CVE-2008-3272

The CVE-2008-3272 issue affects the Linux kernel sound subsystem (sound/core/seq/oss/seq_oss_synth.c). The root cause is that snd_seq_oss_synth_make_info does not verify that the device number lies within the range defined by max_synthdev before returning data, enabling local users to leak sensit...

CVE-2009-2849

CVE-2009-2849 affects the Linux kernel md driver (drivers/md/md.c) prior to version 2.6.30.2. The issue allows local attackers to trigger a NULL pointer dereference in suspend_lo_store and suspend_hi_store via writable sysfs suspend_* attributes, potentially causing a denial of service. The vulne...

CVE-2009-3290

CVE-2009-3290 affects KVM in Linux kernel 2.6.25-rc1 and earlier than 2.6.31 on x86. The kvm_emulate_hypercall implementation fails to restrict MMU hypercalls by CPL, enabling a local guest user to crash the guest kernel and read/write guest memory via unspecified addresses. Root cause: CPL check...

CVE-2009-3613

The CVE-2009-3613 issue affects the Linux kernel swiotlb implementation in the r8169 driver (drivers/net/r8169.c) and is exploitable before kernel version 2.6.27.22. Remote attackers can trigger a denial of service by sending large amounts of jumbo frames (e.g., flood ping), exhausting IOMMU spac...

CVE-2010-2066

CVE-2010-2066 affects the Linux kernel up to version 2.6.34. The flaw is in fs/ext4/move_extent.c: the mext_check_arguments routine, which can allow a local attacker to overwrite an append-only file when using the MOVE_EXT ioctl and designating that file as the donor. The issue arises from insuff...

CVE-2010-4076

CVE-2010-4076 affects Linux kernel 2.6.36.1 and earlier. The rs_ioctl function in drivers/char/amiserial.c does not initialize a structure member, enabling local users to read potentially sensitive information from kernel stack memory via TIOCGICOUNT. A fix is to apply the kernel update that addr...

CVE-2011-0710

CVE-2011-0710 affects the Linux kernel on the s390 platform. The function task_show_regs in arch/s390/kernel/traps.c permits a local user to read the registers of an arbitrary process by reading a status file under /proc, for kernels before 2.6.38-rc4-next-20110216. The connected MiracleLinux adv...

CVE-2011-2479

CVE-2011-2479 affects the Linux kernel up to version 2.6.38.x and allows a local user to trigger a denial of service by a crafted MAP_PRIVATE mmap on /dev/zero that causes THP creation to misbehave. The vulnerability is in transparent huge pages handling and can crash the system. A fix exists in ...

CVE-2011-3363

The CVE-2011-3363 issue affects the Linux kernel up to version 2.6.38, specifically the setup_cifs_sb function in fs/cifs/connect.c. The root cause is improper handling of DFS referrals, enabling a remote CIFS server to trigger a denial-of-service (system crash) by placing a referral at the root ...

CVE-2011-4915

CVE-2011-4915 affects the Linux kernel, specifically the file fs/proc/base.c, up to version 3.1. It enables a local attacker to disclose sensitive keystroke information by accessing /proc/interrupts, constituting an information-disclosure vulnerability. Root cause: improper exposure of keystroke-...

CVE-2013-2850

CVE-2013-2850: Heap-based buffer overflow in the Linux kernel’s iSCSI target subsystem (iscsi_add_notunderstood_response in drivers/target/iscsi/iscsi_target_parameters.c) affects kernel versions up to 3.9.4. The flaw can allow remote attackers to trigger memory corruption and OOPS, with potentia...

CVE-2013-3231

CVE-2013-3231 affects the Linux kernel prior to 3.9-rc7. The llc_ui_recvmsg function in net/llc/af_llc.c does not initialize a certain length variable, enabling local users to leak sensitive information from kernel stack memory via crafted recvmsg or recvfrom syscalls. This is a local information...

