CVE-2021-47403

CVE-2021-47403 relates to the Linux kernel ipack: ipoctal subsystem, where a reference to the carrier module was taken on every open but released only when the final reference to the tty struct dropped. The root cause is a module reference leak during tty installation/open, leading to a lingering...

CVE-2021-47405

CVE-2021-47405 affects the Linux kernel HID usbhid subsystem. The issue is a memory leak from unsent raw_report buffers when a USB HID device is removed; a patch/fix has been released in the kernel to address this. The CVSS metrics in the initial record show a MEDIUM base score (5.5) with LOCAL a...

CVE-2021-47407

The CVE-2021-47407 issue is in the Linux kernel's KVM x86 code related to SRCU initialization during page track setup. The root cause is a missing validation of init_srcu_struct()’s return value, which can fail (e.g., due to OOM) and lead to a NULL pointer dereference found by a modified syzkalle...

CVE-2021-47410

CVE-2021-47410 concerns the Linux kernel where the AMDGPU/KFD stack emitted a warning trace due to the function svm_migrate_fini releasing device resources via devm_memunmap_pages and devm_release_mem_region after a patch that split amdgpu_device_fini into early/late phases. The root cause is the...

CVE-2021-47492

CVE-2021-47492 affects the Linux kernel: mm, thp collapse_file may bail out early for writeback pages when blocksize ≥ pagesize for XFS, because the code filters writeback pages via page_has_private/try_to_release_page instead of explicitly checking PG_writeback. This can cause end_page_writeback...

CVE-2021-47571

The CVE-2021-47571 issue affects the Linux kernel rtl8192e driver in staging. The root cause is a use-after-free in _rtl92e_pci_disconnect() where free_rtllib() frees the dev pointer, and the code reorders operations to avoid using the freed pointer. The vulnerability leads to potential use-after...

CVE-2021-47590

CVE-2021-47590 affects the Linux kernel MPTCP path. The deadlock occurs when __mptcp_push_pending() calls mptcp_flush_join_list() while holding the subflow socket lock, enabling __mptcp_sockopt_sync() to lock the subflow socket. The fix uses __mptcp_flush_join_list() (not plain mptcp_flush_join_l...

CVE-2021-47634

CVE-2021-47634 affects the Linux kernel ubi subsystem where a race condition can occur between ctrl_cdev_ioctl and ubi_cdev_ioctl, leading to a use-after-free reported by KASAN. The issue arises because device creation is made available before it’s safely accessible via sysfs, allowing concurrent...

CVE-2022-3910

CVE-2022-3910 is a Local Use-After-Free in the Linux kernel’s io_uring path. The root cause is an improper update of the reference count when io_msg_ring is invoked with a fixed file, causing a use-after-free and local privilege escalation. The issue arises because fixed files are permanently reg...

CVE-2022-48697

In CVE-2022-48697, Linux kernel nvmet/nvme contains a use-after-free in blk_mq_complete_request_remote that is triggered in the nvmet path during IO handling, as detailed by the fixed commit in the kernel (nvmet: fix a use-after-free) with the related call trace and KASAN exposure. The issue was ...

CVE-2022-48840

CVE-2022-48840: Linux kernel iavf hang on reboot/shutdown due to a new wait-loop in iavf_remove() that could loop indefinitely when adapter is already removed during shutdown. The fix adds a state check at the start of iavf_remove() and skips rest of the function if the adapter is in __IAVF_REMOV...

CVE-2022-48971

CVE-2022-48971 describes a Linux kernel Bluetooth initialization issue: if bt_init fails after registering an LED via bt_leds_init(), bt_leds_cleanup() may not run, potentially allowing a freed bluetooth-power text to be accessed by later led_trigger_register() calls. The result can be a kernel p...

CVE-2022-48973

CVE-2022-48973 is a Linux kernel vulnerability in the gpio/amd8111 path related to a reference-count leak for PCI devices. The issue arises because for_each_pci_dev() is implemented via pci_get_device(), which increments the reference count for the returned pci_dev but may not decrement the input...

