CVE-2021-47407

The CVE-2021-47407 issue is in the Linux kernel's KVM x86 code related to SRCU initialization during page track setup. The root cause is a missing validation of init_srcu_struct()’s return value, which can fail (e.g., due to OOM) and lead to a NULL pointer dereference found by a modified syzkalle...

CVE-2021-47541

CVE-2021-47541 targets the Linux kernel mlx4_en driver. In mlx4_en_try_alloc_resources(), mlx4_en_copy_priv() may free tmp->tx_cq on the error path, and later mlx4_en_alloc_resources() dereferences &tmp->tx_cq[t][i], risking a use-after-free. The fix adds a guard/check around mlx4_en_copy_p...

CVE-2021-47563

In the Linux kernel, the following vulnerability has been resolved: ice: avoid bpf_prog refcount underflow Ice driver has the routines for managing XDP resources that are sharedbetween ndo_bpf op and VSI rebuild flow. The latter takes place forexample when user changes queue count on an interface...

CVE-2021-47590

CVE-2021-47590 affects the Linux kernel MPTCP path. The deadlock occurs when __mptcp_push_pending() calls mptcp_flush_join_list() while holding the subflow socket lock, enabling __mptcp_sockopt_sync() to lock the subflow socket. The fix uses __mptcp_flush_join_list() (not plain mptcp_flush_join_l...

CVE-2021-47631

CVE-2021-47631 affects the Linux kernel (ARM: da850-evm path) where a NULL pointer dereference could occur in da850_evm_config_emac() during boot on palmetto-bmc/QEMU setups. The root cause is emac_pdata being NULL because davinci_soc_info is populated only on Davinci machines, while the function...

CVE-2021-47644

CVE-2021-47644 affects the Linux kernel where the “media: staging: media: zoran” code path was updated to move videodev allocation out of zr36057_init() and create new handling functions for zr->video_dev. The change fixes a memory leak in zr->video_dev and improves code readability. The vu...

CVE-2022-48631

The CVE-2022-48631 issue affects the Linux kernel’s ext4 extents parsing. Specifically, ext4_ext_binsearch_idx() could operate on an extent header with eh_depth > 0 when eh_entries is 0, leading to garbage indices and kernel crash (BUG at fs/ext4/extents.c:2258) observed in the provided traces...

CVE-2022-48799

CVE-2022-48799 corresponds to a Linux kernel perf subsystem issue: list corruption in perf_cgroup_switch() affecting the cgrp_cpuctx_list during event removal. The root cause is a risky iteration over a list while removing entries; the recommended fix is to replace list_for_each_entry with list_f...

CVE-2022-48842

CVE-2022-48842 describes a race in the Linux kernel ice driver during interface enslave (bonding). The vulnerability occurs when an auxiliary device is re-created: ice_plug_aux_dev() is invoked from ice_service_task() context, potentially creating an aux device while another thread holds RTNL loc...

CVE-2022-48977

The CVE-2022-48977 vulnerability affects the Linux kernel CAN subsystem. It fixes a NULL pointer dereference in can_rcv_filter, triggered by missing initialization of ml_priv in the receive path for CAN frames. The issue arises because dev->type may be ARPHRD_CAN in CAN-capable devices, but so...

CVE-2022-48985

CVE-2022-48985 : Linux kernel net: mana driver race on per-CQ variable napi_work_done. After napi_complete_done(), NAPI_F_STATE_SCHED may be cleared, letting another CPU run a napi thread and access cq->work_done; if that thread sets it to >= budget, it may continue to run and cause memory ...

CVE-2022-49139

CVE-2022-49139 affects the Linux kernel Bluetooth stack. The issue occurs in the HCI handling path: upon receiving a HCI_Synchronous_Connection_Complete for a BDADDR of an existing LE connection, with LE link type and a status triggering the second packet-processing case, a NULL pointer dereferen...

