Database/Kernel, userspace & hypervisor
Linux kernel and hypervisor vulnerabilities for GPU hosts
Host kernel, userspace, virtualization, and CPU microcode flaws that break the line between tenant and host: KVM, Xen, QEMU, VMware, and the kernel every GPU node boots.
329 entries30 critical41 known exploitedFilter and search this layer
2026
- Linux kernel - NVMe-oF target DH-HMAC-CHAP authentication, drivers/nvme/target/fabrics-cmd-auth.c: TENANT ISOLATIONCriticalAug 15, 2026
- Linux kernel - iSCSI TCP initiator, drivers/scsi/libiscsi_tcp.c: TENANT ISOLATION: The iSCSI initiator receives PDUCriticalAug 15, 2026
- Linux kernel mlx5_core MACsec offload: TENANT ISOLATION: deleting an offloaded MACsec RX secure channel freesHighAug 15, 2026
- Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): MULTI-TENANT ISOLATION: A use-after-free in the amdkfdHighAug 15, 2026
- Linux kernel mlx5_ib (queue pair sizing): set_rq_size() computes the receive-queue work-entry size as 1 << rq_wqe_shiftHighAug 15, 2026
- Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A race condition or locking defect in the amdkfd (KFDHighAug 15, 2026
- Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): MULTI-TENANT ISOLATION: An out-of-bounds accessHighAug 15, 2026
- Linux perf/x86/amd/brs - kernel address leakage through Branch Sampling: MULTI-TENANT ISOLATION: A user-only branchUnscoredAug 15, 2026
- Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A correctness defect in the amdkfd (KFD computeUnscoredAug 15, 2026
- Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): MULTI-TENANT ISOLATION: Memory is handed to a consumerUnscoredAug 15, 2026
- Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A memory or reference-count leak in the amdkfd (KFDHighAug 12, 2026
- Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): MULTI-TENANT ISOLATION: An out-of-bounds accessHighAug 10, 2026
- Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A correctness defect in the amdkfd (KFD computeHighAug 10, 2026
- Linux kernel mlx5_core port / transceiver module EEPROM (MCIA register): The MCIA register can return 32 dwordsHighAug 10, 2026
- Linux i915 GPU kernel driver (context SSEU parameter): NULL dereference reachable by setting a context engine slotUnscoredAug 10, 2026
- Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A correctness defect in the amdkfd (KFD computeUnscoredAug 10, 2026
Xen (vRTC): Out-of-bounds read in vRTC emulation - hypervisor memory disclosure to a guestHighJul 28, 2026- Xen (grant tables): Type confusion in grant-copy - guest corrupts hypervisor stateUnscoredJul 28, 2026
- Xen (grant tables): Grant-table version change racing with other operationsUnscoredJul 28, 2026
- Linux kernel - NVMe-oF target DH-HMAC-CHAP authentication, drivers/nvme/target/fabrics-cmd-auth.c: TENANT ISOLATIONCriticalJul 25, 2026
- Linux kernel - NVMe-oF target discovery controller, drivers/nvme/target/discovery.c: TENANT ISOLATION: The discoveryCriticalJul 25, 2026
- Linux kernel - LIO iSCSI target CHAP authentication, drivers/target/iscsi/iscsi_target_auth.c: TENANT ISOLATIONCriticalJul 19, 2026
- Linux kernel mlx5_core TX timeout devlink health reporter: The TX timeout recovery handler accesses the netdev pointerCriticalJul 19, 2026
- Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): MULTI-TENANT ISOLATION: An out-of-bounds accessHighJul 19, 2026
- Linux i915 GPU kernel driver: MULTI-TENANT ISOLATION: A use-after-free in the i915 GPU kernel driverHighJul 19, 2026
Linux KVM/SVM - AVIC IPI virtualization on Hygon Family 18h: MULTI-TENANT ISOLATION: AVIC inter-processor-interruptHighJul 19, 2026- Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): MULTI-TENANT ISOLATION: Missing or insufficientMediumJul 19, 2026
- Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A NULL pointer dereference in the amdkfd (KFD computeUnscoredJul 19, 2026
- Linux KVM - GHCB v2+ scratch area location enforcement: MULTI-TENANT ISOLATION: KVM did not require the GHCB softwareHighJul 4, 2026
- Linux KVM - dirty-page tracking without a vCPU on a dying VM: KVM warned (and on panic_on_warn hosts, panicked)MediumJul 1, 2026
- Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): MULTI-TENANT ISOLATION: An out-of-bounds accessHighJun 25, 2026
- Linux drm/xe GPU kernel driver (suspend/shutdown without display): The xe driver oopses on suspend or shutdownMediumJun 25, 2026
- Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): MULTI-TENANT ISOLATION: Missing or insufficientMediumJun 25, 2026
- Xen (x86 HVM): x86 HVM I/O port list traversal flawUnscoredJun 18, 2026
- Linux kernel nvmet-tcp - ICReq/teardown race and data-digest error paths: Three lifecycle bugs an initiator can driveCriticalMay 28, 2026
- Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): MULTI-TENANT ISOLATION: An out-of-bounds accessHighMay 28, 2026
- Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): MULTI-TENANT ISOLATION: Memory is handed to a consumerMediumMay 28, 2026
- Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): MULTI-TENANT ISOLATION: An out-of-bounds accessHighMay 27, 2026
- Linux kernel mlx5_core RX datapath (striding RQ, page_pool): A regression introduced by the fix for CVE-2025-40350CriticalMay 8, 2026
- Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A correctness defect in the amdkfd (KFD computeMediumMay 8, 2026
- Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): MULTI-TENANT ISOLATION: An out-of-bounds accessHighMay 6, 2026
- Linux i915 GPU kernel driver: MULTI-TENANT ISOLATION: A use-after-free in the i915 GPU kernel driverHighApr 24, 2026
- Linux i915 GPU kernel driver (submission backend setup): i915 dereferences the submission backend before checkingMediumApr 24, 2026
- Linux kernel (crypto algif_aead): Incorrect resource transfer between spheres in algif_aead (reverted to out-of-placeHighApr 22, 2026
- Linux kernel mlx5_core IPsec full offload (ESN handling): The extended-sequence-number wrap event can be processedHighApr 3, 2026
- Xen (EPT): Use-after-free of EPT paging structures - HVM guest to host compromiseUnscoredMar 23, 2026
- Linux KVM - irqfd routing type clobbered on deassign: MULTI-TENANT ISOLATION: Deassigning a KVM_IRQFD clobbersHighFeb 14, 2026
- CephFS kernel client (ceph.ko, ceph_handle_caps): The kernel trusts snap_trace_len straight off the wire, so aCritical2026
- Intel Data Center GPU driver for VMware ESXi (buffer overflow): A buffer overflow in the Intel datacenter graphicsCritical2026
KubeVirt virt-handler (symlink following in migration proxy): During live migration virt-handler dials Unix socketsHigh2026- Intel Data Center GPU driver for VMware ESXi (out-of-bounds read): Out-of-bounds read in the ESXi GPU driver exposingHigh2026
- Intel Data Center GPU driver for VMware ESXi (out-of-bounds write): Out-of-bounds write in the ESXi GPU driver causingHigh2026
2024
- AMD SEV-SNP (BadRAM): BadRAM: improper validation of DIMM SPD metadata lets an attacker with physical access or ring0MediumJun 10, 2026
- AMD CPU (TSA-L1): Transient Scheduler Attack - store-to-load forwarding leak across contexts on Zen 3/4MediumJul 8, 2025
- AMD CPU (TSA-SQ): Transient Scheduler Attack via the store queue - cross-context information leakMediumJul 8, 2025
- AMD CPU (EntrySign): Improper signature verification in the AMD CPU microcode patch loaderHighJun 27, 2025
- Xen / Intel CPU (ITS): Indirect Target Selection - speculative execution leak across privilege domains on Intel partsMediumMay 13, 2025
- Linux kernel - NVMe-oF target configfs, drivers/nvme/target/configfs.c: TENANT ISOLATIONMediumJan 15, 2025
- Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A race condition or locking defect in the amdkfd (KFDMediumJan 15, 2025
- Linux KVM x86 - hypercall completion for protected guests: KVM used the wrong helper to decide whether a hypercallMediumJan 11, 2025
- Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): MULTI-TENANT ISOLATION: An out-of-bounds accessHighDec 28, 2024
- Linux kernel mlx5_ib (pkey change notifier): A race between InfiniBand device deregistration and the pkey-change workHighDec 27, 2024
- Linux kernel (ALSA usb-audio): Out-of-bounds access for Extigy/Mbox devicesMediumDec 27, 2024
- Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A correctness defect in the amdkfd (KFD computeMediumDec 27, 2024
- Linux kernel (ALSA usb-audio): Out-of-bounds read finding clock sourcesHighDec 24, 2024
- Xen (x86 speculation): Xen hypercall page unsafe against speculative attacks - guest leaks hypervisor memoryUnscoredDec 24, 2024
- Intel CPU (Native BHI): Native Branch History Injection - unprivileged user leaks kernel memory despite eIBRSMediumDec 19, 2024
- Linux kernel mlx5_core kTLS TX offload: The kTLS TX path mixes get_page() and page_ref_inc() when acquiring referencesCriticalDec 4, 2024
- Linux kernel (uvcvideo): Out-of-bounds write parsing UVC_VS_UNDEFINED frames - exploited in the wildHighDec 2, 2024
- Linux kernel (HID): Uninitialised HID report buffer leaks kernel memoryMediumNov 19, 2024
- Linux kernel (vsock/virtio): Dangling pointer in vskMediumNov 19, 2024
- Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): MULTI-TENANT ISOLATION: A use-after-free in the amdkfdHighOct 21, 2024
- Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): MULTI-TENANT ISOLATION: Missing or insufficientHighSep 27, 2024
- Linux kernel mlx5_core RX datapath (SHAMPO / HW-GRO): A remote sender can make the mlx5 receive path release a SHAMPOCriticalSep 18, 2024
- VMware vCenter: Heap overflow in DCERPC - unauthenticated remote code execution on vCenterCriticalSep 17, 2024
- VMware vCenter: Privilege escalation to root on vCenter via a crafted network packetHighSep 17, 2024
- Linux kernel mlx5_core TX timeout devlink health reporter: The TX timeout recovery path runs without the state lock, soHighSep 11, 2024
- Linux kernel mlx5_core RX datapath (SHAMPO): SHAMPO can deliver completion entries with zero consumed stridesCriticalSep 4, 2024
