CVE-2022-48788

The CVE-2022-48788 entry concerns a use-after-free in the Linux kernel nvme-rdma transport error_recovery path. The root cause is a race between submit_async_event and the error_recovery handler where the ctrl state is modified and admin queue destroyed without ensuring the async_event_work is fl...

CVE-2022-48824

CVE-2022-48824 : In the Linux kernel, the scsi myrs driver can crash during error handling. If privdata->hw_init() fails non‑zero, myrs_detect() leaves cs->disable_intr as NULL and myrs_cleanup() dereferences a NULL pointer, causing a kernel crash with a NULL pointer dereference. The issue ...

CVE-2022-48950

CVE-2022-48950 affects the Linux kernel: perf_pending_task() UaF could run after the event is freed. The root cause involves two situations: (1) task_work already queued before destroying the event; (2) destroying the event queues task_work. The documented fix is to extend the perf_event lifetime...

CVE-2022-48957

Summary: CVE-2022-48957 is a Linux kernel issue in the dpaa2-switch component where a memory leak can occur because cmd_buff is not freed on error in dpaa2_switch_acl_entry_add() and dpaa2_switch_acl_entry_remove(). The connected documents confirm the root cause and that a fix was applied, e.g., ...

CVE-2022-49005

CVE-2022-49005 is tied to a Linux kernel issue in ASoC: ops where _sx controls use a non-standard max field. The root cause is an incorrect bounds check in snd_soc_put_volsw_sx(): the max value must be treated as the number of steps and checked accordingly against the maximum. Connected Astra Lin...

CVE-2022-49012

In CVE-2022-49012, the Linux kernel fixes an afs_put_server cleanup leak where atomic_read was inadvertently replaced with atomic_inc_return, preventing server cleanup and causing rmmod to hang with a purge warning. The vulnerability is tied to the AFS server cleanup path and affects server deall...

CVE-2022-49019

Converging sources confirm CVE-2022-49019 affects the Linux kernel nixge Ethernet driver. The issue is a NULL dereference in nixge_hw_dma_bd_release() when priv->rx_bd_v is invalid due to a prior allocation failure in nixge_hw_dma_bd_init(). A fix exists that moves the for() loop dereferencing...

CVE-2022-49024

CVE-2022-49024 affects the Linux kernel CAN subsystem (m_can PCI). The patch fixes a memleak by calling m_can_class_free_dev() in the remove path and error handling of the probe path, freeing resources allocated by m_can_class_allocate_dev() . Connected advisories (MiracleLinux/RLSA/RHEL/ALSA OSS...

CVE-2022-49098

Technical details about CVE-2022-49098 (affected product/versions, root cause, impact, fix) are not provided in the connected documents. The Initial description contains patch context but no public exploit specifics; monitor for updates.

CVE-2022-49125

CVE-2022-49125 affects the Linux kernel DRM sprd driver. The issue is a potential NULL dereference of the ‘drm’ pointer in sprd_drm_shutdown, with a warning log that could dereference it. The fix removes the dereference risk by adjusting the shutdown path and changes the warning handling from unc...

CVE-2022-49126

CVE-2022-49126 concerns the Linux kernel component scsi/mpi3mr. The issue is described as memory leaks in the operational reply queue’s memory segments that are not freed when unloading the driver. The entry states a fix for these leaks has been implemented. No exploitation details are provided i...

CVE-2022-49206

CVE-2022-49206 affects the Linux kernel RDMA/mlx5 path. The issue is a memory leak in the error flow of the subscribe event routine where a second xa_insert() failure leaves obj_event unreleased. The fix adds proper memory cleanup in the error unwinding path to prevent the leak. The documented im...

CVE-2022-49269

The CVE-2022-49269 issue affects the Linux kernel CAN subsystem: isotp_bind() incorrectly validates CAN IDs, allowing a state machine path that can be reached with non-standard IDs (ex: 0x6000001 and 0xC28001) that map to 11-bit IDs 0x001. The fix sanitizes SFF/EFF CAN ID values before address ch...

