CVE-2013-4350

CVE-2013-4350 affects the Linux kernel IPv6 SCTP code (net/sctp/ipv6.c) up to version 3.11.1. The vulnerability arises because the data structures and function calls fail to trigger an intended IPsec encryption configuration, enabling remote attackers to sniff traffic and obtain sensitive informa...

CVE-2017-13715

The CVE-2017-13715 issue affects the Linux kernel (net/core/flow_dissector.c). The __skb_flow_dissect function can fail to initialize n_proto, ip_proto, and thoff, enabling a remote attacker to trigger a denial of service (system crash) or potentially execute arbitrary code via a crafted MPLS pac...

CVE-2018-12714

The CVE-2018-12714 entry concerns the Linux kernel up to 4.17.2, where filter parsing in kernel/trace/trace_events_filter.c could be invoked with no filter (N=0), causing an N−1 index access. This can lead to a slab out-of-bounds write via crafted perf_event_open and mmap, resulting in denial-of-...

CVE-2021-47039

CVE-2021-47039 entry is rejected and not an active vulnerability entry.

CVE-2021-47090

CVE-2021-47090 affects the Linux kernel memory manager (mm/hwpoison) where MF_COUNT_INCREASED is not cleared before retrying get_any_page, triggering a kernel BUG in release_pages() when MADV_SOFT_OFFLINE is tested. The issue leads to a kernel panic/BUG_ON scenario (VM_BUG_ON_PAGE) during page re...

CVE-2021-47108

Linux kernel vulnerability CVE-2021-47108 affects Mediatek HDMI support (drm/mediatek) where MT8173 can crash due to a NULL mtk_hdmi_conf dereference when a HDMI cable is plugged in. The issue was addressed by adding a NULL pointer check in mtk_hdmi_bridge_mode_valid() (commit 41ca9caaae0b) and p...

CVE-2021-47194

CVE-2021-47194 : Linux kernel vulnerability in cfg80211 where switching from P2P_GO to ADHOC via NL80211_CMD_SET_INTERFACE failed to call cfg80211_stop_ap, allowing in-use data to be re-initialized (e.g., sdata->assigned_chanctx_list) while still in assigned_vifs, corrupting the linked list. D...

CVE-2021-47210

The CVE-2021-47210 issue affects the Linux kernel USB Type-C subsystem (tipd) specifically in tps6598x_block_read. The fix removes a WARN_ON and ensures that calls with length exceeding the allowed maximum return an error instead of triggering a crash under panic-on-warn. This change mitigates lo...

CVE-2021-47301

Summary: CVE-2021-47301 affects the Linux kernel igb/igc driver stack. Root cause: a use-after-free in the reset path where next_to_watch is not cleared while cleaning the TX ring, risking a freed skb being freed again if igb_poll() executes during reset. Impact: potential invalid memory accesses...

CVE-2021-47445

CVE-2021-47445 : In the Linux kernel, the drm/msm driver has a fixed null dereference involving the pointer edp. The initialization path dereferenced edp before checking for null, causing a potential NULL pointer dereference. The update fixes the issue by dereferencing edp only after it has been ...

CVE-2021-47547

CVE-2021-47547 is a Linux kernel vulnerability in the tulip de4x5 driver. The fix prevents an out-of-bounds access of the array lp->phy[8] when the loop ends with k==8, which could occur if all ids in lp->phy[8] are non-zero. The connected Astra Linux bulletin mirrors this kernel issue and ...

CVE-2021-47555

The CVE-2021-47555 issue affects the Linux kernel VLAN real_dev handling. Injecting an error before dev_hold(real_dev) in register_vlan_dev() caused the real_dev refcount to underflow when the dummy netdevice was removed, triggering a refcount warning and an endless unregister_netdevice loop. The...

CVE-2021-47602

CVE-2021-47602 affects the Linux kernel mac80211 QoS admission-control path. The root cause was an uninitialized-value path triggered by non-QoS nullfunc packets, which could access the QoS header. The fix restricts all actions to QoS data packets, preventing misuse from non-QoS traffic. Remediat...