- Linux drm/xe GPU kernel driver (display opregion): A resource leak in the xe driver's display opregion handlingMediumSep 4, 2024
- Linux kernel mlx5_core TC connection tracking offload: Updating a connection-tracking entry allocates a replacementCriticalAug 21, 2024
- Intel ice driver (Ethernet 800 Series, Linux kernel mode): MULTI-TENANT ISOLATION: Improper initialisation in the LinuxHighAug 14, 2024
- Intel ice driver (Ethernet 800 Series, Linux kernel mode): MULTI-TENANT ISOLATION: Kernel-mode driver flaw in the IntelHighAug 14, 2024
- Intel ice driver (Ethernet 800 Series, Linux kernel mode): MULTI-TENANT ISOLATION: Kernel-mode driver flaw in the IntelHighAug 14, 2024
- Intel ice driver (Ethernet 800 Series, Linux kernel mode): MULTI-TENANT ISOLATION: Kernel-mode driver flaw in the IntelHighAug 14, 2024
- Intel ice driver (Ethernet 800 Series, Linux kernel mode): MULTI-TENANT ISOLATION: Kernel-mode driver flaw in the IntelHighAug 14, 2024
- Intel oneAPI Math Kernel Library (oneMKL): An uncontrolled library search path: the component loads a shared libraryMediumAug 14, 2024
- Intel ice driver (Ethernet 800 Series, Linux kernel mode): A protection-mechanism failure in the E810 Linux kernelMediumAug 14, 2024
- QEMU (NBD server): Improper synchronisation during socket closure - DoS of the QEMU NBD serverHighAug 5, 2024
- Linux i915 GPU kernel driver: MULTI-TENANT ISOLATION: A use-after-free in the i915 GPU kernel driverHighJul 29, 2024
- Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A correctness defect in the amdkfd (KFD computeHighJul 18, 2024
- Linux kernel mlx5_ib (shared receive queue): The max_sge attribute for a shared receive queue is taken from the userHighJul 12, 2024
Microsoft Hyper-V: Hyper-V elevation of privilege, exploited in the wildHighJul 9, 2024- OpenSSH (sshd, RHEL9): Signal-handling race in the privsep child - possible RCE, RHEL 9 specificHighJul 8, 2024
- QEMU (qemu-img): `qemu-img info` on an untrusted qcow2 image reaches arbitrary host file read/writeHighJul 2, 2024
OpenSSH (sshd): regreSSHion: signal-handler race in sshd giving unauthenticated remote root on glibc LinuxHighJul 1, 2024- VMware ESXi: AD-integrated ESXi grants full host admin to any member of a re-created "ESX Admins" groupMediumJun 25, 2024
- VMware vCenter: Heap overflow in the DCERPC implementation - unauthenticated remote code execution on vCenterCriticalJun 18, 2024
- Linux kernel (net routing): Use-after-free in network route management (__dst_negative_advice) - actively exploitedHighJun 10, 2024
- Arm Mali GPU kernel driver: Use-after-free in the Bifrost/Valhall GPU kernel driverHighJun 7, 2024
- Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): MULTI-TENANT ISOLATION: Missing or insufficientMediumMay 30, 2024
- Xen (x86 speculation): Incorrect logic for BTC/SRSO mitigationsHighMay 16, 2024
- Intel DSA/IAA (idxd): Hardware erratum: direct access to Intel DSA/IAA accelerators by an untrusted application allowsMediumMay 16, 2024
- Linux i915 GPU kernel driver: MULTI-TENANT ISOLATION: A use-after-free in the i915 GPU kernel driverHighMay 1, 2024
- Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A memory or reference-count leak in the amdkfd (KFDMediumMay 1, 2024
- glibc (iconv): Out-of-bounds write in the ISO-2022-CN-EXT iconv converter - turns PHP/app file-read bugs into RCEHighApr 17, 2024
- Oracle VirtualBox: Easily exploitable Core flaw allowing unauthorised access to VirtualBox-accessible dataMediumApr 16, 2024
- Linux kernel amdkfd (KFD compute driver, /dev/kfd) (amdkfd): MULTI-TENANT ISOLATION: An out-of-bounds accessMediumApr 13, 2024
- QEMU (virtio): DMA reentrancy leads to double free across virtio devices - guest-to-host code execution in QEMUHighApr 9, 2024
- Linux kernel (netfilter): nft_chain_filter NETDEV_UNREGISTER mishandling for inet/ingress basechains - UAFMediumApr 4, 2024
- util-linux (wall): WallEscape: escape-sequence injection via wall(1)MediumMar 27, 2024
libvirt: Off-by-one in udevListInterfacesByStatus() - libvirtd crash / info leakMediumMar 11, 2024- VMware ESXi / Workstation / Fusion: Use-after-free in the XHCI USB controllerCriticalMar 5, 2024
- VMware ESXi / Workstation / Fusion: Use-after-free in the UHCI USB controllerCriticalMar 5, 2024
- Linux kernel (ksmbd): Use-after-free in ksmbd_tcp_new_connection() - in-kernel SMB serverHighFeb 22, 2024
- Linux kernel (nf_tables): Use-after-free in nft_verdict_init() - double-free to local rootHighJan 31, 2024
- Linux kernel (kTLS): splice() into a kTLS socket overwrites read-only kernel pages - local privilege escalationHighJan 17, 2024
- Linux kernel (io_uring): Page use-after-free via io_uring buffer-ring mmap - unprivileged local user to rootHighJan 16, 2024
- VMware ESXi / Workstation / Fusion (storage controller out-of-bounds read/write): A malicious actor inside a VMHigh2024
2025
- Xen (x86): CPU opcode cache corruption - host instability triggerable from a guestHighMay 15, 2026
