Linux Kernel vulnerabilities

CVE-2024-26988 [HIGH] CWE-787 CVE-2024-26988: In the Linux kernel, the following vulnerability has been resolved: init/main.c: Fix potential stat In the Linux kernel, the following vulnerability has been resolved: init/main.c: Fix potential static_command_line memory overflow We allocate memory of size 'xlen + strlen(boot_command_line) + 1' for static_command_line, but the strings copied into static_command_line are extra_command_line and command_line, rather than extra_command_line and boot_c

CVE-2023-5972 [HIGH] CWE-476 CVE-2023-5972: A null pointer dereference flaw was found in the nft_inner.c functionality of netfilter in the Linux A null pointer dereference flaw was found in the nft_inner.c functionality of netfilter in the Linux kernel. This issue could allow a local user to crash the system or escalate their privileges on the system.

CVE-2023-45898 [HIGH] CWE-416 CVE-2023-45898: The Linux kernel before 6.5.4 has an es1 use-after-free in fs/ext4/extents_status.c, related to ext4 The Linux kernel before 6.5.4 has an es1 use-after-free in fs/ext4/extents_status.c, related to ext4_es_insert_extent.

CVE-2022-48822 [HIGH] CWE-416 CVE-2022-48822: In the Linux kernel, the following vulnerability has been resolved: usb: f_fs: Fix use-after-free f In the Linux kernel, the following vulnerability has been resolved: usb: f_fs: Fix use-after-free for epfile Consider a case where ffs_func_eps_disable is called from ffs_func_disable as part of composition switch and at the same time ffs_epfile_release get called from userspace. ffs_epfile_release will free up the read buffer and call ffs_data_close

CVE-2023-52612 [HIGH] CWE-120 CVE-2023-52612: In the Linux kernel, the following vulnerability has been resolved: crypto: scomp - fix req->dst bu In the Linux kernel, the following vulnerability has been resolved: crypto: scomp - fix req->dst buffer overflow The req->dst buffer size should be checked before copying from the scomp_scratch->dst to avoid req->dst buffer overflow problem.

CVE-2022-49236 [HIGH] CWE-416 CVE-2022-49236: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF due to race betwee In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF due to race between btf_try_get_module and load_module While working on code to populate kfunc BTF ID sets for module BTF from its initcall, I noticed that by the time the initcall is invoked, the module BTF can already be seen by userspace (and the BPF verifier). The ex

CVE-2024-26852 [HIGH] CWE-416 CVE-2024-26852: In the Linux kernel, the following vulnerability has been resolved: net/ipv6: avoid possible UAF in In the Linux kernel, the following vulnerability has been resolved: net/ipv6: avoid possible UAF in ip6_route_mpath_notify() syzbot found another use-after-free in ip6_route_mpath_notify() [1] Commit f7225172f25a ("net/ipv6: prevent use after free in ip6_route_mpath_notify") was not able to fix the root cause. We need to defer the fib6_info_release

CVE-2024-47698 [HIGH] CWE-787 CVE-2024-47698: In the Linux kernel, the following vulnerability has been resolved: drivers: media: dvb-frontends/r In the Linux kernel, the following vulnerability has been resolved: drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error Ensure index in rtl2832_pid_filter does not exceed 31 to prevent out-of-bounds access. dev->filters is a 32-bit value, so set_bit and clear_bit functions should only operate on indices from 0 to 31. If index is

CVE-2022-49722 [HIGH] CWE-787 CVE-2022-49722: In the Linux kernel, the following vulnerability has been resolved: ice: Fix memory corruption in V In the Linux kernel, the following vulnerability has been resolved: ice: Fix memory corruption in VF driver Disable VF's RX/TX queues, when it's disabled. VF can have queues enabled, when it requests a reset. If PF driver assumes that VF is disabled, while VF still has queues configured, VF may unmap DMA resources. In such scenario device still can m

CVE-2024-40958 [HIGH] CWE-416 CVE-2024-40958: In the Linux kernel, the following vulnerability has been resolved: netns: Make get_net_ns() handle In the Linux kernel, the following vulnerability has been resolved: netns: Make get_net_ns() handle zero refcount net Syzkaller hit a warning: refcount_t: addition on 0; use-after-free. WARNING: CPU: 3 PID: 7890 at lib/refcount.c:25 refcount_warn_saturate+0xdf/0x1d0 Modules linked in: CPU: 3 PID: 7890 Comm: tun Not tainted 6.10.0-rc3-00100-gcaa4f9578

CVE-2015-5364 [HIGH] CWE-399 CVE-2015-5364: The (1) udp_recvmsg and (2) udpv6_recvmsg functions in the Linux kernel before 4.0.6 do not properly The (1) udp_recvmsg and (2) udpv6_recvmsg functions in the Linux kernel before 4.0.6 do not properly consider yielding a processor, which allows remote attackers to cause a denial of service (system hang) via incorrect checksums within a UDP packet flood.

