CVE-2017-18224

CVE-2017-18224 : The Linux kernel before 4.15 contains a race condition in the ocfs2 extent-tree path. Specifically, in fs/ocfs2/aops.c, a semaphore is omitted during read operations in DIRECT mode, enabling a local attacker to trigger a denial of service by modifying the e_cpos field. The connec...

CVE-2019-15792

CVE-2019-15792 affects the shiftfs implementation in Ubuntu's kernel series (5.0 and 5.3), where shiftfs_btrfs_ioctl_fd_replace() calls fdget(oldfd) and passes the resulting file* to shiftfs_real_fdget(), casting file->private_data (a void*) to a struct shiftfs_file_info *. Since private_data ...

CVE-2020-35513

CVE-2020-35513 describes a flaw in the Linux kernel NFS implementation where an incorrect umask during file/directory modification can be triggered when NFSv4.2 and a non-NFSv4.2 process access the NFS concurrently. The result is resource starvation leading to denial of service. The initial and c...

CVE-2021-4442

CVE-2021-4442 – The Linux kernel TCP stack vulnerability described as: a syzkaller repro could cause RCV_SEQ to be advanced after data restoration in the receive queue, enabling an out-of-order or invalid sequence handling when TCP_QUEUE_SEQ is used on non-empty queues. The connected documents (A...

CVE-2021-46996

CVE-2021-46996 corresponds to a memleak in the Linux kernel nftables netfilter code, specifically in the userdata error path when creating new objects. The fixed description states that the patch releases an object name if userdata allocation fails, addressing a memory leak in the userdata error ...

CVE-2021-47065

CVE-2021-47065: Technical details (affected product/versions, impact, fix) are not provided in the supplied documents. Monitor official updates for the vulnerability specifics and patch availability.

CVE-2021-47372

CVE-2021-47372 is a Linux kernel use-after-free in the macb driver. The issue arises from plat_dev->dev->platform_data being released by platform_device_unregister() and subsequently using pclk and hclk, leading to use-after-free in macb_remove. The fixed sequence avoids using the clk devic...

CVE-2021-47391

CVE-2021-47391 – Linux kernel RDMA CMA race (use-after-free risk) Vulnerability summary from connected advisories: The RDMA/cma component can allow a second rdma_resolve_ip() for the same id_priv due to an invariant violation when the FSM cycles between RDMA_CM_IDLE, RDMA_CM_ADDR_QUERY and RDMA_C...

CVE-2021-47458

CVE-2021-47458 affects the ocfs2 mount path in the Linux kernel. It occurs when mounting ocfs2 with o2cb or pcmk on kernels built with Fortify Source, due to non-null-terminated strings in the disk representation being treated as null-terminated by strlcpy, triggering a buffer overflow and a fort...

CVE-2021-47511

The CVE-2021-47511 issue affects the Linux kernel ALSA: pcm: oss path, where period size calculation could produce negative values treated as positive due to size_t. The OSS layer could pass an oversized period/buffer to lower layers. The authenticated fix changes handling to ssize_t with proper ...

CVE-2021-47595

CVE-2021-47595 affects the Linux kernel net/sched sch_ets. The vulnerability arises when the ETS qdisc changes (ets_qdisc_change) cause list_del corruption, leading to kernel BUG checks (invalid opcode in list_debug.c) and a system crash. The provided traces show the crash occurs in ets_qdisc_cha...

CVE-2022-3544

CVE-2022-3544 describes a memory leak in the Linux kernel within Netfilter, specifically the damon_sysfs_add_target function in mm/damon/sysfs.c. The issue is triggered through manipulation of target handling and is described as a vulnerability in the kernel’s Netfilter component. The initial des...

CVE-2022-48919

CVE-2022-48919 affects the Linux kernel’s CIFS mount flow. The issue is a double-free race in cifs_get_root() when a mount fails inside cifs_smb3_do_mount(); deactivate_locked_super() leads to delayed_free(), potentially freeing resources twice if code continues to the out: path. The vulnerabilit...

