CVE-2022-48983

CVE-2022-48983 is a Linux kernel vulnerability where a NULL pointer dereference in io_tctx_exit_cb() could occur during io_uring/cancellation interplay, leading to a kernel panic. The issue arose when task_work added by io_ring_exit_work() could race with cancellation of exec work, causing curren...

CVE-2022-49074

CVE-2022-49074 concerns the Linux kernel vulnerability in the GICv3 interrupt controller. The issue was caused by incorrect polling of GICR RWP in redistributors, where the code tested the distributor bit index instead of the correct RWP bit, a mistake that reportedly persisted for eight years. T...

CVE-2022-49185

The CVE-2022-49185 entry concerns a Linux kernel pinctrl nomadik issue where of_node_put() was missing in nmk_pinctrl_probe, risking a refcount leak. The fix adds a call to of_node_put() to balance the refcount returned by of_parse_phandle(), as described across connected advisories (Astra Linux,...

CVE-2022-49203

CVE-2022-49203 – Linux kernel (drm/amd/display): The issue is a double free during GPU reset on DC streams. Root cause: during reset, a pre-commit state backup retains valid link encoder assignments; DC clears them in the current state but not in the backup, freeing an extra reference and causing...

CVE-2022-49712

CVE-2022-49712 : In the Linux kernel, the usb: gadget: lpc32xx_udc probe had a refcount leak due to an extra reference from of_parse_phandle(); the fix adds of_node_put() to release the node when not needed. This mitigates a refcount leak in the probe path. Connected advisories (SUSE/Nessus/OpenV...

CVE-2022-49855

CVE-2022-49855 affects the Linux kernel wwan driver (net: wwan: iosm). The root cause is that ipc_pcie_read_bios_cfg() uses acpi_evaluate_dsm() to obtain BIOS power-state config but fails to free the returned acpi_object, causing a memory leak. The issue has been resolved by freeing the acpi_obje...

CVE-2022-49940

CVE-2022-49940 concerns the Linux kernel tty/n_gsm subsystem. The vulnerability arises when gsmld_receive_buf() may call gsm->receive() even if gsm->receive is not initialized, leading to a NULL pointer dereference. The fix adds a sanity check to avoid invoking gsm->receive() if the func...

CVE-2022-50211

CVE-2022-50211 : Linux kernel md-raid10 path had a slab-out-of-bounds KASAN warning in raid10_remove_disk during an lvm-based reshape test. The fix verifies that the value “number” is valid to prevent an out-of-bounds read (Read of size 8) from 256-byte kmalloc slab. The issue is tied to KASAN re...

CVE-2023-3108

CVE-2023-3108 affects the Linux kernel, specifically the get_user_pages_fast path in the skcipher_recvmsg interface for symmetric-key ciphers (crypto/algif_skcipher.c). The flaw allows a local user to crash the system. Public details in the provided documents confirm the vulnerable component and ...

CVE-2023-3389

CVE-2023-3389 (Linux kernel io_uring UAF) : A use-after-free in the io_uring subsystem can be exploited to achieve local privilege escalation. The issue involves racing a io_uring cancel poll request with a linked timeout, which can trigger a UAF in an hrtimer. Impact is local privilege escalatio...

CVE-2023-52562

CVE-2023-52562 affects the Linux kernel, specifically the slab allocator path in mm/slab_common. The root cause is a slab_caches list corruption that can occur when a module creates a slab cache but does not release all allocated objects before destroying the cache at rmmod time, causing kmem_cac...

CVE-2023-52825

CVE-2023-52825 involves a race condition in the Linux kernel’s DRM/AMDKFD svm code where vram buffer unref (prange->svm_bo) can occur concurrently in mmu callbacks and a post-migrate callback to system RAM. The race may lead to use-after-free if the unref is performed unsafely across async tas...

CVE-2023-52976

CVE-2023-52976 – Linux kernel : The vulnerability occurs in efi_mem_reserve_persistent when dereferencing the result of memremap while iterating a linked list, if memremap returns NULL. The patch adds a NULL check and falls back to allocating a new page when memremap fails, mitigating potential N...

CVE-2023-53047

CVE-2023-53047 refers to a race condition in the Linux kernel’s AMDTEE path (amdtee_open_session) that can lead to use-after-free when a session is closed concurrently. The official fix is to set the sess->sess_mask bit as the last step in amdtee_open_session to prevent use-after-free after se...

CVE-2023-53057

The CVE-2023-53057 entry corresponds to a Linux kernel Bluetooth HCI global-out-of-bounds bug. The issue arises in hci_init_stage_sync() looping a variable-length array, where amp_init1[] and amp_init2[] lacked an intentionally invalid final element, enabling out-of-bounds reads during hci_dev_op...

CVE-2023-53132

CVE-2023-53132 concerns a memory leak in the Linux kernel driver for SCSI mpi3mr, specifically mpi3mr_hba_port. The connected documents state that the leak was fixed in mpi3mr_remove(), with the driver freeing mpi3mr_hba_port at .remove. The affected software is the Linux kernel (mpi3mr SCSI driv...

