CVE-2021-47418

CVE-2021-47418 refers to a Linux kernel vulnerability in net_sched: a NULL pointer dereference inside fifo_set_limit() that could OOPS when adjusting limits on certain qdiscs (notably pfifo_fast, which lacks a change() operation). The issue was reproduced via syzbot and the fix makes fifo_set_lim...

CVE-2009-3613

The CVE-2009-3613 issue affects the Linux kernel swiotlb implementation in the r8169 driver (drivers/net/r8169.c) and is exploitable before kernel version 2.6.27.22. Remote attackers can trigger a denial of service by sending large amounts of jumbo frames (e.g., flood ping), exhausting IOMMU spac...

CVE-2010-1084

CVE-2010-1084 affects Linux kernel 2.6.18–2.6.33 (and possibly other versions); vulnerability arises from memory corruption triggered by a large number of Bluetooth sockets, related to sysfs file sizing in net/bluetooth/l2cap.c, net/bluetooth/rfcomm/core.c, net/bluetooth/rfcomm/sock.c, and net/bl...

CVE-2010-4162

CVE-2010-4162: Linux kernel before 2.6.36.2 contains multiple integer overflows in fs/bio.c that allow local users to cause a denial of service (system crash) via a crafted device ioctl to a SCSI device. MiracleLinux AXSA:2011-57 lists CVE-2010-4162 among affected kernel issues and references a f...

CVE-2010-4250

CVE-2010-4250 concerns a memory leak in the inotify_init1 path of the Linux kernel’s inotify subsystem (fs/notify/inotify/inotify_user.c) prior to kernel 2.6.37. The issue is triggered by failed attempts to create files, allowing local users to exhaust memory and potentially cause a denial of ser...

CVE-2010-4529

CVE-2010-4529 refers to an integer underflow in the irda_getsockopt function (net/irda/af_irda.c) of the Linux kernel prior to 2.6.37 on non-x86 platforms. This underflow could allow a local attacker to obtain potentially sensitive information from kernel heap memory via an IRLMP_ENUMDEVICES gets...

CVE-2011-4326

CVE-2011-4326 affects the Linux kernel’s UDP fragment handling for IPv6 when UDP Fragmentation Offload (UFO) is enabled. Specifically, the vulnerability lies in udp6_ufo_fragment in net/ipv6/udp.c, allowing remote attackers to crash the system by sending fragmented IPv6 UDP packets to a bridge. T...

CVE-2013-2634

CVE-2013-2634 affects the Linux kernel prior to 3.8.4. The issue: net/dcb/dcbnl.c does not initialize certain structures, enabling a local attacker to read sensitive data from kernel stack memory via a crafted application. Connected advisories (e.g., MiracleLinux AXSA-2013-592:07) corroborate the...

CVE-2014-0049

CVE-2014-0049 affects the Linux kernel up to version 3.13.5 via a buffer overflow in the complete_emulated_mmio path of arch/x86/kvm/x86.c. The flaw allows a guest OS user to trigger an invalid memory copy that can lead to arbitrary code execution on the host. The published fix is in Linux kernel...

CVE-2015-1465

The CVE-2015-1465 issue affects the Linux kernel IPv4 code prior to 3.18.8, where the RCU grace period length is not properly considered when redirecting lookups without caching. This can allow remote attackers to cause a denial of service via a flood of packets, leading to memory consumption or ...

CVE-2015-8967

From connected documents: CVE-2015-8967 affects the Linux kernel's arch/arm64/kernel/sys.c prior to version 4.0. Local users with write access can bypass the kernel’s strict page permissions and modify the system-call table to gain privileges, implying local privilege escalation. A patch/commit a...

CVE-2018-12929

CVE-2018-12929 concerns the Linux kernel ntfs_read_locked_inode vulnerability in ntfs.ko on kernel 4.15.0, which can trigger a use-after-free read and potentially cause a denial of service (kernel oops or panic) via a crafted NTFS filesystem. The available documents confirm the CVE ID and the aff...