CVE-2026-53362 [HIGH] CVE-2026-53362: In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on th In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are computed as alloclen = fragheaderlen + transhdrlen; pagedlen = datalen - transhdrlen; datalen already

CVE-2022-48956 [HIGH] CWE-416 CVE-2022-48956: In the Linux kernel, the following vulnerability has been resolved: ipv6: avoid use-after-free in i In the Linux kernel, the following vulnerability has been resolved: ipv6: avoid use-after-free in ip6_fragment() Blamed commit claimed rcu_read_lock() was held by ip6_fragment() callers. It seems to not be always true, at least for UDP stack. syzbot reported: BUG: KASAN: use-after-free in ip6_dst_idev include/net/ip6_fib.h:245 [inline] BUG: KASAN:

CVE-2025-22035 [HIGH] CWE-416 CVE-2025-22035: In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free in In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free in print_graph_function_flags during tracer switching Kairui reported a UAF issue in print_graph_function_flags() during ftrace stress testing [1]. This issue can be reproduced if puting a 'mdelay(10)' after 'mutex_unlock(&trace_types_lock)' in s_start(), a

CVE-2023-52864 [HIGH] CWE-787 CVE-2023-52864: In the Linux kernel, the following vulnerability has been resolved: platform/x86: wmi: Fix opening In the Linux kernel, the following vulnerability has been resolved: platform/x86: wmi: Fix opening of char device Since commit fa1f68db6ca7 ("drivers: misc: pass miscdevice pointer via file private data"), the miscdevice stores a pointer to itself inside filp->private_data, which means that private_data will not be NULL when wmi_char_open() is called.

CVE-2022-49258 [HIGH] CWE-416 CVE-2022-49258: In the Linux kernel, the following vulnerability has been resolved: crypto: ccree - Fix use after f In the Linux kernel, the following vulnerability has been resolved: crypto: ccree - Fix use after free in cc_cipher_exit() kfree_sensitive(ctx_p->user.key) will free the ctx_p->user.key. But ctx_p->user.key is still used in the next line, which will lead to a use after free. We can call kfree_sensitive() after dev_dbg() to avoid the uaf.

CVE-2024-42104 [HIGH] CWE-416 CVE-2024-42104: In the Linux kernel, the following vulnerability has been resolved: nilfs2: add missing check for i In the Linux kernel, the following vulnerability has been resolved: nilfs2: add missing check for inode numbers on directory entries Syzbot reported that mounting and unmounting a specific pattern of corrupted nilfs2 filesystem images causes a use-after-free of metadata file inodes, which triggers a kernel bug in lru_add_fn(). As Jan Kara pointed ou

CVE-2022-49464 [HIGH] CWE-416 CVE-2022-49464: In the Linux kernel, the following vulnerability has been resolved: erofs: fix buffer copy overflow In the Linux kernel, the following vulnerability has been resolved: erofs: fix buffer copy overflow of ztailpacking feature I got some KASAN report as below: [ 46.959738] ================================================================== [ 46.960430] BUG: KASAN: use-after-free in z_erofs_shifted_transform+0x2bd/0x370 [ 46.960430] Read of size 4074 a

CVE-2024-49930 [HIGH] CWE-129 CVE-2024-49930: In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix array out-of- In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix array out-of-bound access in SoC stats Currently, the ath11k_soc_dp_stats::hal_reo_error array is defined with a maximum size of DP_REO_DST_RING_MAX. However, the ath11k_dp_process_rx() function access ath11k_soc_dp_stats::hal_reo_error using the REO destination SRN

CVE-2023-52975 [HIGH] CWE-416 CVE-2023-52975: In the Linux kernel, the following vulnerability has been resolved: scsi: iscsi_tcp: Fix UAF during In the Linux kernel, the following vulnerability has been resolved: scsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddress Bug report and analysis from Ding Hui. During iSCSI session logout, if another task accesses the shost ipaddress attr, we can get a KASAN UAF report like this: [ 276.942144] BUG: KASAN: use-after-free in _raw