CVE-2014-8173

CVE-2014-8173 affects the Linux kernel before 3.13 on NUMA systems. The function pmd_none_or_trans_huge_or_clear_bad in include/asm-generic/pgtable.h fails to correctly identify PMD entries as transparent huge-table entries, allowing a local user to trigger a NULL pointer dereference and system c...

CVE-2016-10318

The CVE-2016-10318 issue affects the Linux kernel’s ext4 and f2fs filesystem encryption support (fs/crypto/policy.c). It is caused by a missing authorization check in fscrypt_process_policy, allowing a user to assign an encryption policy to a directory owned by another user, which can lead to a d...

CVE-2016-2085

CVE-2016-2085 : The Linux kernel (before 4.5) contains an info leak/vulnerability in evm_verify_hmac in security/integrity/evm/evm_main.c, where improper data copy enables local users to forge MAC values via a timing side-channel attack. Affected: Linux kernel up to version 4.4.x (prior to 4.5). ...

CVE-2017-17853

CVE-2017-17853 affects the Linux kernel’s BPF verifier (kernel/bpf/verifier.c) up to version 4.14.8. Local users can trigger memory corruption and potentially other impact via incorrect BPF_RSH signed bounds calculations. The connected Nessus advisories for Unity Linux describe the same issue and...

CVE-2020-36779

CVE-2020-36779 affects the Linux kernel i2c stm32f7 driver. The issue is a PM reference leak where pm_runtime_get_sync increments the usage count on return even when it fails, in stm32f7_i2c_xx functions (local attack vector). The patch replaces the problematic path with pm_runtime_resume_and_get...

CVE-2020-36791

The CVE-2020-36791 entry refers to a Linux kernel net_sched issue where cp->alloc_hash could be left at an incorrect size after a hash allocation, enabling a potential out-of-bounds access. The described root cause is that the hash calculation was moved before tcindex_alloc_perfect_hash() but ...

CVE-2021-47020

CVE-2021-47020 is a Linux kernel vulnerability in the SoundWire subsystem. The issue is a memory leak in the stream config error path for soundwire: stream: when stream config fails, the master runtime releases slave_runtimes from the slave_rt_list but the slave runtime is not added to that list ...

CVE-2021-47067

CVE-2021-47067 relates to the Linux kernel Tegra regulator code. Affected component: soc/tegra regulators in the kernel; issue was a lockup when voltage-spread is out of range. Root cause described: a bug in voltage-spread handling caused the voltage coupler to lock up; the fix accounts for the m...

CVE-2021-47105

CVE-2021-47105 : In the Linux kernel, the ice: xsk path had a bug where cleaning the SW ring NULLed xdp_buff but did not return the buffers to the xsk pool. This caused buffers in the umem to leak and become unusable. The fix adds a missing xsk_buff_free() in the cleanup path and ensures only the...

CVE-2021-47135

CVE-2021-47135 relates to the Linux kernel mt76 mt7921 driver. Public docs show a fix for an AOOB/array-out-of-bounds issue in mt7921_mcu_tx_rate_report and removal of an unnecessary variable, addressing an out-of-bounds access. References point to upstream stable commits (d874e6c069… and 6919e8a...

CVE-2021-47201

In the Linux kernel, the following vulnerability has been resolved: iavf: free q_vectors before queues in iavf_disable_vf iavf_free_queues() clears adapter->num_active_queues, whichiavf_free_q_vectors() relies on, so swap the order of these two functioncalls in iavf_disable_vf(). This resolves...

CVE-2021-47211

CVE-2021-47211 refers to a Linux kernel vulnerability in ALSA: usb-audio where snd_usb_find_clock_source could return a null cs_desc, risking a null pointer dereference. The fix adds a null check before dereferencing the clock source descriptor. The portrait of affected code points to the ALSA us...