CVE-2022-49219

CVE-2022-49219 concerns a memory-leak in the Linux kernel VFIO PCI driver during D3hot↔D0 transitions. If vfio_pci_core_device::needs_pm_restore is set, the current PCI state is saved in pm_save on D0→D3hot and would be restored on D3hot→D0. The code uses pci_store_saved_state() to save state and...

CVE-2022-49247

CVE-2022-49247 – Linux kernel media stk1160 issue : The vulnerability concerns the stk1160 driver in the Linux kernel’s videobuf2 path. When start_streaming fails, the driver previously returned all queued buffers with VB2_BUF_STATE_ERROR, but it should have returned them with VB2_BUF_STATE_QUEUE...

CVE-2022-49368

CVE-2022-49368 relates to a Linux kernel out-of-bounds read in net: ethernet: mtk_eth_soc, triggered by an invalid fsp->location that comes from user via ethtool_get_rxnfc(). The vulnerability is fixed by validating the location parameter to prevent the read, with upstream kernel patches refer...

CVE-2022-49443

CVE-2022-49443 relates to a data race in Linux kernel epoll during epoll_wait, caused by lockless access to ep->rdllist via ep_events_available and list handling. The issue manifests as a KCSAN-detected race between ep_start_scan/ep_send_events and do_epoll_wait, potentially affecting availabi...

CVE-2022-49447

CVE-2022-49447 concerns the Linux kernel on ARM/HiSilicon where of_find_compatible_node increments the device_node refcount but no corresponding of_node_put was invoked, causing a refcount leak. The fix removes the leak by adding of_node_put after of_find_compatible_node. Affected software is the...

CVE-2022-49476

CVE-2022-49476 concerns the Linux kernel issue where mt76/mt7921 kept calling mt7921_irq_handler during devm_free_irq, risking a NULL pointer dereference in mt7921_pci_remove. The provided logs show a kernel crash (NULL pointer dereference) during device removal. The associated fix postpones free...

CVE-2022-49482

In the Linux kernel, CVE-2022-49482 concerns the ASoC: mxs-saif driver. The root cause is a refcount leak where of_parse_phandle() returns a node pointer with an incremented refcount that is not released unless a corresponding of_node_put() is invoked when done. The documented fix is to call of_n...

CVE-2022-49623

CVE-2022-49623 : In the Linux kernel, the powerpc/xive/spapr path allocated a bitmap using bits units instead of the required long-sized units, causing a KASAN slab-out-of-bounds access on the 8-byte bitmap. The stack trace shows the access occurs during CPU setup for SMP, with the fault tied to ...

CVE-2022-49740

CVE-2022-49740 concerns the Linux kernel brcmfmac driver. The vulnerability arises when the device-provided channel spec count exceeds the allocated list length in brcmf_construct_chaninfo() and brcmf_enable_bw40_2g(), causing slab-out-of-bounds reads. The patch adds bounds checks so these functi...

CVE-2022-49773

CVE-2022-49773 affects the Linux kernel (drm/amd/display for DCN314). Root cause: optc2_configure_crc() wraps optc1_configure_crc() plus extra registers not applicable to dcN314, which can trigger a warning trace. Mitigation/Fix: use optc1_configure_crc() directly. References note patches in kern...

CVE-2022-49977

Summary (CVE-2022-49977): The Linux kernel vulnerability arises from ftrace registration handling when ftrace_startup_enable fails. If disabled and not rolled back, an op may remain in ftrace_ops_list, leading to a NULL dereference in is_ftrace_trampoline via ftrace_ops_trampoline. The concrete f...

CVE-2023-52694

CVE-2023-52694 relates to the Linux kernel drm/bridge tpd12s015 driver. The issue arises from marking tpd12s015_remove() with __exit, which causes the function to be discarded when the driver is built-in; on unbind, cleanup may be skipped, leading to resource leakage. The vulnerability was resolv...

CVE-2023-52801

In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix missing update of domains_itree after splitting iopt_area In iopt_area_split(), if the original iopt_area has filled a domain and islinked to domains_itree, pages_nodes have to be properlyreinserted. Otherwise the do...

