CVE-2022-49694

The Linux kernel contains a use-after-free vulnerability in the del_gendisk function. The issue occurs because disabling the elevator and freeing the scheduler tags were being performed in disk_release and blk_cleanup_queue, where the q->tag_set might already be dead. To resolve this, the work...

CVE-2021-47260

In CVE-2021-47260, the Linux kernel NFS client had a potential NULL dereference in nfs_get_client(), which callers did not expect and could trigger an Oops. The issue is resolved by returning an error pointer instead of NULL. The description notes this is likely dead code and may not affect many ...

CVE-2021-47320

CVE-2021-47320 is a Linux kernel vulnerability describing an ACL memory leak in the NFS code path. The issue centers on leaked entries in acl memory when creating posix_acl_create() paths, specifically in the NFS routines nfs3_proc_create() and nfs3_proc_mknod() error handling. The connected Ness...

CVE-2021-47362

CVE-2021-47362 affects the Linux kernel’s drm/amd/pm power management code. The vulnerability occurs during DPM initialization when set_power_state reads values from the current state; if current state is not populated, this can lead to a NULL pointer dereference. The ATCS/ACPI path for PCI speed...

CVE-2021-47403

A vulnerability exists in the Linux kernel within the ipack: ipoctal module (specifically the drivers/ipack/devices/ipoctal.c file). The issue is caused by a module reference leak where a reference to the carrier module was taken on every open but only released once when the final reference to th...

CVE-2021-47434

CVE-2021-47434 concerns the Linux kernel xHCI host controller where command ring pointer corruption could occur while aborting a command. The issue arises because the 64-bit CRCR is written in two 32-bit writes; when the upper 32 bits are not updated (they may remain zero) due to the command ring...

CVE-2021-47464

The Linux kernel is affected by a vulnerability in the audit_filter_rules() function within the kernel/auditsc.c module. The root cause is a null-pointer dereference because the system incorrectly assumed the ctx variable could be null. This flaw could allow an attacker to compromise the confiden...

CVE-2021-47485

CVE-2021-47485 affects the Linux kernel InfiniBand driver (IB/qib). The flaw is a buffer overflow in struct qib_user_sdma_pkt fields caused by arithmetic on user-controlled buffers (overflowing addrlimit or bytes_togo), which can lead to kernel memory corruption. The issue has been resolved by ad...

CVE-2021-47493

CVE-2021-47493 affects the Linux kernel OCFS2 subsystem. The issue is a race between ocfs2_test_bg_bit_allocatable() and jbd2_journal_put_journal_head() that can release the journal_head from the buffer_head, when bg_bh->b_private is NULL, leading to a vmcore crash. The described impact in the...

CVE-2022-3238

The CVE-2022-3238 entry describes a double-free in the Linux kernel NTFS3 subsystem triggered when remount and unmount occur concurrently, allowing a local user to crash or potentially escalate privileges. Connected documents confirm the issue is in the kernel NTFS3 code path and that the vulnera...

CVE-2022-48968

CVE-2022-48968: In the Linux kernel, octeontx2-pf had a memory leak in otx2_init_tc() where tc_entries_bitmap allocated by otx2_tc_alloc_ent_bitmap() was not freed on rhashtable_init() failure. This is a local-access vulnerability with a potential denial of service impact due to memory exhaustion...

CVE-2022-48981

CVE-2022-48981 is a Linux kernel vulnerability related to DRM SHMEM: the error-path handling in drm/shmem-helper and the ownership of references in drm_gem_shmem_mmap() can cause a use-after-free of a GEM object. The root cause is that drm_gem_shmem_mmap() does not own a reference, potentially fr...

CVE-2022-49059

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: add flush_workqueue to prevent uaf Our detector found a concurrent use-after-free bug when detaching anNCI device. The main reason for this bug is the unexpected schedulingbetween the used delayed mechanism (timer and w...

