CVE-2022-49351

CVE-2022-49351 is tied to the Linux kernel fix in net: altera: Fix refcount leak in altera_tse_mdio_create. The issue arises in for_each_child_of_node() iterations where the previous node’s reference count is decremented and, on breaking out of the loop, of_node_put() was not called, leading to a...

CVE-2022-49778

CVE-2022-49778 concerns the Linux kernel on arm64 where pmd_user_accessible_page() incorrectly treated non-leaf PMDs as leaf, causing a decrease of file_map_count for non-leaf PMDs during collapse of huge pages and triggering a BUG_ON() in mm/page_table_check.c. The provided connected documents c...

CVE-2022-49885

CVE-2022-49885 is a Linux kernel vulnerability in ACPI APEI where ghes_estatus_pool_init() can overflow due to signed integer math during len calculation (len += (num_ghes * GHES_ESOURCE_PREALLOC_MAX_SIZE)). The root cause is using int for num_ghes, which can overflow and cause subsequent vmalloc...

CVE-2023-32252

CVE-2023-32252 affects the Linux kernel ksmbd (the in-kernel SMB server). The flaw occurs in the handling of SMB2_LOGOFF commands due to improper validation of a pointer before access. This can allow an attacker to trigger a denial-of-service on the affected system. The description and connected ...

CVE-2023-52741

CVE-2023-52741 affects the Linux kernel CIFS implementation: a use-after-free in rdata->read_into_pages() can occur when the network is unstable during read operations. The issue is caused by improper return-condition sequencing, enabling UAF in readpages_fill_pages (and related paths such as ...

CVE-2023-52884

CVE-2023-52884 is a Linux kernel issue where the input core locking for the cyapa driver’s suspend/resume paths was missing, allowing a warning to be emitted during suspend on Samsung Exynos5250 Snow Chromebook. The fix adds input->mutex locking in suspend/resume to prevent races with other in...

CVE-2023-52977

CVE-2023-52977 is a kernel vulnerability in the Linux kernel’s net/openvswitch path where a memory leak occurs in ovs_flow_cmd_new when key allocation fails. The issue is triggered during netlink/genl handling as shown in the provided trace, and the remediation described in the patch is to reorde...

CVE-2023-53016

CVE-2023-53016 concerns a potential deadlock in the Linux kernel Bluetooth rfcomm path. The issue arises when rfcomm_sock_connect holds the sk lock while waiting for the rfcomm lock, and rfcomm_sock_release may hold the rfcomm lock and attempt to acquire the sk lock, creating a deadlock scenario....

CVE-2023-53079

The CVE-2023-53079 issue affects the Linux kernel mlx5 driver (net/mlx5) and related eswitch/vport flow-rule handling. Root cause: during EEH, vport MC/UC/multicast promiscuous rules aren’t deleted in teardown, and the firmware may reset these settings after EEH, causing the driver to attempt to ...

CVE-2023-53090

CVE-2023-53090 affects the Linux kernel DRM/AMDKFD component (kfd_wait_on_events). The vulnerability arises because the kfd_event_waiter structure allocated by alloc_event_waiters() does not initialize its event field. If copy_from_user() fails in kfd_wait_on_events(), the code frees the previous...

CVE-2023-53100

CVE-2023-53100 affects the Linux kernel ext4 inline data handling. The issue arises in ext4_update_inline_data when ext4_xattr_shift_entries changes i_inline_off, causing an incorrect inline offset and, during get_max_inline_xattr_value_size, an entry that leads to free calculations becoming nega...

CVE-2023-53105

CVE-2023-53105 affects the Linux kernel mlx5 driver, specifically a NULL pointer dereference in encap lock cleanup when unloading a module with a peer offloaded TC flow. The underlying issue occurs when the peer uplink rep profile is changed to a NIC profile and the encap lock is destroyed during...

