Linux Kernel vulnerabilities

CVE-2025-21785 [HIGH] CWE-787 CVE-2025-21785: In the Linux kernel, the following vulnerability has been resolved: arm64: cacheinfo: Avoid out-of- In the Linux kernel, the following vulnerability has been resolved: arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array The loop that detects/populates cache information already has a bounds check on the array size but does not account for cache levels with separate data/instructions cache. Fix this by incrementing the index for any popula

CVE-2024-50262 [HIGH] CWE-787 CVE-2024-50262: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds write in In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds write in trie_get_next_key() trie_get_next_key() allocates a node stack with size trie->max_prefixlen, while it writes (trie->max_prefixlen + 1) nodes to the stack when it has full paths from the root to leaves. For example, consider a trie with max_prefixlen i

CVE-2023-52464 [HIGH] CWE-119 CVE-2023-52464: In the Linux kernel, the following vulnerability has been resolved: EDAC/thunderx: Fix possible out In the Linux kernel, the following vulnerability has been resolved: EDAC/thunderx: Fix possible out-of-bounds string access Enabling -Wstringop-overflow globally exposes a warning for a common bug in the usage of strncat(): drivers/edac/thunderx_edac.c: In function 'thunderx_ocx_com_threaded_isr': drivers/edac/thunderx_edac.c:1136:17: error: 'strnca

CVE-2024-38578 [HIGH] CWE-787 CVE-2024-38578: In the Linux kernel, the following vulnerability has been resolved: ecryptfs: Fix buffer size for t In the Linux kernel, the following vulnerability has been resolved: ecryptfs: Fix buffer size for tag 66 packet The 'TAG 66 Packet Format' description is missing the cipher code and checksum fields that are packed into the message packet. As a result, the buffer allocated for the packet is 3 bytes too small and write_tag_66_packet() will write up to

CVE-2021-47609 [HIGH] CWE-120 CVE-2021-47609: In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scpi: Fix string In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scpi: Fix string overflow in SCPI genpd driver Without the bound checks for scpi_pd->name, it could result in the buffer overflow when copying the SCPI device name from the corresponding device tree node as the name string is set at maximum size of 30. Let us fix it by

CVE-2021-47553 [HIGH] CWE-908 CVE-2021-47553: In the Linux kernel, the following vulnerability has been resolved: sched/scs: Reset task stack sta In the Linux kernel, the following vulnerability has been resolved: sched/scs: Reset task stack state in bringup_cpu() To hot unplug a CPU, the idle task on that CPU calls a few layers of C code before finally leaving the kernel. When KASAN is in use, poisoned shadow is left around for each of the active stack frames, and when shadow call stacks are

CVE-2021-47474 [HIGH] CWE-787 CVE-2021-47474: In the Linux kernel, the following vulnerability has been resolved: comedi: vmk80xx: fix bulk-buffe In the Linux kernel, the following vulnerability has been resolved: comedi: vmk80xx: fix bulk-buffer overflow The driver is using endpoint-sized buffers but must not assume that the tx and rx buffers are of equal size or a malicious device could overflow the slab-allocated receive buffer when doing bulk transfers.

CVE-2025-22056 [HIGH] CWE-787 CVE-2025-22056: In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix gene In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix geneve_opt type confusion addition When handling multiple NFTA_TUNNEL_KEY_OPTS_GENEVE attributes, the parsing logic should place every geneve_opt structure one by one compactly. Hence, when deciding the next geneve_opt position, the pointer addition should

CVE-2025-21780 [HIGH] CWE-120 CVE-2025-21780: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: avoid buffer overfl In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() It malicious user provides a small pptable through sysfs and then a bigger pptable, it may cause buffer overflow attack in function smu_sys_set_pp_table().

CVE-2025-37854 [HIGH] CWE-416 CVE-2025-37854: In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix mode1 reset cra In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix mode1 reset crash issue If HW scheduler hangs and mode1 reset is used to recover GPU, KFD signal user space to abort the processes. After process abort exit, user queues still use the GPU to access system memory before h/w is reset while KFD cleanup worker free system

CVE-2024-39480 [HIGH] CWE-120 CVE-2024-39480: In the Linux kernel, the following vulnerability has been resolved: kdb: Fix buffer overflow during In the Linux kernel, the following vulnerability has been resolved: kdb: Fix buffer overflow during tab-complete Currently, when the user attempts symbol completion with the Tab key, kdb will use strncpy() to insert the completed symbol into the command buffer. Unfortunately it passes the size of the source buffer rather than the destination to strnc

CVE-2023-52867 [HIGH] CWE-787 CVE-2023-52867: In the Linux kernel, the following vulnerability has been resolved: drm/radeon: possible buffer ove In the Linux kernel, the following vulnerability has been resolved: drm/radeon: possible buffer overflow Buffer 'afmt_status' of size 6 could overflow, since index 'afmt_idx' is checked after access.

