CVE Database and Vulnerability Search

Browse vendorsBrowse ecosystems

Search CVE and GHSA vulnerability records by identifier, title, vendor, product, package, or CWE. Filter by severity, CISA KEV, ransomware association, linked artifacts, and Nuclei templates; sort by publication date, CVSS, or EPSS.

Vulnerabilities
381,276
with PoCs
37,250
CISA KEV
1,665
Ransomware
606
with Nuclei
4,342
Advanced

Showing 25 vulnerabilities on this page

Signals CISA KEV Ransomware Nuclei
VulnerabilityTitle and contextCVSSEPSSPoCsSignals

Race condition vulnerability in Linux kernel media/dvb-core in dvbdmx_write()

A race condition was found in the Linux kernel's media/dvb-core in dvbdmx_write() function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or denial of service issue.

CWE-362CWE-476Feb 5, 2024
CVSS5.3v3.1EPSS0.181%PoCs0SignalsSTIX

Race condition vulnerability in Linux kernel bluetooth in conn_info_{min,max}_age_set()

A race condition was found in the Linux kernel's net/bluetooth device driver in conn_info_{min,max}_age_set() function. This can result in integrity overflow issue, possibly leading to bluetooth connection abnormality or denial of service.

CWE-190CWE-362Feb 5, 2024
CVSS4.6v3.1EPSS0.317%PoCs0SignalsSTIX

Race condition vulnerability in Linux kernel net/bluetooth in {conn,adv}_{min,max}_interval_set()

A race condition was found in the Linux kernel's net/bluetooth in {conn,adv}_{min,max}_interval_set() function. This can result in I2cap connection or broadcast abnormality issue, possibly leading to denial of service.

CWE-362Feb 5, 2024
CVSS4.6v3.1EPSS0.325%PoCs0SignalsSTIX

Race condition vulnerability in Linux kernel bluetooth sniff_{min,max}_interval_set()

A race condition was found in the Linux kernel's net/bluetooth in sniff_{min,max}_interval_set() function. This can result in a bluetooth sniffing exception issue, possibly leading denial of service.

CWE-362Feb 5, 2024
CVSS4.6v3.1EPSS0.712%PoCs0SignalsSTIX

Race condition vulnerability in Linux kernel bluetooth driver in {min,max}_key_size_set()

A race condition was found in the Linux kernel's bluetooth device driver in {min,max}_key_size_set() function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or denial of service issue.

CWE-362CWE-476Feb 5, 2024
CVSS4.6v3.1EPSS0.805%PoCs0SignalsSTIX

Race condition vulnerability in Linux kernel media/xc4000 xc4000_get_frequency()

A race condition was found in the Linux kernel's media/xc4000 device driver in xc4000 xc4000_get_frequency() function. This can result in return value overflow issue, possibly leading to malfunction or denial of service issue.

CWE-362Feb 5, 2024
CVSS3.3v3.1EPSS0.205%PoCs0SignalsSTIX

Race condition vulnerability in Linux kernel scsi device driver lpfc_unregister_fcf_rescan()

A race condition was found in the Linux kernel's scsi device driver in lpfc_unregister_fcf_rescan() function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or denial of service issue.

CWE-362CWE-476Feb 5, 2024
CVSS5.0v3.1EPSS0.184%PoCs0SignalsSTIX

Race condition vulnerability in Linux kernel sound/hda snd_hdac_regmap_sync

A race condition was found in the Linux kernel's sound/hda device driver in snd_hdac_regmap_sync() function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or denial of service issue.

CWE-362CWE-476Feb 5, 2024
CVSS5.3v3.1EPSS0.167%PoCs0SignalsSTIX

Race condition vulnerability in Linux kernel drm/exynos exynos_drm_crtc_atomic_disable

A race condition was found in the Linux kernel's drm/exynos device driver in exynos_drm_crtc_atomic_disable() function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or denial of service issue.