CVE-2024-26676

CVE-2024-26676 concerns the Linux kernel’s af_unix garbage collection. The issue arose when a socketpair self-send creates a self-referential GC candidate cycle that is not untangled due to missing MSG_OOB handling, causing a memory leak. The root cause was exposed after removing io_uring GC dead...

CVE-2024-26942

CVE-2024-26942 (Linux kernel) affects the qcom at803x PHY driver (at8031) in the Linux kernel. The root cause is a NULL dereference where the private data (priv) is referenced before it has been allocated during the driver’s rework/split, causing a kernel panic when probing at8031. The fix ensure...

CVE-2024-27400

CVE-2024-27400 affects the Linux kernel: drm/amdgpu, specifically amdgpu_ttm_move(). The issue is with move/ notification ordering—notifications must be sent before the actual move so DMA-buf and VM move notifications have the correct order; after a move, the old location becomes unavailable. The...

CVE-2024-35791

CVE-2024-35791 affects the Linux kernel KVM: SVM subsystem. It describes a use-after-free in svm_register_enc_region() that is mitigated by flushing converted pages under the kvm lock before releasing the lock, preventing region/pages from being freed by another task. The fix is a patch to perfor...

CVE-2024-35806

The CVE-2024-35806 entry concerns the Linux kernel vulnerability in soc: fsl: qbman where IRQs must be disabled when taking cgr_lock to avoid deadlocks. The description states that smp_call_function_single already disables IRQs in the affected code path and that qman_update_cgr and qman_delete_cg...

CVE-2024-35902

The CVE-2024-35902 issue affects the Linux kernel’s RDS path. In net/rds, a null cp can be dereferenced in __rds_rdma_map when cp->cp_conn is accessed, potentially causing a crash. Analysis notes that cp is a parameter that may be NULL at several call sites (e.g., rds_get_mr, rds_get_mr_for_de...

CVE-2024-35935

CVE-2024-35935 – Linux kernel (btrfs: send: handle path ref underflow in header iterate_inode_ref()) Connected documents confirm a concrete fix in the Linux kernel: when building a path buffer for iterate_inode_ref(), a BUG_ON-based path underflow handling was replaced with proper error handling ...

CVE-2024-38576

CVE-2024-38576 affects the Linux kernel where rcuc: rcu: print_cpu_stall_info() could overflow a buffer when jiffies differences are large. The root cause involved printing an unsigned difference with %ld and a potential buffer overflow, which is fixed by replacing sprintf() with snprintf() and a...

CVE-2024-40939

CVE-2024-40939 (Linux kernel) : The issue affects the Linux kernel net/wwan/iosm path. When region creation fails in ipc_devlink_create_region(), the delete path used a tainted pointer that actually held an error code. The fix decreases the region index before performing the delete to avoid taint...

CVE-2024-40942

CVE-2024-40942 corresponds to a Linux kernel vulnerability involving the wifi/mac80211 mesh code. The issue was a leak of mesh_preq_queue objects that are stored in a per-mesh interface list to track path resolution. When an mpath is deleted or a mesh interface is removed, entries in this preq_qu...

CVE-2024-40976

CVE-2024-40976 — Linux kernel (drm/lima) Affected: drm/lima in the Linux kernel. Description details a race in which a rendering job may trigger the drm sched timeout handler and still complete before the hard reset, risking a refcount imbalance on lima_pm_idle and producing stack traces. Root ca...

CVE-2024-42153

The CVE CVE-2024-42153 affects the Linux kernel I2C pnx driver, where del_timer_sync() invoked from an ISR could emit a deadlock warning. The fix replaces del_timer_sync() with wait_for_completion_timeout() in isr, allowing removal of the timer and related code. This change removes the warning an...

CVE-2024-44949

CVE-2024-44949 affects the Linux kernel on PA-RISC (parisc) systems. The issue stems from ARCH_DMA_MINALIGN being set to 16, enabling two unrelated 16‑byte allocations to share a cache line and risking DMA/cached writes corrupting the data. The fix updates the alignment: ARCH_DMA_MINALIGN becomes...

