Linux Kernel vulnerabilities

CVE-2024-50063 [HIGH] CVE-2024-50063: In the Linux kernel, the following vulnerability has been resolved: bpf: Prevent tail call between In the Linux kernel, the following vulnerability has been resolved: bpf: Prevent tail call between progs attached to different hooks bpf progs can be attached to kernel functions, and the attached functions can take different parameters or return different return values. If prog attached to one kernel function tail calls prog attached to another kernel functi

CVE-2024-50203 [HIGH] CWE-787 CVE-2024-50203: In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: Fix address emissio In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: Fix address emission with tag-based KASAN enabled When BPF_TRAMP_F_CALL_ORIG is enabled, the address of a bpf_tramp_image struct on the stack is passed during the size calculation pass and an address on the heap is passed during code generation. This may cause a heap buff

CVE-2021-47282 [HIGH] CWE-787 CVE-2021-47282: In the Linux kernel, the following vulnerability has been resolved: spi: bcm2835: Fix out-of-bounds In the Linux kernel, the following vulnerability has been resolved: spi: bcm2835: Fix out-of-bounds access with more than 4 slaves Commit 571e31fa60b3 ("spi: bcm2835: Cache CS register value for ->prepare_message()") limited the number of slaves to 3 at compile-time. The limitation was necessitated by a statically-sized array prepare_cs[] in the driv

CVE-2021-47137 [HIGH] CWE-770 CVE-2021-47137: In the Linux kernel, the following vulnerability has been resolved: net: lantiq: fix memory corrupt In the Linux kernel, the following vulnerability has been resolved: net: lantiq: fix memory corruption in RX ring In a situation where memory allocation or dma mapping fails, an invalid address is programmed into the descriptor. This can lead to memory corruption. If the memory allocation fails, DMA should reuse the previous skb and mapping and drop

CVE-2025-21786 [HIGH] CWE-416 CVE-2025-21786: In the Linux kernel, the following vulnerability has been resolved: workqueue: Put the pwq after de In the Linux kernel, the following vulnerability has been resolved: workqueue: Put the pwq after detaching the rescuer from the pool The commit 68f83057b913("workqueue: Reap workers via kthread_stop() and remove detach_completion") adds code to reap the normal workers but mistakenly does not handle the rescuer and also removes the code waiting for th

CVE-2025-21700 [HIGH] CWE-416 CVE-2025-21700: In the Linux kernel, the following vulnerability has been resolved: net: sched: Disallow replacing In the Linux kernel, the following vulnerability has been resolved: net: sched: Disallow replacing of child qdisc from one parent to another Lion Ackermann was able to create a UAF which can be abused for privilege escalation with the following script Step 1. create root qdisc tc qdisc add dev lo root handle 1:0 drr step2. a class for packet aggrega

CVE-2024-56638 [HIGH] CVE-2024-56638: In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_inner: incorrect In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_inner: incorrect percpu area handling under softirq Softirq can interrupt ongoing packet from process context that is walking over the percpu area that contains inner header offsets. Disable bh and perform three checks before restoring the percpu inner header offsets to valid

CVE-2020-0432 [HIGH] CVE-2020-0432: In skb_to_mamac of networking In skb_to_mamac of networking.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-143560807

CVE-2022-49753 [HIGH] CWE-416 CVE-2022-49753: In the Linux kernel, the following vulnerability has been resolved: dmaengine: Fix double increment In the Linux kernel, the following vulnerability has been resolved: dmaengine: Fix double increment of client_count in dma_chan_get() The first time dma_chan_get() is called for a channel the channel client_count is incorrectly incremented twice for public channels, first in balance_ref_count(), and again prior to returning. This results in an incorr

CVE-2024-36477 [HIGH] CWE-125 CVE-2024-36477: In the Linux kernel, the following vulnerability has been resolved: tpm_tis_spi: Account for SPI he In the Linux kernel, the following vulnerability has been resolved: tpm_tis_spi: Account for SPI header when allocating TPM SPI xfer buffer The TPM SPI transfer mechanism uses MAX_SPI_FRAMESIZE for computing the maximum transfer length and the size of the transfer buffer. As such, it does not account for the 4 bytes of header that prepends the SPI da

