CVE-2022-49525

CVE-2022-49525 relates to the Linux kernel: the media: cx25821 driver issue triggers a warning when removing the module (remove_proc_entry leaking cx25821 IRQ). The connected advisories confirm the root cause is not a_privately exploitable bug in userland but a resource management ordering proble...

CVE-2022-49164

CVE-2022-49164 describes a Linux kernel vulnerability on PowerPC with TM (transaction memory) that could corrupt the user r13 register due to a SLB miss during treclaim/trechkpt handling. The issue occurs when SCRATCH0 is live with the saved user r13 value, which can be clobbered by the kernel r1...

CVE-2022-49282

CVE-2022-49282 is a Linux kernel issue affecting f2fs quota handling. The vulnerability stems from an incorrect loop condition in f2fs_quota_sync() where cnt should be passed to sb_has_quota_active() to correctly determine active quotas. When type is -1, the compiler may discard the check, potent...

CVE-2022-49397

CVE-2022-49397 affects the Linux kernel, in the phy: qcom-qmp driver. The vulnerability is a leak of a struct clk (pipe clock reference) on probe errors, including late probe error/deferral paths. The advisory states the fix releases the held pipe clock reference on such errors, i.e., a proper cl...

CVE-2022-49474

CVE-2022-49474 (Linux kernel) affects the Bluetooth SCO path. The issue arises when connecting the same SCO socket twice (sco_sock_connect), which can create two sco_conn objects but only one is bound to the socket. If the socket closes before the SCO connection is established, the timer for the ...

CVE-2022-49514

Concrete details available: CVE-2022-49514 concerns the Linux kernel ASoC Mediatek driver, specifically a fix in the mt8173_max98090_dev_probe error path. The root issue was a refcount leak in the error path, and the remediation is to call of_node_put(platform_node) to avoid the leak. Connected a...

CVE-2022-49640

The CVE-2022-49640 issue affects the Linux kernel’s sysctl path, specifically proc_douintvec_minmax(). A concurrent access to a sysctl variable led to potential data races; the fix patches the function to use READ_ONCE() and WRITE_ONCE() internally, addressing the data-race on the sysctl side. Th...

CVE-2022-49652

CVE-2022-49652 affects the Linux kernel in the dmaengine: ti driver, specifically ti_dra7_xbar_route_allocate. The root cause is a refcount leak caused by not calling of_node_put() on a phandle-derived node when it is no longer needed; of_parse_phandle() returns a node pointer with an incremented...

CVE-2022-49678

The CVE-2022-49678 entry concerns the Linux kernel, specifically the BCM/BRCM STB PM integration (soc: bcm: brcmstb: pm: pm-arm). The root cause is a refcount leak: of_find_matching_node() returns a node pointer with an incremented refcount and was not released with of_node_put() when no longer n...

CVE-2022-49713

In CVE-2022-49713, the Linux kernel vulnerability affects the USB-DWC2 HCD initialization path. The issue is a memory leak in dwc2_hcd_init where usb_create_hcd allocates memory for hcd but may fail to free it if platform_get_resource() fails; the fix moves the error path from error1 to error2 an...

CVE-2022-49741

In the Linux kernel, CVE-2022-49741 affects the fbdev smscufx driver by faulty error handling in ufx_usb_probe, which the advisory and connected Nessus/NASL records describe as causing a memory leak (unreferenced object in ufx_usb_probe). The issue is tied to the ufx_usb_probe error path, includi...

CVE-2022-49742

The CVE-2022-49742 issue affects the Linux kernel’s f2fs code. It describes a lock initialization order problem where spin_lock(&sbi->error_lock) is taken before spin_lock_init() is called, flagging a lockdep warning in f2fs_handle_error(). The recommended remediation is to initialize locks (a...

CVE-2022-49754

CVE-2022-49754: Linux kernel Bluetooth mgmt_mesh_add() contains a buffer overflow risk in mgmt_util.c. Smatch indicates mesh_tx->param is 48 bytes while the destination can reach 50 bytes; caller rejects only when len > 50, creating a potential overflow window. Multiple connected sources co...