CVE-2023-52856

CVE-2023-52856 relates to the Linux kernel drm/bridge lt8912b path. The lt8912b driver’s lt8912_bridge_detach() called drm_connector_unregister() and drm_connector_cleanup(), but these are only for connectors registered via drm_connector_register(); the driver’s destroy hook is drm_connector_clea...

CVE-2023-52865

CVE-2023-52865 affects the Linux kernel clk-mt6797 clock-data path. The vulnerability arises from not validating the return value of mtk_alloc_clk_data(), which could lead to a NULL pointer dereference. The fix adds a check for the return value to prevent NULL dereference and stabilize clock data...

CVE-2023-52879

The CVE-2023-52879 issue concerns the Linux kernel tracing subsystem, specifically the trace_event_file object used for tracefs events. A use-after-free can occur when a kprobe event is deleted while a user-space process still holds an opened “enable” file descriptor for that event, because the u...

CVE-2023-53085

The CVE-2023-53085 issue affects the Linux kernel, specifically the drm/edid path. The root cause is a data leak: on EDID fetch errors that leave the transfer buffer unchanged, slab data can be leaked to logs. The fix clears the transfer buffer before fetching the EDID to prevent leaking informat...

CVE-2024-26652

In the Linux kernel, the following vulnerability has been resolved: net: pds_core: Fix possible double free in error handling path When auxiliary_device_add() returns error and then callsauxiliary_device_uninit(), Callback function pdsc_auxbus_dev_releasecalls kfree(padev) to free memory. We shou...

CVE-2024-26667

CVE-2024-26667 affects the Linux kernel DRM MSM DPU path: the vulnerability stems from dereferencing hw_pp in dpu_encoder_helper_phys_cleanup assuming validity. The fix adds a validity check for hw_pp before use, aligning with the commit 8b45a26f2ba9 and related patchwork note. Patch details show...

CVE-2024-26745

The Linux kernel contains a vulnerability in the powerpc/pseries/iommu component where the IOMMU table is not properly initialized for kdump over SR-IOV . When the kdump kernel attempts to copy dump data using SR-IOV, it encounters a NULL pointer dereference in iommu_area_alloc() because the newl...

CVE-2024-26784

Mode C: Normal CVE-2024-26784 details confirmed. Affected software: Linux kernel (ARM) scmi_perf_domain driver. Issue: NULL dereference during module removal when the device-tree entry '#power-domain-cells' is missing, causing probe to bail early but remove() to run with uninitialized state. Root...

CVE-2024-35879

CVE-2024-35879 affects the Linux kernel. The issue arises from a race between devlink removals and destruction of OF nodes during the sequence 1) of_platform_depopulate() and 2) of_overlay_remove(). During step 1, devices and attached of_node are destroyed asynchronously via a workqueue, which co...

CVE-2024-35903

The CVE-2024-35903 entry: In the Linux kernel, x86/bpf: Fix IP after emitting call depth accounting. The issue adjusts the IP passed to emit_patch to compute the correct offset for a CALL when x86_call_depth_emit_accounting emits code; without this, instructions may be skipped and the system coul...

CVE-2024-35926

CVE-2024-35926 : In the Linux kernel, the crypto IA A group fixes an async_disable descriptor leak in the iaa_compress/decompress paths. The root cause was that disable_async paths did not free idxd descriptors, leaking resources in tests where req->dst is null. A patch adds a proper free, res...

CVE-2024-37354

CVE-2024-37354 : In the Linux kernel, the vulnerability is described as a crash in the Btrfs file system caused by a race between fsync and size-extending writes into preallocated extents. The crash manifests as a BUG in btrfs_set_item_key_safe, triggered by overlapping preallocated extents (e.g....

