CVE-2022-50178

The CVE-2022-50178 issue is in Linux kernel wifi support for rtw89 (8852a) where a negative RF calibration result in the DPK could trigger a divisor-by-zero and a core dump. The root cause is division in the calibration logic; the fix guards division by zero by having phy_div() perform division o...

CVE-2021-47357

CVE-2021-47357 : In the Linux kernel, the atm: iphase removal path calls del_timer(), which can leave a timer handler running after the driver remove completes, causing a possible use-after-free. The fix uses del_timer_sync() to wait for the timer handler to finish and prevent rescheduling. Conne...

CVE-2021-47368

CVE-2021-47368 concerns a Linux kernel vulnerability in enetc where irq_set_affinity_hit() stores a cpumask_t reference in an irq descriptor, referencing memory on the stack. This leads to illegal accesses when the affinity_hint is read via procfs, potentially causing paging oops. The issue is mi...

CVE-2021-47395

CVE-2021-47395 : Linux kernel/mac80211 vulnerability where the rate limiting for injected VHT MCS/NSS in ieee80211_parse_tx_radiotap was tightened to fix a syzkaller warning. Affected component: mac80211 (ieee80211_parse_tx_radiotap, ieee80211_rate_set_vht). Reported impact in the public docs is ...

CVE-2021-47399

Technical details about CVE-2021-47399 (ixgbe NULL pointer dereference) are not provided in the supplied documents. Monitor for updates from vendors; no concrete technical details are included here.

CVE-2021-47409

CVE-2021-47409 concerns a Linux kernel vulnerability in the USB: dwc2 subsystem where a NULL return from platform_get_resource() could lead to a NULL pointer dereference. The issue is triggered when the return value is not checked, as described in the CVE entry and echoed in connected advisories ...

CVE-2021-47474

CVE-2021-47474 affects the Linux kernel driver family for comedi vmk80xx. The vulnerability arises from the driver using endpoint-sized buffers while assuming tx and rx buffers are equal size; a malicious device could overflow the slab-allocated receive buffer during bulk transfers. The issue is ...

CVE-2021-47475

CVE-2021-47475 is a Linux kernel vulnerability in the comedi vmk80xx USB driver. The issue arises from transfer-buffer size checks: buffers were endpoint-sized and lacked validation, enabling overflows when a malicious device with larger max-packet sizes or unexpected accesses could write past th...

CVE-2021-47486

CVE-2021-47486 affects the Linux kernel’s RISC-V BPF JIT: when NR_JIT_ITERATIONS is reached and jit_data->header is NULL, bpf_jit_binary_free() dereferences a NULL and can crash. The fix is a NULL-argument check before calling bpf_jit_binary_free(), per the provided description. Public details...

CVE-2021-47565

The CVE-2021-47565 issue is in the Linux kernel, specifically the scsi: mpt3sas path. The root cause is a race/NULL-check problem when iterating over a host (shost) sdev list: a drive may be removed and its sas_target object freed while its sdev remains, allowing code to access sas_target->sas...

CVE-2021-47583

CVE-2021-47583 affects the Linux kernel’s media/mxl111sf driver. Syzbot reported an uninitialized mutex in mxl111sf_ctrl_msg() due to the previous mutex_init(&state->msg_lock) being called too late. The order of dvb_usbv2_init() calls meant mxl111sf_ctrl_msg() could run from frontend_attach be...

CVE-2021-47637

CVE-2021-47637: In the Linux kernel ubifs deadlock during concurrent rename whiteout and inode writeback. Root cause is a deadlock between the ui_mutex held during ubifs_write_inode/lock and the whiteout budget path, causing hung tasks in writeback and rename code (rename_whiteout → ubifs_rename ...

CVE-2021-47638

CVE-2021-47638: In Linux kernel ubifs, rename_whiteout path frees whiteout_ui->data twice in ubifs_free_inode(), causing a double-free (KASAN). Root cause: during rename_whiteout, whiteout_ui->data is freed once and later freed again in ubifs_free_inode() via kfree(ui->data). Impact: loc...

