CVE-2023-52481

CVE-2023-52481 affects ARM64 Linux kernels with Cortex‑A520 erratum 2966298. A speculatively executed unprivileged load could leak data from a privileged load via a cache side channel when returning to EL0, limited to loads in the same translation regime (same ASID/VMID). Mitigation implemented a...

CVE-2023-52691

CVE-2023-52691 concerns the Linux kernel’s DRM AMD power management path. The issue is a double-free in the AMD GPU driver flow: when allocation of adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries fails, amdgpu_free_extended_power_table is called to free fields, and if control flow re...

CVE-2023-52773

CVE-2023-52773 concerns a NULL pointer dereference in the Linux kernel’s DRM/AMD display path. The issue is in amdgpu_dm_i2c_xfer(), which can dereference a null pointer when performing a DDC/I2C transfer. The description states that on ddc_service_construct(), the code now checks both the link t...

CVE-2023-52868

CVE-2023-52868 is a Linux kernel vulnerability in the thermal: core component that can cause a string overflow. The root cause is that the dev->id value is derived from ida_alloc() and can be up to INT_MAX; if it is too large, the sprintf() calls can overflow the buffer. The published descript...

CVE-2023-52938

CVE-2023-52938 concerns the Linux kernel in the usb: typec: ucsi area. The issue occurs when the driver tries to resume USB-C ports that have not yet been registered, causing a NULL pointer dereference. The attached connected documents confirm the vulnerability and its fix in the kernel, with ref...

CVE-2023-53089

CVE-2023-53089 affects the Linux kernel ext4/xattr path. The issue occurs during eviction of inodes with extended attributes (EA) where ext4_xattr_delete_inode triggers a hang due to finding an EA inode (ea_inum = 15) that is in I_FREEING state and waiting for the EA inode’s deletion, causing an ...

CVE-2023-53108

CVE-2023-53108 – Linux kernel (net/iucv) : The vulnerability arises from incorrect sizing of iucv_irq_data, which must be 4 bytes larger. The under-allocation can permit a Redzone/heap corruption (dma-kmalloc-64) during iucv_init/cpu hotplug flow, with objects showin g incomplete frees in the obs...

CVE-2024-35800

CVE-2024-35800 affects the Linux kernel EFI/kdump path. The root cause is calling get_next_variable() without validating the pointer, which in kdump can be NULL and cause a panic during kexec-ed kernel boot. The fix introduces a validity check before calling get_next_variable(), and the issue was...

CVE-2024-35875

CVE-2024-35875 affects the Linux kernel “x86/coco” subsystem. The vulnerability stems from seeding the RNG at boot using RDRAND on CoCo systems; if RDRAND is broken or unavailable, the RNG may be left unseeded, potentially compromising cryptographic operations. The fix ensures an attempt to seed ...

CVE-2024-35901

CVE-2024-35901 relates to the Linux kernel mana driver: mana_get_rxbuf_cfg() aligns the RX DMA datasize to a multiple of 64, enabling a packet around MTU+14 (e.g., 1536) to be received and trigger skb_over_panic. The impact is a kernel panic/BUG in net/core/skbuff.c when skb_panic is hit during s...

CVE-2024-35949

CVE-2024-35949 affects the Linux kernel's btrfs subsystem. The root cause was that WRITTEN was not ensured on all metadata blocks, allowing potential corruption if extended leaf checks were skipped for blocks without WRITTEN. The fix adds checks to ensure WRITTEN is set and guarantees that __btrf...

CVE-2024-35999

Technical details (affected kernel version, specific patch, exploitability) are not provided in the supplied documents; the CVE entry is referenced in advisories, but no concrete technical details are included here.

CVE-2024-39481

The CVE-2024-39481 issue affects the Linux kernel's media: mc component, specifically the media_pipeline_start graph walk. The root cause is that the graph walk followed all links, including non-pad links, which could crash the system when encountering links like MEDIA_LNK_FL_ANCILLARY_LINK. The ...

CVE-2024-39482

CVE-2024-39482 relates to the Linux kernel bug in bcache: it abused a fixed-length array in btree_iter when used with dynamically-sized iterators, triggering UBSAN. The fix introduces a flexible array member in btree_iter and a separate btree_iter_stack that embeds a btree_iter plus a data array,...

CVE-2024-40932

CVE-2024-40932 affects the Linux kernel DRM Exynos VIDI driver. The issue is a memory leak in .get_modes() where a duplicated EDID is never freed, leading to potential memory exhaustion. The provided connected advisories confirm the root cause and the fix: a memory leak in drm/exynos/vidi: get_mo...

CVE-2024-42136

CVE-2024-42136 affects the Linux kernel cdrom subsystem. The issue stems from an arithmetic path in last_media_change that could trigger a signed integer overflow under UBSAN when running syzkaller; the issue is resolved by rearranging the check to avoid any arithmetic, preventing the overflow. T...

CVE-2024-42262

CVE-2024-42262 relates to the Linux kernel’s DRM/V3D subsystem. The issue is a memory leak in the main loop: if fetching userspace memory fails, all drm_syncobjs looked up up to that point are leaked due to a missing drm_syncobj_put. The defect was fixed by exporting and using a common cleanup he...