CVE-2022-49418

The CVE-2022-49418 entry concerns a Linux kernel NFSv4 crash during referral lookup caused by using an uninitialized nfs4_label. The fix, as described in the provided documents, sends along the already-allocated fattr with nfs4_fs_locations and drops the memcpy of fattr, which avoids two extra al...

CVE-2022-49495

CVE-2022-49495 : In the Linux kernel, the drm/msm/hdmi driver fails to check the return value of platform_get_resource_byname(), which can lead to a null-pointer dereference if NULL is returned. The issue has been fixed by applying a patch that adds the necessary NULL check (Patchwork: 482992). S...

CVE-2022-49555

Summary: CVE-2022-49555 is tied to the Linux kernel Bluetooth subsystem (hci_qca). The issue arises when a timer is freed while still active due to code calling del_timer() instead of del_timer_sync(), risking timer-list corruption. The description notes that the hci_qca driver may trigger this, ...

CVE-2022-49652

CVE-2022-49652 affects the Linux kernel in the dmaengine: ti driver, specifically ti_dra7_xbar_route_allocate. The root cause is a refcount leak caused by not calling of_node_put() on a phandle-derived node when it is no longer needed; of_parse_phandle() returns a node pointer with an incremented...

CVE-2022-49703

Conforms to Mode C. The CVE-2022-49703 issue affects the Linux kernel ibmvfc driver: the back pointer from a SCSI queue to the vhost adapter was not set during subcrq allocation, which could allow a stale backpointer to be dereferenced during IRQ handling. This could cause a kernel NULL pointer d...

CVE-2022-49910

CVE-2022-49910 (Linux kernel) : A race between two Bluetooth L2CAP flows can cause a use-after-free in l2cap_rx_state_recv (kernel 5.19.8). Specifically, an SKB queued by l2cap_reassemble_sdu may be freed by bt_sock_recvmsg/sock path, while code still accesses l2cap_ctrl in the SKB CB after l2cap...

CVE-2022-49938

CVE-2022-49938 is a Linux kernel vulnerability in the CIFS SMB2_negotiation path. The issue is a small mempool leak in SMB2_negotiate() where, on certain dialect-mismatch failures, the code could exit without freeing the response buffer from mempool due to an incorrect -EIO handling. The fix tigh...

CVE-2022-50033

CVE-2022-50033: In the Linux kernel USB host OHCI PPC OF driver, of_find_compatible_node() may return a node with an incremented refcount and of_node_put() must be used when not needed. The issue is a refcount leak in ohci_hcd_ppc_of_probe(). Affected: Linux kernel (ohci-ppc-of path). Impact is a...

CVE-2022-50069

CVE-2022-50069 concerns the Linux kernel BPF subsystem. The root cause is that bpf_sys_bpf() may copy instruction data from a kernel address (via bpfptr_t) without validating it, since copy_from_bpfptr() can dereference in-kernel pointers. This can lead to a use-after-free/invalid dereference in ...

CVE-2022-50132

CVE-2022-50132 (Linux kernel) affects the usb: cdns3 gadget code. The root cause is an invalid dereference when ep is NULL due to the placement of the priv_ep assignment. The vulnerability is resolved by changing the assignment location in cdns3_gadget_ep_dequeue() and cdns3_gadget_ep_enable(), p...

CVE-2023-3022

The CVE-2023-3022 entry corresponds to a Linux kernel IPv6 module flaw where arg.result is inconsistently used in fib6_rule_lookup, being sometimes rt6_info and other times fib6_info. This mismatch is not accounted for where rt6_info is expected unconditionally, potentially causing a kernel panic...

CVE-2023-52517

CVE-2023-52517 affects the Linux kernel SPI sun6i driver where a race between DMA RX completion and RX FIFO drain could corrupt data. The fix separates RX FIFO drain from DMA mode by draining RX FIFO only in interrupt mode and by waiting for RX DMA completion before returning when DMA is used, en...