CVE-2022-49794

CVE-2022-49794 affects the Linux kernel IIO ADC driver (iio: adc: at91_adc). The issue is a potential memory leak in at91_adc_allocate_trigger where, if iio_trigger_register() returns an error, the driver should free the trigger reference via iio_trigger_free() and then release memory with iio_tr...

CVE-2022-49799

Summary of CVE-2022-49799 (Linux kernel): The vulnerability resides in the tracing subsys, specifically register_synth_event(), where if set_synth_event_print_fmt() fails, the code may call trace_remove_event_call() and unregister_trace_event() twice, causing the trace_event_call to invoke __unre...

CVE-2022-49892

CVE-2022-49892 — Linux kernel (ftrace): A use-after-free was fixed in dynamic ftrace_ops handling. KASAN reported use-after-free when two dynamic ftrace_ops with identical content were registered, and on unregistering the second op, FTRACE_UPDATE_CALLS and FTRACE_UPDATE_TRACE_FUNC could be skippe...

CVE-2022-49960

CVE-2022-49960 concerns a Linux kernel vulnerability in the i915 DRM driver where a null pointer dereference in tgl_get_bw_info() (bi_next) can cause a kernel panic. The issue manifests during Asus Chromebooks booting on v5.17-rc1, producing an Oops and a fatal exception. The bug was fixed by the...

CVE-2022-50034

CVE-2022-50034 affects the Linux kernel USB cdns3 gadget workaround 2. A use-after-free occurs in cdns3_wa2_remove_old_request when priv_req->request.buf is freed before the list node is removed with list_del_init(), leaving a dangling pointer in the list. The patch reorders the sequence, movi...

CVE-2022-50051

CVE-2022-50051 affects the Linux kernel’s ASoC: SOF subsystem, specifically a debug path where a buffer overflow could occur due to using snprintf(). The vulnerability arises because snprintf() returns the would‑be‑filled size when the string exceeds the destination buffer, which can lead to an o...

CVE-2022-50095

The CVE-2022-50095 issue affects the Linux kernel posix-cpu-timers: when a non-leader thread execs, the timer’s task reference may point to the old PID, so exit_itimers cannot disarm armed timers. This could leave timers in the timerqueue_list and, during processing, cause a use-after-free. The r...

CVE-2022-50220

CVE-2022-50220 is a Linux kernel vulnerability in the usbnet subsystem where a use-after-free can occur on disconnect due to linkwatch handling after unregister_netdev. The issue stems from usbnet_deferred_kevent() being awaited in a path that may access freed netdev state, potentially enabling m...

CVE-2023-0615

CVE-2023-0615 affects the Linux kernel V4L2 and vivid test code paths. The vulnerability is a memory leak with potential divide-by-zero and integer overflow when triggering ioctls such as VIDIOC_S_DV_TIMINGS, which could allow a local user to crash the system if vivid test code is enabled. Public...

CVE-2023-31081

CVE-2023-31081 affects Linux kernel 6.2 in drivers/media/test-drivers/vidtv/vidtv_bridge.c, where a NULL pointer dereference occurs in vidtv_mux_stop_thread. The issue arises because, in vidtv_stop_streaming, after dvb->mux is set to NULL, vidtv_mux_stop_thread is invoked with the NULL pointer...

CVE-2023-52678

CVE-2023-52678 is a Linux kernel vulnerability in drm/amdkfd: Confirm list is non-empty before using list_first_entry in kfd_topology.c. The fix adds a check that returns -ENODATA when the list is empty, preventing a potential NULL dereference; this is documented as resolved in the Linux kernel a...

CVE-2023-52742

The CVE-2023-52742 entry concerns the Linux kernel USB plusb driver. The vulnerability arises from treating a zero-length control-OUT transfer as a read instead of a write, triggering a WARNING in urb.c when usb_submit_urb is executed. The provided connected details specify the root cause as inco...