CVE-2022-49159

CVE-2022-49159 relates to the Linux kernel driver for QLogic qla2xxx SCSI adapters. The described issue is a race between the timeout handler and the normal completion path that can lead to a NULL pointer dereference when abort handling accesses a freed sp->qpair. The recommended fix, document...

CVE-2022-49209

CVE-2022-49209 concerns a memleak in the Linux kernel related to bpf/sockmap path when sk_msg_alloc() returns -ENOMEM during tcp_bpf_sendmsg and related paths (e.g., tls_sw_sendmsg). The root cause is partial memory allocation (msg_tx->sg.size > osize) leaving allocated memory unreleased if...

CVE-2022-49259

The CVE-2022-49259 item concerns a Linux kernel bug where a kobject (queue) could be deleted before its child kobjects, triggering a kernel WARN. The vulnerability stems from improper deletion order in the sysfs/kobject lifecycle, leading to a possible sysfs group not found warning (e.g., 'sysfs...

CVE-2022-49274

The CVE-2022-49274 entry concerns OCFS2: crash when mounting with quotas enabled due to improper initialization of dqi_gqlock’s dqi_type and dqi_sb during quota initialization. The issue, introduced by commit 6c85c2c72819, is resolved by ensuring global quota information is properly initialized. ...

CVE-2022-49336

The CVE-2022-49336 entry documents a Linux kernel issue in drm/etnaviv where etnaviv_iommu_unmap_gem could unmap a mapping twice if it had already been reaped. The root cause is not checking for a reaped mapping before unmapping, which could corrupt involved data structures; the vulnerability lea...

CVE-2022-49467

CVE-2022-49467 is a Linux kernel issue: a memory‑leak in the DRM MSM driver during mdp5_crtc_cursor_set() caused by incorrect handling in drm_gem_object_lookup/drm_gem_object_get and cursor_bo when msm_gem_get_and_pin_iova fails. Affected components/impact are within the kernel’s DRM subsystem (d...

CVE-2022-49508

CVE-2022-49508 affects the Linux kernel HID elan driver. The issue was a potential double free in elan_input_configured because input may be freed explicitly via input_free_device() even though the device is managed by devm_input_allocate_device(). The devm framework guarantees automatic cleanup ...

CVE-2022-49523

CVE-2022-49523 affects the Linux kernel component ath11k, specifically the spectral scan path during spectral_deinit. The issue arises when ath11k modules are removed (rmmod) with spectral scan enabled, which can trigger a crash (kernel NULL pointer dereference) as shown by the provided call trac...

CVE-2022-49720

The CVE-2022-49720 entry is valid and supported by multiple connected advisories. The vulnerability resides in the Linux kernel block layer, specifically in blk_mq_alloc_request_hctx, where offline-queue handling could trigger a UBSAN array-index-out-of-bounds condition (index 512 out of 512 elem...

CVE-2022-49871

CVE-2022-49871 concerns the Linux kernel net: tun subsystem memory leaks arising from napi_get_frags when GRO processing is not completed. The provided data shows that in certain paths (tun_get_user -> napi_gro_frags -> napi_frags_finish -> GRO_NORMAL) the napi->rx_list may remain pop...

CVE-2022-49874

CVE-2022-49874 concerns the Linux kernel HID subsystem, specifically a memory-leak in the Hyper-V mousevsc_probe path. The vulnerability arises when hid_add_device() returns an error and the allocated hid_dev is not freed, potentially leaking memory. The referenced fix ensures hid_destroy_device(...

CVE-2022-49882

CVE-2022-49882 concerns the Linux kernel KVM gfn_to_pfn_cache handling. The issue arises when the cache is inactive but refreshed without verifying the active flag, potentially leaving a valid but inactive cache and enabling use-after-free scenarios (e.g., dereferencing NULL kernel pointers or mi...

