CVE-2016-2067

CVE-2016-2067 affects the Linux kernel MSM GPU driver: drivers/gpu/msm/kgsl.c in the MSM graphics driver (QuIC Android contributions) for kernel 3.x. The root cause is mishandling of the KGSL_MEMFLAGS_GPUREADONLY flag, which can create accidental read/write mappings. This enables a local attacker...

CVE-2016-2854

CVE-2016-2854 concerns the AUFS module in the Linux kernel (versions 3.x/4.x), which does not properly maintain POSIX ACL xattr data. This can allow a local attacker to gain privileges by exploiting a group-writable setgid directory. The connected documents confirm the vulnerability and its local...

CVE-2017-18202

The CVE-2017-18202 issue affects the Linux kernel prior to 4.14.4, where __oom_reap_task_mm in mm/oom_kill.c mishandles gather operations. This can enable a local attacker to cause a denial of service via a TLB entry leak or use-after-free, potentially with other unspecified impacts by triggering...

CVE-2017-5576

CVE-2017-5576 affects the Linux kernel VideoCore DRM driver (vc4) via vc4_get_bcl in drivers/gpu/drm/vc4/vc4_gem.c. An integer overflow when handling a crafted size in VC4_SUBMIT_CL ioctl can enable a local denial of service or possibly other impact. Present in kernel versions before 4.9.7; patch...

CVE-2017-7277

CVE-2017-7277 affects the Linux kernel TCP stack up to version 4.10.6. It arises from mishandling SCM_TIMESTAMPING_OPT_STATS in net/core/skbuff.c and net/socket.c, enabling local users to read sensitive kernel socket data or cause a denial of service (out-of-bounds read) via crafted syscalls. Ups...

CVE-2018-12931

CVE-2018-12931 affects the Linux kernel ntfs.ko (ntfs_attr_find) in kernel 4.15.0, enabling a stack-based out-of-bounds write that can cause a denial of service (kernel oops/panic) or other unspecified impact via a crafted NTFS filesystem. The vulnerability is confirmed in multiple advisories (e....

CVE-2020-36781

CVE-2020-36781: In the Linux kernel i2c: imx, a reference leak occurs when pm_runtime_get_sync returns (including failure). The leak happens because the PM runtime reference count is incremented on return from pm_runtime_get_sync, but code paths i2c_imx_xfer() and i2c_imx_remove() do not balance ...

CVE-2021-20226

CVE-2021-20226 describes a use-after-free in the Linux kernel io_uring subsystem. The root cause is a failure to validate an object’s existence before operations by not incrementing the file reference counter while in use. This can allow a local attacker with user privileges to trigger a denial o...

CVE-2021-47087

The CVE-2021-47087 entry concerns the Linux kernel: tee: optee fix for an incorrect page free bug. The issue arises when a pointer to an allocated struct page is already advanced near the end of allocation, making __free_pages(page, order) unsafe if the pointer isn’t reset. The documented fix sto...

CVE-2021-47149

The CVE-2021-47149 entry concerns a Linux kernel vulnerability in the Fujitsu net driver where fmvj18x_get_hwinfo() dereferences NULL if ioremap fails. The fix adds a check on the ioremap return value and returns -1 to the caller on failure, preventing a NULL pointer dereference. Public details i...

CVE-2021-47179

In the Linux kernel, the following vulnerability has been resolved: NFSv4: Fix a NULL pointer dereference in pnfs_mark_matching_lsegs_return() Commit de144ff4234f changes _pnfs_return_layout() to callpnfs_mark_matching_lsegs_return() passing NULL as the structpnfs_layout_range argument. Unfortuna...

CVE-2021-47280

CVE-2021-47280 is a Linux kernel vulnerability affecting drm_getunique() in the DRM subsystem. A time-of-check-to-time-of-use (TOCTOU) error occurs by reading file_priv->master before acquiring the device master mutex, allowing a master pointer to be used after the original object may have bee...

