Linux Kernel vulnerabilities

CVE-2024-49869 [HIGH] CWE-120 CVE-2024-49869: In the Linux kernel, the following vulnerability has been resolved: btrfs: send: fix buffer overflo In the Linux kernel, the following vulnerability has been resolved: btrfs: send: fix buffer overflow detection when copying path to cache entry Starting with commit c0247d289e73 ("btrfs: send: annotate struct name_cache_entry with __counted_by()") we annotated the variable length array "name" from the name_cache_entry structure with __counted_by() to

CVE-2022-3239 [HIGH] CWE-416 CVE-2022-3239: A flaw use after free in the Linux kernel video4linux driver was found in the way user triggers em28 A flaw use after free in the Linux kernel video4linux driver was found in the way user triggers em28xx_usb_probe() for the Empia 28xx based TV cards. A local user could use this flaw to crash the system or potentially escalate their privileges on the system.

CVE-2025-37822 [HIGH] CVE-2025-37822: In the Linux kernel, the following vulnerability has been resolved: riscv: uprobes: Add missing fen In the Linux kernel, the following vulnerability has been resolved: riscv: uprobes: Add missing fence.i after building the XOL buffer The XOL (execute out-of-line) buffer is used to single-step the replaced instruction(s) for uprobes. The RISC-V port was missing a proper fence.i (i$ flushing) after constructing the XOL buffer, which can result in incorrect e

CVE-2024-57998 [HIGH] CWE-125 CVE-2024-57998: In the Linux kernel, the following vulnerability has been resolved: OPP: add index check to assert In the Linux kernel, the following vulnerability has been resolved: OPP: add index check to assert to avoid buffer overflow in _read_freq() Pass the freq index to the assert function to make sure we do not read a freq out of the opp->rates[] table when called from the indexed variants: dev_pm_opp_find_freq_exact_indexed() or dev_pm_opp_find_freq_ceil/

CVE-2022-3424 [HIGH] CWE-416 CVE-2022-3424: A use-after-free flaw was found in the Linux kernel’s SGI GRU driver in the way the first gru_file_u A use-after-free flaw was found in the Linux kernel’s SGI GRU driver in the way the first gru_file_unlocked_ioctl function is called by the user, where a fail pass occurs in the gru_check_chiplet_assignment function. This flaw allows a local user to crash or potentially escalate their privileges on the system.

CVE-2021-47458 [HIGH] CWE-787 CVE-2021-47458: In the Linux kernel, the following vulnerability has been resolved: ocfs2: mount fails with buffer In the Linux kernel, the following vulnerability has been resolved: ocfs2: mount fails with buffer overflow in strlen Starting with kernel 5.11 built with CONFIG_FORTIFY_SOURCE mouting an ocfs2 filesystem with either o2cb or pcmk cluster stack fails with the trace below. Problem seems to be that strings for cluster stack and cluster name are not guara

CVE-2022-2977 [HIGH] CWE-416 CVE-2022-2977: A flaw was found in the Linux kernel implementation of proxied virtualized TPM devices. On a system A flaw was found in the Linux kernel implementation of proxied virtualized TPM devices. On a system where virtualized TPM devices are configured (this is not the default) a local attacker can create a use-after-free and create a situation where it may be possible to escalate privileges on the system.

CVE-2025-37752 [HIGH] CWE-129 CVE-2025-37752: In the Linux kernel, the following vulnerability has been resolved: net_sched: sch_sfq: move the li In the Linux kernel, the following vulnerability has been resolved: net_sched: sch_sfq: move the limit validation It is not sufficient to directly validate the limit on the data that the user passes as it can be updated based on how the other parameters are changed. Move the check at the end of the configuration update process to also catch scenario

CVE-2021-47566 [HIGH] CWE-787 CVE-2021-47566: In the Linux kernel, the following vulnerability has been resolved: proc/vmcore: fix clearing user In the Linux kernel, the following vulnerability has been resolved: proc/vmcore: fix clearing user buffer by properly using clear_user() To clear a user buffer we cannot simply use memset, we have to use clear_user(). With a virtio-mem device that registers a vmcore_cb and has some logically unplugged memory inside an added Linux memory block, I can e

CVE-2022-1976 [HIGH] CWE-416 CVE-2022-1976: A flaw was found in the Linux kernel’s implementation of IO-URING. This flaw allows an attacker with A flaw was found in the Linux kernel’s implementation of IO-URING. This flaw allows an attacker with local executable permission to create a string of requests that can cause a use-after-free flaw within the kernel. This issue leads to memory corruption and possible privilege escalation.

