ...

CVE-2021-47049

CVE-2021-47049 affects the Linux kernel driver hv: vmbus. The vulnerability is a use-after-free in __vmbus_open() caused by freeing open_info without removing it from the vmbus_connection. The fix is to remove open_info from the chn_msg_list before freeing it (explicit in the advisory). Impact is...

CVE-2024-35915

CVE-2024-35915 affects the Linux kernel NFC/NCI subsystem. The issue is an uninitialized payload read in nci_rx_work() when a received packet has a zero-length payload, leading to potential uninitialized data exposure. The patch fixes the vulnerability by validating the payload size before invoki...

CVE-2021-46973

CVE-2021-46973 is a Linux kernel use-after-free in the MHI path for qrtr (net: qrtr: Avoid potential use after free in MHI send). The issue occurs because the MHI ul_callback could run immediately after queuing an skb, potentially decrementing the associated skb’s refcount and freeing it, which m...

CVE-2024-53144

The CVE-2024-53144 entry maps to a Linux kernel Bluetooth issue in hci_event: BR/EDR JUST_WORKS was aligned with LE, affecting the Just Works pairing flow and forcing user confirmation via confirm_hint due to policy changes in bluetoothd. The description notes this alignment and its rationale; no...

CVE-2025-21659

CVE-2025-21659 covers a Linux kernel netdev issue where NAPI IDs were not namespaced because they were not exposed to user space before the netlink API. The vulnerability arises because netlink must ensure that a NAPI instance belongs to the same network namespace as the genl socket owner; otherw...

CVE-2024-26980

CVE-2024-26980 affects the Linux kernel’s ksmbd component. The vulnerability arises when SMB2_TRANSFORM_PROTO_NUM is used, allowing request size validation to be skipped and potentially triggering a slab-out-of-bounds read in smb2_allocate_rsp_buf(). The issue occurs if a transform request’s size...

CVE-2025-21629

CVE-2025-21629 concerns a Linux kernel vulnerability in the IPv6 offload path for BIG TCP packets. The issue arose when a commit disabled hardware offload for IPv6 packets that include extension headers on devices advertising NETIF_F_IPV6_CSUM; this could trigger skb_warn_bad_offload for BIG TCP ...

CVE-2024-26598

CVE-2024-26598 is a Linux kernel vulnerability affecting KVM on arm64 with vgic-its. The issue is a use-after-free risk in the LPI translation cache: vgic_its_check_cache() drops a lock that serializes refcount changes without first elevating the vgic_irq refcount. If a translation cache hit race...

CVE-2025-37899

The CVE-2025-37899 issue affects the Linux kernel’s ksmbd session logoff path, where sess->user can still be in use by another thread, enabling a use-after-free in smb2_sess_setup handling. The vulnerability is rated with CVSSv3.1: Local attack, Low privileges required, no user interaction, wi...

CVE-2013-2094

CVE-2013-2094 affects the Linux kernel: the perf_swevent_init code in kernel/events/core.c uses an incorrect integer type, enabling a local, unprivileged user to escalate privileges via a crafted perf_event_open call. The issue leads to out-of-bounds access of perf_swevent_enabled and has been fi...

CVE-2021-22555

CVE-2021-22555 is a Linux kernel heap out-of-bounds write vulnerability in net/netfilter/x_tables.c, dating to 2.6.19-rc1. The issue allows a local attacker to gain privileges or cause a DoS via heap memory corruption in the username space. Public sources in the connected docs confirm the vulnera...

CVE-2023-3079

Summary (CVE-2023-3079) : A type confusion in V8 in Google Chrome prior to 114.0.5735.110 can allow remote code execution via a crafted HTML page, with heap corruption as the underlying issue. The vulnerability affects Chrome’s Chromium-based rendering stack (V8 engine) and is rated High severity...

CVE-2026-43284

Summary of CVE-2026-43284 (Linux kernel): The issue occurs in ESP decryption for UDP paths when using shared skb frags. Specifically, after MSG_SPLICE_PAGES attaches pages to an skb, and SKBFL_SHARED_FRAG is set, ESP input could decrypt in place on data not privately owned by the skb, if the frag...

