CVE-2010-1146

The CVE-2010-1146 entry concerns the Linux kernel (2.6.33.2 and earlier) where, if a ReiserFS filesystem exists, read/write access to the .reiserfs_priv directory is not restricted. Local attackers could exploit this by modifying extended attributes or ACLs, demonstrated by deleting a file under ...

CVE-2010-4079

CVE-2010-4079 affects the Linux kernel ivtvfb driver (ivtvfb_ioctl in drivers/media/video/ivtv/ivtvfb.c) prior to 2.6.36-rc8. The root cause is failure to initialize a structure member, enabling local users to leak information from kernel stack memory via the FBIOGET_VBLANK ioctl. Affected versio...

CVE-2010-4525

CVE-2010-4525: The Linux kernel up to 2.6.34.y omits initialization of kvm_vcpu_events->interrupt.pad, enabling local attackers to read potentially sensitive data from kernel stack memory via unspecified vectors. The affected component is kernel/KVM (Linux kernel 2.6.33/2.6.34.y). Multiple adv...

CVE-2011-1927

The CVE-2011-1927 entry concerns the Linux kernel: the ip_expire function in net/ipv4/ip_fragment.c before 2.6.39 fails to properly construct ICMP_TIME_EXCEEDED after a timeout, allowing remote attackers to trigger a NULL pointer dereference and crash parts of the kernel via crafted fragmented pa...

CVE-2011-2479

CVE-2011-2479 affects the Linux kernel up to version 2.6.38.x and allows a local user to trigger a denial of service by a crafted MAP_PRIVATE mmap on /dev/zero that causes THP creation to misbehave. The vulnerability is in transparent huge pages handling and can crash the system. A fix exists in ...

CVE-2011-3638

CVE-2011-3638 affects the Linux kernel’s ext4 extents handling. The vulnerability occurs in fs/ext4/extents.c where a modified extent may not be marked_dirty during certain extent-splitting paths, enabling a local attacker to trigger a denial of service (kernel crash) through ext4 unmount/mount o...

CVE-2012-3552

The CVE-2012-3552 issue is a race condition in the Linux kernel IP implementation that exists in versions before 3.0. According to the connected documents, remote attackers could trigger a denial of service (slab corruption and system crash) by sending packets to an application that sets socket o...

CVE-2012-4565

CVE-2012-4565 affects the Linux kernel up to version 3.4.18 (pre-3.4.19) in tcp_illinois_info within net/ipv4/tcp_illinois.c. When net.ipv4.tcp_congestion_control illinois is enabled, local users can trigger a divide-by-zero OOPS by reading TCP stats, causing denial of service. Mitigation is to u...

CVE-2013-2634

CVE-2013-2634 affects the Linux kernel prior to 3.8.4. The issue: net/dcb/dcbnl.c does not initialize certain structures, enabling a local attacker to read sensitive data from kernel stack memory via a crafted application. Connected advisories (e.g., MiracleLinux AXSA-2013-592:07) corroborate the...

CVE-2016-10318

The CVE-2016-10318 issue affects the Linux kernel’s ext4 and f2fs filesystem encryption support (fs/crypto/policy.c). It is caused by a missing authorization check in fscrypt_process_policy, allowing a user to assign an encryption policy to a directory owned by another user, which can lead to a d...

CVE-2016-6787

CVE-2016-6787 affects the Linux kernel’s performance subsystem: kernel/events/core.c before 4.0 mismanages locks during certain migrations, allowing local users to gain privileges via a crafted application (Android internal bug 31095224). Impact is local privilege escalation with complete confide...

CVE-2017-17857

The CVE-2017-17857 vulnerability affects the Linux kernel’s verifier.c check_stack_boundary in versions up to 4.14.8, allowing local users to trigger memory corruption and potential denial of service or other impact by mishandling invalid variable stack read operations. Connected advisories (Unit...

