CVE-2022-48887

CVE-2022-48887 affects the Linux kernel DRM vmwgfx driver. User-resource lookups previously used RCU paths, which were buggy and could crash when command buffers were submitted from two threads. The fix replaces the RCU-based lookups with a regular spin lock to remove races in accesses to shared ...

CVE-2010-3086

CVE-2010-3086 affects the Linux kernel (pre-2.6.25) via futex.h: exception fixup code replaced LOCK_PREFIX with a no-op, enabling local users to trigger a page fault and cause a denial of service (panic). Public advisories (e.g., MiracleLinux AXSA-2010-500:18 and OSV/RHSA entries) reference this ...

CVE-2010-4347

CVE-2010-4347 affects the Linux kernel’s ACPI subsystem. The vulnerability arises in the debugfs interface (custom_method file) which, due to world-writable 0222 permissions, lets a local user place a custom ACPI method in interpreter tables via acpi_debugfs_init in drivers/acpi/debugfs.c. This c...

CVE-2011-1927

The CVE-2011-1927 entry concerns the Linux kernel: the ip_expire function in net/ipv4/ip_fragment.c before 2.6.39 fails to properly construct ICMP_TIME_EXCEEDED after a timeout, allowing remote attackers to trigger a NULL pointer dereference and crash parts of the kernel via crafted fragmented pa...

CVE-2011-3363

The CVE-2011-3363 issue affects the Linux kernel up to version 2.6.38, specifically the setup_cifs_sb function in fs/cifs/connect.c. The root cause is improper handling of DFS referrals, enabling a remote CIFS server to trigger a denial-of-service (system crash) by placing a referral at the root ...

CVE-2012-6704

CVE-2012-6704 affects the Linux kernel prior to 3.5. The sock_setsockopt path in net/core/sock.c mishandles negative values for sk_sndbuf/sk_rcvbuf, enabling a local attacker with CAP_NET_ADMIN to trigger memory corruption and a possible denial of service (memory corruption/system crash). Affecte...

CVE-2013-1827

CVE-2013-1827 affects the Linux kernel: net/dccp/ccid.h before 3.5.4. It allows local privilege escalation or denial of service (NULL pointer dereference and system crash) via CAP_NET_ADMIN on a getsockopt call (sender or receiver). The connected advisories/bulletins (Unity/Linux Nessus entries) ...

CVE-2013-2897

CVE-2013-2897 affects the Linux kernel HID multitouch driver (drivers/hid/hid-multitouch.c) with CONFIG_HID_MULTITOUCH enabled, up to kernel 3.11. The vulnerability allows physically proximate attackers to trigger a denial of service via crafted HID devices, causing heap memory corruption or a NU...

CVE-2014-9730

CVE-2014-9730 affects the Linux kernel’s UDF support. The function udf_pc_to_char in fs/udf/symlink.c relies on unused component lengths, enabling a local attacker to trigger a denial of service (system crash) by mounting a crafted UDF image. The vulnerability is fixed in kernel 3.18.2 (see Chang...

CVE-2015-8963

CVE-2015-8963 : The Linux kernel contains a race condition in kernel/events/core.c related to swevent handling during a CPU unplug operation. Affected: Linux kernel versions before 4.4. Impact: local privilege escalation or denial of service (use‑after‑free) as described in the vulnerability entr...

CVE-2016-2543

CVE-2016-2543 affects the Linux kernel before 4.4.1: the snd_seq_ioctl_remove_events path in sound/core/seq/seq_clientmgr.c does not verify FIFO assignment before clearing, enabling local users to trigger a NULL pointer dereference and an OOPS (denial of service). Remediation: upgrade to kernel 4...

CVE-2018-12930

CVE-2018-12930 targets the ntfs_end_buffer_async_read function in the ntfs.ko driver of Linux kernel 4.15.0. A crafted NTFS filesystem can trigger a stack-based out-of-bounds write, leading to a denial of service (kernel oops or panic) and possibly unspecified other impacts. The connected documen...

