CVE-2022-48794

CVE-2022-48794 affects the Linux kernel wireless stack for the IEEE 802.15.4 at86rf230 driver. On error, ieee802154_xmit_complete() is not invoked and skb structures are leaked after manual wake_queue() calls in Tx paths. The fix described in the sources is to free the skb upon error before retur...

CVE-2022-48938

CVE-2022-48938 affects the Linux kernel CDC-NCM path. The issue arises when a broken device provides an extreme offset (e.g., 0xFFF0) with a plausible fragment length, allowing an integer overflow in the existing sanity check. The description states that both offset and offset + len must be check...

CVE-2022-48994

CVE-2022-48994 affects the Linux kernel ALSA sequencing path. The issue arises from a prototype mismatch: seq_copy_in_user() and seq_copy_in_kernel() did not match snd_seq_dump_func_t, leading to -Wcast-function-type-strict checks with Clang. The patch fixes the function prototypes and removes ca...

CVE-2022-49308

The CVE-2022-49308 entry describes a Linux kernel extcon overflow/NULL dereference vulnerability that could cause an Oops when sysfs state_show() runs before driver data is set. The root cause is extcon device creation occurring before drvdata is initialized, leading to an edev NULL dereference d...

CVE-2022-49311

CVE-2022-49311 concerns a deadlock in the Linux kernel driver rtl8192bs (rtw_joinbss_event_prehandle) where a timer deletion under a spin_lock_bh caused a timer handler to wait on the same lock. The issue manifested as two threads blocking each other, risking an infinite hang. The documented fix ...

CVE-2022-49385

CVE-2022-49385 concerns a Linux kernel UAF in the driver_base path. When driver_attach(drv) fails, the code frees driver_private but had already been added to the bus, allowing a use-after-free condition. The documented fix is to ensure the object is removed from the bus on failure, preventing th...

CVE-2022-49923

The CVE affects the Linux kernel nxp-nci path (nfc: nxp-nci: Fix potential memory leak in nxp_nci_send). The root cause is that nxp_nci_send() frees the allocated skb only on nxp_nci_i2c_write() failure; when the write succeeds, nxp_nci_i2c_write() does not free the skb, causing a memory leak. A ...

CVE-2023-38429

The CVE-2023-38429 issue is reported in the Linux kernel (pre-6.3.4) within ksmbd: fs/ksmbd/connection.c contains an off-by-one error in memory allocation (ksmbd_smb2_check_message), which can cause out-of-bounds access. Connected advisories (Astra Linux, Nessus plugin references) corroborate the...

CVE-2023-52507

CVE-2023-52507 affects the Linux kernel NFC stack (nfc: nci) where the protocol is validated via a bitmask; the issue arises from an assertion that the requested protocol is below the maximum, preventing a potential shift-out-of-bounds and clarifying errors between undefined vs. unsupported proto...

CVE-2023-52511

CVE-2023-52511 (Linux kernel, spi sun6i) : The issue stems from RX SPI transfers with DMA enabled where data could be corrupted during DMA to memory when transfers span more than a single byte. The fix reduces the width of each DMA read to the RX FIFO to a single byte, mitigating data loss. Publi...

CVE-2023-52561

CVE-2023-52561 : Linux kernel (arm64) vulnerability affecting DB845c boards with Qualcomm sdm845-db845c DTs. The issue stems from not reserving the cont splash memory region (framebuffer memory used by the bootloader), which could trigger a kernel panic (arm-smmu: Unhandled context fault) on v5.1...

CVE-2023-52564

CVE-2023-52564 is a Linux kernel issue related to the GSM tty driver. The advisory states that reverting the patch “tty: n_gsm: fix UAF in gsm_cleanup_mux” did not solve the original problem. The root cause described is that gsm_cleanup_mux() could call gsm_dlci_release() (via dlci_put()/tty_port...