CVE-2022-48981

CVE-2022-48981 is a Linux kernel vulnerability related to DRM SHMEM: the error-path handling in drm/shmem-helper and the ownership of references in drm_gem_shmem_mmap() can cause a use-after-free of a GEM object. The root cause is that drm_gem_shmem_mmap() does not own a reference, potentially fr...

CVE-2022-48985

CVE-2022-48985 (Linux kernel) : A race on per-CQ variable napi_work_done in net: mana can allow a concurrent thread to race with napi_complete_done(), potentially clearing NAPIF_STATE_SCHED and corrupting cq->work_done, leading to memory corruption and panic. The fix saves the per-CQ work_done...

CVE-2022-49354

CVE-2022-49354 is a Linux kernel issue where a refcount leak in octeon_pata_OCTEON code was fixed. The vulnerability stems from refcount handling in pata_octeon_cf during octeon_cf_probe and in the usage of of_find_device_by_node() which took a reference but was not released with put_device(). Th...

CVE-2022-49443

CVE-2022-49443 relates to a data race in Linux kernel epoll during epoll_wait, caused by lockless access to ep->rdllist via ep_events_available and list handling. The issue manifests as a KCSAN-detected race between ep_start_scan/ep_send_events and do_epoll_wait, potentially affecting availabi...

CVE-2022-49453

Summary (CVE-2022-49453) : In the Linux kernel, the TI SoC power-domain driver (soc: ti: ti_sci_pm_domains) might dereference a NULL pointer if devm_kcalloc returns NULL. The recommended fix is to check the allocation result and return -ENOMEM, mirroring the handling in earlier code paths. The is...

CVE-2022-49467

CVE-2022-49467 is a Linux kernel issue: a memory‑leak in the DRM MSM driver during mdp5_crtc_cursor_set() caused by incorrect handling in drm_gem_object_lookup/drm_gem_object_get and cursor_bo when msm_gem_get_and_pin_iova fails. Affected components/impact are within the kernel’s DRM subsystem (d...

CVE-2022-49476

CVE-2022-49476 concerns the Linux kernel issue where mt76/mt7921 kept calling mt7921_irq_handler during devm_free_irq, risking a NULL pointer dereference in mt7921_pci_remove. The provided logs show a kernel crash (NULL pointer dereference) during device removal. The associated fix postpones free...

CVE-2022-49478

CVE-2022-49478 affects the Linux kernel via the media: pvrusb2 driver, specifically a faulty check in pvr2_i2c_core_init that permits an array index of -1 to be used. The issue arises when hdw->unit_number is initialized to -1 and may remain unchanged if the init-table walk fails, leading to o...

CVE-2022-49516

CVE-2022-49516 affects the Linux kernel: the ice network driver could dereference a VSI pointer returned by ice_get_vf_vsi without validating it, which could be NULL in scenarios such as resets when a VSI is removed and recreated. The published fix is to check the return value of ice_get_vf_vsi e...

CVE-2022-49526

CVE-2022-49526 - Linux kernel md/bitmap issue : In clustered MD (md-cluster) setups, the code path md_bitmap_read_sb can permit a faulty bitmap to pass sanity checks, allowing the chunksize to be assigned even when the bitmap data is invalid. This leads to a division error (DIV_ROUND_UP_SECTOR_T)...

CVE-2022-49658

CVE-2022-49658 concerns the Linux kernel’s BPF bounds propagation. The issue stems from insufficient propagation of tnum min/max bounds into register bounds during operations like adjust_scalar_min_max_vals, allowing a register that becomes a constant-like value to leak pointers when it is later ...

CVE-2022-49720

The CVE-2022-49720 entry is valid and supported by multiple connected advisories. The vulnerability resides in the Linux kernel block layer, specifically in blk_mq_alloc_request_hctx, where offline-queue handling could trigger a UBSAN array-index-out-of-bounds condition (index 512 out of 512 elem...