CVE-2023-52805

CVE-2023-52805 affects the Linux kernel/JFS inode allocation. The issue is an array-index-out-of-bounds in diAlloc caused by lack of validation of the iag’s agno during new inode allocation, which could lead to fragmentation. A fix was added to perform the necessary check, and multiple connected ...

CVE-2023-52844

CVE-2023-52844: Linux kernel vulnerability in media: vidtv psi where kstrdup() return value wasn't checked. The fix adds a check for kstrdup() and returns an error to avoid NULL pointer dereference. Affected kernel versions (Linux kernel series) have been updated with this patch; references point...

CVE-2023-52860

CVE-2023-52860 relates to the Linux kernel; the root issue occurs in the perf driver when tearing down a hisi_hns3 PMU, where CPU hotplug callbacks could run after the PMU is unregistered, leading to a NULL pointer dereference. The fix uses cpuhp_state_remove_instance_nocalls() instead of cpuhp_s...

CVE-2023-52876

CVE-2023-52876 relates to the Linux kernel clk-mt7629-eth path where mtk_alloc_clk_data() could return NULL, risking a NULL pointer dereference. The fix adds a check on the return value to prevent dereferencing NULL and thus mitigates local privilege/escalation risk as described in the CVE detail...

CVE-2023-52899

CVE-2023-52899 – kernel vulnerability (Linux kernel) has concrete details in connected advisories: a missing protection in the AXI channel error handling path (axi_chan_handle_err) for the vd signal can lead to a NULL pointer dereference and kernel panic. The issue is described as “Add exception ...

CVE-2023-53019

CVE-2023-53019 concerns the Linux kernel: the net/mdio subsystem allowed an out-of-bounds access in mdiobus_get_phy() when an invalid addr is passed (e.g., -1 in stmmac_init_phy). The advisory notes that addr must be validated before use to prevent access to mdio_map. Impact is described as high,...

CVE-2023-53038

CVE-2023-53038 concerns the Linux kernel: in scsi lpfc, the function lpfc_sli4_cgn_params_read() may encounter a kzalloc() failure, after which lpfc_read_object() dereferences pdata without a NULL check. The published fix changes the error code path from -ENODEV to -ENOMEM to reflect allocation f...

CVE-2023-53106

CVE-2023-53106 is a Linux kernel use-after-free in the NFC st-nci driver (ndlc_remove) caused by a race between scheduled work (llt_ndlc_sm_work) and driver removal. The race may allow use-after-free of ndlc->ndev during ndlc_rcv_queue/nci_recv_frame, affecting both st_nci_i2c_remove and st_nc...

CVE-2024-26723

CVE-2024-26723 affects the lan966x portion of the Linux kernel. A crash occurs when adding an interface under a bond (lag) because some ports can be NULL pointers (not probed); the code iterates over ports and dereferences NULL. The fix is to check for NULL pointers before accessing port data. Th...

CVE-2024-35920

In CVE-2024-35920, a race/NULL-pointer risk was addressed in the Linux kernel’s media: mediatek vcodec path. The fix adds a lock to protect the ctx_list to prevent dereferencing a NULL ctx_list in vpu_dec_ipi_handler when the list was deleted due to SCP IP block behavior, preventing a kernel oops...

CVE-2024-36890

CVE-2024-36890: Linux kernel mm/slab fix to have __free(kfree) treat error pointers as valid data. Previously, automatic cleanup could crash if an allocation freed as an error pointer was not checked; wm831x_gpio_dbg_show() is cited as an example. The resolution updates the auto cleanup path to v...

CVE-2024-36900

CVE-2024-36900 affects the Linux kernel’s net/hns3 driver. The vulnerability arises when a devlink reload occurs during hardware initialization: the reload can access hardware resources before initialization, potentially causing a kernel crash. The fix is to register devlink after hardware initia...