CVE-2022-48962

CVE-2022-48962 affects the Linux kernel net layer via the hisilicon driver code path net: hisilicon: Fix potential use-after-free in hisi_femac_rx(). The skb can be delivered to napi_gro_receive() which may free it; dereferencing the skb after that may trigger a use-after-free. The connected Tena...

CVE-2022-49151

CVE-2022-49151 is a Linux kernel vulnerability in the CAN/USB subsystem (can: mcba_usb) where usb_submit_urb() could warn due to an incorrect endpoint type. Syzbot reported a bogus urb transfer when the pipe’s type did not match the endpoint, prompting a code path change: pipes are now saved in m...

CVE-2022-49276

CVE-2022-49276 affects the Linux kernel’s JFFS2 file-system code. A memory leak can occur in jffs2_scan_medium when an error in jffs2_scan_eraseblock() adds memory to jffs2_summary, leading to unreferenced allocations reported by kmemleak. The advisory notes that on exit the memory should be rele...

CVE-2022-49315

CVE-2022-49315 concerns a deadlock in the Linux kernel, specifically in the staging driver rtl8192e (rtllib_beacons_stop). The issue arises when rtllib_beacons_stop() holds ieee->beacon_lock while calling del_timer_sync(), while the timer handler (rtllib_send_beacon_cb) needs the same lock, ca...

CVE-2022-49408

CVE-2022-49408 involves a memory-leak in ext4 when parsing on-disk mount options in the Linux kernel. The root cause is memory allocated in ext4_fs_context not being freed if option processing fails; the fix replaces direct kfree() with ext4_fc_free(). Practical impact is a leak during mounting w...

CVE-2022-49566

The CVE-2022-49566 issue affects the Linux kernel crypto/qat RSA path. When an RSA key in PKCS #1 V2.1 form 2 is used, private key components persist after the TFM is released due to memory not being freed. The fix replaces explicit buffer frees in qat_rsa_exit_tfm() with a call to qat_rsa_clear_...

CVE-2022-49725

CVE-2022-49725 affects the Linux kernel i40e driver (Intel Ethernet) and relates to a crash after PF reset when ethtool -t tests are run in close succession. The root cause is a race between pf reset calling i40e_vsi_close in prep_for_reset and ethtool -t calling i40e_vsi_close in diag_test, wher...

CVE-2022-49920

The CVE-2022-49920 entry concerns a race in the Linux kernel netfilter nf_tables netlink notifier that can release objects while a transaction context may still reference them. The root cause is a race between the commit release path (invoked via call_rcu and running locklessly) and object remova...

CVE-2022-50066

Summary: CVE-2022-50066 affects the Linux kernel’s net/atlantic driver (Aquantia) where the final iteration of a for loop can dereference an out-of-bounds aq_vec entry, causing a UBSAN array-index-out-of-bounds condition. The issue manifests as index 8 being out of range for aq_vec_s *[8] in aq_n...

CVE-2023-52508

The Linux kernel contains a vulnerability in the nvme-fc component where a null pointer dereference occurs in the nvme_fc_io_getuuid() function. This is caused by the nvme_fc_fcp_op structure, which describes an AEN operation, being initialized with a null request structure pointer . An FC LLDD m...

CVE-2023-52517

CVE-2023-52517 affects the Linux kernel SPI sun6i driver where a race between DMA RX completion and RX FIFO drain could corrupt data. The fix separates RX FIFO drain from DMA mode by draining RX FIFO only in interrupt mode and by waiting for RX DMA completion before returning when DMA is used, en...

CVE-2023-52633

CVE-2023-52633 affects the Linux kernel time-travel feature. In basic time-travel mode, timer_read() may process a timer interrupt after computing the forward time but before finishing the update, causing the interrupt to set a time that is incompatible with the forward, which can make time go ba...

CVE-2023-52642

CVE-2023-52642 concerns a Linux kernel issue in the media: rc subsystem where attaching/detaching BPF programs could require write permission, with an auxiliary CAP_NET_ADMIN requirement. The main impact described across multiple advisories is a locally exploitable condition in kernel space that ...