CVE-2021-47235

CVE-2021-47235 affects the Linux kernel net/ethernet path: ec_bhf_remove() uses priv (netdev private data) after free_netdev() is called, enabling a use-after-free. The fixed sequence moves free_netdev() to occur after the PCI I/O unmaps (pci_iounmap) of priv, preventing access to freed memory. D...

CVE-2021-47265

CVE-2021-47265 is a Linux kernel RDMA issue in the mlx5_ib driver. The vulnerability stems from missing validation of the user-supplied port when creating a flow rule, leading to an improper check and a kernel oops as shown in the call trace (_create_flow_rule … mlx5_ib_create_flow …). The CVE ha...

CVE-2021-47339

In CVE-2021-47339, the Linux kernel fix targets media: v4l2-core, addressing uninitialized kernel stack data that could be used as input for driver ioctl handlers due to mistakes in compat ioctl implementation. The resolution requires explicitly clearing the entire ioctl input buffer before conve...

CVE-2021-47382

The CVE-2021-47382 entry concerns the Linux kernel component s390/qeth. Root cause: a deadlock risk in qeth_do_reset() where discipline_mutex could be held on an error path, preserving the original deadlock potential when a qeth channel path is offline. The vulnerability arises from a race betwee...

CVE-2021-47453

CVE-2021-47453: In the Linux kernel, the ice driver could crash during unload if RDMA support is uninitialized, due to freeing aux_idx unconditionally in the remove path. The root cause is an IDA free that wasn’t gated by the RDMA status bit, which could be allocated at probe time but become unne...

CVE-2021-47518

CVE-2021-47518 summary (Linux kernel) : A NULL pointer dereference in the NFC (nfc) subsystem was fixed. The netlink callback nfc_genl_dump_ses_done() did not verify that its received argument is non-NULL, risking dereference if allocation failed earlier in dumpit() (nfc_genl_dump_ses()). A patch...

CVE-2021-47622

CVE-2021-47622 affects the Linux kernel SCSI/UFS path. The issue is a deadlock in the error handling flow when all tags are allocated: the SCSI error path triggers ufshcd_eh_host_reset_handler(), which queues work that calls ufshcd_err_handler(), leading to a lockup in the workqueue (ufs_eh_wq_0)...

CVE-2022-48633

CVE-2022-48633: In the Linux kernel, the gma500/psb_gem Unpin path could trigger a WARN_ON (lock->magic != lock) due to ww_mutex being destroyed by drm_gem_object_release(). The fix relocates drm_gem_object_release() to occur after psb_gem_unpin(), preventing the invalid lock state. Affected c...

CVE-2022-48790

In the Linux kernel, the following vulnerability has been resolved: nvme: fix a possible use-after-free in controller reset during load Unlike .queue_rq, in .submit_async_event drivers may not check the ctrlreadiness for AER submission. This may lead to a use-after-freecondition that was observed...

CVE-2022-48852

The CVE (CVE-2022-48852) affects the Linux kernel DRM/VC4 HDMI driver. The issue arises because the HDMI codec device is registered on bind but not unregistered on unbind, causing a device leak. Root cause: unbind path does not unregister the HDMI codec device, leaving orphaned device state. The ...

CVE-2022-48875

CVE-2022-48875 affects the Linux kernel’s wireless stack (mac80211). The vulnerability arises when AMPDU start handling in the driver path can encounter a NULL sdata during deauthentication, leading to a NULL dereference. Specifically, ieee80211_tx_ba_session_handle_start() may receive NULL for s...

CVE-2022-48955

CVE-2022-48955 affects the Linux kernel Thunderbolt net path. The issue is a memory leak in tbnet_open() where tb_ring_alloc_rx() failure could leave the ida allocated in tb_xdomain_alloc_out_hopid() unreleased. The documented fix adds tb_xdomain_release_out_hopid() to the error path to release t...

CVE-2022-48995

Mode C: Concrete details found. Affected component: Linux kernel module raydium_ts_i2c (raydium_i2c_ts) using sunray/raydium_i2c_send().Root cause: memory leak during i2c bank switching; tx_buf is not freed after BANK_SWITCH on i2c BUS operations, creating kmemleak objects in test with a bpf mock...

