357 results · Clear filters · Feed
-
Unscored —CVE-2023-2002 Public exploit
A vulnerability was found in the HCI sockets implementation due to a missing capability check in net/bluetooth/hci_sock…
-
High 7.8
In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests can be abused…
-
Medium 4.7CVE-2023-0045 Public exploit
Incorrect indirect branch prediction barrier in the Linux Kernel
The current implementation of the prctl syscall does not issue an IBPB immediately during the syscall. The ib_prctl_set function updates the Thread Information Flags (TIFs) for the task and updates the SPEC_CTRL MSR on the function __speculation_ctrl_update,…
-
Medium 5.6CVE-2023-1998 Public exploit
Spectre v2 SMT mitigations problem in Linux kernel
The Linux kernel allows userspace processes to enable mitigations by calling prctl with PR_SET_SPECULATION_CTRL which disables the speculation feature as well as by using seccomp. We had noticed that on VMs of at least one major cloud provider, the kernel sti…
-
High 8.2CVE-2023-2008 Public exploit
Kernel: udmabuf: improper validation of array index leading to local privilege escalation
A flaw was found in the Linux kernel's udmabuf device driver, within a fault handler. This issue occurs due to the lack of proper validation of user-supplied data, which can result in memory access past the end of an array. This may allow an attacker to escal…
-
High 7.8CVE-2023-1829 Public exploit
Use-after-free in tcindex (traffic control index filter) in the Linux Kernel
A use-after-free vulnerability in the Linux Kernel traffic control index filter (tcindex) can be exploited to achieve local privilege escalation. The tcindex_delete function which does not properly deactivate filters in case of a perfect hashes while deleting…
-
Unscored —CVE-2023-0179 Public exploit
A buffer overflow vulnerability was found in the Netfilter subsystem in the Linux Kernel. This issue could allow the le…
-
Medium 6.7CVE-2023-28772 Public exploit
An issue was discovered in the Linux kernel before 5.13.3. lib/seq_buf.c has a seq_buf_putmem_hex buffer overflow.
-
High 7.8CVE-2023-1281 Public exploit
UAF in Linux kernel's tcindex (traffic control index filter) implementation
Use After Free vulnerability in Linux kernel traffic control index filter (tcindex) allows Privilege Escalation. The imperfect hash area can be updated while packets are traversing, which will cause a use-after-free when 'tcf_exts_exec()' is called with the d…
-
High 7.8
A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities w…
KEV Jun 17, 2025 -
High 7.8CVE-2023-0461 Public exploit
Use-after-free vulnerability in the Linux Kernel
There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local privilege escalation. To reach the vulnerability kernel configuration flag CONFIG_TLS or CONFIG_XFRM_ESPINTCP has to be configured, but the operation does not …
-
High 8.1CVE-2023-20938 Public exploit
In binder_transaction_buffer_release of binder.c, there is a possible use after free due to improper input validation. …
-
High 7.1CVE-2023-26607 Public exploit
In the Linux kernel 6.0.8, there is an out-of-bounds read in ntfs_attr_find in fs/ntfs/attrib.c.
-
High 7.9
Use after free in SNDRV_CTL_IOCTL_ELEM in Linux Kernel
A use after free vulnerability exists in the ALSA PCM package in the Linux Kernel. SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32 is missing locks that can be used in a use-after-free that can result in a priviledge escalation to gain ring0 access from the system user. …
KEV Mar 30, 2023 -
Medium 5.5CVE-2022-4543 Public exploit
A flaw named "EntryBleed" was found in the Linux Kernel Page Table Isolation (KPTI). This issue could allow a local att…
-
High 7.8CVE-2022-45934 Public exploit
An issue was discovered in the Linux kernel through 6.0.10. l2cap_config_req in net/bluetooth/l2cap_core.c has an integ…
-
High 8.0CVE-2022-42896 Public exploit
Info Leak in l2cap_core in the Linux Kernel
There are use-after-free vulnerabilities in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_connect and l2cap_le_connect_req functions which may allow code execution and leaking kernel memory (respectively) remotely via Bluetooth. A remote attacker coul…
-
Medium 5.5CVE-2022-3564 Public exploit
Linux Kernel Bluetooth l2cap_core.c l2cap_reassemble_sdu use after free
A vulnerability classified as critical was found in Linux Kernel. Affected by this vulnerability is the function l2cap_reassemble_sdu of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The manipulation leads to use after free. It is recommende…
-
Unscored —CVE-2022-20421 Public exploit
In binder_inc_ref_for_node of binder.c, there is a possible way to corrupt memory due to a use after free. This could l…
-
Unscored —CVE-2022-42703 Public exploit
mm/rmap.c in the Linux kernel before 5.19.7 has a use-after-free related to leaf anon_vma double reuse.
-
Medium 5.5CVE-2022-41218 Public exploit
In drivers/media/dvb-core/dmxdev.c in the Linux kernel through 5.19.10, there is a use-after-free caused by refcount ra…
-
Unscored —CVE-2022-2639 Public exploit
An integer coercion error was found in the openvswitch kernel module. Given a sufficiently large number of actions, whi…
-
Unscored —CVE-2021-3864 Public exploit
A flaw was found in the way the dumpable flag setting was handled when certain SUID binaries executed its descendants. …
-
High 7.5CVE-2022-36946 Public exploit
nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote attackers to cause a …
-
Unscored —CVE-2022-29900 Public exploit
Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution under certain mic…
-
Unscored —CVE-2022-34918 Public exploit
An issue was discovered in the Linux kernel through 5.18.9. A type confusion bug in nft_set_elem_init (leading to a buf…
-
Unscored —CVE-2022-2078 Public exploit
A vulnerability was found in the Linux kernel's nft_set_desc_concat_parse() function .This flaw allows an attacker to t…
-
Unscored —CVE-2022-32250 Public exploit
net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create user/net namespace…
-
High 7.8CVE-2022-29581 Public exploit
Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to cause privilege …
-
Unscored —CVE-2022-1679 Public exploit
A use-after-free flaw was found in the Linux kernel’s Atheros wireless adapter driver in the way a user forces the ath9…
-
Unscored —CVE-2022-30594 Public exploit
The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers to bypass in…
-
Unscored —CVE-2022-20009 Public exploit
In various functions of the USB gadget subsystem, there is a possible out of bounds write due to a missing bounds check…
-
Unscored —CVE-2022-1015 Public exploit
A flaw was found in the Linux kernel in linux/net/netfilter/nf_tables_api.c of the netfilter subsystem. This flaw allow…
-
High 7.8
An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_queue event notification subsystem. This…
KEV Aug 26, 2026 -
Unscored —
A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends a packet with…
-
Unscored —CVE-2022-27666 Public exploit
A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and net/ipv6/esp6.c. This fla…
-
Unscored —CVE-2022-1011 Public exploit
A use-after-free flaw was found in the Linux kernel’s FUSE filesystem in the way a user triggers write(). This flaw all…
-
Unscored —CVE-2021-39685 Public exploit
In various setup methods of the USB gadget subsystem, there is a possible out of bounds write due to an incorrect flag …
-
Medium 6.5CVE-2022-0001 Public exploit
Non-transparent sharing of branch predictor selectors between contexts in some Intel(R) Processors may allow an authori…
-
Unscored —CVE-2021-3656 Public exploit
A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VM…