- Xen / x86 CPU: Floating Point Divider State Sampling - transient-execution leak of FP divider state across domainsUnscoredApr 27, 2026
- Linux kernel mlx5_core RX datapath (striding RQ + XDP multi-buffer): The mlx5 driver assumed an XDP program couldCriticalDec 16, 2025
- Linux kernel amdkfd (KFD compute driver, /dev/kfd) (amd/amdkfd): A division by zero in the amdkfd (KFD compute driverHighDec 16, 2025
- Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A race condition or locking defect in the amdkfd (KFDUnscoredDec 9, 2025
- Linux kernel amdkfd (KFD compute driver, /dev/kfd) (amd/amdkfd): A NULL pointer dereference in the amdkfd (KFD computeUnscoredDec 8, 2025
- Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A NULL pointer dereference in the amdkfd (KFD computeUnscoredNov 12, 2025
- Xen (Viridian): Incorrect input sanitisation in Viridian (Hyper-V enlightenment) hypercallsUnscoredOct 31, 2025
- Linux kernel mlx5_core flow steering / flow counters (hardware steering): Use-after-free releasingHighOct 15, 2025
- VMware Aria Operations / VMware Tools: Local privilege escalation to root inside a managed VM via SDMP service discoveryHighSep 29, 2025
- AMD Zen 1-Zen 5 - branch predictor isolation between guest and userspace hypervisor (AMD-SB-7046): MULTI-TENANTUnscoredSep 11, 2025
- Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A NULL pointer dereference in the amdkfd (KFD computeMediumSep 5, 2025
- Linux kernel mlx5_core IPsec RX offload: When hardware reports an xfrm state ID for a decrypted packet whose stateHighAug 19, 2025
- Linux KVM - CPU soft lockup setting per-page memory attributes on large SNP guests: Running an SEV-SNP guestMediumAug 16, 2025
- Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): MULTI-TENANT ISOLATION: Missing or insufficientMediumAug 16, 2025
- Intel ice driver (Ethernet 800 Series, Linux kernel mode): MULTI-TENANT ISOLATION: Improper input validationHighAug 12, 2025
- Intel ice driver (Ethernet 800 Series, Linux kernel mode): MULTI-TENANT ISOLATION: A missing check for an exceptionalHighAug 12, 2025
- Intel ice driver (Ethernet 800 Series, Linux kernel mode): MULTI-TENANT ISOLATION: Kernel-mode flaw in the 800-seriesHighAug 12, 2025
- Intel ice driver (Ethernet 800 Series, Linux kernel mode): MULTI-TENANT ISOLATION: Kernel-mode flaw in the 800-seriesHighAug 12, 2025
- Intel ice driver (Ethernet 800 Series, Linux kernel mode): MULTI-TENANT ISOLATION: Kernel-mode flaw in the 800-seriesHighAug 12, 2025
- Intel ice driver (Ethernet 800 Series, Linux kernel mode): MULTI-TENANT ISOLATION: Kernel-mode flaw in the 800-seriesHighAug 12, 2025
- Intel ice driver (Ethernet 800 Series, Linux kernel mode): MULTI-TENANT ISOLATION: Kernel-mode flaw in the 800-seriesHighAug 12, 2025
- Linux i915 GPU kernel driver (GT timeline / VMA allocation): A timeline is left held when VMA allocation fails, soHighJul 25, 2025
- PAM (pam-config): Local user is treated as `allow_active` in PAMHighJul 23, 2025
- Linux kernel (posix-cpu-timers): TOCTOU race between handle_posix_cpu_timers() and posix_cpu_timer_del()HighJul 22, 2025
- Xen (VT-d passthrough): Deadlock potential with VT-d and legacy PCI device pass-through - host hangUnscoredJul 17, 2025
- VMware ESXi / Workstation / Fusion: Integer overflow in the VMXNET3 virtual NICCriticalJul 15, 2025
- VMware ESXi / Workstation / Fusion: Integer underflow in VMCI leading to an out-of-bounds writeCriticalJul 15, 2025
- VMware ESXi / Workstation / Fusion: Heap overflow in the PVSCSI controllerCriticalJul 15, 2025
- VMware ESXi / Workstation / Tools: Uninitialised memory in vSockets discloses host memory to the guestHighJul 15, 2025
sudo: Local privilege escalation via the `--chroot` optionHighJun 30, 2025- sudo: Local privilege escalation via the `--host` option against host-specific sudoers rulesHighJun 30, 2025
- libblockdev / udisks: allow_active to root via libblockdev through udisksHighJun 19, 2025
- Linux kernel (ksmbd): Use-after-free in ksmbd session logoff (found by an LLM-assisted audit)MediumMay 20, 2025
- glibc: Static setuid binaries incorrectly search LD_LIBRARY_PATH during dlopen - local privilege escalationHighMay 16, 2025
- Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): MULTI-TENANT ISOLATION: A use-after-free in the amdkfdHighMay 9, 2025
- Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A NULL pointer dereference in the amdkfd (KFD computeMediumMay 9, 2025
- Linux kernel (net/sched SFQ): Missing limit validation in sch_sfq - out-of-bounds writeMediumMay 1, 2025
- Linux kernel - NVMe/TCP host (initiator), drivers/nvme/host/tcp.c: TENANT ISOLATION: nvme_tcp_recv_pdu()CriticalApr 1, 2025
- Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A NULL pointer dereference in the amdkfd (KFD computeMediumApr 1, 2025
- Linux kernel amdkfd (KFD compute driver, /dev/kfd) (amdkfd): A correctness defect in the amdkfd (KFD compute driverHighMar 7, 2025
- VMware ESXi / Workstation: TOCTOU race leading to an out-of-bounds write in VMX - full VM escape to host code executionCriticalMar 4, 2025
