CVE-2022-48887

CVE-2022-48887 affects the Linux kernel DRM vmwgfx driver. User-resource lookups previously used RCU paths, which were buggy and could crash when command buffers were submitted from two threads. The fix replaces the RCU-based lookups with a regular spin lock to remove races in accesses to shared ...

CVE-2022-48904

CVE-2022-48904 (Linux kernel, IOMMU/AMD) : Fix for an I/O page table memory leak in the IOMMU when launching VMs with PCIe pass-through. Root cause: memory is freed after updating the I/O page table mode, causing leakage. Resolution: free the page-table memory before updating the mode. CVSSv3.1 b...

CVE-2021-47550

CVE-2021-47550 corresponds to a memleak in the Linux kernel DRM/AMD amdgpu path. Specifically, amdgpu_get_xgmi_hive may leak if kobject_init_and_add fails and kobject_put is not called. The connected Nessus/OpenVAS advisories reproduce this description and reference kernel-level fixes in the amdg...

CVE-2021-47652

The CVE-2021-47652 issue affects the Linux kernel driver path video: fbdev: smscufx (ufx_usb_probe). The root cause was a null pointer dereference when fb_alloc_cmap() fails in the probe path because modelist was not initialized yet; the error handling path called fb_destroy_modelist() leading to...

CVE-2022-0646

The CVE-2022-0646 issue affects the Linux kernel MCTP subsystem, caused by a use-after-free in the code path involving cancel_work_sync after unregister_netdev during device removal. It targets Linux Kernel 5.17-rc1 through 5.17-rc5, enabling a local attacker to crash the system or escalate privi...

CVE-2022-48633

CVE-2022-48633: In the Linux kernel, the gma500/psb_gem Unpin path could trigger a WARN_ON (lock->magic != lock) due to ww_mutex being destroyed by drm_gem_object_release(). The fix relocates drm_gem_object_release() to occur after psb_gem_unpin(), preventing the invalid lock state. Affected c...

CVE-2022-48697

The CVE-2022-48697 issue is a Linux kernel vulnerability in nvmet (NVMe target) where a use-after-free could occur in the nvmet request completion path (blk_mq_complete_request_remote and related nvmet/nvme_loop code). The provided documents confirm a fix was applied in the Linux kernel to addres...

CVE-2022-49017

CVE-2022-49017 (Linux kernel) : A use-after-free in Tipc processing was mitigated by re-fetching the skb control block from the newly allocated skb after tipc_msg_validate(), preventing dereferencing a freed skb. The issue manifested as a KASAN use-after-free in tipc_crypto_rcv_complete and relat...

CVE-2022-49102

CVE-2022-49102 affects the Linux kernel. The issue, resolved by a patch from habanalabs, fixes a memory leak in the MMU DR finalization path when the host-resident shadow is NULL, which can occur because the DR and HR are not dependent. The patch addresses a copy-paste error and prevents the leak...

CVE-2022-49106

CVE-2022-49106 affects the Linux kernel (staging: vchiq_arm). The root cause is a potential NULL pointer dereference in vchiq_dump_platform_instances when vchiq_get_state() may return NULL. The vulnerability could impact kernel availability with local access required. A fix is included in upstrea...

CVE-2022-49131

CVE-2022-49131 concerns a Linux kernel kernel-panic in the ath11k driver while unloading/loading modules on some ARM platforms. The root cause is a dereference path leading to an OOPS in napi_by_id during netif_napi_add, which could occur over repeated unload/load cycles. The fixed fix is to call...

CVE-2022-49189

CVE-2022-49189 : In the Linux kernel (clk-rcg2, Qualcomm display pixel clock), final D calculation for the M/N ratio could fall outside the accepted range, causing underflow. The fix updates the D-value calculation to respect the valid range for given M and N, preventing underflow. Affected compo...