CVE-2022-0185

CVE-2022-0185 is a Linux kernel vulnerability in the legacy_parse_param path of the Filesystem Context API. It is a heap-based buffer overflow in parameter length verification that can be triggered by an unprivileged local user when opening a filesystem that falls back to legacy handling, enablin...

CVE-2013-6282

The CVE-2013-6282 issue affects the Linux kernel on ARM v6k/v7 where get_user and put_user do not validate certain addresses, enabling an unprivileged user to read/write arbitrary kernel memory. Exploitation was reported in the wild on Android devices in late 2013. Affected kernel versions includ...

CVE-2023-52434

CVE-2023-52434 affects Linux kernel SMB/CIFS: the vulnerability is in smb2_parse_contexts() used by SMB2_open (mount.cifs path). Root cause: insufficient validation of offsets/lengths before dereferencing create contexts, enabling an out-of-bounds access that could trigger a kernel oops when serv...

CVE-2017-1000251

CVE-2017-1000251 affects the Linux kernel Bluetooth subsystem (BlueZ) in L2CAP processing, causing a stack buffer overflow when handling configuration responses. Affected range includes kernels from 2.6.32 up to 4.13.1. Exploitation could crash the system or, in some deployments, allow remote cod...

CVE-2019-17666

CVE-2019-17666 affects the Linux kernel Realtek rtlwifi driver (rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c). The root cause is a missing upper-bound check that leads to a buffer overflow. Impact stated in sources includes memory corruption and potential remote code execution, wit...

CVE-2026-43503

The CVE-2026-43503 entry concerns Linux kernel net/skbuff handling: when frags are moved by frag-transfer helpers (notably __pskb_copy_fclone() and skb_shift()), the SKBFL_SHARED_FRAG flag was not propagated to the destination skb, causing destination pages to remain shared while skb_has_shared_f...

CVE-2021-22543

CVE-2021-22543 is described in connected advisories as a local privilege-escalation through KVM and improper handling of VM_IO|VM_PFNMAP VMAs, which can bypass RO checks and allow reading/writing guest memory by a privileged VM operator. Technical details across sources indicate the vulnerability...

CVE-2019-3846

CVE-2019-3846 affects the upstream kernel’s Marvell mwifiex wireless kernel driver. The description documents a memory corruption flaw that could allow privilege escalation when connecting to a malicious wireless network. Connected sources confirm this is within the mwifiex driver and describe th...

CVE-2019-14821

CVE-2019-14821 is a Linux kernel KVM issue: an out-of-bounds access in the Coalesced MMIO write path can occur if a host user controls the MMIO ring buffer indices (ring->first/ring->last). A local attacker with /dev/kvm access could crash the host kernel or potentially escalate privileges ...

CVE-2026-53359

CVE-2026-53359 is a KVM/x86 shadow MMU use-after-free caused by a role mismatch when reusing shadow pages during a nested walk. The flaw arises when a PDE is modified and a 4KB leaf SPTE is installed on the new path, but the parent 2MB page’s direct flag and the shadow page’s role may not align, ...

CVE-2020-28374

CVE-2020-28374 affects the Linux kernel’s SCSI target (LIO) code, specifically drivers/target/target_core_xcopy.c, where insufficient identifier checking could let a remote attacker read or write files via directory traversal in an XCOPY request. Affected component is the Linux kernel prior to 5....

CVE-2021-4154

CVE-2021-4154 is a Linux kernel use-after-free in cgroup v1 parsing (cgroup1_parse_param) that allows local privilege escalation via the fsconfig parameter, potentially enabling container breakout and system DoS. Affected component: kernel/cgroup/cgroup-v1.c in the Linux kernel. Root cause: use-a...