CVE-2024-26632

CVE-2024-26632 affects the Linux kernel’s block layer, where iterating over an empty bio could trigger a NULL dereference in bio_first_folio() if bio contains no data. The fix moves the end-of-bio test from bio_next_folio() to bio_first_folio(), preventing oopses by avoiding dereferencing a NULL ...

CVE-2024-26856

CVE-2024-26856 relates to the Linux kernel net driver for Sparx5. A use-after-free occurs when a MAC table entry is removed but still used; the code freed the mac_entry before its vid was used to delete the HW entry. The fix delays freeing until after deleting the hardware entry by first using th...

CVE-2024-35932

CVE-2024-35932 affects the Linux kernel DRM VC4 driver. The issue is in non-blocking commits where the check plane->state->fb == state->fb is not reliably protected, causing potential refcount underflow across prepare_fb/cleanup_fb. The root cause is that drm_plane.state should not be ac...

CVE-2024-35961

Summary: CVE-2024-35961 affects the Linux kernel mlx5 driver (net/mlx5). A non-fatal firmware error during device probe could cause a WARN_ON because devlink_register() was invoked late; the fix is to call devl_register() first under the devlink lock to avoid the warning. The issue is documented ...

CVE-2024-35972

The CVE refers to a Linux kernel memory-leak in bnxt_en during bnxt_rdma_aux_device_init(), triggered when ulp = kzalloc() fails and the edev is not assigned to the cleanup path. The fix assigns the allocated edev immediately after kzalloc(), preventing leaks on error paths. Impact is memory leak...

CVE-2024-38593

CVE-2024-38593 affects the Linux kernel’s net: micrel: lan8841 timestamp handling. Description: the issue occurred when a port was brought up and then down, because the code started using the ptp workqueue to fetch the second timestamp part. If NETWORK_PHY_TIMESTAMPING is disabled, the ptp_clock ...

CVE-2024-40917

CVE-2024-40917 affects the Linux kernel memory management (memblock) related to NUMA/node handling. The issue stems from memblock_validate_numa_coverage() allowing a NUMA_NO_NODE condition and memblock_alloc_range_nid() warning about MAX_NUMNODES, leading to a NULL dereference in memmap_init() wh...

CVE-2024-43825

The CVE-2024-43825 entry concerns a Linux kernel IIO subsystem issue: in iio_gts_build_avail_time_table, the sorting logic can misbehave when a time_us value is zero, potentially causing an out-of-bounds write (example sequence 3, 0, 1) and, if no zero times exist, elements may be copied unsorted...

CVE-2024-43843

CVE-2024-43843 affects the Linux kernel in the riscv/bpf trampoline path. The issue stems from an inconsistency in the dry-run vs real patch phase after commit 26ef208c209a, where the size of the trampoline image used to allocate memory can lead to an out-of-bounds condition in RV64 when computin...

CVE-2024-46728

CVE-2024-46728 affects the Linux kernel (drm/amd/display) where there is a fix for using aux_rd_interval: the value of aux_rd_interval (size 7) must be checked before use. The connected Azure/Linux Nessus entries confirm the advisory references this vulnerability and describe the fix as preventin...

CVE-2024-46735

CVE-2024-46735 is a Linux kernel vulnerability where NULL pointer dereference could occur in ublk_ctrl_start_recovery when two UBLK_CMD_START_USER_RECOVERY commands race; the fix adds a NULL/zero-queues check and returns early in ublk_ctrl_start_recovery when ub->nr_queues_ready is zero. Conne...

CVE-2024-46778

The CVE-2024-46778 entry describes a Linux kernel defect in drm/amd/display where UnboundedRequestEnabled was checked as a pointer (dml_bool_t *UnboundedRequestEnabled) instead of its boolean value, causing address-based checks rather than dereferenced value. This was fixed to address a reverse N...

CVE-2024-46824

Summary (CVE-2024-46824) The connected MiracleLinux/MiracleLinux AXSA advisory AXSA:2024-9508:43 for MiracleLinux 9 ( kernel 5.14.0-503.14.1.el9_5 ) explicitly lists CVE-2024-46824 among the vulnerabilities. The advisory notes that the issue affects iommufd: drivers must supply the cache_invalida...

CVE-2024-46846

The CVE-2024-46846 issue is a Linux kernel vulnerability found in the Rockchip SPI driver (spi: rockchip) involving unbalanced runtime PM/system PM handling. The root cause was a commit that stopped respecting runtime PM and unconditionally disabled clocks during system sleep, potentially double-...

CVE-2024-50119

CVE-2024-50119 affects the Linux kernel CIFS client: the issue is a warning that occurs when destroying cifs_io_request_pool, which is not created by mempool_create. The resolution is to revert the pool with mempool_exit() instead of mempool_destroy, per the vulnerability description and linked k...

CVE-2024-50129

CVE-2024-50129 affects the Linux kernel in the net/pse-pd path, where an out-of-bounds access could occur when iterating PI structures. The fix tightens the loop limit so the code no longer accesses pcdev->nr_lines, which was allocated as exactly that many PI structures. This bounds-checking c...