CWE-362CWE-476Feb 5, 2024
CVSS5.3v3.1EPSS0.158%PoCs0SignalsSTIX

Possible UAF in bt_accept_poll in Linux kernel

Use After Free vulnerability in Linux Linux kernel kernel on Linux, x86, ARM (bluetooth modules) allows Local Execution of Code. This vulnerability is associated with program files https://gitee.Com/anolis/cloud-kernel/blob/devel-5.10/net/bluetooth/af_bluetooth.C. This issue affects Linux kernel: from v2.6.12-rc2 before v6.8-rc1.

CWE-416Jan 30, 2024
CVSS3.5v3.1EPSS0.495%PoCs0SignalsSTIX

NULL pointer deference in rfcomm_check_security in Linux kernel

NULL Pointer Dereference vulnerability in Linux Linux kernel kernel on Linux, x86, ARM (net, bluetooth modules) allows Overflow Buffers. This vulnerability is associated with program files /net/bluetooth/rfcomm/core.C. This issue affects Linux kernel: v2.6.12-rc2.

CWE-476Jan 25, 2024
CVSS6.3v3.1EPSS0.615%PoCs0SignalsSTIX

Integer overflow in raid5_cache_count in Linux kernel

Integer Overflow or Wraparound vulnerability in Linux Linux kernel kernel on Linux, x86, ARM (md, raid, raid5 modules) allows Forced Integer Overflow.

CWE-190Jan 25, 2024
CVSS4.4v3.1EPSS0.59%PoCs0SignalsSTIX

Incorrect Verifier Branch Pruning Logic Leads To Arbitrary Read/Write In Linux Kernel and Lateral Privilege Escalation

Incorrect verifier pruning in BPF in Linux Kernel >=5.4 leads to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and container escape.

CWE-682Sep 20, 2023
CVSS10.0v3.1EPSS3.55%PoCs1SignalsSTIX

Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability

Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register contents when CAP_NET_ADMIN is in any user or network namespace

CWE-787Jul 5, 2023
CVSS7.8v3.1EPSS1.51%PoCs2SignalsSTIX

Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability

Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability; `nft_chain_lookup_byid()` failed to check whether a chain was active and CAP_NET_ADMIN is in any user or network namespace

CWE-416Jul 5, 2023
CVSS7.8v3.1EPSS2.05%PoCs1SignalsSTIX

Use-after-free in Linux kernel's netfilter subsystem

A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in net/netfilter/nf_tables_api.c. Mishandled error handling with NFT_MSG_NEWRULE makes it possible to use a dangling pointer in the same transaction causing a use-after-free vulnerability. This flaw allows a local attacker with user access to cause a privilege escalation issue. We recommend upgrading past commit 1240eb93f0616b21c675416516ff3d74798fdc97

CWE-416Jun 28, 2023
CVSS7.8v3.1EPSS0.914%PoCs1SignalsSTIX

Privilege escalation with IO_RING_OP_CLOSE in the Linux Kernel

A time-of-check to time-of-use issue exists in io_uring subsystem's IORING_OP_CLOSE operation in the Linux kernel's versions 5.6 - 5.11 (inclusive), which allows a local user to elevate their privileges to root. Introduced in b5dba59e0cf7e2cc4d3b3b1ac5fe81ddf21959eb, patched in 9eac1904d3364254d622bf2c771c4f85cd435fc2, backported to stable in 788d0824269bef539fe31a785b1517882eafed93.

CWE-367Jun 28, 2023
CVSS7.8v3.1EPSS0.218%PoCs0SignalsSTIX

Copy_from_user Spectre-V1 Gadget in Linux Kernel

Copy_from_user on 64-bit versions of the Linux kernel does not implement the __uaccess_begin_nospec allowing a user to bypass the "access_ok" check and pass a kernel pointer to copy_from_user(). This would allow an attacker to leak information. We recommend upgrading beyond commit 74e19ef0ff8061ef55957c3abd71614ef0f42f47