- VMware ESXi: Arbitrary kernel write from the VMX process - sandbox escape completing the zero-day chainHighMar 4, 2025
- VMware ESXi / Workstation / Fusion: Out-of-bounds read in HGFS leaks vmx process memory to the guestHighMar 4, 2025
- OpenSSH (sshd): Pre-auth memory/CPU amplification - denial of service against sshdMediumFeb 28, 2025
- Linux kernel mlx5_ib on-demand paging (ODP): Implicit on-demand-paging memory region destroy work can be queued twiceHighFeb 27, 2025
- Linux kernel (vsock): vsock binding not kept until socket destruction - use-after-free, local root with a public exploitHighFeb 27, 2025
- OpenSSH (client): Machine-in-the-middle against the client when VerifyHostKeyDNS is enabledMediumFeb 18, 2025
- Linux kernel (net/sched ETS): Out-of-bounds indexing in the ETS qdisc - memory corruption from CAP_NET_ADMINMediumFeb 10, 2025
- Microsoft Hyper-V: Heap-based buffer overflow in the NT Kernel Integration VSPHighJan 14, 2025
- Microsoft Hyper-V: Use-after-free in the NT Kernel Integration VSP - elevation of privilege, exploited in the wildHighJan 14, 2025
- Microsoft Hyper-V: Use-after-free in the NT Kernel Integration VSP - elevation of privilege, exploited in the wildHighJan 14, 2025
- CephFS kernel client (ceph.ko, MDS auth caps): MULTI-TENANT ISOLATION: in a multi-FS Ceph cluster the kernel clientHigh2025
- AMD Pensando ionic cloud driver for VMware ESXi (heap overflow): Second heap overflow in the ionic ESXi driverHigh2025
- AMD Pensando ionic cloud driver for VMware ESXi (heap overflow): Heap-based buffer overflow in the ionic SmartNICHigh2025
2023
- Linux i915 GPU kernel driver: MULTI-TENANT ISOLATION: A use-after-free in the i915 GPU kernel driverHighDec 30, 2025
- Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A NULL pointer dereference in the amdkfd (KFD computeUnscoredDec 30, 2025
- Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A race condition or locking defect in the amdkfd (KFDUnscoredDec 24, 2025
- Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): MULTI-TENANT ISOLATION: A use-after-free in the amdkfdHighDec 9, 2025
- Linux i915 GPU kernel driver: MULTI-TENANT ISOLATION: A use-after-free in the i915 GPU kernel driverHighOct 4, 2025
- Linux cpufreq/amd-pstate-ut - kernel panic when loading the unit-test driver: Loading the amd-pstate unit-test moduleMediumOct 4, 2025
- Linux i915 GPU kernel driver (display page table objects): The buffer object backing a display page tableHighSep 18, 2025
- Linux i915 GPU kernel driver (active barrier tracking): Non-idle barriers were misused as fence trackers, corruptingHighMay 2, 2025
- Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): MULTI-TENANT ISOLATION: Missing or insufficientHighMay 2, 2025
- Linux i915 GPU kernel driver (GEM tiling): MULTI-TENANT ISOLATION: A double-free reachable by racingHighMar 27, 2025
- Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A correctness defect in the amdkfd (KFD computeHighMar 27, 2025
- Linux i915 GPU kernel driver: MULTI-TENANT ISOLATION: A use-after-free in the i915 GPU kernel driverHighAug 21, 2024
- AMD CPU (Sinkclose): Sinkclose: SMM lock bypassHighAug 12, 2024
- Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): MULTI-TENANT ISOLATION: An out-of-bounds accessHighMay 21, 2024
- Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): MULTI-TENANT ISOLATION: A use-after-free in the amdkfdHighMay 21, 2024
- Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): MULTI-TENANT ISOLATION: Missing or insufficientHighMay 17, 2024
- Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A race condition or locking defect in the amdkfd (KFDMediumApr 2, 2024
- Linux kernel - NVMe-oF TCP target, drivers/nvme/target/tcp.c: FABRIC DOS: A host sending an H2CData commandHighFeb 23, 2024
- GPU local/shared memory not cleared between kernels (AMD, Apple, Qualcomm, Imagination): MULTI-TENANT ISOLATION: a GPUMediumJan 16, 2024
- Xen (64-bit PV): Top-level shadow reference dropped too early for 64-bit PV guests - privilege escalation to hostHighJan 5, 2024
- Xen (libfsimage/pygrub): Multiple vulnerabilities in libfsimage disk handlingHighJan 5, 2024
- Xen on AMD - debug extensions (DBEXT) exposure to guests: MULTI-TENANT ISOLATION: AMD CPUs since roughly 2014 carryMediumJan 5, 2024
- Xen on AMD - debug extensions (DBEXT) exposure to guests: MULTI-TENANT ISOLATION: Companion to the other XSA-444MediumJan 5, 2024
- shadow-utils: Possible password leak during passwd(1) change (uninitialised memory)MediumDec 27, 2023
- Linux kernel (perf): Out-of-bounds write in perf_read_group() via read_size overflow - local rootHighDec 19, 2023
- Linux kernel (IGMP): Use-after-free in IPv4 IGMP - local privilege escalationHighDec 19, 2023
- Linux kernel (netfilter pipapo): Inactive elements mishandled in nft_pipapo_walk - use-after-free, local rootHighDec 18, 2023
- OpenSSH (transport): Terrapin: prefix-truncation attack on the SSH Binary Packet ProtocolMediumDec 18, 2023
