CVE-2024-26721

In CVE-2024-26721, the Linux kernel’s drm/i915 dsc: PPS register address macro was wrong after PPS 11. The patch fixes the address calculation by adding an offset of 12 for PPS >= 12, correcting PPS 12–16 addresses that previously caused incorrect DSC PPS parameter reads/writes and potential D...

CVE-2022-48887

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Remove rcu locks from user resources User resource lookups used rcu to avoid two extra atomics. Unfortunatelythe rcu paths were buggy and it was easy to make the driver crash bysubmitting command buffers from two diff...

CVE-2022-49112

CVE-2022-49112 is a Linux kernel issue described in the provided docs as a fix for a monitor-mode crash involving the mt76/mt7921s stack. The problem arises when a CTS packet in monitor mode could cause improper skb handling due to only the first RXD buffer being linear; pulling RXD-size+6 bytes ...

CVE-2022-49120

CVE-2022-49120 pertains to the Linux kernel SCSI pm8001 path. The vulnerability is a task leak in pm8001_send_abort_all() where allocated SAS tasks may not be freed if pm8001_tag_alloc() or pm8001_mpi_build_cmd() fail. The fix ensures proper freeing of the SAS task in those failure paths. Public ...

CVE-2022-49189

CVE-2022-49189 : In the Linux kernel (clk-rcg2, Qualcomm display pixel clock), final D calculation for the M/N ratio could fall outside the accepted range, causing underflow. The fix updates the D-value calculation to respect the valid range for given M and N, preventing underflow. Affected compo...

CVE-2022-49212

Vulnerability (CVE-2022-49212) in the Linux kernel affects the MTD/Rawnand Atmel NAND driver. A refcounting bug on a refcounted object nc->dmac can miss a balance in several error paths after dma_request_channel(), potentially leaking a reference. The issue is fixed by decrementing the refcoun...

CVE-2022-49240

The CVE-2022-49240 issue is in the Linux kernel ASoC: mediatek mt8195 driver. The of_parse_phandle() call returns a device_node with refcount incremented, but of_node_put() is not invoked in the error path, causing a refcount leak; a fix ensures of_node_put() is called on the device_node in error...

CVE-2022-49242

CVE-2022-49242 relates to the Linux kernel ASoC: mxs driver. The issue is a refcount leak in error paths within mxs_sgtl5000_probe caused by only calling of_node_put() in the regular path; if codec_np is NULL, saif_np[0] and saif_np[1] may remain non-NULL and leak. The root cause is improper rele...

CVE-2022-49274

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix crash when mount with quota enabled There is a reported crash when mounting ocfs2 with quota enabled. RIP: 0010:ocfs2_qinfo_lock_res_init+0x44/0x50 [ocfs2]Call Trace:ocfs2_local_read_info+0xb9/0x6f0 [ocfs2]dquot_load_q...

CVE-2022-49282

CVE-2022-49282 is a Linux kernel issue affecting f2fs quota handling. The vulnerability stems from an incorrect loop condition in f2fs_quota_sync() where cnt should be passed to sb_has_quota_active() to correctly determine active quotas. When type is -1, the compiler may discard the check, potent...

CVE-2022-49352

CVE-2022-49352 relates to the Linux kernel ext4: fix warning in ext4_handle_inode_extension, where a write path can trigger inode size accounting inconsistencies under memory pressure. The issue describes an observed sequence where inode.i_size is 4096, but EXT4_I(inode)->i_disksize is set to ...

CVE-2022-49462

The CVE-2022-49462 issue affects the Linux kernel DRM MSM A6xx driver (a6xx_gpu_init). Root cause: of_parse_phandle() returns a node pointer with refcount incremented and a missing of_node_put() leads to a refcount leak. The code path in a6xx_gmu_init() passes the node to of_find_device_by_node()...

CVE-2022-49484

CVE-2022-49484 is a Linux kernel issue related to the mt76/mt7915 MAC RX vector handling. The provided documents state a fix for a possible NULL pointer dereference in mt7915_mac_fill_rx_vector that could occur when the chip does not support dbdc and the hardware reports band_idx = 1. The fix is ...