CVE-2023-52631

CVE-2023-52631 affects the Linux kernel NTFS3 path. The issue is a NULL dereference in ntfs_load_attr_list() caused by a 32-bit overflow in size calculation (le32_to_cpu(attr->res.data_size) + 1023), which can yield zero and make kmalloc return ZERO_SIZE_PTR, leading to a crash on memcpy. The ...

CVE-2023-52939

Summary of CVE-2023-52939 (Linux kernel): The vulnerability is in the memory control group (memcg) path of the Linux kernel, specifically in mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath(). The root cause arises after the hwpoison patch that forcibly uncharges a LRU hwpoi...

CVE-2023-52984

CVE-2023-52984 affects the Linux kernel PHY code for DP83822 family: DP83825/DP83826 devices can dereference a NULL private data pointer because probe() initializes only the DP83822 path and interrupt setup is shared. The fix adds a NULL-pointer check/verifies the pointer before use, preventing t...

CVE-2023-53008

CVE-2023-53008 (Linux kernel): CIFS session setup fix to prevent memory leaks by freeing cifs_ses::auth_key.response before allocating it. This addresses potential memory leaks during reconnect or mounting. The advisory states the fix in the CIFS session setup path; no exploit specifics are provi...

CVE-2023-53036

CVE-2023-53036 relates to the Linux kernel's DRM/amdgpu stack. On GPUs with RAS enabled, there is a call trace warning and potential hang during device shutdown due to a vulnerability in the amdgpu_vram_mgr_fini path that can propagate through amdgpu_ttm_fini, amdgpu_bo_fini, and related release ...

CVE-2023-53059

CVE-2023-53059 :Vulnerability in the Linux kernel related to the Cros EC chardev path (platform/chrome) where an ioctl handling could leak kernel page data if a larger insize is provided in struct cros_ec_command when issuing EC host commands. The issue enables an information disclosure (confiden...

CVE-2023-53071

CVE-2023-53071 affects the Linux kernel WiFi driver mt76. The root cause was calling ieee80211_unregister_hw unconditionally when probing a mt7921e PCI card without firmware, which could lead to a NULL pointer dereference on driver removal. The fix ensures mt76_unregister_device is invoked only f...

CVE-2024-26630

CVE-2024-26630 (Linux kernel) : The issue in cachestat stemmed from reading folio data from the page cache XRAY without holding a reference, allowing a folio to be released and reused during the operation. The fix switches to the xarray machinery for folio offsets and dirty/writeback state, preve...

CVE-2024-26751

CVE-2024-26751 affects the Linux kernel on ARM (ep93xx) where the gpiod_lookup_table lacks a terminator. If gpio_find() is passed a con_id not present in the table, it may loop indefinitely and trigger an oops. The available connected documents confirm the issue and describe the fix as adding a t...

CVE-2024-26788

CVE-2024-26788 affects Linux kernel’s dmaengine: fsl-qdma. The concrete issue is that qDMA IRQs could be enabled before registers were configured, allowing pending interrupts from the primary kernel to reach the irq handler prematurely and cause a panic. The connected Astra Linux advisory confirm...

CVE-2024-26844

Linux kernel vulnerability CVE-2024-26844 was resolved by patching the block layer to address a harmful iov_iter direction issue. A Syzkaller warning reported that an iov_iter could be used in both directions due to a transfer direction SG_DXFER_TO_FROM_DEV, which would copy user buffers into the...

CVE-2024-40947

CVE-2024-40947 affects the Linux kernel IMA subsystem. The root cause was sleeping in an RCU read-side critical section caused by kmalloc(GFP_KERNEL) inside ima_lsm_copy_rule (via ima_filter_rule_match) leading to potential use-after-free and NULL pointer dereference during file operations. The i...

CVE-2024-40968

CVE-2024-40968 affects the Linux kernel on MIPS/Octeon systems. The issue was that after a PCIe link surprise down, the standard PCIe config interface could be abused to cause a kernel panic (“Data bus error”) when accessing peripheral PCIe devices. The fix adds a PCIe link status check and, when...