CVE-2024-46726

CVE-2024-46726 (Linux kernel, drm/amd/display) fixes overflow/overrun in index calculations (vmid0p72_idx, vnom0p8_idx, vmax0p9_idx) to prevent array size overflow. The patch resolves 3 OVERRUNs and 1 INTEGER_OVERFLOW reported by Coverity; affected AMD display path. Remediation is to apply the up...

CVE-2024-46755

CVE-2024-46755 affects the Linux kernel mwifiex wifi driver. The vulnerability occurs when mwifiex_get_priv_by_id() returns a priv pointer for a given bss_num/bss_type without verifying the priv is in use, leading to NULL pointer dereferences down the call stack when an AP is started (e.g., via w...

CVE-2024-46775

CVE-2024-46775 affects the Linux kernel DRM AMD display path (drm/amd/display). Root cause: function return values were not checked before their results were used by subsequent calls. The patch resolves 4 CHECKED_RETURN issues reported by Coverity and fixes the vulnerability by validating return ...

CVE-2024-46896

The CVE-2024-46896 vulnerability is in the Linux kernel DRM/AMDGPU path. It stems from a memset in drm_sched_job_init() that overwrites the initialized base.sched field in amdgpu_job_alloc, causing a CS validation path to be rejected with a bogus ring and potentially a crash. The fix passes NULL ...

CVE-2024-47677

CVE-2024-47677 affects the Linux kernel exFAT implementation. The flaw: when exfat_load_upcase_table reaches the end and returns -EINVAL, allocated memory is not freed, and as exfat_load_default_upcase_table allocates more memory this can cause a memory leak. Details from connected advisories ind...

CVE-2024-47741

In CVE-2024-47741, the Linux kernel’s btrfs code had a race when multiple threads perform lseek (SEEK_DATA/SEEK_HOLE) on the same file descriptor. The bug stems from find_desired_extent() grabbing the file’s private_data while it may be NULL, allowing two threads to allocate separate file private...

CVE-2024-50065

Technical details for CVE-2024-50065 are not provided in the connected documents. Monitor for updates.

CVE-2024-50170

CVE-2024-50170 affects the Linux kernel bcmasp driver (net/bcmasp). The vulnerability occurs when bcmasp_xmit() returns NETDEV_TX_OK after a mapping failure, leaking the skb. The fix adds a dev_kfree_skb() call to free the skb, correcting the memory leak on the transmit path. The documents do not...

CVE-2024-50188

CVE-2024-50188 : In the Linux kernel, the net: phy: dp83869 vulnerability caused memory corruption when enabling fiber. The DP83869 PHY driver called linkmode_set_bit() with a bit mask (1 <

CVE-2024-50231

CVE-2024-50231 affects the Linux kernel’s IIO subsystem (gts helper). The issue is a memory-leak in iio_gts_build_avail_scale_table() where per_time_gains elements/arrays are not freed, triggered when running iio-test-gts tests (gts_test_gains, gts_test_itimes). The leak manifests as unreferenced...

CVE-2024-53067

The CVE-2024-53067 entry relates to the Linux kernel SCSI/UFS subsystem. A fix prevents RTC update work from starting before runtime PM in the UFS driver is fully initialized, addressing a crash (Oops) observed in the ufshcd_rtc_work path. The core issue is a race/ordering problem that could trig...

CVE-2024-53077

CVE-2024-53077 affects the Linux kernel rpcrdma subsystem, specifically the rpcrdma_device xa_array. The root cause is that xa_init_flags() in rpcrdma_add_one() may allocate memory in the xarray that is not released during removal because there is no matching xa_destroy() in rpcrdma_remove_one()....

CVE-2024-53116

CVE-2024-53116 concerns the Linux kernel panic/warning scenario in the Panthor DRM/GPU VM path. The description documents a bug in partial GPU mapping of buffer objects (BOs) where Panthor failed to correctly handle mappings that span multiple scatterlists and where the mapping offset did not sta...