CVE-2022-49751

CVE-2022-49751 corresponds to a Linux kernel issue where, during removal of the ds2482 driver, a warning is produced: do not call blocking ops when !TASK_RUNNING; state=1 in w1_process(). The fix involves altering w1_process() so that when the loop breaks, the task state is set to TASK_RUNNING to...

CVE-2022-50035

CVE-2022-50035 affects the Linux kernel DRM AMDGPU path. The issue is a use-after-free in amdgpu_bo_list mutex handling caused by double-unlocking of bo_list_mutex when amdgpu_cs_vm_handling returns non-zero, which can lead to a refcount underflow (as shown in the trace). The vulnerability is dem...

CVE-2022-50068

CVE-2022-50068 affects the Linux kernel DRM TTM path (drm/ttm). The issue is a null pointer dereference in ttm_bo_validate during and after bo initialization, triggered by inspecting a NULL bo->resource in mem_type handling, potentially causing a kernel crash (general protection fault) and a l...

CVE-2022-50212

CVE-2022-50212 affects the Linux kernel netfilter nf_tables subsystem. The vulnerability arises when looking up chains by ID without ensuring the chain belongs to the same table; a chain from another table can be linked in, and removing the source table can leave a rule connected to the wrong cha...

CVE-2023-1032

The CVE-2023-1032 issue is a Linux kernel IO_URING IORING_OP_SOCKET double-free in __sys_socket_file() within net/socket.c. It was introduced by commit da214a475f8bd1d3e9e7a19ddfeb4d1617551bab and fixed by commit 649c15c7691e9b13cbe9bf6c65c365350e056067. The connected document set provides concre...

CVE-2023-52503

CVE-2023-52503: Linux kernel vulnerability in amdtee_close_session allows a local race causing use-after-free in amdtee_open_session due to non-atomic session destruction. The fix makes the decrement of sess->refcount and removal of sess from the session list an atomic/critical section in dest...

CVE-2023-52783

CVE-2023-52783 affects the Linux kernel and fixes a local kernel-panic scenario in the net/wangxun path. When a device uses a custom subsystem vendor ID, wx_sw_init() may return before wx->mac_table is allocated, causing a NULL pointer dereference and a kernel panic. The connected documents co...

CVE-2023-52801

CVE-2023-52801 concerns the Linux kernel iommufd code. In iopt_area_split(), if the original iopt_area had filled a domain and is linked to domains_itree, pages_nodes must be reintegrated; otherwise domains_itree becomes corrupted and leads to use-after-free. The vulnerability is resolved by ensu...

CVE-2023-53057

The CVE-2023-53057 entry corresponds to a Linux kernel Bluetooth HCI global-out-of-bounds bug. The issue arises in hci_init_stage_sync() looping a variable-length array, where amp_init1[] and amp_init2[] lacked an intentionally invalid final element, enabling out-of-bounds reads during hci_dev_op...

CVE-2023-6200

The CVE describes a race condition in the Linux kernel that allows an unauthenticated attacker on an adjacent network to send ICMPv6 router advertisement packets to achieve arbitrary code execution. The impact is documented as high (C/H/I/A) with an adjacent network location and no user interacti...

CVE-2024-26798

CVE-2024-26798 : Linux kernel fbcon font restore regression fix. The commit a5a923038d70 initially restored old font data on vc_resize() failure but only for user fonts; system/internal fonts were left unreverted, causing a subsequent fbcon_do_set_font() to fail restoration and potentially crash ...

CVE-2024-26824

CVE-2024-26824: In the Linux kernel, the crypto/algif_hash zero-length error path incorrectly freed an SG list that was never allocated when hashing a zero-length message. The fix is to avoid freeing the SG list on the zero-length error path. Connected data (NVD entry and Nessus/UNPATCHED_CVE_202...