CVE-2021-47323

CVE-2021-47323 affects the Linux kernel watchdog driver sc520_wdt: use-after-free can occur if timer removal uses del_timer() during device removal. The issue is addressed by replacing del_timer() with del_timer_sync() to ensure the timer handler finishes before teardown, preventing potential use...

CVE-2021-47346

The CVE-2021-47346 entry concerns a Linux kernel vulnerability in coresight’s tmc-etf path. A global-out-of-bounds read (KASAN) occurred in tmc_update_etf_buffer() due to reading barrier_pkt beyond its allocated size after barrier_pkt trailing null removal in a prior patch. The issue is triggered...

CVE-2021-47358

CVE-2021-47358 concerns the Linux kernel staging/greybus uart use-after-free vulnerability. The root cause is improper lifetime management of greybus tty state after disconnect, allowing user-space processes to hold an open tty indefinitely and for tty drivers to release underlying structures whi...

CVE-2021-47374

In the Linux kernel, the following vulnerability has been resolved: dma-debug: prevent an error message from causing runtime problems For some drivers, that use the DMA API. This error message can be reachedseveral millions of times per second, causing spam to the kernel's printkbuffer and bringi...

CVE-2021-47401

In the Linux kernel, the following vulnerability has been resolved: ipack: ipoctal: fix stack information leak The tty driver name is used also after registering the driver and mustspecifically not be allocated on the stack to avoid leaking informationto user space (or triggering an oops). Driver...

CVE-2021-47430

CVE-2021-47430 concerns a Linux kernel issue related to SMAP handling on x86. The vulnerability arises in x86/entry where the OS may warn when AC is active in user mode, even if SMAP is disabled or partially disabled, leading to a conditional warning that could fire on machines that support SMAP ...

CVE-2021-47484

CVE-2021-47484 : The Linux kernel fix targets the octeontx2-af driver, addressing a possible null pointer dereference in rvu_debugfs.c and rvu_nix.c. The patch resolves a dereference path that could occur in the affected octeontx2 network/fabric handling. Connected documents confirm a corrected p...

CVE-2021-47550

CVE-2021-47550 corresponds to a memleak in the Linux kernel DRM/AMD amdgpu path. Specifically, amdgpu_get_xgmi_hive may leak if kobject_init_and_add fails and kobject_put is not called. The connected Nessus/OpenVAS advisories reproduce this description and reference kernel-level fixes in the amdg...

CVE-2021-47552

In the Linux kernel, the following vulnerability has been resolved: blk-mq: cancel blk-mq dispatch work in both blk_cleanup_queue and disk_release() For avoiding to slow down queue destroy, we don't callblk_mq_quiesce_queue() in blk_cleanup_queue(), instead of delaying tocancel dispatch work in b...

CVE-2021-47612

CVE-2021-47612 (Linux kernel) — A vulnerability in nf cGenl dump paths can cause a null-pointer dereference and kernel crash when kmalloc in nfc_genl_dump_devices() fails, leading to a segfault in nfc_genl_dump_devices_done and related netlink/worker threads. The issue is fixed in the Linux kerne...

CVE-2021-47641

CVE-2021-47641 (Linux kernel) affects the video fbdev Cirrus driver (cirrusfb) within the kernel’s fbdev subsystem. The issue arises in cirrusfb_check_pixclock when pixclock can be zero, causing a divide by zero that Syzkaller reported. The driver then rounds up pixclock to approximate maxclock, ...

CVE-2021-47652

The CVE-2021-47652 issue affects the Linux kernel driver path video: fbdev: smscufx (ufx_usb_probe). The root cause was a null pointer dereference when fb_alloc_cmap() fails in the probe path because modelist was not initialized yet; the error handling path called fb_destroy_modelist() leading to...

CVE-2021-47653

The CVE-2021-47653 case concerns a Linux kernel media/davinci vpif driver use-after-free on driver unbind. The driver allocates two platform device structures during probe and fails to deregister them on unbind, risking freeing device resources at remove() time. The published fix adds the missing...