CVE-2024-56665

CVE-2024-56665 refers to a Linux kernel issue in the bpf/perf subsystem. The crash arises when a tracepoint perf event uses a BPF program with attr.inherit=1, and the event is inherited by a child after fork, causing the child to share the parent’s tp_event->prog_array. On teardown, the first ...

CVE-2024-56768

CVE-2024-56768 (Linux kernel) : On x86-64, calling bpf_get_smp_processor_id() in builds with CONFIG_SMP disabled can trigger a page fault due to unavailable pcpu_hot. The fix in the patch inline returns 0 for the !CONFIG_SMP path, preventing the fault. References point to the kernel stable histor...

CVE-2024-58034

CVE-2024-58034 in the Linux kernel fixes an OF node reference bug in memory: tegra20-emc. The issue arises when tegra_emc_find_node_by_ram_code() releases some device nodes while still in use, potentially causing use-after-free (UAF). The description states that the emc-tables node is a child wit...

CVE-2024-58068

CVE-2024-58068 affects the Linux kernel OPP subsystem. If a bandwidth table is not created (e.g., interconnect properties missing in the OPP consumer node) and a driver calls dev_pm_opp_find_bw_ceil() or dev_pm_opp_find_bw_floor(), the kernel may NULL-dereference when reading bandwidth from _read...

CVE-2025-21712

In the Linux kernel, the md/md-bitmap component had a race where bitmap_get_stats() could be called while the bitmap storage was destroyed or not fully initialized, risking a general protection fault. The root cause was dereferencing bitmap->storage outside a synchronized lifetime of the bitma...

CVE-2025-21723

Summary (CVE-2025-21723) In the Linux kernel, mpi3mr/scsi code was fixed to prevent a crash when BSG setup fails. If bsg_setup_queue() fails, bsg_queue may be non-NULL, causing mpi3mr_bsg_exit() to skip bsg_remove_queue() and trigger a NULL pointer dereference (kernel crash) as shown in the entry...

CVE-2025-21908

CVE-2025-21908 concerns the Linux kernel NFS subsystem. The issue arises when nfs_release_folio() can deadlock during writeback initiated by kcompactd, triggering a recursive path through NFS and the NFSD loopback on the same host. The patch adds PF_KCOMPACTD and a current_is_kcompactd() helper t...

CVE-2025-22001

CVE-2025-22001 relates to the Linux kernel, where an integer overflow could occur in qaic_validate_req() due to u64 values supplied from user space via qaic_attach_slice_bo_ioctl(). The vulnerability was fixed by ensuring calculations don’t wrap using check_add_overflow() (kernel fixes referenced...

CVE-2025-22033

CVE-2025-22033: Linux kernel arm64 fix for a NULL pointer dereference in alignment handling. The issue occurs when do_alignment_t32_to_handler() fixes only specific instructions and returns NULL for others (e.g., LDREX); callers would proceed with regular alignment fault handling (SIGBUS). Withou...

CVE-2025-23155

The CVE-2025-23155 issue affects the Linux kernel’s STMicroelectronics stmmac driver. In stmmac_request_irq_multi_msi(), a pointer to the stack variable cpu_mask is passed to irq_set_affinity_hint(), which is stored in irq_desc->affinity_hint. After the function returns, the pointer becomes da...

CVE-2025-37787

CVE-2025-37787 affects the Linux kernel in the mv88e6xxx DSA driver. The issue arises when unbinding the driver: a NULL devlink global region pointer is passed to devlink_region_destroy(), causing a NULL-tolerant crash. The root cause is that some devlink regions (MV88E6XXX_REGION_STU and MV88E6X...

CVE-2025-37817

Linux kernel vulnerability CVE-2025-37817 involves a double free in the mcb path: in chameleon_parse_gdd(), if mcb_device_register() fails, the code could release mdev via put_device() and then free it again on the error path. The fixed behavior is to return early if mcb_device_register() fails, ...