CVE-2022-50006

CVE-2022-50006 affects the Linux kernel in NFSv4.2 handling of __nfs42_ssc_open. The issue arises when a destination server processes a COPY and should not accept a passed filehandle if it’s not a regular filehandle; additionally, if alloc_file_pseudo() fails, the kernel must drop the reference t...

CVE-2023-23586

CVE-2023-23586 affects the Linux kernel io_uring subsystem. A time namespace vvar page can be leaked into a process via a page fault because timens_install’s single-thread check ignores io_uring io_worker threads; when the time namespace is destroyed, the vvar page may remain and a subsequent pag...

CVE-2023-52519

CVE-2023-52519 — Linux kernel (intel-ish-hid) : On Elkhart Lake (EHL) based systems, an Out-of-Band wake service can enable PME wake. The ISH driver must re-enable the ACPI GPE bit on resume to preserve wake capability, but BIOS clears the bit without decrementing the OS GPE reference count, caus...

CVE-2023-52695

CVE-2023-52695 concerns the Linux kernel, specifically the DRM/AMD display path. The connected Nessus entry states the vulnerability was resolved by the patch: drm/amd/display: Check writeback connectors in create_validate_stream_for_sink. The stated root cause is to verify the connector type to ...

CVE-2023-52816

CVE-2023-52816 relates to a Linux kernel flaw in drm/amdkfd where a UBSAN shift out-of-bounds occurs when shifting exponent 255, which is too large for a 64-bit unsigned long during a page-fault/get_user path. Impact is high (local exploitability per CVSS), and the issue is fixed by kernel patche...

CVE-2023-52883

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix possible null pointer dereference abo->tbo.resource may be NULL in amdgpu_vm_bo_update.

CVE-2023-52894

CVE-2023-52894 affects the Linux kernel USB gadget f_ncm path, where a NULL cdev->gadget dereferences max_speed in ncm_bitrate() during SPEED_NOTIFY handling. The issue was observed on an aarch64 GKI 5.10.149-android13 crash (NULL pointer dereference at 0x5c) and is linked to ncm_do_notify() S...

CVE-2023-52999

CVE-2023-52999 : In the Linux kernel, the UaF in netns ops registration error path is resolved by skipping the dereference of the gen pointer when net_assign_generic() fails, preventing a slab-out-of-bounds write. The change fixes ops_init/error path behavior after failure, addressing an out-of-b...

CVE-2024-26833

CVE-2024-26833 : In the Linux kernel, the drm/amd/display memory-leak issue was caused by not freeing memory for dmub_srv after its destruction. The backtrace implicates dmub_sw_init and related AMDGPU initialization paths, with an unfreed object after dmub_srv destruction. The advisory’s fix is ...

CVE-2024-27021

In CVE-2024-27021, the Linux kernel r8169 LED handling caused a RTNL-related deadlock on module removal due to binding devm_led_classdev_register() to the netdev. The fix removes device-managed LED functions and ensures led_classdev_unregister() is safe even if registration failed. This mitigates...

CVE-2024-35799

CVE-2024-35799 relates to the Linux kernel, specifically the DRM/AMD display path. The issue occurs when disabling a stream encoder, where a function invoked during disable no longer exists. The fix adds a null-check for the function declaration in the disable-stream encoder path to prevent a cra...

CVE-2024-35921

CVE-2024-35921 affects the Linux kernel media/mediatek vcodec HEVC decoding path. The stateless HEVC decoder stored the instance pointer in the context even on initialization failure, leading to a use-after-free when the pointer was freed during deinit. The documented workaround is to store the i...

CVE-2024-36937

Summary of CVE-2024-36937 : The Linux kernel vulnerability affects XDP redirect handling when broadcasting to a map via BPF_F_BROADCAST. The issue arose because xdp_do_redirect() could see a NULL destination pointer if the destination map was destroyed before the XDP program ran, causing a crash....