CVE-2023-52571

Consolidated details indicate CVE-2023-52571 relates to the Linux kernel power: supply: rk817 driver, where a refcount leak in the probe path was fixed. The issue arose because of_node_put() was only added on some return paths, not all error paths or at driver removal time. The fix ensures of_nod...

CVE-2023-52755

CVE-2023-52755 involves a slab out-of-bounds write in ksmbd smb_inherit_dacl() in the Linux kernel. The root cause is an offsets check failure when offsets exceed allocation size; the fix adds validation of three offsets against allocation size. Public advisories (e.g., Astra Linux bulletin for L...

CVE-2023-52883

CVE-2023-52883 : In the Linux kernel, a null pointer dereference could occur in the AMDGPU driver. The issue arises in drm/amdgpu_vm_bo_update where abo->tbo.resource may be NULL, enabling an attacker-controlled or unintended path to trigger a crash. The vulnerability is fixed by the kernel pa...

CVE-2023-52894

CVE-2023-52894 affects the Linux kernel USB gadget f_ncm path, where a NULL cdev->gadget dereferences max_speed in ncm_bitrate() during SPEED_NOTIFY handling. The issue was observed on an aarch64 GKI 5.10.149-android13 crash (NULL pointer dereference at 0x5c) and is linked to ncm_do_notify() S...

CVE-2023-53045

CVE-2023-53045 is mitigated in the Linux kernel via a fix to the USB gadget driver (usb: gadget: u_audio). In the unbind callback for f_uac1/f_uac2, a call to snd_card_free() could block waiting for resources to be released if userspace kept the file descriptor open, potentially causing a deadloc...

CVE-2023-53062

Summary (CVE-2023-53062) : Affects the Linux kernel in the usb SMSC95xx driver. The vulnerability arises when the packet length retrieved from a descriptor may exceed the actual skb length, allowing a cloned skb to leak kernel memory contents as it traverses the network stack. The issue is docume...

CVE-2024-26768

The CVE-2024-26768 issue affects the Linux kernel LoongArch ACPI MADT handling. The root cause was an overflow of acpi_core_pic[NR_CPUS] when the MADT table includes more CPUs than NR_CPUS (default NR_CPUS=64). The patch defines the array as acpi_core_pic[MAX_CORE_PIC] to match physical cores, pr...

CVE-2024-26912

The connected Nessus entry for CVE-2024-26912 provides concrete details: in the Linux kernel, the Nouveau driver leaked several GSP-RM DMA buffers (nvkm_gsp_mem objects) that were never deallocated. Some buffers could be freed soon after GSP-RM initialization, while others remained until driver u...

CVE-2024-35818

CVE-2024-35818 : In the Linux kernel, LoongArch-specific fix defines the __io_aw() hook as mmiowb() to address issues from removing explicit mmiowb() invocations in drivers. The patch relocates the mmiowb tracking to handle mutex-protected MMIO, since some MMIO regions (e.g., in radeon) are guard...

CVE-2024-35996

Technical details for CVE-2024-35996 are not provided in the supplied documents. The description summarizes kernel-mitigation changes, but there are no explicit affected products, versions, impacts, or fixes. Monitor vendor advisories for updates.

CVE-2024-36890

CVE-2024-36890: Linux kernel mm/slab fix to have __free(kfree) treat error pointers as valid data. Previously, automatic cleanup could crash if an allocation freed as an error pointer was not checked; wm831x_gpio_dbg_show() is cited as an example. The resolution updates the auto cleanup path to v...

CVE-2024-38385

CVE-2024-38385 (Linux kernel) : The vulnerability is in genirq/irqdesc where irq_find_at_or_after() dereferences an interrupt descriptor returned by mt_find() without holding the sparse_irq_lock or an RCU read lock, allowing a use-after-free if the descriptor is freed after mt_find(). The proof o...