CVE-2022-3110

CVE-2022-3110 affects the Linux kernel (through 5.16-rc6) and is tied to the r8188eu wireless driver. The vulnerability is in _rtw_init_xmit_priv (drivers/staging/r8188eu/core/rtw_xmit.c), where the return value of rtw_alloc_hwxmits() is not checked, which may lead to a NULL pointer dereference. ...

CVE-2022-48792

CVE-2022-48792 - Linux kernel (scsi: pm8001): A use-after-free can occur when a sas_task is aborted by the upper layer before I/O completion is handled in mpi_ssp_completion() or mpi_sata_completion(). The two steps (inform upper layer with complete() and release resources in pm8001_ccb_task_free...

CVE-2022-48904

CVE-2022-48904 (Linux kernel, IOMMU/AMD) : Fix for an I/O page table memory leak in the IOMMU when launching VMs with PCIe pass-through. Root cause: memory is freed after updating the I/O page table mode, causing leakage. Resolution: free the page-table memory before updating the mode. CVSSv3.1 b...

CVE-2022-48948

CVE-2022-48948 concerns a Linux kernel vulnerability in the USB gadget UVC setup handler. The issue arises when a control transfer request carries up to 64 bytes (UVC_MAX_REQUEST_SIZE) while the data stage for OUT transfers copies bytes into a 60-byte uvc_event->data.data buffer, enabling a po...

CVE-2022-48968

CVE-2022-48968: In the Linux kernel, octeontx2-pf had a memory leak in otx2_init_tc() where tc_entries_bitmap allocated by otx2_tc_alloc_ent_bitmap() was not freed on rhashtable_init() failure. This is a local-access vulnerability with a potential denial of service impact due to memory exhaustion...

CVE-2022-49032

CVE-2022-49032 is a Linux kernel vulnerability in the IIO health afe4404 driver where an oob read occurs in afe4404_read_raw/afe4404_write_raw due to inadequate bounds checks on channel arrays (afe4404_channel_leds and afe4404_channel_offdacs). The bug lets an out-of-bounds read of size 4 be trig...

CVE-2022-49044

CVE-2022-49044 affects the Linux kernel dm‑integrity driver. When tag_size is smaller than the digest size, a portion of the digest is written beyond the end of ic->recalc_tags, corrupting memory in integrity_recalc->integrity_sector_checksum->crypto_shash_final. The fix increases the ta...

CVE-2022-49059

The CVE-2022-49059 issue is a Linux kernel vulnerability in NFC/NCI where a race between a delayed mechanism (timer) and a workqueue can lead to a use-after-free when detaching an NCI device. The fix added flush_workqueue to prevent this UAF by ensuring the timer/workqueue lifecycle cannot race w...

CVE-2022-49110

CVE-2022-49110 relates to the Linux kernel netfilter conntrack autotuning change. The vulnerability stems from the gc logic that evicts entries; after the commit 4608fdfc07e1, conntrack gc runs every 2 minutes and, on large hash tables, evictions shift from the packet path to the gc worker, poten...

CVE-2022-49115

CVE-2022-49115 is a Linux kernel vulnerability in the PCI: endpoint subsystem where a misused goto label could lead to a memory leak. The description across connected advisories reiterates the same root cause and states that a fix was applied in the kernel (commit history referenced in the linked...

CVE-2022-49154

The CVE-2022-49154 entry is validated by connected advisories describing a Linux kernel KVM SVM issue: an out-of-bounds guest IRQ in svm_update_pi_irte() could crash when guest_irq comes via KVM_IRQFD. The root cause is an out-of-bounds access that could trigger a crash; the mitigation is a kerne...

CVE-2022-49203

CVE-2022-49203 affects the Linux kernel DRM AMD display path. The issue occurs during GPU reset in the DC/DM bridge, where backing up and then clearing link encoder assignments can lead to a double free of a stream reference, potentially causing a NULL pointer dereference. The root cause is the t...