CVE-2023-39197 [HIGH] CWE-125 CVE-2023-39197: An out-of-bounds read vulnerability was found in Netfilter Connection Tracking (conntrack) in the Li An out-of-bounds read vulnerability was found in Netfilter Connection Tracking (conntrack) in the Linux kernel. This flaw allows a remote user to disclose sensitive information via the DCCP protocol.

CVE-2024-53095 [HIGH] CWE-416 CVE-2024-53095: In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix use-after-free In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix use-after-free of network namespace. Recently, we got a customer report that CIFS triggers oops while reconnecting to a server. [0] The workload runs on Kubernetes, and some pods mount CIFS servers in non-root network namespaces. The problem rarely happened, but it

CVE-2024-35905 [HIGH] CWE-129 CVE-2024-35905: In the Linux kernel, the following vulnerability has been resolved: bpf: Protect against int overfl In the Linux kernel, the following vulnerability has been resolved: bpf: Protect against int overflow for stack access size This patch re-introduces protection against the size of access to stack memory being negative; the access size can appear negative as a result of overflowing its signed int representation. This should not actually happen, as the

CVE-2023-0030 [HIGH] CWE-416 CVE-2023-0030: A use-after-free flaw was found in the Linux kernel’s nouveau driver in how a user triggers a memory A use-after-free flaw was found in the Linux kernel’s nouveau driver in how a user triggers a memory overflow that causes the nvkm_vma_tail function to fail. This flaw allows a local user to crash or potentially escalate their privileges on the system.

CVE-2025-38512 [HIGH] CVE-2025-38512: In the Linux kernel, the following vulnerability has been resolved: wifi: prevent A-MSDU attacks in In the Linux kernel, the following vulnerability has been resolved: wifi: prevent A-MSDU attacks in mesh networks This patch is a mitigation to prevent the A-MSDU spoofing vulnerability for mesh networks. The initial update to the IEEE 802.11 standard, in response to the FragAttacks, missed this case (CVE-2025-27558). It can be considered a variant of CVE-20

CVE-2023-1252 [HIGH] CWE-416 CVE-2023-1252: A use-after-free flaw was found in the Linux kernel’s Ext4 File System in how a user triggers severa A use-after-free flaw was found in the Linux kernel’s Ext4 File System in how a user triggers several file operations simultaneously with the overlay FS usage. This flaw allows a local user to crash or potentially escalate their privileges on the system. Only if patch 9a2544037600 ("ovl: fix use after free in struct ovl_aio_req") not applied yet, the ke

CVE-2022-49888 [HIGH] CWE-787 CVE-2022-49888: In the Linux kernel, the following vulnerability has been resolved: arm64: entry: avoid kprobe recu In the Linux kernel, the following vulnerability has been resolved: arm64: entry: avoid kprobe recursion The cortex_a76_erratum_1463225_debug_handler() function is called when handling debug exceptions (and synchronous exceptions from BRK instructions), and so is called when a probed function executes. If the compiler does not inline cortex_a76_errat

CVE-2024-46852 [HIGH] CWE-193 CVE-2024-46852: In the Linux kernel, the following vulnerability has been resolved: dma-buf: heaps: Fix off-by-one In the Linux kernel, the following vulnerability has been resolved: dma-buf: heaps: Fix off-by-one in CMA heap fault handler Until VM_DONTEXPAND was added in commit 1c1914d6e8c6 ("dma-buf: heaps: Don't track CMA dma-buf pages under RssFile") it was possible to obtain a mapping larger than the buffer size via mremap and bypass the overflow check in dma

CVE-2024-58069 [HIGH] CWE-787 CVE-2024-58069: In the Linux kernel, the following vulnerability has been resolved: rtc: pcf85063: fix potential OO In the Linux kernel, the following vulnerability has been resolved: rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read The nvmem interface supports variable buffer sizes, while the regmap interface operates with fixed-size storage. If an nvmem client uses a buffer size less than 4 bytes, regmap_read will write out of bounds as it expects t

CVE-2025-39860 [HIGH] CWE-416 CVE-2025-39860: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix use-after-free i In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() syzbot reported the splat below without a repro. In the splat, a single thread calling bt_accept_dequeue() freed sk and touched it after that. The root cause would be the racy l2cap_sock_cleanup_listen() call added by the