CVE-2021-39714 [HIGH] CVE-2021-39714: In ion_buffer_kmap_get of ion In ion_buffer_kmap_get of ion.c, there is a possible use-after-free due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-205573273References: Upstream kernel

CVE-2022-50070 [HIGH] CVE-2022-50070: In the Linux kernel, the following vulnerability has been resolved: mptcp: do not queue data on clo In the Linux kernel, the following vulnerability has been resolved: mptcp: do not queue data on closed subflows Dipanjan reported a syzbot splat at close time: WARNING: CPU: 1 PID: 10818 at net/ipv4/af_inet.c:153 inet_sock_destruct+0x6d0/0x8e0 net/ipv4/af_inet.c:153 Modules linked in: uio_ivshmem(OE) uio(E) CPU: 1 PID: 10818 Comm: kworker/1:16 Tainted: G OE

CVE-2024-56759 [HIGH] CWE-416 CVE-2024-56759: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free when In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free when COWing tree bock and tracing is enabled When a COWing a tree block, at btrfs_cow_block(), and we have the tracepoint trace_btrfs_cow_block() enabled and preemption is also enabled (CONFIG_PREEMPT=y), we can trigger a use-after-free in the COWed extent bu

CVE-2024-53139 [HIGH] CWE-416 CVE-2024-53139: In the Linux kernel, the following vulnerability has been resolved: sctp: fix possible UAF in sctp_ In the Linux kernel, the following vulnerability has been resolved: sctp: fix possible UAF in sctp_v6_available() A lockdep report [1] with CONFIG_PROVE_RCU_LIST=y hints that sctp_v6_available() is calling dev_get_by_index_rcu() and ipv6_chk_addr() without holding rcu. [1] WARNING: suspicious RCU usage 6.12.0-rc5-virtme #1216 Tainted: G W net/core/d

CVE-2022-49951 [HIGH] CWE-416 CVE-2022-49951: In the Linux kernel, the following vulnerability has been resolved: firmware_loader: Fix use-after- In the Linux kernel, the following vulnerability has been resolved: firmware_loader: Fix use-after-free during unregister In the following code within firmware_upload_unregister(), the call to device_unregister() could result in the dev_release function freeing the fw_upload_priv structure before it is dereferenced for the call to module_put(). This

CVE-2022-3238 [HIGH] CWE-459 CVE-2022-3238: A double-free flaw was found in the Linux kernel’s NTFS3 subsystem in how a user triggers remount an A double-free flaw was found in the Linux kernel’s NTFS3 subsystem in how a user triggers remount and umount simultaneously. This flaw allows a local user to crash or potentially escalate their privileges on the system.

CVE-2022-20568 [HIGH] CVE-2022-20568: In (TBD) of (TBD), there is a possible way to corrupt kernel memory due to a use after free In (TBD) of (TBD), there is a possible way to corrupt kernel memory due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-220738351References: Upstream kernel

CVE-2025-71159 [HIGH] CWE-416 CVE-2025-71159: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free warni In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free warning in btrfs_get_or_create_delayed_node() Previously, btrfs_get_or_create_delayed_node() set the delayed_node's refcount before acquiring the root->delayed_nodes lock. Commit e8513c012de7 ("btrfs: implement ref_tracker for delayed_nodes") moved refcount_

CVE-2026-53264 [HIGH] CWE-416 CVE-2026-53264: In the Linux kernel, the following vulnerability has been resolved: net/sched: act_api: use RCU wit In the Linux kernel, the following vulnerability has been resolved: net/sched: act_api: use RCU with deferred freeing for action lifecycle When NEWTFILTER and DELFILTER are run concurrently it is possible to create a race with an associated action. Let's illustrate with CPU0 running NEWTFILTER and CPU1 running DELFILTER: 0: mutex_lock() 0, mutex he

CVE-2022-49846 [HIGH] CWE-787 CVE-2022-49846: In the Linux kernel, the following vulnerability has been resolved: udf: Fix a slab-out-of-bounds w In the Linux kernel, the following vulnerability has been resolved: udf: Fix a slab-out-of-bounds write bug in udf_find_entry() Syzbot reported a slab-out-of-bounds Write bug: loop0: detected capacity change from 0 to 2048 BUG: KASAN: slab-out-of-bounds in udf_find_entry+0x8a5/0x14f0 fs/udf/namei.c:253 Write of size 105 at addr ffff8880123ff896 by t