Linux Kernel vulnerabilities

CVE-2022-2964 [HIGH] CWE-119 CVE-2022-2964: A flaw was found in the Linux kernel’s driver for the ASIX AX88179_178A-based USB 2.0/3.0 Gigabit Et A flaw was found in the Linux kernel’s driver for the ASIX AX88179_178A-based USB 2.0/3.0 Gigabit Ethernet Devices. The vulnerability contains multiple out-of-bounds reads and possible out-of-bounds writes.

CVE-2025-38490 [HIGH] CWE-415 CVE-2025-38490: In the Linux kernel, the following vulnerability has been resolved: net: libwx: remove duplicate pa In the Linux kernel, the following vulnerability has been resolved: net: libwx: remove duplicate page_pool_put_full_page() page_pool_put_full_page() should only be invoked when freeing Rx buffers or building a skb if the size is too short. At other times, the pages need to be reused. So remove the redundant page put. In the original code, double free

CVE-2022-1419 [HIGH] CWE-416 CVE-2022-1419: The root cause of this vulnerability is that the ioctl$DRM_IOCTL_MODE_DESTROY_DUMB can decrease refc The root cause of this vulnerability is that the ioctl$DRM_IOCTL_MODE_DESTROY_DUMB can decrease refcount of *drm_vgem_gem_object *(created in *vgem_gem_dumb_create*) concurrently, and *vgem_gem_dumb_create *will access the freed drm_vgem_gem_object.

CVE-2021-47634 [HIGH] CWE-416 CVE-2021-47634: In the Linux kernel, the following vulnerability has been resolved: ubi: Fix race condition between In the Linux kernel, the following vulnerability has been resolved: ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl Hulk Robot reported a KASAN report about use-after-free: BUG: KASAN: use-after-free in __list_del_entry_valid+0x13d/0x160 Read of size 8 at addr ffff888035e37d98 by task ubiattach/1385 [...] Call Trace: klist_dec_and_

CVE-2024-40927 [HIGH] CWE-416 CVE-2024-40927: In the Linux kernel, the following vulnerability has been resolved: xhci: Handle TD clearing for mu In the Linux kernel, the following vulnerability has been resolved: xhci: Handle TD clearing for multiple streams case When multiple streams are in use, multiple TDs might be in flight when an endpoint is stopped. We need to issue a Set TR Dequeue Pointer for each, to ensure everything is reset properly and the caches cleared. Change the logic so tha

CVE-2022-49700 [HIGH] CWE-416 CVE-2022-49700: In the Linux kernel, the following vulnerability has been resolved: mm/slub: add missing TID update In the Linux kernel, the following vulnerability has been resolved: mm/slub: add missing TID updates on slab deactivation The fastpath in slab_alloc_node() assumes that c->slab is stable as long as the TID stays the same. However, two places in __slab_alloc() currently don't update the TID when deactivating the CPU slab. If multiple operations race

CVE-2024-53171 [HIGH] CWE-416 CVE-2024-53171: In the Linux kernel, the following vulnerability has been resolved: ubifs: authentication: Fix use- In the Linux kernel, the following vulnerability has been resolved: ubifs: authentication: Fix use-after-free in ubifs_tnc_end_commit After an insertion in TNC, the tree might split and cause a node to change its `znode->parent`. A further deletion of other nodes in the tree (which also could free the nodes), the aforementioned node's `znode->cparent

CVE-2024-26793 [HIGH] CWE-416 CVE-2024-26793: In the Linux kernel, the following vulnerability has been resolved: gtp: fix use-after-free and nul In the Linux kernel, the following vulnerability has been resolved: gtp: fix use-after-free and null-ptr-deref in gtp_newlink() The gtp_link_ops operations structure for the subsystem must be registered after registering the gtp_net_ops pernet operations structure. Syzkaller hit 'general protection fault in gtp_genl_dump_pdp' bug: [ 1010.702740] gt

CVE-2026-23427 [HIGH] CWE-416 CVE-2026-23427: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in du In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in durable v2 replay of active file handles parse_durable_handle_context() unconditionally assigns dh_info->fp->conn to the current connection when handling a DURABLE_REQ_V2 context with SMB2_FLAGS_REPLAY_OPERATION. ksmbd_lookup_fd_cguid() does not filter by

CVE-2025-38533 [HIGH] CWE-787 CVE-2025-38533: In the Linux kernel, the following vulnerability has been resolved: net: libwx: fix the using of Rx In the Linux kernel, the following vulnerability has been resolved: net: libwx: fix the using of Rx buffer DMA The wx_rx_buffer structure contained two DMA address fields: 'dma' and 'page_dma'. However, only 'page_dma' was actually initialized and used to program the Rx descriptor. But 'dma' was uninitialized and used in some paths. This could lead