CVE-2019-11811

CVE-2019-11811 affects the Linux kernel up to version 5.0.4 (pre-5.0.4). The issue is a use-after-free on read access to /proc/ioports after the ipmi_si driver is removed, tied to ipmi_si_intf.c, ipmi_si_mem_io.c, and ipmi_si_port_io.c. Impact: local privilege/escalation risk if an attacker can u...

CVE-2021-47039

CVE-2021-47039 entry is rejected and not an active vulnerability entry.

CVE-2021-47075

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix memory leak in nvmet_alloc_ctrl() When creating ctrl in nvmet_alloc_ctrl(), if the cntlid_min is largerthan cntlid_max of the subsystem, and jumps to the"out_free_changed_ns_list" label, but the ctrl->sqs lack of be...

CVE-2021-47086

The CVE-2021-47086 entry concerns the Linux kernel Phonet/pep path. The connected Astra Linux bulletin repeats that the vulnerability arises in an ioctl that refines enabling an unbound pipe, where the socket may not be bound to a valid Phonet object. If the socket is not bound, two issues occur:...

CVE-2021-47116

CVE-2021-47116 concerns the Linux kernel ext4 memory leak. According to the primary description, the vulnerability is triggered when memory leaks on the error path of ext4_mb_init_backend, occurring if a filesystem is corrupted with an illegally large s_log_groups_per_flex. The issue is resolved ...

CVE-2021-47165

CVE-2021-47165 relates to the Linux kernel drm/meson shutdown crash when the main component is not probed (e.g., dw-hdmi not loaded or probe deferred). The issue causes a NULL dereference during shutdown, shown in meson_drv_shutdown and related shutdown paths. The fix described across sources is ...

CVE-2021-47229

CVE-2021-47229 concerns the Linux kernel PCI aardvark driver. A kernel panic could occur when a new PIO transfer is started before the previous one finished; the kernel will issue an External Abort/SSeror interrupt leading to a reboot. The root cause analysis noted a previously added Trusted Firm...

CVE-2021-47288

CVE-2021-47288 affects the Linux kernel media: ngene component. Affected code path is ngene_command_config_free_buf(), which previously copied 6 bytes into a one-byte config field of the wrong structure (FW_CONFIGURE_BUFFERS) via a single memcpy(). The fix relocates the 6 additional members into ...

CVE-2021-47342

CVE-2021-47342 affects the Linux kernel’s ext4 filesystem. A race during remounting a read-only, mmp-protected filesystem can cause a use-after-free (UAF) when the kmmpd thread may exit and leave sbi->s_mmp_tsk pointing at freed memory, triggering an object lifetime dereference in ext4_stop_mm...

CVE-2021-47401

In the provided documents, CVE-2021-47401 affects the Linux kernel’s ipack/ipoctal driver (drivers/ipack/devices/ipoctal.c). The root cause is that the tty driver name was allocated on the stack, enabling a stack information leak to user space or triggering an oops, and the name could encode topo...

CVE-2021-47404

Summary (CVE-2021-47404): The issue stems from a slab-out-of-bounds write in the HID Betop driver (betopff) in the Linux kernel. Syzbot observed a write beyond slab bounds due to assuming an input report exists; malicious devices can violate this assumption. The public advisories, including Astra...

CVE-2021-47538

CVE-2021-47538 affects the Linux kernel’s rxrpc component. The root cause is a leak of an rxrpc_local reference in rxrpc_lookup_peer(), where a peer candidate’s local object is not released properly. The fix requires calling rxrpc_put_local() for the peer candidate before kfree(), as the peer hol...

CVE-2021-47596

CVE-2021-47596 is a Linux kernel use-after-free in the hns3 driver (net: hns3: fix use-after-free bug in hclgevf_send_mbx_msg). The vulnerability arises from the removal sequence where the netdevice is freed during client removal, while the acceleration engine’s uninstall step still traces runtim...