CVE-2022-48665

CVE-2022-48665 concerns the Linux kernel exFAT code, where using an int as the sector index can overflow on large-capacity partitions (e.g., 512-byte sectors with >2 TB). The vulnerability is described as a memory/overflow issue in exfat handling that could affect large partitions. Connected a...

CVE-2022-48689

CVE-2022-48689 pertains to a Linux kernel issue in TCP zerocopy where pfmemalloc status could be misinterpreted by page_is_pfmemalloc() in certain paths. The Astra Linux note confirms the advisory and reiterates the same vulnerability in the kernel and notes a prereq backport: 84ce071e38a6 (net: ...

CVE-2022-48694

CVE-2022-48694 concerns the Linux kernel RDMA/irdma component. The root cause was that SW-generated completions for outstanding WRs posted on a Send Queue (SQ) could be targeted to the wrong Completion Queue (CQ) after a QP enters an error state, causing ib_drain_sq to hang without a completion. ...

CVE-2022-48959

CVE-2022-48959 affects the Linux kernel net: dsa: sja1105 code path. The root cause is a memory leak when dsa_devlink_region_create fails in sja1105_setup_devlink_regions(), where priv->regions is not released. The vulnerability resolution is a fix in the kernel that releases the leaked memory...

CVE-2022-49128

The CVE concerns the Linux kernel DRM bridge PM runtime: calling pm_runtime_get_sync() could increment the runtime PM counter even on error, risking a refcount leak. The provided fix replaces this API with pm_runtime_resume_and_get() (which does not change the runtime PM counter on error) and add...

CVE-2022-49174

CVE-2022-49174 affects the Linux kernel ext4 filesystem, specifically the ext4_mb_mark_bb() logic when flex_bg (default enabled) and fast_commit are used. The issue occurs when an inode’s extents span block groups and ext4_mb_mark_bb() reads the starting block group’s bitmap only once; it does no...

CVE-2022-49187

The CVE-2022-49187 entry concerns the Linux kernel clk subsystem. A NULL device pointer in clk_core (often from clk_register/clk_hw_register paths) can lead to a NULL pointer dereference when clk_hw_get_clk() is invoked on a clk_hw whose clk_core.dev is NULL, due to a call to dev_name() on NULL. ...

CVE-2022-49193

CVE-2022-49193 concerns the Linux kernel ice driver: a scheduling-while-atomic bug during aux critical error interrupt in ice_misc_intr() could lead to an oops via a mutex lock path. The fixed sequence adds handling in process context (ice_service_task) and introduces a PF state bit (oicr_err_reg...

CVE-2022-49224

CVE-2022-49224 affects the Linux kernel in the power: supply: ab8500 module, where a memory leak can occur because kobject_init_and_add() may fail and memory is not released. The fix is to call kobject_put() on error to properly clean up, as documented in the vulnerability description. The issue ...

CVE-2022-49232

CVE-2022-49232 is a Linux kernel vulnerability in the DRM/AMD display path. In amdgpu_dm_connector_add_common_modes(), the code assigns the result of amdgpu_dm_create_common_mode() to mode and then passes it to drm_mode_probed_add(). If amdgpu_dm_create_common_mode() fails, mode may be NULL and d...

CVE-2022-49271

CVE-2022-49271 affects the Linux kernel CIFS/SMB2 code. When smb2_ioctl_query_info() is called with flags=PASSTHRU_FSCTL and output_buffer_length=0, the kernel could copy a bad pointer (buffer) and end up dereferencing NULL, potentially leading to a NULL pointer dereference. The fix also ensures ...

CVE-2022-49336

The CVE-2022-49336 entry documents a Linux kernel issue in drm/etnaviv where etnaviv_iommu_unmap_gem could unmap a mapping twice if it had already been reaped. The root cause is not checking for a reaped mapping before unmapping, which could corrupt involved data structures; the vulnerability lea...