CVE-2021-47108

Linux kernel vulnerability CVE-2021-47108 affects Mediatek HDMI support (drm/mediatek) where MT8173 can crash due to a NULL mtk_hdmi_conf dereference when a HDMI cable is plugged in. The issue was addressed by adding a NULL pointer check in mtk_hdmi_bridge_mode_valid() (commit 41ca9caaae0b) and p...

CVE-2021-47136

CVE-2021-47136 : In the Linux kernel Mellanox mlx5 driver, the tc skb extension (TC_SKB_EXT) may be left uninitialized due to not zero-initializing new fields when the extension is allocated, causing UBSAN-invalid loads. The connected document specifies the vulnerable code path as mlx5e_rep_tc_up...

CVE-2021-47149

The CVE-2021-47149 entry concerns a Linux kernel vulnerability in the Fujitsu net driver where fmvj18x_get_hwinfo() dereferences NULL if ioremap fails. The fix adds a check on the ioremap return value and returns -1 to the caller on failure, preventing a NULL pointer dereference. Public details i...

CVE-2021-47237

CVE-2021-47237 relates to a memory leak in the Linux kernel’s net: hamradio mkiss driver. The issue occurs because mkiss_open() allocates a net device but mkiss_close() only unregisters it without freeing, leading to multiple unreferenced objects and memory leaks reported in syzbot logs. The conn...

CVE-2021-47269

CVE-2021-47269 is a Linux kernel issue in the DesignWare USB3 (dwc3) ep0 handling. The root cause is missing validation of the ep index from dwc3_wIndex_to_dep(), which can lead to referring to a non-existing endpoint and a NULL pointer dereference in certain configurations (e.g., composite devic...

CVE-2021-47323

A use-after-free vulnerability exists in the Linux kernel within the sc520_wdt watchdog driver's wdt_turnoff() function. The issue is caused by the remove() path calling del_timer(), which does not wait for the timer handler to finish, potentially allowing it to run after the driver's remove func...

CVE-2021-47335

CVE-2021-47335 (Linux kernel, f2fs) : A race on the global fsync_entry_slab across multi filesystem instances caused a use-after-free in the slab cache during f2fs recovery. The root cause is concurrent access to the slab pointer when multiple f2fs mounts exist, leading to a use-after-free during...

CVE-2021-47339

In CVE-2021-47339, the Linux kernel fix targets media: v4l2-core, addressing uninitialized kernel stack data that could be used as input for driver ioctl handlers due to mistakes in compat ioctl implementation. The resolution requires explicitly clearing the entire ioctl input buffer before conve...

CVE-2021-47346

The CVE-2021-47346 entry concerns a Linux kernel vulnerability in coresight’s tmc-etf path. A global-out-of-bounds read (KASAN) occurred in tmc_update_etf_buffer() due to reading barrier_pkt beyond its allocated size after barrier_pkt trailing null removal in a prior patch. The issue is triggered...

CVE-2021-47360

In CVE-2021-47360, the Linux kernel binder subsystem is affected. During BC_FREE_BUFFER processing, cleanup of BINDER_TYPE_FDA objects may close one or more fds, and because close operations run via the task work mechanism, the thread must return to userspace for the file object to be dereference...

CVE-2021-47622

CVE-2021-47622 affects the Linux kernel SCSI/UFS path. The issue is a deadlock in the error handling flow when all tags are allocated: the SCSI error path triggers ufshcd_eh_host_reset_handler(), which queues work that calls ufshcd_err_handler(), leading to a lockup in the workqueue (ufs_eh_wq_0)...

CVE-2021-47656

Summary (CVE-2021-47656): In the Linux kernel’s jffs2 subsystem, a use-after-free occurs in jffs2_clear_xattr_subsystem during mounting a jffs2 image when an abnormal block is encountered. The code path frees an xattr_ref object twice (UAF) due to a call sequence in jffs2_build_filesystem/jffs2_d...