- Intel CPU (Reptar): Redundant REX-prefix MOVSB causes unpredictable behaviourHighNov 14, 2023
- AMD SEV-ES (CacheWarp): CacheWarp: INVD lets a malicious hypervisor revert SEV-ES guest memory writes, breaking guestMediumNov 14, 2023
- QEMU (IDE/ATAPI): Improper IDE controller reset lets a guest overwrite the host MBR of an attached deviceMediumNov 3, 2023
- VMware vCenter: Out-of-bounds write in the DCERPC implementation - unauthenticated remote code executionCriticalOct 25, 2023
- glibc (ld.so): Looney Tunables: buffer overflow in the ld.so GLIBC_TUNABLES parser - local root on default installsHighOct 3, 2023
- Arm Mali GPU kernel driver: Use-after-free via improper GPU memory processingMediumOct 1, 2023
- Linux (Xen netback): Buffer overrun in netback due to an unusual packet - guest attacks dom0HighSep 22, 2023
- Linux kernel (eBPF verifier): Incorrect verifier pruning marks unsafe paths as safeHighSep 20, 2023
- QEMU (net): Triggerable assertion via a race on NIC hot-unplug - guest can abort the host QEMU processMediumSep 13, 2023
- Linux kernel (net/sched hfsc): Use-after-free in sch_hfsc qdisc - local rootHighSep 6, 2023
- Linux kernel (AF_UNIX): Use-after-free in unix_stream_sendpage - local privilege escalation, no capabilities neededMediumSep 6, 2023
- AMD CPU (DIV0): Division-by-zero leaves stale quotient data readable across contexts - confidentiality loss on Zen 1MediumAug 8, 2023
- AMD CPU (Inception / SRSO): Inception: Speculative Return Stack OverflowMediumAug 8, 2023
- Linux kernel (nf_tables): UAF adding a rule with NFTA_RULE_CHAIN_ID - local rootHighAug 7, 2023
- Linux kernel (netfilter pipapo): UAF from improper element removal in nft_pipapo_remove() - local rootHighJul 31, 2023
- AMD CPU (Zenbleed): Zenbleed: cross-process/cross-VM register-file data leak on Zen 2 at ~30 kB/s per core, no specialMediumJul 24, 2023
- OpenSSH (ssh-agent): Remote code execution in ssh-agent PKCS#11 support when agent forwarding reaches a hostile hostCriticalJul 20, 2023
- Linux kernel (mm VMA): StackRot: privilege escalation via non-RCU-protected VMA traversalHighJul 11, 2023
- Linux kernel (nf_tables): Use-after-free in nft_chain_lookup_byid() - local root (Pwn2Own Vancouver chain)HighJul 5, 2023
- Linux kernel (nf_tables): Stack out-of-bounds read/write in nft_byteorder_eval() - local root (Pwn2Own)HighJul 5, 2023
- Linux kernel (nf_tables): UAF in nft_set_lookup_global after mixed named/anonymous set batches - local rootHighJun 28, 2023
- VMware Tools: A fully compromised ESXi host can force VMware Tools to skip host-to-guest authenticationLowJun 13, 2023
- Linux kernel (io_uring): io_uring fixed-buffer registration gives out-of-bounds access to physical memoryHighJun 1, 2023
- Intel i915 graphics driver for Linux (kernel < 6.2.10): MULTI-TENANT ISOLATION: A memory-buffer bounds failureHighMay 10, 2023
- Linux kernel (nf_tables): Use-after-free in nf_tables anonymous-set batch processingHighMay 8, 2023
- Oracle VirtualBox: Core component flaw allowing a low-privileged guest user to take over the host VirtualBoxHighApr 18, 2023
- Linux kernel (net/sched tcindex): Use-after-free in the tcindex traffic-control filter - local rootHighApr 12, 2023
- KVM (nested VMX): Missing CR0/CR4 consistency checks in nVMX - L2 guest can break nested-virt assumptions / crash hostMediumApr 10, 2023
- Linux kernel (netfilter): Integer overflow in nft_payload_copy_vlan - stack leak plus local privilege escalationHighMar 27, 2023
- Linux kernel (OverlayFS/FUSE): OverlayFS copies setuid files from a nosuid FUSE mountHighMar 22, 2023
- systemd: Privilege escalation via the systemctl `less` pager when sudo-granted systemctl is availableMediumMar 3, 2023
- OpenSSL: X.400 address type confusion in X.509 GeneralNameHighFeb 8, 2023
- Linux kernel (ALSA): Use-after-free in snd_ctl_elem_read - local privilege escalationHighJan 30, 2023
- CephFS/RBD kernel client (libceph messenger v2): A signedness bug in net/ceph/messenger_v2.c turns an attacker-chosenHigh2023
2022
- Linux kernel - NVMe-oF TCP target, drivers/nvme/target/tcp.c: TENANT ISOLATION: The NVMe/TCP target usedCriticalDec 24, 2025
- Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A memory or reference-count leak in the amdkfd (KFDUnscoredDec 8, 2025
- Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A memory or reference-count leak in the amdkfd (KFDHighOct 7, 2025
- Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A NULL pointer dereference in the amdkfd (KFD computeHighSep 17, 2025
- Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): MULTI-TENANT ISOLATION: A double free in the amdkfdHighSep 15, 2025
- Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A NULL pointer dereference in the amdkfd (KFD computeMediumMay 1, 2025
- Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A NULL pointer dereference in the amdkfd (KFD computeMediumFeb 26, 2025
- Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A race condition or locking defect in the amdkfd (KFDMediumFeb 26, 2025