CVE-2022-49382

CVE-2022-49382 affects the Linux kernel: soc: rockchip: Fix refcount leak in rockchip_grf_init. The issue occurred because of_find_matching_node_and_match returns a node pointer with an incremented refcount, and the patch adds missing of_node_put() when done to avoid the leak. Connected Astra Lin...

CVE-2022-49432

CVE-2022-49432 affects the Linux kernel on PowerPC/xics: a refcount leak in icp_opal_init() was fixed. The root cause is that of_find_compatible_node() returns a node pointer with refcount already incremented, and the fix is to call of_node_put() on it when done. The upstream description notes th...

CVE-2022-49619

CVE-2022-49619 affects the Linux kernel net/sfp path. The vulnerability stems from sfp_probe() allocating memory via sfp_alloc() and not freeing it when devm_add_action() fails, causing a memory leak. The connected Astra/Tencent/Tenable entries confirm the fix is to replace devm_add_action() with...

CVE-2022-49621

The CVE-2022-49621 issue is a Linux kernel cpufreq.pmac32-cpufreq refcount leak bug. The root cause is missing of_node_put() for three node pointers whose refcounts were incremented by of_find_node_by_name() in pmac_cpufreq_init_MacRISC3(); the fix adds the corresponding of_node_put() calls to dr...

CVE-2022-49627

CVE-2022-49627 targets the Linux kernel’s Integrity Measurement Architecture (IMA). The advisory notes a memory leak possibility in ima_init_crypto() if SHA1 tfm allocation fails, where the ima_algo_array may not be freed. The documented fix adds the missing kfree() for ima_algo_array to prevent ...

CVE-2022-49649

CVE-2022-49649 affects the Linux kernel under xen_netback, where xenvif_rx_next_skb() can be called with an empty RX queue during repeated iterations in xenvif_rx_action(), risking a kernel NULL pointer dereference. The provided crash trace centers on xenvif_rx_skb() and the related netback loop....

CVE-2022-49667

The CVE-2022-49667 issue is a Linux kernel net bonding use-after-free bug triggered by 802.3ad slave unbind. The flaw occurs when bond_3ad_unbind_slave clears an aggregator while there are still ports referencing freed memory, due to ad_clear_agg being invoked even when the port count in a group ...

CVE-2022-49668

The CVE-2022-49668 entry corresponds to a Linux kernel issue where refcount leaks occur in the devfreq helper path: of_get_child_by_name() returns a node with an incremented refcount, and of_node_put() was missing in error paths. The fix adds the missing of_node_put() calls to prevent a refcount ...

CVE-2022-49901

CVE-2022-49901 affects the Linux kernel’s block multi-queue (blk-mq) path. It’s tied to a kmemleak issue triggered by modprobe null_blk.ko during queue initialization when an error path does not properly release resources. The description notes that q->ma_ops is set to NULL before blk_release_...

CVE-2022-49926

CVE-2022-49926: Linux kernel vulnerability in net: dsa: Fix possible memory leaks in dsa_loop_init() was addressed. The issue, reported by kmemleak, involved two leaks in dsa_loop_init(): (1) memory allocated for phy_device via phy_device_create() was not freed because fixed_phy_unregister() only...

CVE-2022-49962

CVE-2022-49962 affects the Linux kernel xHCI driver: the remove path could dereference a null pointer when xHC has only one roothub, attempting to remove both main and shared hcds even if the shared_hcd doesn’t exist. This could trigger a NULL pointer dereference during reboot for affected contro...

CVE-2022-50138

The CVE-2022-50138 entry describes a memory-leak in Linux kernel RDMA qedr: __qedr_alloc_mr() allocates mr->info.pbl_table; if rdma_alloc_tid() and rdma_register_tid() fail, the 'mr' is released but mr->info.pbl_table isn’t, causing a leak. The fix is to release mr->info.pbl_table with q...

CVE-2023-52527

CVE-2023-52527 involves the Linux kernel IPv4/IPv6 path: the handling of transhdrlen in __ip{,6}_append_data() could inflate the length when a packet is only partially filled (e.g., after MSG_MORE), risking duplicate transport header accounting. The issue can arise when splicing into an L2TP sock...