CVE-2017-9059

The CVE-2017-9059 vulnerability affects the Linux kernel’s NFSv4 implementation (up to version 4.11.1). The root cause is an improper channel callback shutdown during unmount of an NFSv4 filesystem, described as a module reference and kernel daemon leak. Impact stated in the sources is a local de...

CVE-2018-6412

CVE-2018-6412 affects the Linux kernel sbusfb_ioctl_helper() in drivers/video/fbdev/sbuslib.c up to and including 4.15. It introduces an integer signedness error that could allow an attacker to leak arbitrary information via the FBIOPUTCMAP_SPARC and FBIOGETCMAP_SPARC ioctls, impacting confidenti...

CVE-2019-16921

In the Linux kernel before 4.17, hns_roce_alloc_ucontext in drivers/infiniband/hw/hns/hns_roce_main.c does not initialize the resp data structure, which may allow attackers to read sensitive information from kernel stack memory (CID-df7e40425813). This CVE affects the kernel code path associated ...

CVE-2021-47169

CVE-2021-47169 : In the Linux kernel, the serial rp2 driver could NULL-dereference if a firmware load via request_firmware_nowait occurred before ports were initialized. The fix was to use a synchronous firmware load (request_firmware) during rp2_probe to ensure interrupts are not handled before ...

CVE-2021-47229

CVE-2021-47229 concerns the Linux kernel PCI aardvark driver. A kernel panic could occur when a new PIO transfer is started before the previous one finished; the kernel will issue an External Abort/SSeror interrupt leading to a reboot. The root cause analysis noted a previously added Trusted Firm...

CVE-2021-47324

CVE-2021-47324 relates to the Linux kernel watchdog driver. The issue is a use-after-free risk in wdt_startup() caused by the remove path calling del_timer() instead of waiting for the timer handler to finish. The timer handler could still be running after the driver’s remove function returns, po...

CVE-2021-47342

CVE-2021-47342 affects the Linux kernel’s ext4 filesystem. A race during remounting a read-only, mmp-protected filesystem can cause a use-after-free (UAF) when the kmmpd thread may exit and leave sbi->s_mmp_tsk pointing at freed memory, triggering an object lifetime dereference in ext4_stop_mm...

CVE-2021-47460

CVE-2021-47460 affects the ocfs2 code path in the Linux kernel. The vulnerability arises during conversion from inline inode data to extents, where the converter zeroed the entire data cluster by touching pages beyond i_size, which writeback may ignore, causing data loss after file growth. A fix ...

CVE-2021-47464

The CVE-2021-47464 issue is a Linux kernel vulnerability in audit_filter_rules where a null-pointer dereference could occur if ctx is NULL. The advisory states a fix has been applied (audit_filter_rules: fix possible null-pointer dereference; ctx could be null) with commits listed in the Referenc...

CVE-2021-47485

CVE-2021-47485 affects the Linux kernel InfiniBand driver (IB/qib). The flaw is a buffer overflow in struct qib_user_sdma_pkt fields caused by arithmetic on user-controlled buffers (overflowing addrlimit or bytes_togo), which can lead to kernel memory corruption. The issue has been resolved by ad...

CVE-2021-47518

CVE-2021-47518 summary (Linux kernel) : A NULL pointer dereference in the NFC (nfc) subsystem was fixed. The netlink callback nfc_genl_dump_ses_done() did not verify that its received argument is non-NULL, risking dereference if allocation failed earlier in dumpit() (nfc_genl_dump_ses()). A patch...

CVE-2021-47596

CVE-2021-47596 is a Linux kernel use-after-free in the hns3 driver (net: hns3: fix use-after-free bug in hclgevf_send_mbx_msg). The vulnerability arises from the removal sequence where the netdevice is freed during client removal, while the acceleration engine’s uninstall step still traces runtim...

CVE-2021-47648

CVE-2021-47648 is a Linux kernel issue where a memory leak could occur in the gpu: host1x path, specifically in host1x_remove(). The fix adds a missing host1x_channel_list_free() call in the remove path (consistent with error path handling in probe). Connected advisories confirm this memory-leak ...