CVE-2024-26832

CVE-2024-26832 affects the Linux kernel mm: zswap writeback path. The fix unlocks and releases the folio obtained from __read_swap_cache_async() before returning, preventing a potential folio from being stranded. Connected advisories confirm a patch in kernel releases (e.g., Linux kernel 6.1.82 i...

CVE-2024-35970

The CVE-2024-35970 issue affects the Linux kernel AF_UNIX socket path. The root cause is improper handling of OOB data: when an OOB skb is dequeued, unix_sock(sk)->oob_skb is not cleared, causing incorrect uAPI state and potential deadlocks. Repro shows a socketpair exchange where MSG_OOB is u...

CVE-2024-35977

CVE-2024-35977 : In the Linux kernel, a race in cros_ec_uart caused a NULL pointer dereference in serdev handling when devm_serdev_device_open() was called before serdev->ops were set. The crash path involves the code path that dereferences serdev->ops->receive_buf if serdev is present b...

CVE-2024-36032

CVE-2024-36032 relates to the Linux kernel Bluetooth QCA driver: a fix for an info leak when fetching the fw build ID. The patch adds missing sanity checks and moves the 255-byte build-id buffer off the stack to prevent leaking stack data through debugfs if the build-info reply is malformed. Astr...

CVE-2024-36951

Mode C: CVE-2024-36951 affects the Linux kernel via the DRM/AMDKFD path. The root cause is a CP interrupt bug that can raise bad packet garbage exception codes; the fix performs a range check to ensure the debugger and runtime do not receive garbage codes. The update also guards exception code ty...

CVE-2024-38562

CVE-2024-38562 affects the Linux kernel wifi nl80211 implementation. The vulnerability arises from improper address calculations after memory allocation for the channels array: before using request->channels[], request->n_channels must be set, and address computations for memory after the c...

CVE-2024-38593

CVE-2024-38593 affects the Linux kernel’s net: micrel: lan8841 timestamp handling. Description: the issue occurred when a port was brought up and then down, because the code started using the ptp workqueue to fetch the second timestamp part. If NETWORK_PHY_TIMESTAMPING is disabled, the ptp_clock ...

CVE-2024-40999

CVE-2024-40999 affects the Linux kernel ENA driver. The vulnerability stems from insufficient validation of completion descriptors in multi-buffer packets: the "first" flag must only appear on the first descriptor. An invalid descriptor can trigger a reset, and a new RX data corruption reset reas...

CVE-2024-41028

CVE-2024-41028 affects the Linux kernel (platform/x86) where the Toshiba ACPI quirk list lacked a terminating entry, causing an array out-of-bounds access during processing. The issue’s root cause is the missing terminating empty entry; remediation is to add the terminating entry. The CVSSv3.1 im...

CVE-2024-42121

CVE-2024-42121 is a Linux kernel vulnerability affecting the DRM/AMD display path. The issue arises from how msg_id is used as an array index and can be negative (not equal to MOD_HDCP_MESSAGE_ID_INVALID, -1). The root cause is missing validation of msg_id before read/write operations, leading to...

CVE-2024-42140

The CVE-2024-42140 issue affects the Linux kernel following kexec crash handling on riscv. The root cause is a deadlock when kexec crash code runs in interrupt context, caused by acquiring the irqdesc spinlock and deactivating irqchip in irq_set_irqchip_state(). The fix removes the unnecessary ir...

CVE-2024-46672

The CVE-2024-46672 issue affects the Linux kernel component related to wifi/brcmfmac and cfg80211_pmksa handling. Exploitation involves SSID-based PMKSA deletion; vulnerable code dereferences NULL bssid/pmkid pointers when processing PMKSA updates and PMKID_V3 operations that include SSID updates...

CVE-2024-46697

CVE-2024-46697 is a Linux kernel issue in nfsd where nfsd4_fattr_args.context could contain uninitialized data if control flow used a goto out before the security label check. The fix initializes context early to prevent freeing junk on the stack when nfsd4_encode_fattr4 takes that path. Connecte...