CVE-2016-2065

The CVE-2016-2065 entry concerns the MSM QDSP6 audio driver (sound/soc/msm/qdsp6v2/msm-audio-effects-q6-v2.c) in the Linux kernel 3.x, used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices. The flaw arises from incorrect use of a parameters pointer when handling an ioctl...

CVE-2016-2853

CVE-2016-2853 – Linux kernel aufs Privilege Escalation : The vulnerability arises in the aufs module (Linux kernel 3.x/4.x) where mount namespace restrictions are insufficient. A local attacker can mount an aufs filesystem atop a FUSE filesystem and, by executing a crafted setuid program, escalat...

CVE-2016-3139

CVE-2016-3139 : The Linux kernel before 3.17 is vulnerable in drivers/input/tablet/wacom_sys.c (wacom_probe). A crafted endpoints value in a USB device descriptor can be exploited by a physically proximate attacker to trigger a NULL pointer dereference, causing a denial of service (system crash)....

CVE-2021-47301

Summary: CVE-2021-47301 affects the Linux kernel igb/igc driver stack. Root cause: a use-after-free in the reset path where next_to_watch is not cleared while cleaning the TX ring, risking a freed skb being freed again if igb_poll() executes during reset. Impact: potential invalid memory accesses...

CVE-2021-47324

CVE-2021-47324 relates to the Linux kernel watchdog driver. The issue is a use-after-free risk in wdt_startup() caused by the remove path calling del_timer() instead of waiting for the timer handler to finish. The timer handler could still be running after the driver’s remove function returns, po...

CVE-2021-47335

CVE-2021-47335 (Linux kernel, f2fs) : A race on the global fsync_entry_slab across multi filesystem instances caused a use-after-free in the slab cache during f2fs recovery. The root cause is concurrent access to the slab pointer when multiple f2fs mounts exist, leading to a use-after-free during...

CVE-2021-47346

The CVE-2021-47346 entry concerns a Linux kernel vulnerability in coresight’s tmc-etf path. A global-out-of-bounds read (KASAN) occurred in tmc_update_etf_buffer() due to reading barrier_pkt beyond its allocated size after barrier_pkt trailing null removal in a prior patch. The issue is triggered...

CVE-2021-47358

CVE-2021-47358 concerns the Linux kernel staging/greybus uart use-after-free vulnerability. The root cause is improper lifetime management of greybus tty state after disconnect, allowing user-space processes to hold an open tty indefinitely and for tty drivers to release underlying structures whi...

CVE-2021-47374

CVE-2021-47374 concerns the Linux kernel DMA debugging code (kernel/dma/debug.c). The issue arises when drivers using the DMA API emit an error condition frequently, causing a flood of printk messages that can drive CPU usage to 100%. The documented fix switches handling from simple rate limiting...

CVE-2021-47460

CVE-2021-47460 affects the ocfs2 code path in the Linux kernel. The vulnerability arises during conversion from inline inode data to extents, where the converter zeroed the entire data cluster by touching pages beyond i_size, which writeback may ignore, causing data loss after file growth. A fix ...

CVE-2021-47547

CVE-2021-47547 is a Linux kernel vulnerability in the tulip de4x5 driver. The fix prevents an out-of-bounds access of the array lp->phy[8] when the loop ends with k==8, which could occur if all ids in lp->phy[8] are non-zero. The connected Astra Linux bulletin mirrors this kernel issue and ...

CVE-2021-47550

CVE-2021-47550 corresponds to a memleak in the Linux kernel DRM/AMD amdgpu path. Specifically, amdgpu_get_xgmi_hive may leak if kobject_init_and_add fails and kobject_put is not called. The connected Nessus/OpenVAS advisories reproduce this description and reference kernel-level fixes in the amdg...

CVE-2021-47602

CVE-2021-47602 affects the Linux kernel mac80211 QoS admission-control path. The root cause was an uninitialized-value path triggered by non-QoS nullfunc packets, which could access the QoS header. The fix restricts all actions to QoS data packets, preventing misuse from non-QoS traffic. Remediat...