CVE-2022-1247

CVE-2022-1247 affects the Linux kernel, specifically the rose driver. The issue is a race condition in rose_connect() where the driver tracks usage with rose_neigh->use. When deleting a rose_route via rose_ioctl(), the driver calls rose_del_node() and only removes neighbours if both their coun...

CVE-2022-3526

CVE-2022-3526 is a Linux kernel issue affecting the macvlan_handle_frame path in drivers/net/macvlan.c (skb). The connected OSV advisory (SUSE-SU-2022:4617-1) confirms a memory-leak vulnerability associated with CVE-2022-3526 and lists it among the fixed issues in kernel updates for SUSE Linux En...

CVE-2022-48634

Summary of CVE-2022-48634 (Linux kernel) : Affects the gma500/GPU path in the Linux kernel. The fault was that gma_crtc_page_flip() held the event_lock spinlock while calling crtc_funcs->mode_set_base(), which takes ww_mutex, creating a sleeping context in an invalid path. The unlock should oc...

CVE-2022-48791

The CVE-2022-48791 issue in the Linux kernel relates to scsi: pm8001 use-after-free for aborted TMF sas_task. The problem occurs when a TMF sas_task is aborted due to a timeout and the task is freed in pm8001_exec_internal_tmf_task() while IO completion occurs later. The IO completion may still t...

CVE-2022-48858

CVE-2022-48858 - Linux kernel mlx5 race (net/mlx5): The vulnerability results from a race on command flush, causing a refcount use-after-free when a command is freed while another process may still access it. The root cause is improper synchronization around command entry refcount, leading to a p...

CVE-2022-49003

In the Linux kernel, the following vulnerability has been resolved: nvme: fix SRCU protection of nvme_ns_head list Walking the nvme_ns_head siblings list is protected by the head's srcuin nvme_ns_head_submit_bio() but not nvme_mpath_revalidate_paths().Removing namespaces from the list also fails ...

CVE-2022-49007

CVE-2022-49007 affects the Linux kernel/NILFS2. A NULL pointer dereference in nilfs_palloc_commit_free_entry() could occur during DAT metadata handling when a lower-level DAT block’s entry is clobbered during commit, leading to a crash. The fix adds NULL checks in nilfs_dat_commit_free() for req-...

CVE-2022-49020

In CVE-2022-49020, the Linux kernel’s net/9p code has a socket leak: p9_fd_create_tcp() and p9_fd_create_unix() call p9_socket_open(), and if p9_trans_fd creation fails they return an error without releasing the socket. The root cause is failure to sock_release() the socket, which this patch fixe...

CVE-2022-49096

In the Linux kernel, the following vulnerability has been resolved: net: sfc: add missing xdp queue reinitialization After rx/tx ring buffer size is changed, kernel panic occurs whenit acts XDP_TX or XDP_REDIRECT. When tx/rx ring buffer size is changed(ethtool -G), sfc driverreallocates and reini...

CVE-2022-49102

CVE-2022-49102 affects the Linux kernel. The issue, resolved by a patch from habanalabs, fixes a memory leak in the MMU DR finalization path when the host-resident shadow is NULL, which can occur because the DR and HR are not dependent. The patch addresses a copy-paste error and prevents the leak...

CVE-2022-49131

CVE-2022-49131 concerns a Linux kernel kernel-panic in the ath11k driver while unloading/loading modules on some ARM platforms. The root cause is a dereference path leading to an OOPS in napi_by_id during netif_napi_add, which could occur over repeated unload/load cycles. The fixed fix is to call...

CVE-2022-49151

CVE-2022-49151 is a Linux kernel vulnerability in the CAN/USB subsystem (can: mcba_usb) where usb_submit_urb() could warn due to an incorrect endpoint type. Syzbot reported a bogus urb transfer when the pipe’s type did not match the endpoint, prompting a code path change: pipes are now saved in m...