CVE-2023-52732

In the Linux kernel, CVE-2023-52732 relates to Ceph when a corrupted snap trace is received by the kclient. The patch implements blocking of all further IO/MDS requests and eviction of the kclient to avoid further IOs on potentially inconsistent MDS state, preventing corrupted contents. The root ...

CVE-2023-52783

CVE-2023-52783 affects the Linux kernel and fixes a local kernel-panic scenario in the net/wangxun path. When a device uses a custom subsystem vendor ID, wx_sw_init() may return before wx->mac_table is allocated, causing a NULL pointer dereference and a kernel panic. The connected documents co...

CVE-2023-52843

CVE-2023-52843 (Linux kernel): The vulnerability arises in LLC processing where mac headers are read via eth_hdr without verifying that skb contains an Ethernet header. Syzbot demonstrated entry into llc_rcv on a tun device, with tun injections that can bypass mac_len validation. The fix adds a m...

CVE-2023-52851

The CVE-2023-52851 entry concerns the Linux kernel, specifically the mlx5/IB stack. Affected component: mlx5 mkey cache initialization and related UMR/IB registration cleanup paths in mlx5_ib_stage_post_ib_reg_umr_init, mlx5r_umr_resource_cleanup, and __mlx5_ib_add. Root cause: in mlx5_mkey_cache...

CVE-2023-52882

In CVE-2023-52882, the Linux kernel vulnerability affects clk: sunxi-ng: h6 where CPUX reparenting during PLL CPUX rate change can cause instability, system crashes, or undefined behavior when CPUX clock changes while running. The issue was resolved by preventing instability when reparenting to a...

CVE-2023-53075

CVE-2023-53075 : In the Linux kernel, a ftrace lookup_rec() path can read records[-1].ip when index is 0, causing a KASAN use-after-free read via task modprobe. The root cause is an invalid access to pg->records[pg->index - 1].ip when pg->index is 0. The fix prevents IP checks when pg-&g...

CVE-2024-26749

CVE-2024-26749 concerns the Linux kernel USB CDNS3 gadget path. The issue was a memory-use-after-free in cdns3_gadget_ep_disable(), where priv_req is freed via cdns3_gadget_ep_free_request() but list_del_init(&priv_req->list) used priv_req->list after it had been freed, triggering a use-aft...

CVE-2024-26829

CVE-2024-26829 : Linux kernel vulnerability in media: ir_toy where a memleak could occur if the command path and irtoy_tx allocation are used and the command fails; the leak is mitigated by freeing the allocated buffer (buf) when irtoy_command fails. Connected advisories confirm the issue and des...

CVE-2024-35813

CVE-2024-35813 affects the Linux kernel MMC core. The issue arises when accessing an array of idatas in the MMC close-ended ffu path, where prev_idata = idatas[i - 1] is performed without verifying that i > 0, enabling a negative/index-out-of-bounds access. The vulnerability is resolved by add...

CVE-2024-38610

The CVE-2024-38610 entry concerns a Linux kernel issue in the acrn_vm_ram_map() path of the ACRN driver. The root cause is flawed follow_pte() usage that can access PFNs incorrectly: (1) it did not verify PTE write permissions (now checked against ACRN_MEM_ACCESS_WRITE); (2) it did not reject ref...

CVE-2024-39477

CVE-2024-39477 affects the Linux kernel mm/hugetlb memory-management code. The root cause was that vma_needs_reservation() could return -ENOMEM when allocate_file_region_entries() failed to allocate a file_region for a reservation, causing a splat in __unmap_hugepage_range(). The published fix is...

CVE-2024-39478

CVE-2024-39478 affects the Linux kernel crypto: starfive implementation. The vulnerability stems from freeing a stack-allocated RSA text buffer (calling kfree on it) causing undefined behavior in later operations. The connected advisories reference Linux kernel patch commits fixing this issue (st...