CVE-2024-36963

CVE-2024-36963 affects the Linux kernel tracefs feature. The issue arises from how permissions are generated for tracefs files: they default to the root inode’s permissions unless the user changes them, and a remount with permissions should update all files, but currently leaves unchanged files t...

CVE-2024-38385

CVE-2024-38385 (Linux kernel) : The vulnerability is in genirq/irqdesc where irq_find_at_or_after() dereferences an interrupt descriptor returned by mt_find() without holding the sparse_irq_lock or an RCU read lock, allowing a use-after-free if the descriptor is freed after mt_find(). The proof o...

CVE-2024-38572

CVE-2024-38572 concerns the Linux kernel wifi driver ath12k. The issue is a missing terminator entry in ath12k_qmi_msg_handlers, which can trigger a global out-of-bounds read in qmi_invoke_handler via KASAN. A fix adds a dummy terminator entry to allow qmi_invoke_handler to traverse to the termin...

CVE-2024-38616

CVE-2024-38616 affects the Linux kernel wifi: carl9170 stack. The issue is a fortified-memset warning triggered in carl9170_tx_release (inlined via kref_put and carl9170_tx_put_skb) in randconfig builds. The root cause is a Fortify warning in fortify_memset_chk due to memory bounds handling; patc...

CVE-2024-40938

CVE-2024-40938 affects the Linux kernel Landlock component, addressing a d_parent walk issue when linking a root mount point. The root cause was a WARN_ON_ONCE triggered by using the source directory’s d_parent even if the source is mounted, because the VFS check runs after security_path_link(). ...

CVE-2024-42066

CVE-2024-42066 is a Linux kernel vulnerability affecting DRM Xe: a potential integer overflow in page size calculation when computing min_page_size. The issue stems from not casting tbo->page_alignment to a 64-bit type before bit-shifting, enabling overflow in the calculation. The connected As...

CVE-2024-42108

Technical details for CVE-2024-42108 are not publicly provided in the connected documents. The available sources reference the vulnerability at a high level. Monitor for updates from kernel advisories and vendor patches.

CVE-2024-46709

The CVE-2024-46709 issue affects the Linux kernel drm/vmwgfx driver, fixed by ensuring external buffers map through the dma_buf interface instead of direct page access. The vulnerability arises because external buffers may not expose readable/writable pages, so media buffers (bo) created from ext...

CVE-2024-46776

The CVE-2024-46776 entry corresponds to a Linux kernel flaw in the DRM/AMD display pipeline. The issue arises when the DC_LOG_DC is executed before verifying link_enc, allowing an invalid state that prompted a reported reverse_inull defect; the fix corrects the sequence by running DC_LOG_DC only ...

CVE-2024-49872

The CVE-2024-49872 issue affects the Linux kernel in mm/gup where memfd_pin_folios can race when creating a hugetlb folio and another actor has already done so, leading to a -EEXIST and a panicking folio_put call if the same folio is used in the next loop iteration. The patch fixes the race by cl...

CVE-2024-50144

The CVE-2024-50144 issue affects the Linux kernel DRM/XE path. Root cause: an unbalanced rpm put() can occur if fence_fini() is invoked twice on error while handling GuC CT for a tlb request, because the code path signals the fence and then returns an error, causing the caller to run fini() again...

CVE-2024-50254

CVE-2024-50254 : In the Linux kernel, the bpf_iter_bits_destroy() path incorrectly used kit->nr_bits bit = kit->nr_bits on completion, uses !nr_bits || bits >= nr_bits to determine completion, and keeps nr_bits > 64 to indicate dynamic allocation. It also changes kit->nr_bits from ...

CVE-2024-50270

CVE-2024-50270 targets the Linux kernel, specifically in mm/damon/core where damon_feed_loop_next_input() contains overflow-prone calculations (score_goal_diff_bp, compensation, etc.) related to a constant target score of 10,000. The fix rewrites the function to avoid overflows and removes the un...