138 results · Clear filters · Feed
-
High 8.8CVE-2025-37899 Public exploit
ksmbd: fix use-after-free in session logoff
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in session logoff The sess->user object can currently be in use by another thread, for example if another connection has sent a session setup request to bind to the …
-
Medium 5.5CVE-2025-23134 Public exploit
ALSA: timer: Don't take register_mutex with copy_from/to_user()
In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Don't take register_mutex with copy_from/to_user() The infamous mmap_lock taken in copy_from/to_user() can be often problematic when it's called inside another mutex, as they mig…
-
High 7.8CVE-2025-21756 Public exploit
vsock: Keep the binding until socket destruction
In the Linux kernel, the following vulnerability has been resolved: vsock: Keep the binding until socket destruction Preserve sockets bindings; this includes both resulting from an explicit bind() and those implicitly bound through autobind during connect(). …
-
High 7.8CVE-2025-21692 Public exploit
net: sched: fix ets qdisc OOB Indexing
In the Linux kernel, the following vulnerability has been resolved: net: sched: fix ets qdisc OOB Indexing Haowei Yan <g1042620637@gmail.com> found that ets_class_from_arg() can index an Out-Of-Bound class in ets_class_from_arg() when passed clid of 0. The ov…
-
High 7.8
media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format
In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format This can lead to out of bounds writes since frames of this type were not taken into account when calculating …
KEV Feb 5, 2025 -
Unscored —CVE-2024-50251 Public exploit
netfilter: nft_payload: sanitize offset and length before calling skb_checksum()
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_payload: sanitize offset and length before calling skb_checksum() If access to offset + length is larger than the skbuff length, then skb_checksum() triggers BUG_ON(). skb_chec…
-
High 7.8CVE-2024-49882 Public exploit
ext4: fix double brelse() the buffer of the extents path
In the Linux kernel, the following vulnerability has been resolved: ext4: fix double brelse() the buffer of the extents path In ext4_ext_try_to_merge_up(), set path[1].p_bh to NULL after it has been released, otherwise it may be released twice. An example of …
-
Medium 5.7CVE-2024-2193 Public exploit
Speculative Race Condition impacts modern CPU architectures that support speculative execution, also known as GhostRace.
A Speculative Race Condition (SRC) vulnerability that impacts modern CPU architectures supporting speculative execution (related to Spectre V1) has been disclosed. An unauthenticated attacker can exploit this vulnerability to disclose arbitrary data from the …
-
High 7.0CVE-2023-3640 Public exploit
Kernel: x86/mm: a per-cpu entry area leak was identified through the init_cea_offsets function when prefetchnta and prefetcht2 instructions being used for the per-cpu entry area mapping to the user space
A possible unauthorized memory access flaw was found in the Linux kernel's cpu_entry_area mapping of X86 CPU data to memory, where a user may guess the location of exception stacks or other important data. Based on the previous CVE-2023-0597, the 'Randomize p…
-
Medium 5.5CVE-2022-4543 Public exploit
A flaw named "EntryBleed" was found in the Linux Kernel Page Table Isolation (KPTI). This issue could allow a local att…
-
Unscored —CVE-2021-3864 Public exploit
A flaw was found in the way the dumpable flag setting was handled when certain SUID binaries executed its descendants. …
-
Unscored —CVE-2022-25265 Public exploit
In the Linux kernel through 5.16.10, certain binary files may have the exec-all attribute if they were built in approxi…
-
Unscored —CVE-2021-3773 Public exploit
A flaw in netfilter could allow a network-connected attacker to infer openvpn connection endpoint information for furth…
-
Unscored —CVE-2020-15802 Public exploit
Devices supporting Bluetooth before 5.1 may allow man-in-the-middle attacks, aka BLURtooth. Cross Transport Key Derivat…
-
Unscored —CVE-2020-14356 Public exploit
A flaw null pointer dereference in the Linux kernel cgroupv2 subsystem in versions before 5.7.10 was found in the way w…
-
High 7.1CVE-2019-15794 Public exploit
Reference counting error in overlayfs/shiftfs error path when used in conjuction with aufs
Overlayfs in the Linux kernel and shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, both replace vma->vm_file in their mmap handlers. On error the original value is not restored, and the reference is put for t…
-
Low 3.9CVE-2018-1121 Public exploit
procps-ng, procps is vulnerable to a process hiding through race condition. Since the kernel's proc_pid_readdir() retur…
-
Unscored —CVE-2016-2854 Public exploit
The aufs module for the Linux kernel 3.x and 4.x does not properly maintain POSIX ACL xattr data, which allows local us…