CVE-2024-42085

CVE-2024-42085 affects the Linux kernel USB DWC3 gadget, where when CONFIG_USB_DWC3_DUAL_ROLE is enabled and the system suspends (e.g., echo mem > /sys/power/state), a deadlock can occur during gadget suspend/resume. The triggering path is dwc3_suspend_common() taking dwc3->lock, then dwc3_...

CVE-2024-42137

CVE-2024-42137 concerns a Linux kernel Bluetooth issue for Qualcomm Atheros (QCA6390). The vulnerability stemmed from a regression introduced by commit 272970be3dab, which fixed a use-after-free in qca_serdev_shutdown() but caused Bluetooth enablement to fail after a warm reboot if enable-gpios w...

CVE-2024-42317

The CVE-2024-42317 issue affects the Linux kernel mm/huge_memory path on ARM64 with 64KB base pages. It stems from xarray not supporting arbitrary page cache sizes beyond MAX_PAGECACHE_ORDER, which can allow a 512 MB page cache in the collapsing path and triggers a warning when splitting an xarra...

CVE-2024-43832

In CVE-2024-43832, the issue is in the Linux kernel's s390/uv path where folio_wait_writeback() could be called without a folio reference after PTL removal, risking use-after-free if a folio is freed concurrently. The root cause is that folio_wait_writeback() requires both no held spinlocks and a...

CVE-2024-46825

CVE-2024-46825 involves the Linux kernel wifi (iwlwifi mvm) where the firmware link ID is checked using WARN_ON() instead of IWL_FW_CHECK. The fix changes the lookup function iwl_mvm_rcu_fw_link_id_to_link_conf() to use IWL_FW_CHECK() when validating firmware-provided input. Public docs show this...

CVE-2024-46847

Mode C The CVE-2024-46847 issue affects the Linux kernel memory-management path for vmalloc/vmap_block. The root cause is that a newly instantiated vbmap_block could be added to the vmap_block_queue xarray before its cpu field was initialised, allowing another CPU walking the xarray to perform an...

CVE-2024-47716

CVE-2024-47716 affects the Linux kernel on ARM where vfp: Use asm volatile in fmrx/fmxr macros fixes floating-point instructions from userspace that could crash arm kernels. The issue is demonstrated by a minimal userspace reproducer on a Raspberry Pi Zero W and is triggered when the kernel is bu...

CVE-2024-47721

CVE-2024-47721 affects the Linux kernel’s RTW89 Wi-Fi driver. The vulnerability stemmed from an unimplemented firmware C2H event RTW89_MAC_C2H_FUNC_READ_WOW_CAM, while the driver counted handlers using NUM_OF_RTW89_MAC_C2H_FUNC_WOW, causing out-of-bounds reads. The issue is resolved by removing t...

CVE-2024-47733

CVE-2024-47733 affects the Linux kernel netfs subsystem: netfs_init()/fscache_proc_init() creates a dentry under fs/netfs, but netfs_exit() only removes the proc entry, not its subtree, causing a non-empty directory to be removed and a leak of entries (e.g., 'requests'). The fix is to use remove_...

CVE-2024-49976

CVE-2024-49976 concerns an ABBA deadlock in the Linux kernel related to timerlat/osnoise kthread handling. The issue arises because stop_kthread() (offline callback for trace/osnoise:online) could deadlock due to holding interface_lock while cpus_write_lock/cpus_read_lock paths are taken, enablin...

CVE-2024-50100

CVE-2024-50100 affects the Linux kernel USB gadget dummy-hcd driver. A change to use hrtimers introduced a mismatch between timer_pending() and hrtimer_active(), causing the URB dequeue path to miss a restarted timer and leading to usb_kill_urb() hangs. The fix adds a dedicated timer_pending flag...

CVE-2024-50113

In CVE-2024-50113, the Linux kernel FireWire (OHCI) core had a bug in the self-ID enumeration path that could assign an invalid port index to a parent device when multiple-port nodes were connected. The issue manifested when any extra node device with three or more ports attached to a 1394 OHCI c...