CVE-2022-49196

The Linux kernel contains a use-after-free vulnerability in the remove_phb_dynamic() function within the arch/powerpc/platforms/pseries/pci_dlpar.c module. The issue occurs because the code accesses &phb->io_resource after calling device_unregister(&host_bridge->dev), which may free the phb...

CVE-2022-49284

The CVE-2022-49284 entry affects the Linux kernel coresight subsystem (syscfg: cscfg_create_device). The issue is a memory leak on registration failure caused by improper error handling in device_register() after device_initialize(); the recommended fix is to use put_device() to relinquish the re...

CVE-2022-49354

CVE-2022-49354 is a Linux kernel issue where a refcount leak in octeon_pata_OCTEON code was fixed. The vulnerability stems from refcount handling in pata_octeon_cf during octeon_cf_probe and in the usage of of_find_device_by_node() which took a reference but was not released with put_device(). Th...

CVE-2022-49422

CVE-2022-49422: Linux kernel dmaengine idxd vulnerability. Root cause: error path in idxd_cdev_register() for alloc_chrdev_region() failures leaks allocated resources. Impact is local with high availability impact as per the CVE entry. Affected context is the idxd driver in the kernel; remediatio...

CVE-2022-49449

The CVE-2022-49449 issue affects Linux kernel pinctrl: renesas: rzn1. The root cause is a possible null-ptr-deref when using 'res' if platform_get_resource() returns NULL. The patch defers dereferencing 'res' by performing devm_ioremap_resource() first (which validates the resource) and then uses...

CVE-2022-49481

The CVE-2022-49481 entry details a Linux kernel regulator issue: pfuze100 refcount leak in pfuze_parse_regulators_dt caused by of_node_get() returning a node with an incremented refcount. The fix adds a drop of the reference via of_node_put() when the node is no longer needed. There is no public ...

CVE-2022-49505

Mode C: The CVE-2022-49505 issue affects the Linux kernel NFC subsystem. The root cause is a UAF (use-after-free) of the rfkill object in the NFC device handling: during nfc_dev_up() and related operations, the rfkill state could be dereferenced if the device is removed via nfc_unregister_device(...

CVE-2022-49524

The Linux kernel contains a use-after-free vulnerability in the media: pci: cx23885 driver. The issue is caused by improper error handling in the cx23885_initdev() function; specifically, the driver fails to release i2c-related resources initialized in cx23885_dev_setup() if the subsequent dma_se...

CVE-2022-49569

CVE-2022-49569 affects the bcm2835 SPI driver in the Linux kernel. When an IRQ-based transfer times out, bcm2835_spi_handle_err() could dereference ctlr->dma_tx/ctlr->dma_rx if DMA pointers are not set, due to the removal of the dma_pending flag. A fix was implemented to check that ctlr-&gt...

CVE-2022-49661

Affected component: Linux kernel, gs_usb driver (USB CAN adapter). Issue: memory leak in gs_usb_open/close where RX URBs allocated with usb_alloc_coherent() were not freed by usb_kill_anchored_urbs() and DMA memory leaked. Root cause: improper freeing pattern; the fix explicitly frees RX URBs and...

CVE-2022-49685

The Linux kernel is affected by a use-after-free vulnerability within the iio: trigger: sysfs component. The root cause is the failure to ensure that irq_work has completed before the trigger is freed during a remove operation. This issue was identified via KASAN reports showing a read of size 8 ...

CVE-2022-49693

CVE-2022-49693 : In the Linux kernel, there is a refcount leak in the drm/msm/mdp4 path during mdp4_modeset_init_intf caused by not releasing the remote device node pointer obtained from of_graph_get_remote_node(). The pointer’s refcount is incremented but not decremented with of_node_put() when ...

CVE-2022-49709

CVE-2022-49709 is a Linux kernel issue where using RCU_NONIDLE during the __cfi_slowpath_diag cpuidle code path can leave the RCU state invalid. The concrete details across connected documents show the root cause: improper RCU usage in cpuidle, leading to a warning trace (rcu_eqs_enter, rcu_idle_...