CVE-2022-49016

CVE-2022-49016 is a Linux kernel issue in the net:mdiobus subsystem. The vulnerability arises from an unbalanced reference count: non-ACPI paths call fwnode_handle_put() in phy_device_release(), while ACPI paths call fwnode_handle_get() before phy_device_register() to balance gets/puts; this prev...

CVE-2022-49095

CVE-2022-49095 : In the Linux kernel, the zorro7xx SCSI driver had a resource leak in zorro7xx_remove_one() where an allocated resource was not freed in the remove path. Some error paths required undoing an ioremap(). A missing iounmap() call was added in the remove function to fix the leak. Vers...

CVE-2022-49468

Summary (CVE-2022-49468) : In the Linux kernel, a memory leak was fixed in thermal/core due to __thermal_cooling_device_register() allocating memory for sysfs trailing paths. The unreferenced object trace and backtrace show allocation in thermal_cooling_device_setup_sysfs() that is not freed unle...

CVE-2022-49472

CVE-2022-49472 affects the Linux kernel PHY Micrel driver: if a .probe is present and .driver_data is missing, a NULL pointer dereference can occur. The fix adds NULL checks for priv->type to allow probing without .driver_data. Connected advisories (Astra/Unity Linux) reference Linux kernel ve...

CVE-2022-49524

CVE-2022-49524 relates to the Linux kernel media driver for cx23885 (pci) where the error path in cx23885_initdev() did not release I2C-related resources when dma_set_mask() failed. The concrete details describe that a failed dma_set_mask() leads to a use-after-free in __process_removed_driver, t...

CVE-2022-49527

In CVE-2022-49527, the Linux kernel media/venus/hfi path was fixed to avoid a null-dereference during deinitialization. If venus_probe fails at pm_runtime_put_sync, the error path previously called hfi_destroy (which sets core->ops to NULL) and then attempted hfi_core_deinit, which would deref...

CVE-2022-49556

The CVE-2022-49556 issue affects the Linux kernel KVM: SVM sev ioctl interfaces. It could cause leakage of uninitialized kernel memory when the length parameter is between SEV_FW_BLOB_MAX_SIZE and the returned data, due to using kmalloc. The fix uses kzalloc for sev ioctl interfaces to allocate c...

CVE-2022-49643

In the Linux kernel, the following vulnerability has been resolved: ima: Fix a potential integer overflow in ima_appraise_measurement When the ima-modsig is enabled, the rc passed to evm_verifyxattr() may benegative, which may cause the integer overflow problem.

CVE-2022-49685

CVE-2022-49685 affects the Linux kernel in the iio: trigger: sysfs path, where a use-after-free occurs in irq_work_run_list when removing a trigger. The advisory states the fix is to ensure that irq_work has completed before the trigger is freed, mitigating a use-after-free in the kernel’s IIO sy...

CVE-2022-49711

The CVE-2022-49711 issue affects the Linux kernel in the bus: fsl-mc-bus path. Root cause: in fsl_mc_bus_remove(), mc->root_mc_bus_dev->mc_io is passed to fsl_destroy_mc_io() after mc->root_mc_bus_dev has already been freed in fsl_mc_device_remove(), causing a KASAN use-after-free. Mitig...

CVE-2022-49727

CVE-2022-49727 : In the Linux kernel, the vulnerability affects the IPv6 L2TP send path (ipv6_sendmsg) where a signed integer overflow can occur when len >= INT_MAX - transhdrlen, causing ulen = len + transhdrlen to overflow. The fix mirrors the approach used in udpv6 by subtracting transhdrle...

CVE-2022-49906

The CVE-2022-49906 issue affects the Linux kernel ibmvnic driver: a path in the reset handling could leak 32 bytes by not freeing the rwi structure when the last rwi in the list is processed. A fix releases the rwi memory on reset success (kernel patch 4f408e1fa6e1 and related commits). Connected...