CVE-2025-21765

CVE-2025-21765 is a Linux kernel IPv6 stack issue where ip6_default_advmss() reads the net structure without proper RCU protection, risking use-after-free scenarios. The vulnerability is fixed in updated kernels across Linux distributions (examples: ALAS2KERNEL advisories for AL2 kernels 5.10/5.1...

CVE-2019-6974

CVE-2019-6974 affects the Linux kernel KVM subsystem: a race in kvm_ioctl_create_device() mishandles reference counting, enabling a local user with access to /dev/kvm to cause a use-after-free, potentially crashing the guest or escalating privileges. The issue is fixed in kernel 4.20.8 and relate...

CVE-2019-19770

CVE-2019-19770 affects the Linux kernel 4.19.83 and is described as a use-after-free (read) in the debugfs_remove function (fs/debugfs/inode.c), which handles removal of files/dirs created via debugfs. Note: kernel developers dispute this as a debugfs issue, characterizing it as misuse of debugfs...

CVE-2020-12351

CVE-2020-12351 corresponds to the Linux kernel Bluetooth vulnerability known as BleedingTooth. Exploitation involves Bluetooth L2CAP and related memory handling, with PoCs showing remote code execution from a nearby attacker. Root causes cited in public exploit data include a type-confusion error...

CVE-2021-3653

The CVE-2021-3653 issue affects the KVM hypervisor AMD code dealing with SVM nested virtualization. The root cause is improper validation of the int_ctl field in the VMCB provided by an L1 guest, which could allow a malicious L1 to enable AVIC for an L2 guest. Consequences stated across connected...

CVE-2022-42896

CVE-2022-42896 affects the Linux kernel, specifically use-after-free in net/bluetooth/l2cap_core.c (l2cap_connect and l2cap_le_connect_req). A remote Bluetooth proximity attacker could trigger code execution or leak kernel memory. A fix is available by upgrading past the commit 711f8c3fb3db618970...

CVE-2020-36158

CVE-2020-36158 is a Linux kernel vulnerability in the Marvell mwifiex WiFi driver (join.c) that allows a long SSID to trigger a buffer overflow, potentially leading to system crash or arbitrary code execution. Affected trees include kernels up to 5.10.4; upstream patch (commit 5c455c5ab332) adds ...

CVE-2020-29569

CVE-2020-29569 describes a use-after-free in the Linux kernel PV block backend (blkback) when Xen is used, where the kernel thread handler may not reset ring->xenblkd to NULL if the frontend toggles between connect/disconnect, allowing a misbehaving guest to trigger a dom0 crash. The issue aff...

CVE-2022-1055

CVE-2022-1055 affects the Linux kernel: a use-after-free in tc_new_tfilter within net/sched/cls_api.c can enable privilege escalation when unprivileged user namespaces are in use. The issue allows a local attacker to escalate privileges; exploitation relies on specific local conditions. A fix is ...

CVE-2023-5178

CVE-2023-5178 is a use-after-free vulnerability in the NVMe over Fabrics over TCP subsystem of the Linux kernel, specifically nvmet_tcp_free_crypto in drivers/nvme/target/tcp.c. The logical bug can lead to use-after-free and double-free conditions, with potential remote code execution or local pr...

CVE-2018-16884

The CVE-2018-16884 issue affects the Linux kernel NFS4.1+ client: mounting NFS shares across different network namespaces can cause a use-after-free in bc_svc_process() leading to memory corruption and potential host panic. Exploitation details in the provided sources are host/container local, wi...

CVE-2021-3491

CVE-2021-3491 concerns the Linux kernel io_uring PROVIDE_BUFFERS path, where the MAX_RW_COUNT limit could be bypassed, causing negative values to be used in mem_rw during /proc//mem reads. This could enable a heap overflow and potential arbitrary code execution in the kernel. The issue was addres...

CVE-2021-3656

CVE-2021-3656 describes a flaw in the KVM hypervisor for AMD processors where the L1 guest can provide a VMCB with an improperly validated virt_ext field, allowing the L1 to disable VMLOAD/VMSAVE intercepts and VLS for the L2 guest. This enables the L2 guest to read/write portions of the host’s p...