CVE-2024-41046

CVE-2024-41046 affects the Linux kernel net: ethernet: lantiq_etop driver. The issue is a double-free in detach caused by never incrementing the currently released descriptor, leading to releasing the same skb multiple times. A patch addressing this is published in stable kernels (as cited by the...

CVE-2024-42120

CVE-2024-42120 pertains to the Linux kernel, specifically a vulnerability in the DRM AMD display code. The issue is an OVERRUN caused by accessing the pipe_ctx array without validating an index against its MAX_PIPES size, which could lead to out-of-bounds access in the vblank handling path. The d...

CVE-2024-42267

CVE-2024-42267 : Linux kernel riscv MM path fix. The vulnerability is in the page fault handling where VM_FAULT_SIGSEGV was not handled, now added to mm_fault_error() so the process is killed correctly and the kernel BUG is avoided. This is a kernel-level issue in the riscv memory management subs...

CVE-2024-42273

CVE-2024-42273 is a Linux kernel vulnerability affecting f2fs where CURSEG_ALL_DATA_ATGC is incorrectly assigned to COMPR_ADDR when the page is GC’d with gcing flag, causing a kernel BUG at fs/f2fs/segment.c:3589 during writeback. The scenario involves creating a small file on a compressed f2fs f...

CVE-2024-42286

CVE-2024-42286 concerns the Linux kernel scsi: qla2xxx where nvme_local_port validation was corrected. The issue could lead to a NULL pointer dereference during NVMe remote port registration in qla2xxx paths, potentially causing a kernel crash. Connected advisories (Astra Linux, Debian LTS, and A...

CVE-2024-42287

The connected documents confirm CVE-2024-42287 affects the Linux kernel scsi/qla2xxx path. Root cause: completing a command early (outside a lock) during unload leads to a race and a crash (NULL pointer dereference) when NPIV/FW reset paths are involved. The mitigation in the provided text is to ...

CVE-2024-43897

CVE-2024-43897 (Linux kernel) : The issue stems from improper validation of GSO (TCP/TSO) input in virtio_net_hdr processing. The kernel’s net/virtio_net_hdr_to_skb checks for checksum fields (csum_start and csum_offset) were insufficient for GSO segs, allowing a bad input path to reach skb_check...

CVE-2024-45007

The CVE-2024-45007 issue affects the Linux kernel component related to xillybus workqueues. Root cause: when a kref is decremented, destroy_workqueue() could be invoked from within a work item that is destroying its own workqueue, an illegal scenario. The documented fix introduces a module-global...

CVE-2024-45020

Linux kernel CVE-2024-45020 fix: a kernel verifier crash in BPF stacksafe() caused by invalid memory access when evaluating stack slots during sched-ext, mitigated by adding an i >= cur->allocated_stack guard. The issue occurs when cur->allocated_stack > old->allocated_stack, riski...

CVE-2024-46773

The CVE-2024-46773 issue in the Linux kernel concerns the drm/amd/display path where a division could be performed with a zero denominator (pbn_div). The root cause is a denominator that could be zero; upstream patch adds a check before use to prevent a DIVIDE_BY_ZERO. Public documents confirm th...

CVE-2024-47662

The CVE-2024-47662 entry concerns the Linux kernel component drm/amd/display (DCN35 DMCUB diagnostics). The issue is that a diagnostic register read was removed to prevent triggering a security violation when DMCUB timeouts occur, blocking Z8 entry. The fix is to stop reading that register from t...

CVE-2024-47688

CVE-2024-47688 (Linux kernel) involves a potential null-pointer dereference in driver core during module_add_driver() probing for of-fpga-region. If kasprintf() fails, the exit path’s second sysfs_remove_link() could dereference a NULL driver_name because kernfs_name_hash() calls strlen() on NULL...