CVE-2024-50149

CVE-2024-50149 : In the Linux kernel, the drm/xe path had a repair for freeing a job during TDR, which could cause a use-after-free because TDR may run the run_job thread. The fix prevents freeing the job in TDR and instead queues it (or lets the scheduler free it). A patch was cherry-picked into...

CVE-2024-50214

Technical details for CVE-2024-50214 are not public in the provided documents. Monitor for updates.

CVE-2024-56541

The CVE-2024-56541 entry concerns the Linux kernel wireless driver ath12k (wifi) where a use-after-free occurs during module removal. Specifically, ath12k_core_deinit() calls ath12k_mac_destroy() which unregisters ah->hw from mac80211 and frees ah->hw and related ar structures; then ath12k_...

CVE-2024-56750

CVE-2024-56750 : Linux kernel — erofs filesystem vulnerability. The issue occurs when mounting file-backed filesystems with an EROFS block size smaller than PAGE_SIZE, where EROFS previously called sb_set_blocksize() and could panic if bdev-backed mounts were not used. The fix directly adjusts s_...

CVE-2024-56784

Technical details for CVE-2024-56784 are not provided in the connected documents. The initial description notes a Linux kernel drm/amd/display fix, but explicit affected versions, root cause specifics, exploitability, or remediation are not disclosed here. Monitor for updates.

CVE-2024-57950

The CVE-2024-57950 entry concerns the Linux kernel drm/amd/display path, where a defect caused denominators used in calculations to potentially be uninitialized or set to zero, risking division by zero. The resolved description states the fix: initialize denominator defaults to 1 to avoid DIVIDE_...

CVE-2025-21733

CVE-2025-21733 is addressed in the OSV entry for ROOT-OS-UBUNTU-2404-CVE-2025-21733, which states that the vulnerability was patched in the rootio-linux package for Root:Ubuntu:24.04. Root has released multiple fixed versions. The description confirms a patched fix rather than active exploitation...

CVE-2025-21895

CVE-2025-21895 pertains to the Linux kernel perf subsystem. The issue arises in perf/core where the order of perf_event_pmu_context entries in parent/child contexts can become inconsistent due to the timing of PMU/event additions, triggering a warning about an unordered pmu_ctx_list in perf_event...

CVE-2025-21913

CVE-2025-21913 affects the Linux kernel, addressing a vulnerability in x86/amd_nb related to MSR handling for MMCFG. The root cause involved unsafe or unchecked RDMSR accesses (amd_get_mmconfig_range) and Xen guests lacking MSR_FAM10H_MMIO_CONF_BASE support, which could trigger warnings and poten...

CVE-2025-21982

CVE-2025-21982 affects the Linux kernel’s pinctrl nuvoton npcm8xx GPIO firmware path. The issue stems from devm_kasprintf() potentially returning NULL on failure, with the NULL return not being checked in npcm8xx_gpio_fw(), leading to a kernel NULL pointer dereference. A fix adds a NULL-check in ...

CVE-2025-21984

Technical details for CVE-2025-21984 are not publicly disclosed in the provided Connected documents; no vendor/product/version specifics or fixes are given here. Monitor for updates.

CVE-2025-22028

CVE-2025-22028 affects the Linux kernel media/v4l2 subsystem, specifically the vimc video capture path. The issue arises in vimc_streamer_pipeline_terminate() where .s_stream() could be invoked for subdevs that were not started or are stopped. The root cause is an unnecessary .s_stream() operatio...

CVE-2025-22034

CVE-2025-22034 concerns the Linux kernel mm/gup path and the handling of FOLL_SPLIT_PMD with hugetlb VMAs. The connected documents indicate a patch series addressing device-exclusive entries (hmm) and that THP interaction was a motivating factor, with hugetlb fencing and mapcount interactions imp...

CVE-2025-22127

CVE-2025-22127 affects the Linux kernel F2FS. The issue could cause a kernel hang when a compressed file system operation triggers IO errors during load of the error table to a dm device, while f2fs_write_data_pages holds the writepages lock. Root cause described: IO error looping in f2fs_prepare...

CVE-2025-23143

CVE-2025-23143 is a Linux kernel issue where unloading a module (e.g., CIFS/NFS) can race with a TCP socket still alive, leading to a NULL pointer dereference in lockdep when hlock_class() is called after the module is gone. The root cause is that CIFS assigns a different lock class to the socket...

CVE-2025-38197

CVE-2025-38197 affects the Linux kernel component platform/x86: dell_rbu. The root cause is a wrong list head passed to list_for_each_entry*() when iterating the packet list, causing incorrect data reads via sysfs and, on clearing the list, potential NULL pointer dereference. A patch fix was intr...

CVE-2025-38498

CVE-2025-38498 is a Linux kernel vulnerability described in the sources as: the function do_change_type() should refuse to operate on unmounted or not-our mounts, with propagation settings restricted to mounts within the caller’s mount namespace. The described impact is local, with potential for ...

CVE-2008-4210

CVE-2008-4210 affects the Linux kernel prior to 2.6.22. fs/open.c does not properly strip setuid/setgid bits on writes, allowing local users to gain privileges of a different group and access sensitive information by creating an executable file in a setgid directory via truncate/ftruncate with me...