CVE-2021-47600

The CVE-2021-47600 entry concerns a Linux kernel vulnerability in the dm btree code where a use-after-free occurs during rebalance_children. The root cause is described as a use-after-free in the btree remove path, with the fix specified as moving dm_tm_unlock() after dm_tm_dec(). The vulnerabili...

CVE-2021-47602

CVE-2021-47602 affects the Linux kernel mac80211 QoS admission-control path. The root cause was an uninitialized-value path triggered by non-QoS nullfunc packets, which could access the QoS header. The fix restricts all actions to QoS data packets, preventing misuse from non-QoS traffic. Remediat...

CVE-2021-47612

CVE-2021-47612 (Linux kernel) — A vulnerability in nf cGenl dump paths can cause a null-pointer dereference and kernel crash when kmalloc in nfc_genl_dump_devices() fails, leading to a segfault in nfc_genl_dump_devices_done and related netlink/worker threads. The issue is fixed in the Linux kerne...

CVE-2021-47634

A race condition exists in the Linux kernel ubi subsystem between ctrl_cdev_ioctl and ubi_cdev_ioctl. The issue stems from using different locks—ubi_devices_mutex and ubi->device_mutex—allowing concurrent execution. Specifically, uif_init and uif_close in ubi_attach can race with ubi_cdev_ioct...

CVE-2022-47942

CVE-2022-47942 affects ksmbd in Linux kernels 5.15–5.19 before 5.19.2. The issue is a heap-based buffer overflow in set_ntacl_dacl triggered by use of SMB2_QUERY_INFO_HE after a malformed SMB2_SET_INFO_HE, potentially exposing memory corruption paths. Public references confirm the vulnerability a...

CVE-2022-48633

CVE-2022-48633: In the Linux kernel, the gma500/psb_gem Unpin path could trigger a WARN_ON (lock->magic != lock) due to ww_mutex being destroyed by drm_gem_object_release(). The fix relocates drm_gem_object_release() to occur after psb_gem_unpin(), preventing the invalid lock state. Affected c...

CVE-2022-48697

The CVE-2022-48697 issue is a Linux kernel vulnerability in nvmet (NVMe target) where a use-after-free could occur in the nvmet request completion path (blk_mq_complete_request_remote and related nvmet/nvme_loop code). The provided documents confirm a fix was applied in the Linux kernel to addres...

CVE-2022-48904

CVE-2022-48904 (Linux kernel, IOMMU/AMD) : Fix for an I/O page table memory leak in the IOMMU when launching VMs with PCIe pass-through. Root cause: memory is freed after updating the I/O page table mode, causing leakage. Resolution: free the page-table memory before updating the mode. CVSSv3.1 b...

CVE-2022-48948

CVE-2022-48948 concerns a Linux kernel vulnerability in the USB gadget UVC setup handler. The issue arises when a control transfer request carries up to 64 bytes (UVC_MAX_REQUEST_SIZE) while the data stage for OUT transfers copies bytes into a 60-byte uvc_event->data.data buffer, enabling a po...

CVE-2022-49044

CVE-2022-49044 affects the Linux kernel dm‑integrity driver. When tag_size is smaller than the digest size, a portion of the digest is written beyond the end of ic->recalc_tags, corrupting memory in integrity_recalc->integrity_sector_checksum->crypto_shash_final. The fix increases the ta...

CVE-2022-49065

The CVE-2022-49065 entry relates to the Linux kernel SUNRPC tracing: a NULL dereference crash when a sunrpc svc_rqst is deferred while tracing is enabled. The fix targets the trace class svc_deferred_event by avoiding reliance on a NULL dr->xprt and instead converting the remote address to a p...

CVE-2022-49108

CVE-2022-49108 concerns the Linux kernel Mediatek clock driver, where memory leaks occur on probe due to not freeing memory in error handling paths. The vulnerability is resolved by handling error branches to free allocated memory, addressing a resource leak (Coverity ID 1491825). Connected sourc...

CVE-2022-49115

CVE-2022-49115 is a Linux kernel vulnerability in the PCI: endpoint subsystem where a misused goto label could lead to a memory leak. The description across connected advisories reiterates the same root cause and states that a fix was applied in the kernel (commit history referenced in the linked...