CVE-2024-50175

CVE-2024-50175 concerns the CAMSS pipeline in the Linux kernel where a use_count guard in stop_streaming misinterprets the number of active streams as a user-space open count. This causes stop_streaming to leave buffers active and can lead to -EBUSY and broken restart behavior when multiple VCs s...

CVE-2024-56661

CVE-2024-56661 : Linux kernel TIPc vulnerability causing a NULL pointer dereference in cleanup_bearer(), traced to a use-after-free like condition where ub->ubsock->sk could be NULL after a blamed commit, leading to an atomic_dec on tipc_net(sock_net(ub->ubsock->sk))->wq_count. The...

CVE-2024-58078

CVE-2024-58078 affects the Linux kernel’s misc subsystem. The issue stems from mismatched id allocation/free in dynamic/minor handling: misc_minor_alloc started using ida for all dynamic/misc minors, but misc_minor_free used ida_free regardless, creating a potential id-usage mismatch (reported tr...

CVE-2024-58094

Technical details (affected product, root cause, impact, and remediation) are not publicly available in the provided connected documents. Monitor for updates from vendors and security advisories for CVE-2024-58094.

CVE-2025-21713

CVE-2025-21713 affects the PowerPC/ pSeries IOMMU path in the Linux kernel. The issue occurs when reusing the same vfio container across different IOMMU groups, where spapr_tce_set_window() may lead to cleanup that dereferences a null or invalid tbl, causing a kernel crash (NULL pointer dereferen...

CVE-2025-21741

CVE-2025-21741 affects the Linux kernel usbnet/ipheth path. The bug is an out-of-bounds read in DPE handling within usbnet, where the number of processed DPEs could exceed the fixed-size NDP16 header. The advisory fix limits processing to the number that fits in the NDP16 header to prevent OoB re...

CVE-2025-21986

CVE-2025-21986 affects the Linux kernel net: switchdev notification path. The root cause is a blocking notification chain that uses a read-write semaphore to protect the chain, which allows recursive notifications to cause the semaphore to be acquired twice for reading. In certain bridge/offload ...

CVE-2025-22107

CVE-2025-22107 - Linux kernel (net: dsa: sja1105) Root cause: in sja1105_table_delete_entry, deleting the last element in the table incorrectly calls memmove over an out-of-bounds element, and the number of elements moved should be size - i - 1. This leads to touching an out-of-bounds memory loca...

CVE-2025-37744

CVE-2025-37744 affects the Linux kernel’s ath12k PCI wireless driver, where a memory allocated during ath12k_pci_probe() could leak if ATH12K_FLAG_QMI_FAIL is set and ath12k_fw_unmap() is not invoked in ath12k_pci_remove(). The issue is mitigated by a fixed sequence in the kernel fix, documented ...

CVE-2025-37755

CVE-2025-37755 relates to the Linux kernel: net: libwx path where page_pool_dev_alloc_pages could return NULL, with a WARN_ON(!page) yet the code continued to use the NULL pointer, potentially crashing. The description notes this is addressed by a kernel fix equivalent to a prior commit (net: fec...

CVE-2025-37775

CVE-2025-37775 affects the Linux kernel in the ksmbd component. The issue centers on a warning in __kernel_write_iter that could relate to directory write attempts; the patch stabilizes behavior by not allowing writes to directories, as described in the initial advisory. The vulnerability is addr...

CVE-2025-37857

CVE-2025-37857 affects the Linux kernel scsi: st driver. It fixes an array overflow in st_setup() by changing the array size from a fixed value to follow the parms size.

CVE-2025-38177

CVE-2025-38177 affects the Linux kernel’s scheduling subsystem (sch_hfsc). The documented fix makes hfsc_qlen_notify() idempotent to improve safety for callers such as qdisc_tree_reduce_backlog(). The described changes include guarding update_vf() (checking cl_nactive) and safely removing RB node...