CVE-2022-3633

CVE-2022-3633 affects the Linux kernel, specifically the function j1939_session_destroy in net/can/j1939/transport.c. The issue is a memory leak caused by the manipulation of this routine. Multiple connected sources (e.g., Chainguard security.json entry, Astra Linux bulletin, CNVD/CNNVD entries, ...

CVE-2022-3977

CVE-2022-3977 is a use-after-free in the Linux kernel MCTP implementation. It occurs when a user performs a DROPTAG ioctl while a socket close happens, potentially crashing the system or allowing local privilege escalation. The issue is documented across multiple sources (NVD entry and OSV/GNU-fa...

CVE-2022-48863

The CVE-2022-48863 entry describes a Linux kernel vulnerability in mISDN: dsp_pipeline_build() leaks memory due to dup pointer handling. Specifically, dsp_pipeline_build() allocates dup with kstrdup(cfg) and then updates dup via strsep(&dup, "|"), leaving dup as NULL when kfree(dup) is called. Th...

CVE-2022-48919

CVE-2022-48919 affects the Linux kernel’s CIFS mount flow. The issue is a double-free race in cifs_get_root() when a mount fails inside cifs_smb3_do_mount(); deactivate_locked_super() leads to delayed_free(), potentially freeing resources twice if code continues to the out: path. The vulnerabilit...

CVE-2022-48954

CVE-2022-48954 refers to a use-after-free in s390/qeth HSci path, where KASAN observed dereference of a freed br2dev_event_work object in qeth_l2_br2dev_worker. Multiple vendor advisories (SUSE SUSE-SU-2024:4131-1, SUSE-SU-2024:4364-1 and OSV entries) summarize the issue and list the affected com...

CVE-2022-49065

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix the svc_deferred_event trace class Fix a NULL deref crash that occurs when an svc_rqst is deferredwhile the sunrpc tracing subsystem is enabled. svc_revisit() setsdr->xprt to NULL, so it can't be relied upon in the...

CVE-2022-49106

CVE-2022-49106 affects the Linux kernel (staging: vchiq_arm). The root cause is a potential NULL pointer dereference in vchiq_dump_platform_instances when vchiq_get_state() may return NULL. The vulnerability could impact kernel availability with local access required. A fix is included in upstrea...

CVE-2022-49119

In the Linux kernel, CVE-2022-49119 concerns a memory leak in the SCSI pm8001 path: in pm8001_chip_fw_flash_update_build(), if the build fails, the previously allocated fw_control_ex must be freed. The issue is resolved by applying the fix in the pm8001_chip_fw_flash_update_req/build flow. Affect...

CVE-2022-49137

CVE-2022-49137 concerns a refcount leak in the Linux kernel’s amdgpu_cs_fence_to_handle_ioctl() path. When info->in.what hits the default case, the function returns -EINVAL without decrementing the previously bumped dma_fence refcount, causing leaks. The issue arises from a missing refcount de...

CVE-2022-49178

In the Linux kernel, the following vulnerability has been resolved: memstick/mspro_block: fix handling of read-only devices Use set_disk_ro to propagate the read-only state to the block layerinstead of checking for it in ->open and leaking a reference in caseof a read-only device.

CVE-2022-49289

CVE-2022-49289 : The Linux kernel fixed an integer overflow in uaccess() during access_ok() checks. Three architectures could mis-handle a negative length/overflow at the end of a user access, potentially returning success when it should not. The fix replaces the overflow-prone check with the com...

CVE-2022-49327

The CVE-2022-49327 issue affects the Linux kernel and is described in multiple advisories (e.g., Unity Linux and SUSE/SUSE-SU family) as a fix for bcached journal no-space deadlock. The vulnerability arises when journal replay during cache set registration can stall if journal buckets are exhaust...