CVE-2024-42310

CVE-2024-42310 concerns a null pointer dereference in the Linux kernel's DRM GMA500 driver, specifically cdv_intel_lvds_get_modes. The bug arises when the return value of drm_mode_duplicate() is assigned to mode and drm_mode_duplicate() fails, potentially leading to an NPD. The issue has been fix...

CVE-2024-44950

CVE-2024-44950 affects the Linux kernel serial driver for sc16is7xx. When enabling the special register set, Receiver time-out and RHR interrupts could cause the IRQ handler to read the FIFO via RHR at address 0x00, which is actually DLL, leading to erroneous FIFO reads. Root cause: invalid FIFO ...

CVE-2024-45011

CVE-2024-45011 in the Linux kernel relates to the xillybus/xillyusb driver probing a device and not validating USB endpoints before use. The patching guidance in the description indicates that every XillyUSB device must have a Bulk IN endpoint at address 1 and may have additional Bulk OUT endpoin...

CVE-2024-45019

CVE-2024-45019 affects the Linux kernel component net/mlx5e. The issue involves the required use of the state lock during the tx timeout reporter; a prior change removed the lock to fix another issue, which could risk deadlocks. The patch restores the lock at a later point when calling mlx5e_safe...

CVE-2024-46721

CVE-2024-46721 covers a NULL-pointer dereference in the Linux kernel’s AppArmor path when creating profiles. The issue arises in aafs_create.constprop.0 within aa_replace_profiles, where profile->parent->dents[AAFS_PROF_DIR] could be NULL if the parent was created by __create_missing_ancest...

CVE-2024-46736

CVE-2024-46736 relates to the Linux kernel SMB (CIFS) client path smb2_rename_path handling. The issue arises when smb2_set_path_attr() is called with a valid cfile and returns -EINVAL; the reference to @cfile is dropped by a prior smb2_compound_op(), which can lead to a double put of @cfile. The...

CVE-2024-47681

CVE-2024-47681 concerns the Linux kernel wifi driver for the mt76 MT7996. The issue is a NULL pointer dereference in the mt7996_mcu_sta_bfer_he routine when adding an STA interface to the MT7996 driver. The description indicates the vulnerability is resolved by fixing the NULL pointer dereference...

CVE-2024-49866

CVE-2024-49866 : Linux kernel race in timerlat cpuhp processing can lead to timer corruption when timerlat/1 migration occurs during thread creation. Root cause: CPU online/offline timing mismatch with asynchronous osnoise workers can schedule a thread onto an offline CPU. Fix implemented: skip o...

CVE-2024-49874

CVE-2024-49874 affects the Linux kernel’s i3c master subsystem (svc_i3c_master). The issue is a use-after-free race between the worker threads bound to master->hj_work and master->ibi_work during cleanup. If the module is removed, master->base can be freed while a worker may still access...

CVE-2024-49906

CVE-2024-49906 has concrete remediation on Root OS (rootio-linux) for Ubuntu 22.04 and Debian 11/12. The OSV entries indicate Root has patched CVE-2024-49906 in the rootio-linux package across multiple distributions with multiple fixed versions available. Ubuntu Security Notices and Debian/Ubuntu...

CVE-2024-49940

CVE-2024-49940 : In the Linux kernel, a tunnel refcount underflow could occur in L2TP handling. The issue stems from a race where session->tunnel is non-NULL in a window between session creation and tunnel refcount increment during l2tp_session_register, allowing a backpointer to a tunnel whos...

CVE-2024-50172

CVE-2024-50172 : Linux kernel RDMA bnxt_re memory leak fix. In bnxt_re_setup_chip_ctx(), if bnxt_qplib_map_db_bar() fails, the driver previously did not free the allocated rdev->chip_ctx memory. The described fix ensures proper cleanup in that failure path, preventing a memory leak. Connected ...

CVE-2024-53137

CVE-2024-53137 : In the Linux kernel, ARM: fix cacheflush with PAN. The cacheflush syscall was broken when PAN for LPAE was implemented, causing faults because user access was not enabled around the cache maintenance instructions. The CVSSv3.1 metrics show LOCAL access, LOW complexity, LOW privil...

CVE-2024-53201

Technical details about CVE-2024-53201 are not provided in the supplied documents. No affected products, root cause, impact, or remediation details are included here; monitor for official disclosures.

CVE-2024-56588

CVE-2024-56588 (Linux kernel) affects the hisi_sas driver. The issue arises when dump files are created on the fly during debugfs dump, which leads to a NULL pointer dereference and kernel hang if the driver is unbound while dumping. The root cause is allocating memory and creating debugfs entrie...

CVE-2024-56689

Technical details for CVE-2024-56689 are not publicly provided in the supplied documents. The initial description indicates a kernel fix for a NULL-dereference in PCI endpoint handling, but no product/version specifics or exploit information are given here. Monitor for updates.

CVE-2024-56766

The CVE-2024-56766 issue affects the Linux kernel’s MTD/NAND path (mtd: rawnand) with a double-free in atmel_pmecc_create_user(). The root cause is allocating the user object with kzalloc() and then freeing it with kfree() after converting the allocation to devm_kzalloc(), leading to a use-after-...