CVE-2022-49209

CVE-2022-49209 concerns a memleak in the Linux kernel related to bpf/sockmap path when sk_msg_alloc() returns -ENOMEM during tcp_bpf_sendmsg and related paths (e.g., tls_sw_sendmsg). The root cause is partial memory allocation (msg_tx->sg.size > osize) leaving allocated memory unreleased if...

CVE-2022-49481

The CVE-2022-49481 entry details a Linux kernel regulator issue: pfuze100 refcount leak in pfuze_parse_regulators_dt caused by of_node_get() returning a node with an incremented refcount. The fix adds a drop of the reference via of_node_put() when the node is no longer needed. There is no public ...

CVE-2022-49523

CVE-2022-49523 affects the Linux kernel component ath11k, specifically the spectral scan path during spectral_deinit. The issue arises when ath11k modules are removed (rmmod) with spectral scan enabled, which can trigger a crash (kernel NULL pointer dereference) as shown by the provided call trac...

CVE-2022-49657

Mode C: CVE-2022-49657 affects the Linux kernel USB networking driver (usbnet). The issue is a memory leak in error paths, specifically usbnet_write_cmd_async() where the buffer(s) to be freed were mixed up, and later a fix for an uninitialized buffer pointer was added. Public references in Nessu...

CVE-2022-49725

Mode C: The CVE-2022-49725 issue affects the Linux kernel i40e driver (VF/PF path) where a race between PF reset and ethtool -t diag_test could let i40e_vsi_close sequence overlap and crash. The fix adds a guard to diag_test to skip offline tests while PF is resetting and logs a failure path (net...

CVE-2022-49790

CVE-2022-49790 concerns a Linux kernel vulnerability in the input driver for iforce. Syzbot reports an uninitialized value in iforce_init_device(), stemming from a length-check bug: the code in 6ac0aec6b0a6 allowed a read because it compared the requested read size against a valid length that cou...

CVE-2022-50227

CVE-2022-50227 affects the Linux kernel (KVM Xen timer) and is resolved by only initializing the Xen timer once. The root cause is that kvm_xen_init_timer() was invoked for every KVM_XEN_VCPU_ATTR_TYPE_TIMER, risking an ODEBUG crash when vcpu->arch.xen.timer is already set. The fix adds a chec...

CVE-2022-50228

CVE-2022-50228 is a Linux kernel vulnerability affecting KVM on x86 with SVM. The issue occurs when userspace can inject an interrupt with GIF=0, which can trigger a kernel BUG (fatal crash) in arch/x86/kvm/svm/svm.c. The provided descriptions explicitly show a kernel BUG at svm_inject_irq and an...

CVE-2023-52879

CVE-2023-52879 describes a Linux kernel vulnerability in tracing, specifically adding ref counters to trace_event_file to prevent use-after-free when a kprobe event is deleted while its tracefs file is still open. The issue can cause a kernel NULL pointer dereference and crash (local privilege no...

CVE-2024-26632

CVE-2024-26632 involves a Linux kernel issue in iterating over an empty bio. The root cause was that bio_first_folio() could call page_folio() on a NULL pointer when a bio contained no data, leading to an oops. The fix relocates the end-of-bio test from bio_next_folio() to bio_first_folio(), and ...

CVE-2024-26705

The CVE-2024-26705 issue affects the Linux kernel parisc BTLB path during CPU bringup with hotplug for 32-bit CPUs. The crash occurred when querying BTLB information from firmware to set up static TLB entries, because the static btlb_info struct required write access but was marked __ro_after_ini...

CVE-2024-35850

CVE-2024-35850 affects the Linux kernel Bluetooth qca driver. Qualcomm ROME controllers registered from the Bluetooth line discipline can have a NULL HCI UART serdev pointer, leading to a NULL-pointer dereference when setup() is invoked for a non-serdev controller. The fix adds a missing sanity c...

CVE-2024-35917

CVE-2024-35917 (Linux kernel, s390/bpf) details from connected Azure Linux Nessus entry show the issue arises from GCC reordering memcpy() after assignments in bpf_jit_plt(), causing NULL pointers to be written instead of the intended return/target addresses. Root cause is GCC alias-analysis misc...