CVE-2024-38603

Mode C CVE-2024-38603 (Linux kernel) affects drivers/perf: hisi: hns3. Root cause: pci_alloc_irq_vectors() allocates an irq vector; if devm_add_action() fails, the irq vector is not freed, causing a memory leak. Fix: replace devm_add_action() with devm_add_action_or_reset() so the irq vector can ...

CVE-2024-38607

CVE-2024-38607 corresponds to a Linux kernel issue: the via-macii ADB driver called request_irq() after disabling hard interrupts, which was unnecessary because the VIA shift register interrupt was masked during VIA1 initialization. The vulnerability is tied to the macintosh/via-macii driver and ...

CVE-2024-40996

CVE-2024-40996 affects the Linux kernel. Problem: bpf: Avoid splat in pskb_pull_reason where a debug WARN may trigger for SYZKALLER-style nets; not interesting for valid traffic and can be suppressed. Root cause involves a debug hint in pskb_may_pull when CONFIG_DEBUG_NET=y; with CONFIG_DEBUG_NET...

CVE-2024-42142

CVE-2024-42142 affects the Linux kernel mlx5 E-switch ingress ACL handling. The bug creates an ingress ACL only when vport metadata match and prio tag are enabled, but the active-backup lag feature also requires it, risking a panic when dropping rules if the ACL doesn’t exist. The fix creates the...

CVE-2024-42151

The CVE-2024-42151 entry concerns the Linux kernel and a BPF-related test: test_1 in bpf_dummy_struct_ops has a first parameter that can be NULL. The vulnerability arises because the verifier could skip a NULL check, leading to a NULL pointer dereference under certain conditions when state is NUL...

CVE-2024-43851

CVE-2024-43851 summary (Linux kernel) The issue affects Linux kernel code for the Xilinx SoC path (soc: xilinx). The root cause is the per-CPU variable cpu_number1 being passed to xlnx_event_handler as the argument dev_id, but not used by that function; a patch renames cpu_number1 to dummy_cpu_nu...

CVE-2024-46766

CVE-2024-46766 affects the Linux kernel, specifically the ice driver’s VSI handling. The issue comes from moving netif_queue_set_napi to rtnl-protected sections, since netif_queue_set_napi() could be invoked from ice_vsi_rebuild() without rtnl locking during reset. The recommended fix fills napi-...

CVE-2024-49970

CVE-2024-49970 affects the Linux kernel DRM AMD display path. The issue is a bounds check failure in dcn401_stream_encoder_create for the DCN401 encoder: the stream_enc_regs array, sized for indices 0–3, could be accessed with eng_id = 5, causing a buffer overflow and undefined behavior. The vuln...

CVE-2024-50037

CVE-2024-50037 affects the Linux kernel’s DRM framebuffer path (drm/fbdev-dma). The root cause was that drm_fbdev_dma_fb_destroy() unconditionally invoked fb_deferred_io_cleanup() even when struct fb_info.fbdefio was NULL, leading to a warning trace in an Apple Silicon display driver context. The...

CVE-2024-50284

CVE-2024-50284 concerns the Linux kernel's ksmbd subsystem, where: a missing error check for xa_store() could allow a flaw when storing into an XArray. The cited details state that xa_store() may fail with xa_err(-EINVAL) if the entry cannot be stored, or xa_err(-ENOMEM) if memory allocation fail...

CVE-2024-56624

CVE-2024-56624 affects the Linux kernel iommufd_fault_alloc path inside iommufd (drivers/iommu/iommufd/fault.c). The issue arises because fput() calls the file->f_op->release handler, which releases, then the fault object and ictx are released again, leading to imbalanced refcounts and memo...

CVE-2024-56696

CVE-2024-56696 affect: Linux kernel ALSA core. The issue arises when kunit_kzalloc() returns a NULL pointer and is dereferenced without a NULL check, which can lead to a NULL pointer dereference. root cause: missing NULL checks for kunit_kzalloc() calls in sound_kunit.c. impact: local, with poten...