CWE-763May 25, 2023
CVSS6.5v3.1EPSS0.635%PoCs0SignalsSTIX

Use-after-free in Linux kernel's Performance Events subsystem

A use-after-free vulnerability in the Linux Kernel Performance Events system can be exploited to achieve local privilege escalation. The perf_group_detach function did not check the event's siblings' attach_state before calling add_event_to_groups(), but remove_on_exec made it possible to call list_del_event() on before detaching from their group, making it possible to use a dangling pointer causing a use-after-free vulnerability. We recommend upgrading past commit fd0815f632c24878e3258219…

CWE-416May 1, 2023
CVSS7.8v3.1EPSS0.251%PoCs0SignalsSTIX

Use-after-free in Linux kernel's Performance Events subsystem

A use-after-free vulnerability in the Linux Kernel io_uring subsystem can be exploited to achieve local privilege escalation. Both io_install_fixed_file and its callers call fput in a file in case of an error, causing a reference underflow which leads to a use-after-free vulnerability. We recommend upgrading past commit 9d94c04c0db024922e886c9fd429659f22f48ea4.

CWE-416May 1, 2023
CVSS7.8v3.1EPSS0.428%PoCs0SignalsSTIX

Spectre V1 Gadget in do_prlimit in the Linux Kernel

A speculative pointer dereference problem exists in the Linux Kernel on the do_prlimit() function. The resource argument value is controlled and is used in pointer arithmetic for the 'rlim' variable and can be used to leak the contents. We recommend upgrading past version 6.1.8 or commit 739790605705ddcf18f21782b9c99ad7d53a8c11

CWE-476Apr 26, 2023
CVSS5.3v3.1EPSS0.72%PoCs0SignalsSTIX

Incorrect indirect branch prediction barrier in the Linux Kernel

The current implementation of the prctl syscall does not issue an IBPB immediately during the syscall. The ib_prctl_set  function updates the Thread Information Flags (TIFs) for the task and updates the SPEC_CTRL MSR on the function __speculation_ctrl_update, but the IBPB is only issued on the next schedule, when the TIF bits are checked. This leaves the victim vulnerable to values already injected on the BTB, prior to the prctl syscall.  The patch that added the support for the conditional miti…

CWE-610Apr 25, 2023
CVSS4.7v3.1EPSS2.4%PoCs2SignalsSTIX

Spectre v2 SMT mitigations problem in Linux kernel

The Linux kernel allows userspace processes to enable mitigations by calling prctl with PR_SET_SPECULATION_CTRL which disables the speculation feature as well as by using seccomp. We had noticed that on VMs of at least one major cloud provider, the kernel still left the victim process exposed to attacks in some cases even after enabling the spectre-BTI mitigation with prctl. The same behavior can be observed on a bare-metal machine when forcing the mitigation to IBRS on boot command line. This …

CWE-1303CWE-203Apr 21, 2023
CVSS5.6v3.1EPSS1.38%PoCs1SignalsSTIX

Use-after-free in Linux kernel's io_uring subsystem

A use-after-free vulnerability in the Linux Kernel io_uring system can be exploited to achieve local privilege escalation. The io_file_get_fixed function lacks the presence of ctx->uring_lock which can lead to a Use-After-Free vulnerability due a race condition with fixed files getting unregistered. We recommend upgrading past commit da24142b1ef9fd5d36b76e36bab328a5b27523e8.

CWE-416Apr 12, 2023
CVSS7.8v3.1EPSS0.285%PoCs0SignalsSTIX

Use-after-free in tcindex (traffic control index filter) in the Linux Kernel

A use-after-free vulnerability in the Linux Kernel traffic control index filter (tcindex) can be exploited to achieve local privilege escalation. The tcindex_delete function which does not properly deactivate filters in case of a perfect hashes while deleting the underlying structure which can later lead to double freeing the structure. A local attacker user can use this vulnerability to elevate its privileges to root. We recommend upgrading past commit 8c710f75256bb3cf05ac7b1672c82b92c43f3d…

CWE-416Apr 12, 2023
CVSS7.8v3.1EPSS1.04%PoCs2SignalsSTIX