CVE-2024-40936

CVE-2024-40936 (Linux kernel) : A patch fixes memregion leaks in cxl/region by moving mode verification to __create_region() before allocating the memregion in devm_cxl_add_region(). This prevents leaks of memregion objects during region creation. Connected sources ( MiracleLinux AXSA advisory ) ...

CVE-2024-41051

CVE-2024-41051 affects the Linux kernel cachefiles subsystem. When queuing ondemand_object_worker() to reopen an object, cachefiles_object may be freed if the related erofs is unmounted, causing a use-after-free if ondemand_object_worker() runs after object free. The fix requires canceling or wai...

CVE-2024-42113

CVE-2024-42113 affects the Linux kernel: net: txgbe: initialize num_q_vectors for MSI/INTx interrupts. When MSI/INTx are used, wx->num_q_vectors remains uninitialized, causing a kernel panic in wx_alloc_q_vectors() when allocating queue vectors. The description confirms the issue is resolved i...

CVE-2024-42127

CVE-2024-42127 affects the Linux kernel driver for Lima (drm/lima) which uses a shared IRQ. The root cause is that during driver removal, clocks are disabled early while interrupts remain registered due to devm-based management, allowing interrupt handlers to run and access device registers with ...

CVE-2024-42155

The CVE-2024-42155 issue affects the Linux kernel on s390 architectures, where the k ey material of protected- or secure-keys should not be visible to the caller. The vulnerability notes that all copies of protected- or secure-keys must be wiped from the stack even if an error occurs. CVSS data p...

CVE-2024-43897

The CVE-2024-43897 entry concerns the Linux kernel net/virtio_net_hdr handling for GSO. The fix tightens csum_start and csum_offset checks in virtio_net_hdr_to_skb for GSO packets, ensuring that a checksum requested via VIRTIO_NET_HDR_F_NEEDS_CSUM is valid in the skb after segmentation. The patch...

CVE-2024-46672

The CVE-2024-46672 issue affects the Linux kernel component related to wifi/brcmfmac and cfg80211_pmksa handling. Exploitation involves SSID-based PMKSA deletion; vulnerable code dereferences NULL bssid/pmkid pointers when processing PMKSA updates and PMKID_V3 operations that include SSID updates...

CVE-2024-46710

CVE-2024-46710 : In the Linux kernel, the drm/vmwgfx component fixed a race where maps used for reading cursor buffers could be unmapped while still active, causing bogus read contents. The fix adds a reference-counted mechanism to track active maps and only unmaps when the count reaches zero, pr...

CVE-2024-46788

The CVE-2024-46788 entry concerns a Linux kernel issue in tracing/osnoise: start_kthread() and stop_thread() were not always called with interface_lock held, enabling kthread_stop() to be invoked on a kernel thread (kthread) that should not be stopped, which could trigger OOPS conditions such as ...

CVE-2024-50037

CVE-2024-50037 affects the Linux kernel’s DRM framebuffer path (drm/fbdev-dma). The root cause was that drm_fbdev_dma_fb_destroy() unconditionally invoked fb_deferred_io_cleanup() even when struct fb_info.fbdefio was NULL, leading to a warning trace in an Apple Silicon display driver context. The...

CVE-2024-50227

The CVE-2024-50227 entry concerns the Linux kernel Thunderbolt code, where KASAN reported a stack-out-of-bounds read in tb_retimer_scan(). The issue arises from a loop that increments a counter causing max to become 3 instead of 2, allowing the second loop to read past a stack array. The fix is t...

CVE-2024-53225

The CVE-2024-53225 issue affects the Linux kernel IOMMU/tegra241-cmdqv path. A misconfiguration with PAGE_SIZE=4KB and CMA alignment could cause VM CMDQ alignment tests to fail, triggering a WARN_ON in arm-smmu-v3.c during queue initialization (arm_smmu_init_one_queue). The root cause is an align...

CVE-2024-56561

Technical details about CVE-2024-56561 are not provided in the connected documents. The initial description contains the kernel fix details but no public-facing specifics (affected products, versions, impact, or remediation) beyond that. Monitor for updates.