CVE-2022-48708

The CVE-2022-48708 issue affects the Linux kernel’s pinctrl/pinmux subsystem. A NULL dereference could occur because pinmux_generic_get_function() could return NULL and the code dereferenced the function pointer without a NULL check, in pcs_set_mux(). The vulnerability was addressed by adding a N...

CVE-2022-48788

The CVE-2022-48788 entry concerns a use-after-free in the Linux kernel nvme-rdma transport error_recovery path. The root cause is a race between submit_async_event and the error_recovery handler where the ctrl state is modified and admin queue destroyed without ensuring the async_event_work is fl...

CVE-2022-48875

CVE-2022-48875 affects the Linux kernel’s wireless stack (mac80211). The vulnerability arises when AMPDU start handling in the driver path can encounter a NULL sdata during deauthentication, leading to a NULL dereference. Specifically, ieee80211_tx_ba_session_handle_start() may receive NULL for s...

CVE-2022-48931

CVE-2022-48931: Linux kernel configfs race when calling configfs_register_subsystem()/configfs_unregister_subsystem() can lead to kernel panic due to concurrent list modifications during link_group()/unlink_group(). The root cause is a race in configfs item management when parent configfs_subsyst...

CVE-2022-48995

Mode C: Concrete details found. Affected component: Linux kernel module raydium_ts_i2c (raydium_i2c_ts) using sunray/raydium_i2c_send().Root cause: memory leak during i2c bank switching; tx_buf is not freed after BANK_SWITCH on i2c BUS operations, creating kmemleak objects in test with a bpf mock...

CVE-2022-49178

CVE-2022-49178 affects the Linux kernel memstick driver (memstick/mspro_block). The issue relates to how read-only devices are handled in the mspro_block code path. Root cause: improper propagation of the read-only state through the block layer during open, leading to a potential reference leak w...

CVE-2022-49240

The CVE-2022-49240 issue is in the Linux kernel ASoC: mediatek mt8195 driver. The of_parse_phandle() call returns a device_node with refcount incremented, but of_node_put() is not invoked in the error path, causing a refcount leak; a fix ensures of_node_put() is called on the device_node in error...

CVE-2022-49241

CVE-2022-49241 affects the Linux kernel ASoC: atmel subsystem, specifically the sam9x5_wm8731_driver_probe. The root cause is a device_node pointer returned by of_parse_phandle() with refcount incremented, but of_node_put() is not invoked in the error path, causing a refcount leak. The fix adds p...

CVE-2022-49331

In the Linux kernel, the nfc: st21nfca driver was fixed to address memory leaks in EVT_TRANSACTION handling. The error paths did not free previously allocated memory, and the patch adds devm_kfree() to those failure paths to prevent leaks. The CVE entry CVE-2022-49331 reflects this fix. The avail...

CVE-2022-49342

CVE-2022-49342 affects the Linux kernel net/ethernet/bgmac path (bcma_mdio_mii_register) where of_get_child_by_name() increases the node refcount, causing a refcount leak. The root cause is missing of_node_put() on unused nodes. Patches add the missing of_node_put() to prevent leaks. Patched stat...

CVE-2022-49346

CVE-2022-49346 is a Linux kernel vulnerability in the net: dsa: lantiq_gswip path. The issue is a refcount leak in gswip_gphy_fw_list caused by every iteration of for_each_available_child_of_node() decrementing the previously referenced node, and a missing explicit of_node_put() when breaking ear...

CVE-2022-49397

CVE-2022-49397 affects the Linux kernel, in the phy: qcom-qmp driver. The vulnerability is a leak of a struct clk (pipe clock reference) on probe errors, including late probe error/deferral paths. The advisory states the fix releases the held pipe clock reference on such errors, i.e., a proper cl...

CVE-2022-49440

CVE-2022-49440 affects the Linux kernel (PowerPC RTAS path). The root cause is MSR[RI] not being preserved when entering RTAS, while RTAS runs in real mode and may trigger a panic/ watchdog lockup if MSR[RI] is unset. The fix updates how MSR is computed before calling RTAS, ensuring a hardcoded v...