CVE-2022-49977

In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead ftrace_startup does not remove ops from ftrace_ops_list whenftrace_startup_enable fails: register_ftrace_functionftrace_startup__register_ftrace_fun...

CVE-2022-50051

CVE-2022-50051 affects the Linux kernel’s ASoC: SOF subsystem, specifically a debug path where a buffer overflow could occur due to using snprintf(). The vulnerability arises because snprintf() returns the would‑be‑filled size when the string exceeds the destination buffer, which can lead to an o...

CVE-2023-20849

The CVE-2023-20849 vulnerability is in the imgsys_cmdq component and is caused by missing valid range checking, leading to a use-after-free that can enable local privilege escalation with SYSTEM privileges. Exploitation requires user interaction. Affected context references MediaTek-related discl...

CVE-2023-52692

The CVE-2023-52692 entry concerns the Linux kernel ALSA Scarrett2 path: scarlett2_usb_set_config() calls scarlett2_usb_get() but does not verify its return value, continuing with an invalid value if get() fails. The vulnerability is resolved by returning the error from scarlett2_usb_get() instead...

CVE-2023-53038

CVE-2023-53038 concerns the Linux kernel: in scsi lpfc, the function lpfc_sli4_cgn_params_read() may encounter a kzalloc() failure, after which lpfc_read_object() dereferences pdata without a NULL check. The published fix changes the error code path from -ENODEV to -ENOMEM to reflect allocation f...

CVE-2023-53075

CVE-2023-53075 : In the Linux kernel, a ftrace lookup_rec() path can read records[-1].ip when index is 0, causing a KASAN use-after-free read via task modprobe. The root cause is an invalid access to pg->records[pg->index - 1].ip when pg->index is 0. The fix prevents IP checks when pg-&g...

CVE-2023-53096

CVE-2023-53096 is a Linux kernel issue where the node interconnect link array is allocated when adding links to a node but not deallocated when nodes are destroyed, causing a memory leak. The vulnerability is resolved in the kernel code by fixing the leak during node destruction. Affected compone...

CVE-2023-53131

CVE-2023-53131 refers to a Linux kernel issue in SUNRPC: a server shutdown leak caused by a race where kthread_stop() may prevent threadfn from running, leaving svc_rqst cleanup incomplete. The connected Nessus/OpenVAS entries for Unity Linux and EulerOS acknowledge the same description block and...

CVE-2024-26724

CVE-2024-26724 : In the Linux kernel, the mlx5 DPLL path (net/mlx5: DPLL) is affected by a use-after-free triggered by delayed-work timer handling. The issue is demonstrated by a KASAN slab-use-after-free in __run_timers and related callstack, with mlx5_dpll_probe allocating memory and mlx5_dpll_...

CVE-2024-26797

CVE-2024-26797 affects the Linux kernel's AMDGPU display path (drm/amd/display). The issue was a potential buffer overflow in map_hw_resources where an index could exceed array bounds. A bounds check was added to ensure the index stays within array limits; if out of bounds, an error is logged and...

CVE-2024-26854

The CVE-2024-26854 entry concerns the Linux kernel ice driver: the pf->dplls.lock mutex was initialized too late and is now moved to the top of ice_dpll_init to fix a use-before-initialization issue. The change also notes that err_exit path destroys the mutex and that ice_dpll_deinit destroys ...

CVE-2024-27021

In CVE-2024-27021, the Linux kernel r8169 LED handling caused a RTNL-related deadlock on module removal due to binding devm_led_classdev_register() to the netdev. The fix removes device-managed LED functions and ensures led_classdev_unregister() is safe even if registration failed. This mitigates...

CVE-2024-35833

CVE-2024-35833 affects the Linux kernel's dmaengine: fsl-qdma. The issue is a memory leak in the queue command DMA caused by dma_alloc_coherent() being undone in neither the remove path nor the error path of fsl_qdma_probe(). The advisory across connected sources states the fix is to switch to th...