CVE-2022-49497

CVE-2022-49497 is a Linux kernel issue in the networking code where two BUG() calls were present in skb_checksum_help(). The vulnerability was resolved by removing these BUG()s and replacing them with WARN_ON_ONCE() so skb_checksum_help() can return an error code instead of triggering a crash whe...

CVE-2022-49502

CVE-2022-49502 relates to the Linux kernel, specifically the media driver component for the rga (graphics) device. The issue was a memory leak in rga_probe where the rga->m2m_dev could remain allocated if rga_probe failed, and the resolution requires freeing m2m_dev on probe failure. The vulne...

CVE-2022-49517

CVE-2022-49517 corresponds to a Linux kernel ASoC issue in Mediatek platforms: mt2701_wm8960_machine_probe incorrectly increments a phandle refcount without balancing it, leading to a refcount leak. The fix is to call of_node_put() to drop the reference. Connected advisories (Astra Linux and Ness...

CVE-2022-49521

In CVE-2022-49521, the Linux kernel vulnerability affects the lpfc SCSI path: if lpfc_complete_unsol_iocb() cannot match the rctl of a received frame, the frame is dropped and resources are leaked. The fix returns resources when discarding an unhandled frame type and updates lpfc_fc_frame_check()...

CVE-2022-49529

CVE-2022-49529 affects the Linux kernel’s DRM/AMDGPU PM code. Root cause: during context release with software SMU disabled, pp_funcs may be uninitialized, causing a NULL pointer dereference and kernel panic (as shown by the amdgpu_dpm_force_performance_level trace). The vulnerability is resolved...

CVE-2022-49530

CVE-2022-49530 affects the Linux kernel DRM/AMD power management code. The vulnerability arises in si_parse_power_table() where allocations for adev->pm.dpm.ps and its elements can be followed by a second free in si_dpm_fini() if an allocation fails, causing a potential double-free of adev-&gt...

CVE-2022-49620

CVE-2022-49620 (Linux kernel, net: tipc) Affects the Tipc subsystem: a potential refcount leak in tipc_sk_create() when tipc_sk_insert() fails. The fix ensures the sk is freed on failure, preventing a leak. The public description notes local attack vector with low privileges required and no user ...

CVE-2022-49640

The CVE-2022-49640 issue affects the Linux kernel’s sysctl path, specifically proc_douintvec_minmax(). A concurrent access to a sysctl variable led to potential data races; the fix patches the function to use READ_ONCE() and WRITE_ONCE() internally, addressing the data-race on the sysctl side. Th...

CVE-2022-49709

CVE-2022-49709 is a Linux kernel issue where using RCU_NONIDLE during the __cfi_slowpath_diag cpuidle code path can leave the RCU state invalid. The concrete details across connected documents show the root cause: improper RCU usage in cpuidle, leading to a warning trace (rcu_eqs_enter, rcu_idle_...

CVE-2022-49770

In the Linux kernel, the following vulnerability has been resolved: ceph: avoid putting the realm twice when decoding snaps fails When decoding the snaps fails it maybe leaving the 'first_realm'and 'realm' pointing to the same snaprealm memory. And then it'llput it twice and could cause random us...

CVE-2022-49960

CVE-2022-49960 concerns a Linux kernel vulnerability in the i915 DRM driver where a null pointer dereference in tgl_get_bw_info() (bi_next) can cause a kernel panic. The issue manifests during Asus Chromebooks booting on v5.17-rc1, producing an Oops and a fatal exception. The bug was fixed by the...

CVE-2022-50022

CVE-2022-50022 is a Linux kernel vulnerability in the md driver (RAID5) that can cause a use-after-free. The issue arises because raid5_release_stripe(sh) drops a reference to sh, but sh is later dereferenced (sh->batch_head) in the same function. The patch fixes this by moving raid5_release_s...