CVE-2021-47612

CVE-2021-47612 (Linux kernel) — A vulnerability in nf cGenl dump paths can cause a null-pointer dereference and kernel crash when kmalloc in nfc_genl_dump_devices() fails, leading to a segfault in nfc_genl_dump_devices_done and related netlink/worker threads. The issue is fixed in the Linux kerne...

CVE-2021-47632

CVE-2021-47632 affects the Linux kernel on PowerPC where a spin_lock in change_page_attr() for set_memory caused spinlock recursion. The fix removes the read/modify/write sequence and the spin_lock(), and uses atomic handling of page-flag sets (_PAGE_KERNEL_RO/ROX/RW/RWX) by comparing flag sets t...

CVE-2022-0646

The CVE-2022-0646 issue affects the Linux kernel MCTP subsystem, caused by a use-after-free in the code path involving cancel_work_sync after unregister_netdev during device removal. It targets Linux Kernel 5.17-rc1 through 5.17-rc5, enabling a local attacker to crash the system or escalate privi...

CVE-2022-48954

CVE-2022-48954 refers to a use-after-free in s390/qeth HSci path, where KASAN observed dereference of a freed br2dev_event_work object in qeth_l2_br2dev_worker. Multiple vendor advisories (SUSE SUSE-SU-2024:4131-1, SUSE-SU-2024:4364-1 and OSV entries) summarize the issue and list the affected com...

CVE-2022-49007

CVE-2022-49007 affects the Linux kernel/NILFS2. A NULL pointer dereference in nilfs_palloc_commit_free_entry() could occur during DAT metadata handling when a lower-level DAT block’s entry is clobbered during commit, leading to a crash. The fix adds NULL checks in nilfs_dat_commit_free() for req-...

CVE-2022-49115

CVE-2022-49115 is a Linux kernel vulnerability in the PCI: endpoint subsystem where a misused goto label could lead to a memory leak. The description across connected advisories reiterates the same root cause and states that a fix was applied in the kernel (commit history referenced in the linked...

CVE-2022-49119

In the Linux kernel, CVE-2022-49119 concerns a memory leak in the SCSI pm8001 path: in pm8001_chip_fw_flash_update_build(), if the build fails, the previously allocated fw_control_ex must be freed. The issue is resolved by applying the fix in the pm8001_chip_fw_flash_update_req/build flow. Affect...

CVE-2022-49209

CVE-2022-49209 concerns a memleak in the Linux kernel related to bpf/sockmap path when sk_msg_alloc() returns -ENOMEM during tcp_bpf_sendmsg and related paths (e.g., tls_sw_sendmsg). The root cause is partial memory allocation (msg_tx->sg.size > osize) leaving allocated memory unreleased if...

CVE-2022-49303

CVE-2022-49303 concerns a Linux kernel deadlock in the rtl8192eu driver (drivers/staging/rtl8192eu) during rtw_joinbss_event_prehandle. The provided details describe a lock-order issue: thread 1 holds pmlmepriv->lock while waiting on del_timer_sync(), but the timer handler (thread 2) also need...

CVE-2022-49346

CVE-2022-49346 is a Linux kernel vulnerability in the net: dsa: lantiq_gswip path. The issue is a refcount leak in gswip_gphy_fw_list caused by every iteration of for_each_available_child_of_node() decrementing the previously referenced node, and a missing explicit of_node_put() when breaking ear...

CVE-2022-49422

CVE-2022-49422: Linux kernel dmaengine idxd vulnerability. Root cause: error path in idxd_cdev_register() for alloc_chrdev_region() failures leaks allocated resources. Impact is local with high availability impact as per the CVE entry. Affected context is the idxd driver in the kernel; remediatio...

CVE-2022-49425

CVE-2022-49425 affects the Linux kernel's f2fs component. The vulnerability arises from dereferencing a stale list iterator after a loop, where cur->page could become a bogus pointer if no break is hit, risking out-of-bounds/undefined values during comparison with page. The documented fix intr...

CVE-2022-49445

CVE-2022-49445 is described in the initial document as a Linux kernel vulnerability where pinctrl: renesas: core could dereference a NULL pointer in sh_pfc_map_resources() if platform_get_resource() returns NULL. The fix moves using the resource after devm_ioremap_resource() (which checks NULL) a...

