Linux Kernel vulnerabilities

CVE-2022-4095 [HIGH] CWE-416 CVE-2022-4095: A use-after-free flaw was found in Linux kernel before 5.19.2. This issue occurs in cmd_hdl_filter i A use-after-free flaw was found in Linux kernel before 5.19.2. This issue occurs in cmd_hdl_filter in drivers/staging/rtl8712/rtl8712_cmd.c, allowing an attacker to launch a local denial of service attack and gain escalation of privileges.

CVE-2023-52482 [HIGH] CWE-787 CVE-2023-52482: In the Linux kernel, the following vulnerability has been resolved: x86/srso: Add SRSO mitigation f In the Linux kernel, the following vulnerability has been resolved: x86/srso: Add SRSO mitigation for Hygon processors Add mitigation for the speculative return stack overflow vulnerability which exists on Hygon processors too.

CVE-2024-57900 [HIGH] CWE-416 CVE-2024-57900: In the Linux kernel, the following vulnerability has been resolved: ila: serialize calls to nf_regi In the Linux kernel, the following vulnerability has been resolved: ila: serialize calls to nf_register_net_hooks() syzbot found a race in ila_add_mapping() [1] commit 031ae72825ce ("ila: call nf_unregister_net_hooks() sooner") attempted to fix a similar issue. Looking at the syzbot repro, we have concurrent ILA_CMD_ADD commands. Add a mutex to ma

CVE-2024-53214 [HIGH] CWE-129 CVE-2024-53214: In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Properly hide first-i In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Properly hide first-in-list PCIe extended capability There are cases where a PCIe extended capability should be hidden from the user. For example, an unknown capability (i.e., capability with ID greater than PCI_EXT_CAP_ID_MAX) or a capability that is intentionally chosen t

CVE-2024-56614 [HIGH] CWE-787 CVE-2024-56614: In the Linux kernel, the following vulnerability has been resolved: xsk: fix OOB map writes when de In the Linux kernel, the following vulnerability has been resolved: xsk: fix OOB map writes when deleting elements Jordy says: " In the xsk_map_delete_elem function an unsigned integer (map->max_entries) is compared with a user-controlled signed integer (k). Due to implicit type conversion, a large unsigned value for map->max_entries can bypass the

CVE-2022-49290 [HIGH] CWE-415 CVE-2022-49290: In the Linux kernel, the following vulnerability has been resolved: mac80211: fix potential double In the Linux kernel, the following vulnerability has been resolved: mac80211: fix potential double free on mesh join While commit 6a01afcf8468 ("mac80211: mesh: Free ie data when leaving mesh") fixed a memory leak on mesh leave / teardown it introduced a potential memory corruption caused by a double free when rejoining the mesh: ieee80211_leave_mesh

CVE-2025-38248 [HIGH] CWE-416 CVE-2025-38248: In the Linux kernel, the following vulnerability has been resolved: bridge: mcast: Fix use-after-fr In the Linux kernel, the following vulnerability has been resolved: bridge: mcast: Fix use-after-free during router port configuration The bridge maintains a global list of ports behind which a multicast router resides. The list is consulted during forwarding to ensure multicast packets are forwarded to these ports even if the ports are not member in

CVE-2024-53168 [HIGH] CWE-416 CVE-2024-53168: In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix one UAF issue cause In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket BUG: KASAN: slab-use-after-free in tcp_write_timer_handler+0x156/0x3e0 Read of size 1 at addr ffff888111f322cd by task swapper/0/0 CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.0-rc4-dirty #7 Hardware name: QEMU St

CVE-2021-47505 [HIGH] CWE-416 CVE-2021-47505: In the Linux kernel, the following vulnerability has been resolved: aio: fix use-after-free due to In the Linux kernel, the following vulnerability has been resolved: aio: fix use-after-free due to missing POLLFREE handling signalfd_poll() and binder_poll() are special in that they use a waitqueue whose lifetime is the current task, rather than the struct file as is normally the case. This is okay for blocking polls, since a blocking poll occurs wi

CVE-2024-22705 [HIGH] CWE-125 CVE-2024-22705: An issue was discovered in ksmbd in the Linux kernel before 6.6.10. smb2_get_data_area_len in fs/smb An issue was discovered in ksmbd in the Linux kernel before 6.6.10. smb2_get_data_area_len in fs/smb/server/smb2misc.c can cause an smb_strndup_from_utf16 out-of-bounds access because the relationship between Name data and CreateContexts data is mishandled.