CVE-2022-50117

CVE-2022-50117 (Linux kernel) : The issue concerns VFIO with migration ops. The mlx5 driver registered migration ops (set_state/get_state) without respecting migration caps, potentially allowing user-space calls to ops not supported by the driver, e.g., leaving migration_state_mutex uninitialized...

CVE-2022-50190

The CVE-2022-50190 entry concerns a Linux kernel issue in the SPI subsystem: a change related to devm_spi_register_controller is reverted, and if devm_add_action() fails in devm_add_action_or_reset(), devm_spi_unregister() decreases ctlr->dev refcount to 0, potentially causing a use-after-free...

CVE-2023-39180

CVE-2023-39180 affects the Linux kernel ksmbd module. The root cause is improper memory release after the memory’s lifetime in SMB2_READ handling, enabling a network-based DoS without authentication on systems with ksmbd enabled. Public details confirm impact as denial-of-service; no vendor patch...

CVE-2023-52646

CVE-2023-52646 concerns the Linux kernel. A null-deref can occur when mremap is invoked on an old aio mapping after a fork because mm->ioctx_table is NULL. The issue was introduced by the patch that made it possible to remap the aio ring and has been fixed by the accompanying commit (e4a0d3e72...

CVE-2023-52701

The CVE-2023-52701 entry concerns Linux kernel net handling: copying skb marks and skb_cb data led to a memory exposure via usercopy checks, observed as a kernel crash on arm64 when CONFIG_HARDENED_USERCOPY=y. Root cause: copying data from skb->cb[] and skb->mark can bypass size checks; pat...

CVE-2023-52876

CVE-2023-52876 relates to the Linux kernel clk-mt7629-eth path where mtk_alloc_clk_data() could return NULL, risking a NULL pointer dereference. The fix adds a check on the return value to prevent dereferencing NULL and thus mitigates local privilege/escalation risk as described in the CVE detail...

CVE-2023-53023

The CVE-2023-53023 entry describes a use-after-free in the Linux kernel NFC local_cleanup path. Specifically, kfree_skb() can be invoked twice during nfc daemon teardown (e.g., neard) after detaching an NFC device, because local_cleanup() frees local->rx_pending and decrements local->ref tw...

CVE-2023-53037

Consolidated data shows CVE-2023-53037 affects the Linux kernel SCSI mpi3mr driver. When SAS Transport Layer is enabled and a device exposed to the OS fails INQUIRY, memory allocated for an internal HBA port data structure is freed but references to that freed memory are not cleared. If the firmw...

CVE-2023-53141

CVE-2023-53141 is a Linux kernel vulnerability described in the Unity/Nessus materials. The issue is in ila_xlat_nl_cmd_get_mapping() for IPv6 ila (used by netlink): it can generate an empty skb, which would trigger a sanity check. The fix is to return an error code instead of generating an empty...

CVE-2024-26760

Summary: CVE-2024-26760 affects the Linux kernel, specifically the SCSI PSCI path (scsi: target: pscsi). The issue stems from memory handling in bio_kmalloc: after a non-success path, bio_uninit() and kfree() are not reliably invoked, which can lead to a WARN and a NULL pointer dereference in bio...

CVE-2024-27411

CVE-2024-27411 affects the Linux kernel Nouveau driver (drm/nouveau nvkm). The vulnerability stems from deallocating a pair of DMA buffers that are required for suspend/resume post GPU init, which can trigger a system-wide rendering freeze on multi-GPU systems. A patch fixes the regression by mov...

CVE-2024-35785

CVE-2024-35785 affects the Linux kernel: a bug in the error path when registering devices on the TEE bus could trigger a kernel panic due to an incorrect error handling flow, specifically following the supplicant-based device enumeration change (commit 7269cba53d90). The issue manifests as a tran...

CVE-2024-35883

CVE-2024-35883 affects the Linux kernel's PCI SPI driver for mchp-pci1xxx. The issue is a potential null pointer dereference in pci1xxx_spi_probe caused by a failed devm_kzalloc, leading to dereferencing a null when spi_int/iter is accessed. Mitigation in the cited fix is to check spi_bus->spi...