CVE-2022-49331

In the Linux kernel, the nfc: st21nfca driver was fixed to address memory leaks in EVT_TRANSACTION handling. The error paths did not free previously allocated memory, and the patch adds devm_kfree() to those failure paths to prevent leaks. The CVE entry CVE-2022-49331 reflects this fix. The avail...

CVE-2022-49397

CVE-2022-49397 affects the Linux kernel, in the phy: qcom-qmp driver. The vulnerability is a leak of a struct clk (pipe clock reference) on probe errors, including late probe error/deferral paths. The advisory states the fix releases the held pipe clock reference on such errors, i.e., a proper cl...

CVE-2022-49410

CVE-2022-49410: Linux kernel tracing double free in create_var_ref fixed by making init_var_ref() store NULL when freeing fields; affected components include the variable ref_field initialization path (create_hist_field -> init_var_ref -> destroy_hist_field). Remediation is to apply the ker...

CVE-2022-49422

CVE-2022-49422: Linux kernel dmaengine idxd vulnerability. Root cause: error path in idxd_cdev_register() for alloc_chrdev_region() failures leaks allocated resources. Impact is local with high availability impact as per the CVE entry. Affected context is the idxd driver in the kernel; remediatio...

CVE-2022-49437

CVE-2022-49437 affects the Linux kernel (powerpc/xive) where a refcount leak occurs in xive_spapr_init due to a missing of_node_put() after of_find_compatible_node() returns a node with an incremented refcount. The provided description specifies that the fix adds the missing of_node_put() to avoi...

CVE-2022-49460

CVE-2022-49460 is a Linux kernel vulnerability affecting the devfreq subsystem (rk3399_dmc: disable edev on remove) that can cause an unbalanced enable-count when unbinding the DFI device. The issue is fixed in the kernel by disabling edev on remove, preventing the erroneous enable/disable tracki...

CVE-2022-49527

In CVE-2022-49527, the Linux kernel media/venus/hfi path was fixed to avoid a null-dereference during deinitialization. If venus_probe fails at pm_runtime_put_sync, the error path previously called hfi_destroy (which sets core->ops to NULL) and then attempted hfi_core_deinit, which would deref...

CVE-2022-49568

CVE-2022-49568 affects the Linux kernel KVM code path, where a NULL dereference can occur during cleanup if destroy() is assumed non-NULL but is not (notably for some Book3s KVM devices that use release() instead). The root cause is an assumption in kvm_ioctl_create_device() that destroy() is alw...

CVE-2022-49674

The CVE-2022-49674 issue is a Linux kernel vulnerability in dm-raid where an array (rs->devs) could be accessed beyond its end when the raid_disks-derived count differed from metadata-driven counts during RAID layout changes. The root cause is using rs->raid_disks for iteration instead of t...

CVE-2022-49693

CVE-2022-49693 : In the Linux kernel, there is a refcount leak in the drm/msm/mdp4 path during mdp4_modeset_init_intf caused by not releasing the remote device node pointer obtained from of_graph_get_remote_node(). The pointer’s refcount is incremented but not decremented with of_node_put() when ...

CVE-2022-49740

CVE-2022-49740 concerns the Linux kernel brcmfmac driver. The vulnerability arises when the device-provided channel spec count exceeds the allocated list length in brcmf_construct_chaninfo() and brcmf_enable_bw40_2g(), causing slab-out-of-bounds reads. The patch adds bounds checks so these functi...

CVE-2022-49871

CVE-2022-49871 concerns the Linux kernel net: tun subsystem memory leaks arising from napi_get_frags when GRO processing is not completed. The provided data shows that in certain paths (tun_get_user -> napi_gro_frags -> napi_frags_finish -> GRO_NORMAL) the napi->rx_list may remain pop...

CVE-2022-49983

The issue CVE-2022-49983 affects the Linux kernel udmabuf driver. If the udmabuf DMA mask is not set explicitly, userspace DMA-BUF access via the CPU can trigger a warning in dma_map_sg_attrs (kernel/dma/mapping.c) during dma-buf CPU access flows (as shown in the stack trace). The vulnerability i...