CVE-2021-47598 [HIGH] CWE-416 CVE-2021-47598: In the Linux kernel, the following vulnerability has been resolved: sch_cake: do not call cake_dest In the Linux kernel, the following vulnerability has been resolved: sch_cake: do not call cake_destroy() from cake_init() qdiscs are not supposed to call their own destroy() method from init(), because core stack already does that. syzbot was able to trigger use after free: DEBUG_LOCKS_WARN_ON(lock->magic != lock) WARNING: CPU: 0 PID: 21902 at kern

CVE-2024-26956 [HIGH] CVE-2024-26956: In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix failure to detect D In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix failure to detect DAT corruption in btree and direct mappings Patch series "nilfs2: fix kernel bug at submit_bh_wbc()". This resolves a kernel BUG reported by syzbot. Since there are two flaws involved, I've made each one a separate patch. The first patch alone resolves the syz

CVE-2024-38577 [HIGH] CWE-120 CVE-2024-38577: In the Linux kernel, the following vulnerability has been resolved: rcu-tasks: Fix show_rcu_tasks_t In the Linux kernel, the following vulnerability has been resolved: rcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow There is a possibility of buffer overflow in show_rcu_tasks_trace_gp_kthread() if counters, passed to sprintf() are huge. Counter numbers, needed for this are unrealistically high, but buffer overflow is still possible.

CVE-2024-0562 [HIGH] CWE-416 CVE-2024-0562: A use-after-free flaw was found in the Linux Kernel. When a disk is removed, bdi_unregister is calle A use-after-free flaw was found in the Linux Kernel. When a disk is removed, bdi_unregister is called to stop further write-back and waits for associated delayed work to complete. However, wb_inode_writeback_end() may schedule bandwidth estimation work after this has completed, which can result in the timer attempting to access the recently freed bdi_wr

CVE-2025-38236 [HIGH] CWE-416 CVE-2025-38236: In the Linux kernel, the following vulnerability has been resolved: af_unix: Don't leave consecutiv In the Linux kernel, the following vulnerability has been resolved: af_unix: Don't leave consecutive consumed OOB skbs. Jann Horn reported a use-after-free in unix_stream_read_generic(). The following sequences reproduce the issue: $ python3 from socket import * s1, s2 = socketpair(AF_UNIX, SOCK_STREAM) s1.send(b'x', MSG_OOB) s2.recv(1, MSG_OOB) #

CVE-2023-52474 [HIGH] CVE-2023-52474: In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fix bugs with non-PAGE In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fix bugs with non-PAGE_SIZE-end multi-iovec user SDMA requests hfi1 user SDMA request processing has two bugs that can cause data corruption for user SDMA requests that have multiple payload iovecs where an iovec other than the tail iovec does not run up to the page boundary for the

CVE-2022-3577 [HIGH] CWE-401 CVE-2022-3577: An out-of-bounds memory write flaw was found in the Linux kernel’s Kid-friendly Wired Controller dri An out-of-bounds memory write flaw was found in the Linux kernel’s Kid-friendly Wired Controller driver. This flaw allows a local user to crash or potentially escalate their privileges on the system. It is in bigben_probe of drivers/hid/hid-bigbenff.c. The reason is incorrect assumption - bigben devices all have inputs. However, malicious devices can br

CVE-2022-49186 [HIGH] CWE-129 CVE-2022-49186: In the Linux kernel, the following vulnerability has been resolved: clk: visconti: prevent array ov In the Linux kernel, the following vulnerability has been resolved: clk: visconti: prevent array overflow in visconti_clk_register_gates() This code was using -1 to represent that there was no reset function. Unfortunately, the -1 was stored in u8 so the if (clks[i].rs_id >= 0) condition was always true. This lead to an out of bounds access in viscon