CVE-2024-36887

CVE-2024-36887 affects the Linux kernel: the e1000e PHY mdic access code originally used usleep_range inside atomic contexts, causing potential kernel panics. A partial revert of a prior workaround reintroduced this by switching usleep_range calls to udelay. The fix is to revert to using usleep_r...

CVE-2024-36965

CVE-2024-36965 affects the Linux kernel remoteproc mediatek by adding a guard to ensure the IPI buffer fits in L2TCM. The IPI buffer address is read from firmware loaded to the System Companion Processor, and the SRAM/L2TCM size defined in the devicetree may be insufficient, especially for multi-...

CVE-2024-38568

The CVE-2024-38568 entry concerns the Linux kernel: drivers/perf: hisi: hns3. It fixes an out-of-bounds write in the event_group array when more events than HNS3_PMU_MAX_HW_EVENTS are added to a perf event group. Root cause: lack of array index bounds checking when writing to event_group[]. Impac...

CVE-2024-38590

CVE-2024-38590 affects the Linux kernel’s RDMA/hns component. The underlying issue is excessive printing of CQE-related errors, which can cause a kernel panic. The documented fix changes printing behavior: replace ibdev_err() with ibdev_err_ratelimited() and reduce CQE dump printing to debug leve...

CVE-2024-39478

CVE-2024-39478 affects the Linux kernel crypto: starfive implementation. The vulnerability stems from freeing a stack-allocated RSA text buffer (calling kfree on it) causing undefined behavior in later operations. The connected advisories reference Linux kernel patch commits fixing this issue (st...

CVE-2024-41045

CVE-2024-41045: Linux kernel vulnerability fixed in bpf_timer_cancel_and_free. The issue arises when canceling/ freeing timers embedded in BPF maps via bpf_map_update_elem, where timer cancellation uses hrtimer_cancel and could deadlock or cause use-after-free under RCUs. The patch suggests using...

CVE-2024-42248

CVE-2024-42248 : In the Linux kernel, the tty/serial Ma35d1 driver had a NULL dereference risk when the serial node is absent because of a missing of_node check. The fix adds a NULL check for of_node and returns an error if pdev->dev.of_node is NULL. Affected component: Linux kernel tty serial...

CVE-2024-42264

CVE-2024-42264 affects the Linux kernel drm/v3d component; the issue is an out-of-bounds access in performance query extensions due to unchecked perfmon user input when copying IDs. A fix was cherry-picked from commit f32b5128d2c440368b5bf3a7a356823e235caabb and backported to address an out-of-bo...

CVE-2024-50092

The CVE affects the Linux kernel netconsole code path. A warning is erroneously emitted when this_chunk equals zero in net: netconsole, instead of only when this_chunk is negative; userdata handling remains valid across iterations. This could mislead operators but the underlying userdata path is ...

CVE-2024-53199

CVE-2024-53199 affects the Linux kernel ASoC: imx-audmix driver. The bug was that devm_kasprintf() can return NULL on failure and imx_audmix_probe() did not check for it, risking a NULL pointer dereference. A NULL-check was added in imx_audmix_probe() to mitigate. The public-facing details specif...

CVE-2024-57953

CVE-2024-57953 affects the Linux kernel RTC driver (rtc: tps6594). On 32-bit systems a 64-bit tmp variable overflows when calculating tmp = offset * TICKS_PER_HOUR, because offset is a long and TICKS_PER_HOUR is very large (32768*3600). The description states the overflow occurs in tps6594_rtc_se...

CVE-2024-58003

CVE-2024-58003 affects the Linux kernel: the media i2c ds90ub9x3 driver family (ub913/ub953) could trigger a memory corruption/crash due to repeated removal calls. The root cause is a leftover call to fwnode_handle_put(priv->sd.fwnode) that was not removed when sd.fwnode handling changed in a ...