CVE-2022-49238 [HIGH] CWE-416 CVE-2022-49238: In the Linux kernel, the following vulnerability has been resolved: ath11k: free peer for station w In the Linux kernel, the following vulnerability has been resolved: ath11k: free peer for station when disconnect from AP for QCA6390/WCN6855 Commit b4a0f54156ac ("ath11k: move peer delete after vdev stop of station for QCA6390 and WCN6855") is to fix firmware crash by changing the WMI command sequence, but actually skip all the peer delete operation

CVE-2024-26883 [HIGH] CWE-119 CVE-2024-26883: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix stackmap overflow chec In the Linux kernel, the following vulnerability has been resolved: bpf: Fix stackmap overflow check on 32-bit arches The stackmap code relies on roundup_pow_of_two() to compute the number of hash buckets, and contains an overflow check by checking if the resulting value is 0. However, on 32-bit arches, the roundup code itself can overflow by doing a

CVE-2023-2235 [HIGH] CWE-416 CVE-2023-2235: A use-after-free vulnerability in the Linux Kernel Performance Events system can be exploited to ach A use-after-free vulnerability in the Linux Kernel Performance Events system can be exploited to achieve local privilege escalation. The perf_group_detach function did not check the event's siblings' attach_state before calling add_event_to_groups(), but remove_on_exec made it possible to call list_del_event() on before detaching from their group, maki

CVE-2022-3977 [HIGH] CWE-416 CVE-2022-3977: A use-after-free flaw was found in the Linux kernel MCTP (Management Component Transport Protocol) f A use-after-free flaw was found in the Linux kernel MCTP (Management Component Transport Protocol) functionality. This issue occurs when a user simultaneously calls DROPTAG ioctl and socket close happens, which could allow a local user to crash the system or potentially escalate their privileges on the system.

CVE-2024-26797 [HIGH] CWE-120 CVE-2024-26797: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Prevent potent In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Prevent potential buffer overflow in map_hw_resources Adds a check in the map_hw_resources function to prevent a potential buffer overflow. The function was accessing arrays using an index that could potentially be greater than the size of the arrays, leading to a bu

CVE-2023-52594 [HIGH] CWE-129 CVE-2023-52594: In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: Fix potential arra In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() Fix an array-index-out-of-bounds read in ath9k_htc_txstatus(). The bug occurs when txs->cnt, data from a URB provided by a USB device, is bigger than the size of the array txs->txstatus, which is HTC_MA

CVE-2023-52796 [HIGH] CWE-787 CVE-2023-52796: In the Linux kernel, the following vulnerability has been resolved: ipvlan: add ipvlan_route_v6_out In the Linux kernel, the following vulnerability has been resolved: ipvlan: add ipvlan_route_v6_outbound() helper Inspired by syzbot reports using a stack of multiple ipvlan devices. Reduce stack size needed in ipvlan_process_v6_outbound() by moving the flowi6 struct used for the route lookup in an non inlined helper. ipvlan_route_v6_outbound() need

CVE-2021-47118 [HIGH] CWE-416 CVE-2021-47118: In the Linux kernel, the following vulnerability has been resolved: pid: take a reference when init In the Linux kernel, the following vulnerability has been resolved: pid: take a reference when initializing `cad_pid` During boot, kernel_init_freeable() initializes `cad_pid` to the init task's struct pid. Later on, we may change `cad_pid` via a sysctl, and when this happens proc_do_cad_pid() will increment the refcount on the new pid via get_pid(),

CVE-2024-47701 [HIGH] CWE-416 CVE-2024-47701: In the Linux kernel, the following vulnerability has been resolved: ext4: avoid OOB when system.dat In the Linux kernel, the following vulnerability has been resolved: ext4: avoid OOB when system.data xattr changes underneath the filesystem When looking up for an entry in an inlined directory, if e_value_offs is changed underneath the filesystem by some change in the block device, it will lead to an out-of-bounds access that KASAN detects as an UAF

CVE-2024-26749 [HIGH] CWE-416 CVE-2024-26749: In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: fixed memory use af In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: fixed memory use after free at cdns3_gadget_ep_disable() ... cdns3_gadget_ep_free_request(&priv_ep->endpoint, &priv_req->request); list_del_init(&priv_req->list); ... 'priv_req' actually free at cdns3_gadget_ep_free_request(). But list_del_init() use priv_req->list after