- Linux kernel mlx5_core software steering (fs_dr): Adding a flow rule with 32 destinations overflows an undersizedHighAug 22, 2024
- Linux kernel drivers/vdpa/mlx5 (mlx5 vDPA net device): TENANT ISOLATION: a guest with an assigned mlx5 vDPA net deviceHighJul 16, 2024
- Linux i915 GPU kernel driver: MULTI-TENANT ISOLATION: A use-after-free in the i915 GPU kernel driverHighApr 28, 2024
- Linux kernel (net/sched cls_route): Use-after-free in the cls_route filterHighJan 8, 2024
- Linux kernel (io_uring): Use-after-free between io_uring and the unix GC - local rootHighJan 8, 2024
- Linux kernel (nf_tables): Cross-table use-after-free in nf_tables leading to local privilege escalationMediumJan 8, 2024
- Intel CPU (Downfall / GDS): Downfall: Gather Data Sampling leaks AVX gather-instruction data across SMT siblingsMediumAug 11, 2023
- Xen on AMD Family 17h / Hygon Family 18h - guest SSBD selection: MULTI-TENANT ISOLATION: Setting Speculative StoreLowMay 17, 2023
- Xen (shadow paging): x86 shadow paging arbitrary pointer dereference - host crash or worseUnscoredApr 25, 2023
- Xen (shadow paging): x86 shadow plus log-dirty mode use-after-free - guest to hostHighMar 21, 2023
- Linux i915 GPU kernel driver (TLB invalidation): MULTI-TENANT ISOLATION: An incorrect TLB flush in i915 leaves the GPUHighJan 27, 2023
- Linux kernel (KASLR): EntryBleed: prefetch side channel defeats KASLR even with KPTIMediumJan 11, 2023
- VMware ESXi / Workstation / Fusion: Heap out-of-bounds write in the USB 2.0 EHCI controllerHighDec 14, 2022
- Xen (xenstored): Guest can crash xenstored, taking down control-plane services for all guests on the hostHighNov 1, 2022
- OpenSSL 3.0: X.509 email-address punycode buffer overflow (4-byte stack overflow)HighNov 1, 2022
- OpenSSL 3.0: X.509 email-address variable-length buffer overflow (DoS)HighNov 1, 2022
- Xen (x86): Unintended memory sharing between guests - cross-tenant data exposureHighNov 1, 2022
- Linux kernel (mm anon_vma): Use-after-free from leaf anon_vma double reuse - memory corruption / privesc primitiveMediumOct 9, 2022
- KVM: NULL pointer dereference in kvm_irq_delivery_to_apic_fast() - guest crashes the hostMediumAug 31, 2022
- Intel CPU (AEPIC Leak): Stale data read from the legacy xAPIC MMIO page - leaks SGX enclave and cross-domain dataMediumAug 18, 2022
- AMD CPU (Branch Type Confusion): Non-Retbleed branch type confusion - speculative cross-domain leakMediumJul 14, 2022
- AMD CPU (Retbleed): Retbleed: arbitrary speculative code execution via return instructionsMediumJul 12, 2022
- Intel CPU (Retbleed): Retbleed on Intel - speculative execution of return instructions leaks across privilege boundariesMediumJul 12, 2022
- Linux kernel (nf_tables): Heap overflow in nft_set_elem_init() - local root, weaponised inside containersHighJul 4, 2022
- Intel CPU (MMIO Stale Data / SBDR): Incomplete cleanup of multi-core shared buffers - stale data read across domainsMediumJun 15, 2022
- Xen (x86 PV): Insufficient care with non-coherent mappings - PV guest to host compromiseMediumJun 9, 2022
- Xen (x86 PV): Race condition in typeref acquisition - PV guest escalates to host privilegeMediumJun 9, 2022
- Linux kernel (netfilter): Use-after-free write in the netfilter subsystem - privilege escalation to rootHighJun 2, 2022
- Xen on AMD-Vi - unity map handling on device reassignment: MULTI-TENANT ISOLATION: AMD-Vi unity mappingsHighApr 5, 2022
- Xen on AMD-Vi - unity map handling: MULTI-TENANT ISOLATION: Second XSA-400 AMD-Vi unity-map issueHighApr 5, 2022
- Xen on AMD-Vi - unity map handling: MULTI-TENANT ISOLATION: Third XSA-400 AMD-Vi issueHighApr 5, 2022
- Xen on AMD-Vi - unity map handling: MULTI-TENANT ISOLATION: Fourth XSA-400 AMD-Vi issue. Patch the set togetherHighApr 5, 2022
- Linux i915 GPU kernel driver (GTT TLB handling): MULTI-TENANT ISOLATION: Stale GPU TLB entries let the GPU keep readingHighMar 25, 2022
- Linux kernel (IPsec ESP): Buffer overflow in the IPsec ESP transformation code - local rootHighMar 23, 2022
- QEMU (virtio-net): Map leaking on error during receive - guest-triggered host memory exhaustion / DoSHighMar 16, 2022
- Linux kernel (pipe): Dirty Pipe: uninitialised pipe_buffer flags allow overwriting read-only files, inclHighMar 10, 2022
- Linux kernel (cgroups v1): cgroups v1 release_agent lets a container with CAP_SYS_ADMIN (or an unconfined userns) runHighMar 3, 2022
- util-linux (chfn/chsh): Partial disclosure of arbitrary files via libreadline in setuid chfn/chshMediumFeb 21, 2022
- Linux kernel (fs_context): Heap overflow in legacy filesystem parameter handlingHighFeb 11, 2022
- Linux kernel (eBPF verifier): kernel/bpf/verifier.c mishandles pointer types - unprivileged BPF to local rootMediumJan 14, 2022
2021
- Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): MULTI-TENANT ISOLATION: An out-of-bounds accessHighOct 1, 2025
- Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amd/amdkfd): A correctness defect in the amdkfd (KFD computeHighMay 24, 2024