CVE-2022-49733

The CVE-2022-49733 entry concerns the Linux kernel ALSA: pcm: oss – a race in snd_pcm_oss_sync() used by the OSS SNDCTL_DSP_SYNC ioctl. The vulnerability arises because snd_pcm_oss_sync() first calls snd_pcm_oss_make_ready(), then uses the params_lock mutex for the rest, allowing a thread to re-e...

CVE-2022-49906

The CVE-2022-49906 issue affects the Linux kernel ibmvnic driver: a path in the reset handling could leak 32 bytes by not freeing the rwi structure when the last rwi in the list is processed. A fix releases the rwi memory on reset success (kernel patch 4f408e1fa6e1 and related commits). Connected...

CVE-2022-49957

CVE-2022-49957 concerns a Linux kernel issue in the kcm path where strp_init() is invoked before the csk->sk_user_data check. The vulnerability arises because strp_init() initializes strp->work (and others); calling strp_done() to cancel it is unnecessary if sk_user_data isn’t checked yet. ...

CVE-2022-50022

CVE-2022-50022 is a Linux kernel vulnerability in the md driver (RAID5) that can cause a use-after-free. The issue arises because raid5_release_stripe(sh) drops a reference to sh, but sh is later dereferenced (sh->batch_head) in the same function. The patch fixes this by moving raid5_release_s...

CVE-2022-50115

CVE-2022-50115 : In the Linux kernel, the ASoC: SOF: ipc3-topology vulnerability caused potential memory corruption due to a double free of ipc_control_data in error/rollback paths when load_bytes-related validation fails. The issue arose because scontrol->ipc_control_data could be freed but n...

CVE-2022-50151

CVE-2022-50151 concerns a Linux kernel issue in usb: cdns3 where a kmalloc call uses GFP_DMA32 flags when allocating a page for a DMA pool, triggering a warning like “Unexpected gfp: GFP_DMA32” and a corrective log. The root cause is the mixing of GFP_DMA32 with dma_pool_alloc/dma_alloc_coherent ...

CVE-2023-22996

CVE-2023-22996 affects the Linux kernel prior to 5.17.2. In drivers/soc/qcom/qcom_aoss.c, an of_find_device_by_node reference is not released after use (e.g., via put_device), which can lead to a lingering reference. The practical impact and exploitability are not described in the provided docume...

CVE-2023-3357

CVE-2023-3357 describes a NULL pointer dereference in the Linux kernel AMD Sensor Fusion Hub driver. This vulnerability can be exploited by a local user to crash the system (local impact). Connected sources indicate a patched kernel is available; e.g., SUSE advisories note kernel updates for affe...

CVE-2023-53116

CVE-2023-53116 (Linux kernel nvmet UAF fix) The vulnerability occurs in nvmet_req_complete() when an nvme target’s queue_response() implementation frees the passed request. This could cause a use-after-free of the request pointer after percpu_ref_put() is invoked. The publicly available advisory ...

CVE-2023-53131

CVE-2023-53131 refers to a Linux kernel issue in SUNRPC: a server shutdown leak caused by a race where kthread_stop() may prevent threadfn from running, leaving svc_rqst cleanup incomplete. The connected Nessus/OpenVAS entries for Unity Linux and EulerOS acknowledge the same description block and...

CVE-2024-26715

CVE-2024-26715 affects the Linux kernel's USB subsystem, specifically the DWC3 gadget driver. The issue is a NULL pointer dereference in dwc3_gadget_suspend that can occur when plug-out/plug-in cycles race with gadget_driver being cleared, allowing a path where a non-NULL dwc->gadget_driver is...

CVE-2024-26728

Summary (CVE-2024-26728) : The Linux kernel module path drm/amd/display contains a fixed null-pointer dereference in EDID reading. The underlining issue occurs when EDID data is read without an aux_mode in the dc_link, leading to a kernel oops during i2c_edid probing in systems with DCN2.1 and HD...