CVE-2022-49282

CVE-2022-49282 is a Linux kernel issue affecting f2fs quota handling. The vulnerability stems from an incorrect loop condition in f2fs_quota_sync() where cnt should be passed to sb_has_quota_active() to correctly determine active quotas. When type is -1, the compiler may discard the check, potent...

CVE-2022-49303

CVE-2022-49303 concerns a Linux kernel deadlock in the rtl8192eu driver (drivers/staging/rtl8192eu) during rtw_joinbss_event_prehandle. The provided details describe a lock-order issue: thread 1 holds pmlmepriv->lock while waiting on del_timer_sync(), but the timer handler (thread 2) also need...

CVE-2022-49312

CVE-2022-49312 (Linux kernel) : The vulnerability concerns a potential memory leak in the rtl8712 staging path. In r871xu_drv_init(), if r8712_init_drv_sw() fails, memory allocated by r8712_alloc_io_queue() in r8712_usb_dvobj_init() is not released because there is no action in r8712_usb_dvobj_de...

CVE-2022-49410

CVE-2022-49410: Linux kernel tracing double free in create_var_ref fixed by making init_var_ref() store NULL when freeing fields; affected components include the variable ref_field initialization path (create_hist_field -> init_var_ref -> destroy_hist_field). Remediation is to apply the ker...

CVE-2022-49542

Summary: CVE-2022-49542 affects the Linux kernel SCSI lpfc path. The vulnerability arises in logging code: during an attempt to log a TRACE message, the code could take a hard lockup path due to an unsafe lock acquisition sequence. Root cause (as described): the cfg_log_verbose check was performe...

CVE-2022-49544

CVE-2022-49544 affects the Linux kernel IPW2X00 stack. The issue is a potential NULL dereference in libipw_xmit() when crypt and crypt->ops could be null. The fix adds null checks before dereferencing these fields. The vulnerability is local with likely crash/denial impact; exploitation status...

CVE-2022-49979

CVE-2022-49979 concerns a Linux kernel refcount bug in sk_psock_get triggered during an SMC fallback in the connect path, due to a mismatch in the sk_user_data field used by both smc and psock. The root cause is the shared use of sk_user_data by two subsystems; the patch adds a new bit (SK_USER_D...

CVE-2022-50035

CVE-2022-50035 affects the Linux kernel DRM AMDGPU path. The issue is a use-after-free in amdgpu_bo_list mutex handling caused by double-unlocking of bo_list_mutex when amdgpu_cs_vm_handling returns non-zero, which can lead to a refcount underflow (as shown in the trace). The vulnerability is dem...

CVE-2022-50093

CVE-2022-50093 affects the Linux kernel IOMMU VT-d code. The issue arises from using arch_test_bit() with a possibly invalid first argument when NUMA is disabled, causing a potential wild memory access after node_online() returns NUMA_NO_NODE. The fix adds an explicit check for node != NUMA_NO_NO...

CVE-2022-50136

CVE-2022-50136 affects Linux kernel/RDMA siw driver. The issue is a bug where siw_recv_mpa_rr returning -EAGAIN could cause IW_CM_EVENT_CONNECT_REPLY to be reported, triggering a kernel bug trace in iw_cm (kernel.c iwcm.c:894). The fix removes the duplicate report of IW_CM_EVENT_CONNECT_REPLY whe...

CVE-2023-39179

CVE-2023-39179 affects the Linux kernel ksmbd module and is triggered by SMB2 read requests. The vulnerability arises from insufficient validation of user-supplied data, allowing a read past the end of an allocated buffer. Impact is potential disclosure of sensitive information on affected system...

CVE-2023-52799

In Linux kernel, CVE-2023-52799 relates to an array-index-out-of-bounds in the JFS path during dmtree_t searches for free blocks (tp->dm_stree). The fix adds a parameter to dbFindLeaf to determine the dmtree type, enabling an out-of-bounds check and preventing access beyond array bounds. Affec...