CVE-2022-49481

The CVE-2022-49481 entry details a Linux kernel regulator issue: pfuze100 refcount leak in pfuze_parse_regulators_dt caused by of_node_get() returning a node with an incremented refcount. The fix adds a drop of the reference via of_node_put() when the node is no longer needed. There is no public ...

CVE-2022-49555

Summary: CVE-2022-49555 is tied to the Linux kernel Bluetooth subsystem (hci_qca). The issue arises when a timer is freed while still active due to code calling del_timer() instead of del_timer_sync(), risking timer-list corruption. The description notes that the hci_qca driver may trigger this, ...

CVE-2022-49569

CVE-2022-49569 affects the bcm2835 SPI driver in the Linux kernel. When an IRQ-based transfer times out, bcm2835_spi_handle_err() could dereference ctlr->dma_tx/ctlr->dma_rx if DMA pointers are not set, due to the removal of the dma_pending flag. A fix was implemented to check that ctlr-&gt...

CVE-2022-49607

CVE-2022-49607 concerns a data race in the Linux kernel between perf_event_set_output() and perf_mmap_close() in the perf/core subsystem. The root cause is a race where perf_mmap_close() holds e2->mmap_mutex while perf_event_set_output() holds e1->mmap_mutex, allowing no serialization and p...

CVE-2022-49685

CVE-2022-49685 affects the Linux kernel in the iio: trigger: sysfs path, where a use-after-free occurs in irq_work_run_list when removing a trigger. The advisory states the fix is to ensure that irq_work has completed before the trigger is freed, mitigating a use-after-free in the kernel’s IIO sy...

CVE-2022-49709

CVE-2022-49709 is a Linux kernel issue where using RCU_NONIDLE during the __cfi_slowpath_diag cpuidle code path can leave the RCU state invalid. The concrete details across connected documents show the root cause: improper RCU usage in cpuidle, leading to a warning trace (rcu_eqs_enter, rcu_idle_...

CVE-2022-49957

CVE-2022-49957 concerns a Linux kernel issue in the kcm path where strp_init() is invoked before the csk->sk_user_data check. The vulnerability arises because strp_init() initializes strp->work (and others); calling strp_done() to cancel it is unnecessary if sk_user_data isn’t checked yet. ...

CVE-2022-50132

CVE-2022-50132 (Linux kernel) affects the usb: cdns3 gadget code. The root cause is an invalid dereference when ep is NULL due to the placement of the priv_ep assignment. The vulnerability is resolved by changing the assignment location in cdns3_gadget_ep_dequeue() and cdns3_gadget_ep_enable(), p...

CVE-2023-52519

CVE-2023-52519 — Linux kernel (intel-ish-hid) : On Elkhart Lake (EHL) based systems, an Out-of-Band wake service can enable PME wake. The ISH driver must re-enable the ACPI GPE bit on resume to preserve wake capability, but BIOS clears the bit without decrementing the OS GPE reference count, caus...

CVE-2023-52799

In Linux kernel, CVE-2023-52799 relates to an array-index-out-of-bounds in the JFS path during dmtree_t searches for free blocks (tp->dm_stree). The fix adds a parameter to dbFindLeaf to determine the dmtree type, enabling an out-of-bounds check and preventing access beyond array bounds. Affec...

CVE-2023-52816

CVE-2023-52816 relates to a Linux kernel flaw in drm/amdkfd where a UBSAN shift out-of-bounds occurs when shifting exponent 255, which is too large for a 64-bit unsigned long during a page-fault/get_user path. Impact is high (local exploitability per CVSS), and the issue is fixed by kernel patche...

CVE-2023-52865

CVE-2023-52865 affects the Linux kernel clk-mt6797 clock-data path. The vulnerability arises from not validating the return value of mtk_alloc_clk_data(), which could lead to a NULL pointer dereference. The fix adds a check for the return value to prevent NULL dereference and stabilize clock data...