CVE-2024-57806

CVE-2024-57806 relates to a Linux kernel btrfs quota (SIMPLE_QUOTA) atomicity bug. The fix ensures the BTRFS_FEATURE_INCOMPAT_SIMPLE_QUOTA flag is set immediately after enabling SIMPLE_MODE, so both the quota status flag and the incompat flag are flushed in the same transaction. Without this, a s...

CVE-2024-57834

CVE-2024-57834 : In the Linux kernel, a null-pointer dereference in the video media driver (vidtv) was fixed. If dvb->mux is not successfully initialized by vidtv_mux_init() during vidtv_start_streaming(), stopping the streaming via vidtv_mux_stop_thread() could dereference a null mux pointer....

CVE-2024-57982

CVE-2024-57982 — Linux kernel xfrm state lookup : A race between lookup and hash table resizing could observe an hmask value too large for the new hashtable, enabling an out-of-bounds read in xfrm_state_lookup_byaddr() during lookup. The fix prefetches net->xfrm.state_hmask and associated poin...

CVE-2024-58056

The CVE-2024-58056 entry documents a Linux kernel remoteproc issue in which rproc_alloc() can trigger ida_free() via rproc_type_release() on an error path before ida_alloc() has been called. The underlying cause is rproc->index being initialized to 0, making rproc->index >= 0 true when t...

CVE-2024-58079

CVE-2024-58079 : In the Linux kernel, a bug in media: uvcvideo could crash on unbind if a GPIO unit is in use. The root cause was using the wrong device for device-managed cleanup (usb device instead of the interface device), which could leave IRQs enabled and lead to an access to freed memory on...

CVE-2025-21688

CVE-2025-21688 : In the Linux kernel, a race between the DRM v3d scheduler and the IRQ execution thread occurs when signaling a fence after a job completes. The patch that assigns the job pointer to NULL after completion can race with run_job() assigning a new job, risking a NULL pointer derefere...

CVE-2025-21738

CVE-2025-21738 describes a Linux kernel vulnerability in the ata libata-sff path where ata_pio_sector() could write outside the allocated buffer, potentially corrupting memory. The issue arises when handling a SCSI_IOCTL_SEND_COMMAND (out_len 0xd42) with SCSI command ATA_16 PASS-THROUGH, ATA_NOP,...

CVE-2025-21889

Technical details for CVE-2025-21889 are not publicly provided in the supplied documents. No affected products, root cause, or patch information are confirmed here. Monitor vendor advisories for updates.

CVE-2025-21995

The CVE-2025-21995 entry documents a Linux kernel vulnerability in drm/sched related to a fence reference count leak. The root cause is a leak of the last_scheduled fence when an entity is killed and adding a cleanup callback fails; the fix decrements the prev fence reference count when dma_fence...

CVE-2025-22120

CVE-2025-22120 affects the Linux kernel ext4: in ext4_setattr(), a jump to the right label out_mmap_sem may occur. If ext4_inode_attach_jinode() fails, filemap_invalidate_unlock() may not be called to unlock mapping->invalidate_lock, leading to a hung task (as shown by the given EXT4-fs error ...

CVE-2025-37739

CVE-2025-37739 involves a Linux kernel issue in the f2fs filesystem where out-of-bounds access could occur during truncate_inode_blocks(). UBSAN reported an array-index-out-of-bounds in f2fs/node.h when get_nid() accessed i_nid with a negative index due to dn.ofs_in_node being zero while the load...

CVE-2025-37790

CVE-2025-37790 affects the Linux kernel in the net: mctp path, specifically the logic for binding lookups under RCU. The issue arises because a bind lookup can happen while a socket is potentially removed, raising a risk during RCU-protected operations if the socket disappears mid-lookup. The CVE...

CVE-2025-37820

CVE-2025-37820 (Linux kernel – xen-netfront) has a concrete issue: the function xdp_convert_buff_to_frame() may return NULL when failing to convert an XDP buffer to an XDP frame due to memory constraints, internal errors, or invalid data. If the caller does not check for NULL, a NULL pointer dere...

CVE-2025-37824

CVE-2025-37824 affects the Linux kernel TIPC monitor path. The issue is a NULL pointer dereference in tipc_mon_reinit_self() caused by a race between enabling and disabling the bearer, where mon->self may be NULL during reinitialization. A fix has been applied in tipc_mon_reinit_self() (net/ti...

CVE-2025-37836

CVE-2025-37836: Linux kernel vulnerability fixed in PCI: Fix reference leak in pci_register_host_bridge. Root cause: if device_register() fails, the code did not drop the reference, risking memory leak. The patch ensures put_device() is called to drop the reference when device_register() fails, p...

CVE-2025-37884

CVE-2025-37884: In the Linux kernel, a deadlock between rcu_tasks_trace and event_mutex was fixed. The issue manifested in _free_event() calling perf_trace_event_unreg() under mutex_lock(&event_mutex) while perf_kprobe_destroy() could synchronize_rcu_tasks_trace(), and in bpf_prog_test_run_syscal...