CVE-2022-49468

Summary (CVE-2022-49468) : In the Linux kernel, a memory leak was fixed in thermal/core due to __thermal_cooling_device_register() allocating memory for sysfs trailing paths. The unreferenced object trace and backtrace show allocation in thermal_cooling_device_setup_sysfs() that is not freed unle...

CVE-2022-49525

CVE-2022-49525 relates to the Linux kernel: the media: cx25821 driver issue triggers a warning when removing the module (remove_proc_entry leaking cx25821 IRQ). The connected advisories confirm the root cause is not a_privately exploitable bug in userland but a resource management ordering proble...

CVE-2022-49556

The CVE-2022-49556 issue affects the Linux kernel KVM: SVM sev ioctl interfaces. It could cause leakage of uninitialized kernel memory when the length parameter is between SEV_FW_BLOB_MAX_SIZE and the returned data, due to using kmalloc. The fix uses kzalloc for sev ioctl interfaces to allocate c...

CVE-2022-49620

CVE-2022-49620 (Linux kernel, net: tipc) Affects the Tipc subsystem: a potential refcount leak in tipc_sk_create() when tipc_sk_insert() fails. The fix ensures the sk is freed on failure, preventing a leak. The public description notes local attack vector with low privileges required and no user ...

CVE-2022-49643

CVE-2022-49643 affects the Linux kernel where, when the ima-modsig option is enabled, the value passed to evm_verifyxattr() may be negative, potentially causing an integer overflow in ima_appraise_measurement. The vulnerability is described across multiple vendor advisories (e.g., Miracle Linux, ...

CVE-2022-49652

CVE-2022-49652 affects the Linux kernel in the dmaengine: ti driver, specifically ti_dra7_xbar_route_allocate. The root cause is a refcount leak caused by not calling of_node_put() on a phandle-derived node when it is no longer needed; of_parse_phandle() returns a node pointer with an incremented...

CVE-2022-49749

The CVE-2022-49749 issue is confirmed in the Linux kernel’s I2C designware driver. In i2c_dw_scl_lcnt() and i2c_dw_scl_hcnt(), multiplying ic_clk by constant factors could overflow 32-bit arithmetic, depending on ic_clk (e.g., ic_clk > 1 MHz). The patch adds a 64-bit cast (u64) to the calculat...

CVE-2022-49754

CVE-2022-49754: Linux kernel Bluetooth mgmt_mesh_add() contains a buffer overflow risk in mgmt_util.c. Smatch indicates mesh_tx->param is 48 bytes while the destination can reach 50 bytes; caller rejects only when len > 50, creating a potential overflow window. Multiple connected sources co...

CVE-2022-49870

In CVE-2022-49870, the Linux kernel fixes undefined behavior in the CAP_TO_MASK bit-shift operation. The issue arises when shifting a signed 32-bit value by 31 bits, triggering UBSAN warnings (shift-out-of-bounds) reported in security/commoncap.c. The vulnerability stems from shifting a value tha...

CVE-2022-50072

CVE-2022-50072 is a Linux kernel use-after-free vulnerability in NFSv4/pnfs related to open operations. The issue occurs when an open RPC call is cancelled: the kernel must not free the open slot or layoutget arguments still in use by the hung RPC. The entry states this was resolved by a fix in t...

CVE-2023-20849

The CVE-2023-20849 vulnerability is in the imgsys_cmdq component and is caused by missing valid range checking, leading to a use-after-free that can enable local privilege escalation with SYSTEM privileges. Exploitation requires user interaction. Affected context references MediaTek-related discl...

CVE-2023-52527

CVE-2023-52527 involves the Linux kernel IPv4/IPv6 path: the handling of transhdrlen in __ip{,6}_append_data() could inflate the length when a packet is only partially filled (e.g., after MSG_MORE), risking duplicate transport header accounting. The issue can arise when splicing into an L2TP sock...

CVE-2023-52738

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/fence: Fix oops due to non-matching drm_sched init/fini Currently amdgpu calls drm_sched_fini() from the fence driver sw finiroutine - such function is expected to be called only after therespective init function - drm...