CVE-2022-25636

CVE-2022-25636 affects the Linux kernel (5.4–5.6.10) via an out-of-bounds heap write in net/netfilter/nf_dup_netdev.c related to nf_tables_offload. This enables local privilege escalation. The connected documents confirm the affected range and the heap OOB write, but do not provide a detailed fix...

CVE-2023-3390

CVE-2023-3390 is a local-use-after-free vulnerability in Linux kernel nftables (net/netfilter/nf_tables_api.c) caused by mishandled NFT_MSG_NEWRULE error paths, enabling a local attacker with CAP_SYS_ADMIN to trigger a privilege escalation. Public advisories (Amazon Linux 2/ALAS, Astra Linux, Deb...

CVE-2023-35001

CVE-2023-35001 is a Linux kernel nftables vulnerability where the nft_byteorder expression mishandles vm register contents when CAP_NET_ADMIN exists in any user or network namespace, causing an out-of-bounds read/write in the nf_tables nft_byteorder path. Public references in the provided documen...

CVE-2023-1989

CVE-2023-1989 affects the Linux kernel, in particular the bluetooth driver path drivers/bluetooth/btsdio.c, function btsdio_remove. A call to btsdio_remove with an unfinished job can create a race condition that leads to a use-after-free (UAF) on hdev devices. Connected Astra Linux bulletin mirro...

CVE-2023-28466

Summary: CVE-2023-28466 affects the Linux kernel up to 6.2.6, where do_tls_getsockopt in net/tls/tls_main.c can race due to a missing lock_sock, causing a use-after-free or NULL pointer dereference. The condition is a local, kernel‑level issue with potential crashes or memory corruption as descri...

CVE-2023-1838

The CVE-2023-1838 entry centers on a use-after-free flaw in the Linux kernel’s vhost_net_set_backend (drivers/vhost/net.c, virtio network subcomponent) caused by a double fget. This can allow a local attacker to crash the system and potentially leak kernel information. Connected documents (Astra ...

CVE-2023-35828

CVE-2023-35828 affects the Linux kernel with a use-after-free in the Renesas USB3 gadget driver (drivers/usb/gadget/udc/renesas_usb3.c: renesas_usb3_remove). The vulnerability is triggered in certain removal paths, enabling local attackers to potentially crash the kernel or escalate privileges. A...

CVE-2022-48502

CVE-2022-48502 affects the Linux kernel ntfs3 subsystem. A vulnerability in fs/ntfs3/xattr.c (ntfs_set_ea) allows an out-of-bounds read during disk reads due to improper checks. This is described in multiple sources (Linux kernel advisories and vendor bulletins) as present in kernels before 6.2. ...

CVE-2023-32248

CVE-2023-32248 describes a flaw in the Linux kernel’s ksmbd (the in-kernel SMB server) related to the handling of SMB2_TREE_CONNECT and SMB2_QUERY_INFO. The issue stems from the lack of proper validation of a pointer before access, which attackers can leverage to cause a denial-of-service conditi...

CVE-2023-35826

CVE-2023-35826 affects the Linux kernel before 6.3.2, with a use-after-free in cedrus_remove (drivers/staging/media/sunxi/cedrus/cedrus.c). The issue is described in the NVD entry and corroborated by related advisories; the root cause is a resource management/use-after-free in the cedrus driver. ...

CVE-2023-1295

CVE-2023-1295 describes a time-of-check to time-of-use issue in the Linux kernel io_uring IORING_OP_CLOSE path, affecting kernels 5.6–5.11 (inclusive). The flaw, a local privilege escalation, is introduced by the commit b5dba59e0cf7e2cc4d3b3b1ac5fe81ddf21959eb and patched in 9eac1904d3364254d622b...