CVE-2024-38616

CVE-2024-38616 affects the Linux kernel wifi: carl9170 stack. The issue is a fortified-memset warning triggered in carl9170_tx_release (inlined via kref_put and carl9170_tx_put_skb) in randconfig builds. The root cause is a Fortify warning in fortify_memset_chk due to memory bounds handling; patc...

CVE-2024-39504

The CVE-2024-39504 entry corresponds to a Linux kernel netfilter issue in nft_inner, where mandatory netlink attributes for payload/meta expressions were not validated when embedded from the inner expression. This could lead to a NULL pointer dereference from userspace. A MiracleLinux AXSA adviso...

CVE-2024-39510

CVE-2024-39510 affects the Linux kernel’s cachefiles subsystem, specifically the cachefiles_ondemand_daemon_read path. The issue is a slab-use-after-free in cachefiles_ondemand_daemon_read() that can lead to use-after-free of an object during on-demand daemon restoration, as demonstrated by a KAS...

CVE-2024-40944

CVE-2024-40944 affects the Linux kernel (x86/kexec). The vulnerability is a bug in call depth tracking where calling cc_platform_has() may fault if depth tracking is active because GS_BASE is reset to 0 by load_segments(). The mitigation described in the documentation is to invoke cc_platform_has...

CVE-2024-42091

CVE-2024-42091 — Linux kernel, module: drm/xe. The issue arose when dumping PAT settings via debugfs without validating pat.ops, allowing a null or unset pat.ops pointer to be used, which could lead to a denial/Not-Provided detail? (NPD) scenario. The fixed behavior patches the code to check the ...

CVE-2024-42260

CVE-2024-42260 - Linux kernel drm/v3d validation issue : The vulnerability occurred in the DRM/V3D path where userspace could pass unknown or invalid drm_syncobj handles in the performance extension. The description states that if an invalid handle appears anywhere in the handle array, the rest o...

CVE-2024-42298

CVE-2024-42298 affects the Linux kernel ASoC: fsl, specifically fsl_qmc_audio, where devm_kasprintf() could return NULL and the result wasn’t checked. The description in the initial document states the fix is to check the returned value. The connected Nessus entry corroborates the vulnerability a...

CVE-2024-42303

The CVE-2024-42303 issue affects the Linux kernel media imx-pxp driver. The root cause is an ERR_PTR dereference in pxp_probe() when devm_regmap_init_mmio() can fail, due to a missing check and bail‑out path. The patch adds a null/error check and exits gracefully, preventing a dereference and pot...

CVE-2024-46734

CVE-2024-46734 — Linux kernel race between direct IO writes and fsync . In scenarios where two threads share the same fd opened with O_DIRECT, one performing direct IO writes and the other calling fsync, a race can occur that may trigger an assertion failure (inode lock not held) or a memory acce...

CVE-2024-46785

CVE-2024-46785 affects the Linux kernel, specifically an issue in eventfs relating to SRCU-protected lists. The root cause is a NULL pointer access in tracefs when ei_child can be set to LIST_POISON1 after removal in eventfs_remove_rec, leading to a crash/panic. The vulnerability materializes whe...

CVE-2024-49872

The CVE-2024-49872 issue affects the Linux kernel in mm/gup where memfd_pin_folios can race when creating a hugetlb folio and another actor has already done so, leading to a -EEXIST and a panicking folio_put call if the same folio is used in the next loop iteration. The patch fixes the race by cl...

CVE-2024-49964

The CVE-2024-49964 issue affects the Linux kernel’s hugetlb path: memfd_pin_folios + unpin_folios could fail to restore free_huge_pages for pages not faulted in due to folio refcounts not reaching zero. The root cause was that folio_ref_unfreeze/folio_try_get/hugetlb_add_to_page_cache interaction...

CVE-2024-50094

CVE-2024-50094 : Linux kernel vulnerability in the sfc driver where netpoll incorrectly called xdp_do_flush() with a budget of zero, causing a crash because bpf_net_context was never assigned. The fix conditionally invokes xdp_do_flush() only when budget is non-zero, mitigating the crash in netpo...