CVE-2024-36024

Summary: CVE-2024-36024 affects the drm/amd/display path in the Linux kernel. It describes a race condition during the DMCUB handshake that can cause a hardware hang by touching INBOX1 RPTR. The documented mitigation is to disable idle reallow as part of command/gpint execution to create a necess...

CVE-2024-36906

CVE-2024-36906: In the Linux kernel for ARM64, KASAN stack-poison was not cleared on exit via cpuidle, causing out-of-bounds reports when returning to the idle path. Root cause: instrumented functions leave stack shadow poisoned as CPUs unwind through idle, and prior context restoration can forge...

CVE-2024-36911

CVE-2024-36911 affects the Linux kernel hv_netvsc driver used in CoCo VMs. The vulnerability stems from the netvsc path freeing decrypted memory when set_memory_decrypted() fails, potentially causing decrypted/shared pages to be returned to the page allocator. The underlying issue is that the cal...

CVE-2024-40899

CVE-2024-40899 is a Linux kernel vulnerability in the cachefiles subsystem, causing a slab-use-after-free in cachefiles_ondemand_get_fd via a restore-triggered path that can lead to use-after-free in cachefiles_ondemand_daemon_read. The connected documents identify the issue as resolved by a patc...

CVE-2024-42103

CVE-2024-42103 applies to the Linux kernel BTRFS subsystem. The issue arises in the reclaim path for block groups: during btrfs_reclaim_bgs_work, a block group removed from the reclaim list can be added in parallel to the unused list, which may then be moved to the reclaim list again and corrupt ...

CVE-2024-42142

CVE-2024-42142 affects the Linux kernel mlx5 E-switch ingress ACL handling. The bug creates an ingress ACL only when vport metadata match and prio tag are enabled, but the active-backup lag feature also requires it, risking a panic when dropping rules if the ACL doesn’t exist. The fix creates the...

CVE-2024-42239

CVE-2024-42239 affects the Linux kernel BPF timer cancellation path. The fix adds an atomic counter (cancelling) in bpf_hrtimer to track in-flight cancellation requests and prevents deadlocks when two callbacks attempt to cancel each other in parallel. The patch ensures that if a cancellation is ...

CVE-2024-42277

CVE-2024-42277 affects the Linux kernel through a NULL dereference in the SPRD IOMMU path. Specifically, in sprd_iommu_cleanup(), before invoking sprd_iommu_hw_en(), dom->sdev may be NULL, leading to a NULL dereference. The connected Astra Linux bulletin confirms the same vulnerability in Linu...

CVE-2024-43825

The CVE-2024-43825 entry concerns a Linux kernel IIO subsystem issue: in iio_gts_build_avail_time_table, the sorting logic can misbehave when a time_us value is zero, potentially causing an out-of-bounds write (example sequence 3, 0, 1) and, if no zero times exist, elements may be copied unsorted...

CVE-2024-43850

CVE-2024-43850 affects the Linux kernel’s Qualcomm icc-bwmon: a refcount imbalance can occur during bwmon_remove, triggering a kernel warning and potentially delaying OPP releases. The OSV and vendor advisories corroborate the issue and describe the fix as a code correction in the bwmon removal p...

CVE-2024-43851

CVE-2024-43851 summary (Linux kernel) The issue affects Linux kernel code for the Xilinx SoC path (soc: xilinx). The root cause is the per-CPU variable cpu_number1 being passed to xlnx_event_handler as the argument dev_id, but not used by that function; a patch renames cpu_number1 to dummy_cpu_nu...

CVE-2024-43852

CVE-2024-43852 refers to a Linux kernel hwmon LTC2991 off-by-one bug in which LTC2991_T_INT_CH_NR is 4 and st->temp_en[] has 4 elements. The vulnerability occurs when channel equals LTC2991_T_INT_CH_NR, reading beyond the end of the array. The fix, described in the description, is to reorder t...