CVE-2024-47745 [HIGH] CVE-2024-47745: In the Linux kernel, the following vulnerability has been resolved: mm: call the security_mmap_file In the Linux kernel, the following vulnerability has been resolved: mm: call the security_mmap_file() LSM hook in remap_file_pages() The remap_file_pages syscall handler calls do_mmap() directly, which doesn't contain the LSM security check. And if the process has called personality(READ_IMPLIES_EXEC) before and remap_file_pages() is called for RW pages, thi

CVE-2024-40899 [HIGH] CWE-416 CVE-2024-40899: In the Linux kernel, the following vulnerability has been resolved: cachefiles: fix slab-use-after- In the Linux kernel, the following vulnerability has been resolved: cachefiles: fix slab-use-after-free in cachefiles_ondemand_get_fd() We got the following issue in a fuzz test of randomly issuing the restore command: BUG: KASAN: slab-use-after-free in cachefiles_ondemand_daemon_read+0x609/0xab0 Write of size 4 at addr ffff888109164a80 by task onde

CVE-2024-36974 [HIGH] CVE-2024-36974: In the Linux kernel, the following vulnerability has been resolved: net/sched: taprio: always valid In the Linux kernel, the following vulnerability has been resolved: net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP If one TCA_TAPRIO_ATTR_PRIOMAP attribute has been provided, taprio_parse_mqprio_opt() must validate it, or userspace can inject arbitrary data to the kernel, the second time taprio_change() is called. First call (with valid attribut

CVE-2024-41050 [HIGH] CWE-416 CVE-2024-41050: In the Linux kernel, the following vulnerability has been resolved: cachefiles: cyclic allocation o In the Linux kernel, the following vulnerability has been resolved: cachefiles: cyclic allocation of msg_id to avoid reuse Reusing the msg_id after a maliciously completed reopen request may cause a read request to remain unprocessed and result in a hung, as shown below: t1 | t2 | t3 cachefiles_ondemand_select_req cachefiles_ondemand_object_is_close

CVE-2024-35886 [HIGH] CWE-674 CVE-2024-35886: In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix infinite recursion in In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix infinite recursion in fib6_dump_done(). syzkaller reported infinite recursive calls of fib6_dump_done() during netlink socket destruction. [1] From the log, syzkaller sent an AF_UNSPEC RTM_GETROUTE message, and then the response was generated. The following recvmmsg() resu

CVE-2023-5633 [HIGH] CVE-2023-5633: The reference count changes made as part of the CVE-2023-33951 and CVE-2023-33952 fixes exposed a us The reference count changes made as part of the CVE-2023-33951 and CVE-2023-33952 fixes exposed a use-after-free flaw in the way memory objects were handled when they were being used to store a surface. When running inside a VMware guest with 3D acceleration enabled, a local, unprivileged user could potentially use this flaw to escalate their privileges.

CVE-2024-47697 [HIGH] CWE-787 CVE-2024-47697: In the Linux kernel, the following vulnerability has been resolved: drivers: media: dvb-frontends/r In the Linux kernel, the following vulnerability has been resolved: drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error Ensure index in rtl2830_pid_filter does not exceed 31 to prevent out-of-bounds access. dev->filters is a 32-bit value, so set_bit and clear_bit functions should only operate on indices from 0 to 31. If index is

CVE-2024-41003 [HIGH] CWE-787 CVE-2024-41003: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix reg_set_min_max corrup In the Linux kernel, the following vulnerability has been resolved: bpf: Fix reg_set_min_max corruption of fake_reg Juan reported that after doing some changes to buzzer [0] and implementing a new fuzzing strategy guided by coverage, they noticed the following in one of the probes: [...] 13: (79) r6 = *(u64 *)(r0 +0) ; R0=map_value(ks=4,vs=8) R6_w=s

CVE-2022-49592 [HIGH] CWE-787 CVE-2022-49592: In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix dma queue left In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix dma queue left shift overflow issue When queue number is > 4, left shift overflows due to 32 bits integer variable. Mask calculation is wrong for MTL_RXQ_DMA_MAP1. If CONFIG_UBSAN is enabled, kernel dumps below warning: [ 10.363842] =================================

CVE-2022-49044 [HIGH] CWE-787 CVE-2022-49044: In the Linux kernel, the following vulnerability has been resolved: dm integrity: fix memory corrup In the Linux kernel, the following vulnerability has been resolved: dm integrity: fix memory corruption when tag_size is less than digest size It is possible to set up dm-integrity in such a way that the "tag_size" parameter is less than the actual digest size. In this situation, a part of the digest beyond tag_size is ignored. In this case, dm-inte