CVE-2022-49196

The CVE-2022-49196 issue affects the Linux kernel (powerpc/pseries) and is a use-after-free in remove_phb_dynamic() where phb may be freed after device_unregister() frees host_bridge, potentially crashing with slub_debug/page_poison. The workaround described is to hold a reference to host_bridge-...

CVE-2022-49258

The CVE-2022-49258 issue is in the Linux kernel crypto/ccree: a use-after-free in cc_cipher_exit() where ctx_p->user.key is freed by kfree_sensitive() but still used on the following line. The fix prevents UAF by moving kfree_sensitive(ctx_p->user.key) after dev_dbg(), effectively ensuring ...

CVE-2022-49284

The CVE-2022-49284 entry affects the Linux kernel coresight subsystem (syscfg: cscfg_create_device). The issue is a memory leak on registration failure caused by improper error handling in device_register() after device_initialize(); the recommended fix is to use put_device() to relinquish the re...

CVE-2022-49320

The CVE-2022-49320 entry concerns the Linux kernel dmaengine for ZynqMP DMA. The root cause is an overflow risk in zynqmp_dma_alloc/free_chan_resources where 32-bit operands are used in size calculations (2 * chan->desc_size * ZYNQMP_DMA_NUM_DESCS). The fix changes the desc_size data type to s...

CVE-2022-49367

Summary (CVE-2022-49367) In the Linux kernel, the mv88e6xxx DSA MDIO registration path contains a refcount leak. The function of_get_child_by_name() returns a node pointer with an incremented refcount, but of_node_put() is not called when finished, leaking references. mv88e6xxx_mdio_register() fo...

CVE-2022-49420

CVE-2022-49420 documents a data race in the Linux kernel involving UDP path: UDP sendmsg() reads sk->sk_bound_dev_if while it can be changed by another thread, and UDP wake/receive paths around __ip6_datagram_connect and udpv6_sendmsg. The issue is in net/ipv6/udp.c and related dgram/connect c...

CVE-2022-49482

In the Linux kernel, CVE-2022-49482 concerns the ASoC: mxs-saif driver. The root cause is a refcount leak where of_parse_phandle() returns a node pointer with an incremented refcount that is not released unless a corresponding of_node_put() is invoked when done. The documented fix is to call of_n...

CVE-2022-49544

CVE-2022-49544 affects the Linux kernel IPW2X00 stack. The issue is a potential NULL dereference in libipw_xmit() when crypt and crypt->ops could be null. The fix adds null checks before dereferencing these fields. The vulnerability is local with likely crash/denial impact; exploitation status...

CVE-2022-49581

CVE-2022-49581 : In the Linux kernel, the be2net driver had a buffer overflow in be_get_module_eeprom due to improper handling of buffer length in be_cmd_read_port_transceiver_data. The vulnerable path could copy more data than available when the buffer is smaller than PAGE_DATA_LEN (or twice tha...

CVE-2022-49635

CVE-2022-49635 affects the Linux kernel. The issue is in drm/i915/selftests, where a subtraction overflow can occur when hole_end is small, and addr + 2 * min_alignment can overflow in mock tests. A patch was applied (cherry picked from commit ab3edc679c552a466e4bf0b11af3666008bd65a2) to fix both...

CVE-2022-49648

CVE-2022-49648 – Linux kernel tracing/histograms memory leak fix . The provided documents confirm a memory-leak regression in the tracing/histograms area that occurred after a double-free fix, and that the issue was resolved by reverting the commit described as fixing double free. The description...

CVE-2022-49882

CVE-2022-49882 concerns the Linux kernel KVM gfn_to_pfn_cache handling. The issue arises when the cache is inactive but refreshed without verifying the active flag, potentially leaving a valid but inactive cache and enabling use-after-free scenarios (e.g., dereferencing NULL kernel pointers or mi...

CVE-2022-49936

Summary (CVE-2022-49936) In the Linux kernel, the USB core vulnerable path is “Prevent nested device-reset calls.” The accompanying analysis shows a recursive locking violation in usb-storage when a nested reset occurs during device removal, caused by a reset being invoked while another is in pro...