CVE-2023-52531

The provided connected document confirms CVE-2023-52531 affects Linux kernel wifi (iwlwifi mvm) memory corruption in the handling of the nvm_data/bands/bitrates structure. Root cause: incorrect pointer arithmetic due to a cast on the flex array, leading to misaddressing after channels and potenti...

CVE-2023-52568

CVE-2023-52568 affects the Linux kernel SGX path, specifically the EAUG race with page-fault handling. The vulnerability arises when the SGX EPC reclaimer (ksgxd) reclaims the SECS EPC page and sets secs.epc_page to NULL; EAUG and ELDU both use this page, but the NULL check was only applied to EL...

CVE-2023-52708

CVE-2023-52708 affects the Linux kernel MMC SPI code. The issue stems from error handling in mmc_spi_probe(): if mmc_add_host() fails, the code previously could call mmc_remove_host() and dereference a null device, causing a crash. The fix routes control to the fail_glue_init path on mmc_add_host...

CVE-2023-52754

CVE-2023-52754 is a Linux kernel vulnerability in the imon USB driver. The driver could memory-corrupt by naively assuming the first interface is bound to imon when probing the second interface; a malformed descriptor could bind the first interface to another driver. A patch adds a sanity check a...

CVE-2023-52804

CVE-2023-52804 affects the Linux kernel (fs/jfs) where db_maxag and db_agpref were used as indexes into db_agfree without validity checks. This could trigger an array-index-out-of-bounds UB in fs/jfs/jfs_dmap.c:639:20 (index 7936 out of range for atomic_t[128]). The issue has been addressed by ad...

CVE-2023-52860

CVE-2023-52860 relates to the Linux kernel; the root issue occurs in the perf driver when tearing down a hisi_hns3 PMU, where CPU hotplug callbacks could run after the PMU is unregistered, leading to a NULL pointer dereference. The fix uses cpuhp_state_remove_instance_nocalls() instead of cpuhp_s...

CVE-2023-53109

CVE-2023-53109 : Linux kernel vulnerability in net: tunnels where IP tunnels may update dev->needed_headroom in the xmit path, causing a data race (KCSAN) in ip_tunnel_xmit and related paths. The patch annotates lockless accesses to dev->needed_headroom for three tunnels’ xmit paths and als...

CVE-2023-53125

In CVE-2023-53125, the Linux kernel vulnerability is in the net: usb: smsc75xx driver. The issue stems from retrieving the packet length from skb data, which can be larger than the actual socket buffer length, allowing a cloned skb to expose kernel memory contents. Affects the kernel USB SMSC75xx...

CVE-2024-26715

CVE-2024-26715 affects the Linux kernel's USB subsystem, specifically the DWC3 gadget driver. The issue is a NULL pointer dereference in dwc3_gadget_suspend that can occur when plug-out/plug-in cycles race with gadget_driver being cleared, allowing a path where a non-NULL dwc->gadget_driver is...

CVE-2024-35993

Astra Linux bulletin confirms CVE-2024-35993 was resolved in the Linux kernel by turning folio_test_hugetlb into a PageType, addressing a race where concurrent folio splits could cause a false hugetlbfs classification. The vulnerability stemmed from folio_test_hugetlb() returning true for a folio...

CVE-2024-36963

CVE-2024-36963 affects the Linux kernel tracefs feature. The issue arises from how permissions are generated for tracefs files: they default to the root inode’s permissions unless the user changes them, and a remount with permissions should update all files, but currently leaves unchanged files t...

CVE-2024-38546

CVE-2024-38546 : Linux kernel (drm: vc4) fix for a NULL pointer dereference in vc4_hdmi_audio_init. of_get_address() may return NULL and be dereferenced; patch adds a NULL check to prevent the crash. This applies to the vc4 HDMI audio path in the kernel DRM vc4 driver; no exploits/public advisori...