- Linux KVM x86 - stack out-of-bounds in ioapic_write_indirect(): MULTI-TENANT ISOLATION: A guest write to the virtualHighMay 21, 2024
- Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A race condition or locking defect in the amdkfd (KFDMediumMay 21, 2024
- Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A memory or reference-count leak in the amdkfd (KFDMediumMay 21, 2024
- Linux KVM/SVM - missing sev_decommission in sev_receive_start: KVM failed to DECOMMISSION the current SEV contextMediumMay 21, 2024
- Linux kernel mlx5_core kTLS RX offload: TLS RX resync list corruption: entries are moved by the resync handlerCriticalApr 10, 2024
- Linux kernel mlx5_core representor TC path + net/sched tc extension: The TC_SKB_EXT skb extension is not zeroedHighMar 25, 2024
- Linux kernel (eBPF): eBPF improper input validation leading to local privilege escalationHighAug 24, 2022
- QEMU (virtio-net): Heap use-after-free in virtio_net_receive_rcu - guest-to-host code execution in the QEMU processHighMar 23, 2022
- KVM (AMD SEV-ES): Out-of-bounds read/write in sev_es_string_io() - malicious SEV-ES guest corrupts host memoryHighFeb 18, 2022
- polkit: Local privilege escalation via polkit_system_bus_name_get_creds_sync() raceHighFeb 16, 2022
- polkit (pkexec): PwnKit: local privilege escalation to root via argv handlingHighJan 28, 2022
- Linux kernel (af_packet): Double free in packet_set_ring(), local privilege escalationHighJan 26, 2022
- Xen on AMD-Vi (AMD IOMMU) - ACPI IVMD unity-map page permissions: MULTI-TENANT ISOLATION: Xen honours ACPI-describedMediumAug 27, 2021
- Xen on AMD-Vi - IOMMU page mapping permissions: MULTI-TENANT ISOLATION: Second of the XSA-378 IOMMU page-mapping issuesMediumAug 27, 2021
- Xen on AMD-Vi - IOMMU page mapping permissions: MULTI-TENANT ISOLATION: Third of the XSA-378 AMD-Vi mapping issuesMediumAug 27, 2021
- Linux kernel (seq_file / fs layer): Sequoia: size_t-to-int conversion in the filesystem layer, local root on defaultHighJul 20, 2021
- Linux kernel (netfilter x_tables): Heap out-of-bounds write in xt_compat_target_from_user()HighJul 7, 2021
- Xen - x86 IOMMU command timeout detection and handling: MULTI-TENANT ISOLATION: Xen's IOMMU command timeout handlingHighJun 30, 2021
- Xen on x86 - speculative vulnerabilities with bare 32-bit PV guests: MULTI-TENANT ISOLATION: Bare (non-shim) 32-bit PVMediumJun 11, 2021
- Linux kernel (eBPF verifier): eBPF ALU32 bitwise-op bounds tracking flawHighJun 4, 2021
- KVM: Improper handling of VM_IO/VM_PFNMAP vmas in KVM lets a guest bypass read-only checksHighMay 26, 2021
- Microsoft Hyper-V: vmswitch fails to validate guest OID requestsCriticalMay 11, 2021
- Linux kernel (overlayfs, Ubuntu patch): OverlayFS file-capability privilege escalationHighApr 17, 2021
- VMware ESXi (OpenSLP): OpenSLP heap overflow - the ESXiArgs ransomware entry point that mass-encrypted thousandsHighFeb 24, 2021
- sudo: Baron Samedit: heap overflow in sudo argument parsing, root from any local accountHighJan 26, 2021
2020
- AMD Radeon Kernel Mode driver - Escape 0x2000c00 call handler: MULTI-TENANT ISOLATION: A low-privileged attacker canHighNov 15, 2021
- VMware ESXi (OpenSLP): Use-after-free in OpenSLP on port 427 - unauthenticated remote code execution on the hypervisorCriticalOct 20, 2020
- Xen - x86 PV guest denial of service via SYSENTER: SYSENTER leaves state sanitisation to software, and on AMD hardwareMediumSep 23, 2020
- Intel CPU (SRBDS / CrossTalk): Special Register Buffer Data SamplingMediumJun 15, 2020
- Linux i915 GPU kernel driver: MULTI-TENANT ISOLATION: A use-after-free in the i915 GPU kernel driverHighJan 14, 2020
IBM Spectrum Scale kernel module: An unauthenticated local trigger takes down the Spectrum Scale kernel module and withHigh2020
2019
- Xen on AMD - x86 HVM pagetable height update: MULTI-TENANT ISOLATION: AMD HVM guest OS users can triggerHighDec 11, 2019
- Xen through 4.12.x - passed-through PCI devices left able to DMA into host memory after being handed to an untrustedMediumOct 31, 2019
- Intel x86-64 CPUs (Ivy Bridge onward); Windows and Linux kernel entry paths: The kernel's syscall/interrupt entry pathMediumSep 3, 2019
- Linux kernel (ptrace): Broken permission and object lifetime handling for PTRACE_TRACEME, local rootHighJul 17, 2019
- Intel i915 graphics kernel-mode driver for Linux (< 5.0): Insufficient input validation in the i915 kernel-mode driverHighMay 17, 2019
2018
- Linux kernel mlx5_ib (create QP response): mlx5_ib_create_qp_resp is never initialized in create_qp_common, so creatingLowJul 26, 2019
- Intel CPU (MDS / ZombieLoad): Microarchitectural Fill Buffer Data SamplingMediumMay 30, 2019
- Linux i915 GPU kernel driver (execbuffer2 ioctl): MULTI-TENANT ISOLATION: The execbuffer2 ioctl acceptedHighMar 21, 2019
- Intel CPU (L1TF / Foreshadow-NG): L1 Terminal Fault: a guest reads any data present in the L1 data cache, includingMediumAug 14, 2018
- IBM GPFS kernel module (mmap path): An unprivileged user panics the kernel on a GPFS node just by mmap-ing a file onMedium2018