CVE-2024-26756

The CVE-2024-26756 issue affects the Linux kernel’s md (multidisk) subsystem, specifically the raid reshape path. The root cause was registering the sync_thread directly from pers->run() during an interrupted reshape, which could set MD_RECOVERY_RUNNING without guaranteeing that md_do_sync() w...

CVE-2024-26768

The CVE-2024-26768 issue affects the Linux kernel LoongArch ACPI MADT handling. The root cause was an overflow of acpi_core_pic[NR_CPUS] when the MADT table includes more CPUs than NR_CPUS (default NR_CPUS=64). The patch defines the array as acpi_core_pic[MAX_CORE_PIC] to match physical cores, pr...

CVE-2024-35987

CVE-2024-35987 relates to the Linux kernel on RISCV NOMMU. The issue arose from enabling a linear mapping that used RAM below the kernel load address, which breaks NOMMU because PAGE_OFFSET is fixed to the load address. As a result mm initialization can start at mem_map and corrupt adjacent kerne...

CVE-2024-35994

CVE-2024-35994 concerns the Linux kernel firmware driver for Qualcomm QSEE/QSEECom (uefisecapp). The issue stems from the QSEECOM APP_SEND command handling: the driver originally treated request and response buffers as separate DMA regions, but the firmware expects both buffers to live in a singl...

CVE-2024-40944

CVE-2024-40944 affects the Linux kernel (x86/kexec). The vulnerability is a bug in call depth tracking where calling cc_platform_has() may fault if depth tracking is active because GS_BASE is reset to 0 by load_segments(). The mitigation described in the documentation is to invoke cc_platform_has...

CVE-2024-42091

CVE-2024-42091 — Linux kernel, module: drm/xe. The issue arose when dumping PAT settings via debugfs without validating pat.ops, allowing a null or unset pat.ops pointer to be used, which could lead to a denial/Not-Provided detail? (NPD) scenario. The fixed behavior patches the code to check the ...

CVE-2024-43850

CVE-2024-43850 affects the Linux kernel’s Qualcomm icc-bwmon: a refcount imbalance can occur during bwmon_remove, triggering a kernel warning and potentially delaying OPP releases. The OSV and vendor advisories corroborate the issue and describe the fix as a code correction in the bwmon removal p...

CVE-2024-43891

Summary (CVE-2024-43891) The Linux kernel tracing subsystem vulnerability arises from a race where the format file for events/user_events/__test_event/format could be accessed after its metadata indicated the file was freed. A shortcut used for the format file caused it to skip pointer checks, so...

CVE-2024-44966

The CVE-2024-44966 entry concerns a Linux kernel issue in the binfmt_flat component. A RISC-V specific FLAT format variant allocated no space for the shared library pointer region, but code initializing that region was not disabled, causing corruption of sizeof(long) bytes before the DATA segment...

CVE-2024-45030

CVE-2024-45030 affects the Linux kernel igb driver: when MAX_SKB_FRAG is set to very large values (e.g., 45), payload corruption can occur on TX, demonstrated by an SSH session repro. Root cause: the driver fails to account for possibly large shared info size when choosing ring layout and may att...

CVE-2024-46683

CVE-2024-46683 refers to a Linux kernel vulnerability in the DRM/xe path where a use-after-free could occur around the preempt fence due to dropping the queue reference before the fence lock is secured. The issue arises because the fence lock was previously associated with the queue, and releasin...

CVE-2024-46850

CVE-2024-46850 affects the Linux kernel DRM/AMD display path: the dcn35_set_drr() function in the AMD DC hardware sequencing code can race with dc_state_destruct() which nulls the DC state resource context. If destruction occurs in parallel with IRQ processing that calls dcn35_set_drr(), callback...

CVE-2024-47708

CVE-2024-47708 : In the Linux kernel, the netkit driver missed assigning the required bpf_net_context during XDP-redirect handling, causing a NULL pointer dereference when NETKIT_REDIRECT invokes skb_do_redirect() and accesses per-CPU variables. The fix is to set the bpf_net_context before callin...