CVE-2021-47436

CVE-2021-47436 – Linux kernel USB Musb DSPS probe error path fix . The connected Astra/Unity advisories confirm a root cause in the Musb DSPS driver where dsps_setup_optional_vbus_irq() and dsps_create_musb_pdev() were inverted in the error path, leaving a platform device registered but not unreg...

CVE-2021-47475

CVE-2021-47475 is a Linux kernel vulnerability in the comedi vmk80xx USB driver. The issue arises from transfer-buffer size checks: buffers were endpoint-sized and lacked validation, enabling overflows when a malicious device with larger max-packet sizes or unexpected accesses could write past th...

CVE-2021-47551

CVE-2021-47551 affects the Linux kernel’s DRM/AMD AMDKFD during SR-IOV reset handling. The issue could trigger a kernel panic when a reset is retried after a failed reset, due to uninitialized state being re-done. The fixed behavior avoids re-uninitialization on a subsequent reset, addressing a s...

CVE-2021-47650

CVE-2021-47650: In the Linux kernel, ASoC: soc-compress had a potential null pointer when codec_dai could be NULL if card->dai_link->num_codecs was 0, traced through snd_soc_register_card() -> snd_soc_bind_card() -> soc_init_pcm_runtime() -> snd_soc_dai_compress_new() -> snd_soc...

CVE-2022-48634

In the Linux kernel, the following vulnerability has been resolved: drm/gma500: Fix BUG: sleeping function called from invalid context errors gma_crtc_page_flip() was holding the event_lock spinlock while callingcrtc_funcs->mode_set_base() which takes ww_mutex. The only reason to hold event_lo...

CVE-2022-48739

CVE-2022-48739 affects the Linux kernel ASoC hdmi-codec subsystem. The vulnerability arises from out-of-bounds memory accesses during memcpy(), caused by an incorrect size for the iec_status array. The fix aligns the size of iec_status with the status array of struct snd_aes_iec958, eliminating t...

CVE-2022-48766

CVE-2022-48766 relates to the Linux kernel, specifically the DRM/AMD display path. The vulnerability is resolved by wrapping dcn301_calculate_wm_and_dlg for FPU, mirroring the dcn30 logic. Without this fix, the kernel may emit a flood of WARNs and can experience kernel panics. The description not...

CVE-2022-48777

CVE-2022-48777 affects the Linux kernel mtd parsers for Qualcomm partitions. The issue triggers a kernel panic when a partition entry is skipped (name is empty and leads to a NULL name in cleanup). The patch reworks the parser logic to first validate the partition number, then allocate and popula...

CVE-2022-48840

CVE-2022-48840: Linux kernel iavf hang on reboot/shutdown due to a new wait-loop in iavf_remove() that could loop indefinitely when adapter is already removed during shutdown. The fix adds a state check at the start of iavf_remove() and skips rest of the function if the adapter is in __IAVF_REMOV...

CVE-2022-48954

CVE-2022-48954 refers to a use-after-free in s390/qeth HSci path, where KASAN observed dereference of a freed br2dev_event_work object in qeth_l2_br2dev_worker. Multiple vendor advisories (SUSE SUSE-SU-2024:4131-1, SUSE-SU-2024:4364-1 and OSV entries) summarize the issue and list the affected com...

CVE-2022-49003

CVE-2022-49003 affects the Linux kernel NVMe subsystem. The issue arises from incomplete SRCU protection when walking the nvme_ns_head siblings list during nvme_mpath_revalidate_paths(), and from missing SRCU synchronization when removing namespaces from the list, which can allow a concurrent sca...

CVE-2022-49007

CVE-2022-49007 affects the Linux kernel/NILFS2. A NULL pointer dereference in nilfs_palloc_commit_free_entry() could occur during DAT metadata handling when a lower-level DAT block’s entry is clobbered during commit, leading to a crash. The fix adds NULL checks in nilfs_dat_commit_free() for req-...

CVE-2022-49016

CVE-2022-49016 is a Linux kernel issue in the net:mdiobus subsystem. The vulnerability arises from an unbalanced reference count: non-ACPI paths call fwnode_handle_put() in phy_device_release(), while ACPI paths call fwnode_handle_get() before phy_device_register() to balance gets/puts; this prev...

CVE-2022-49096

The CVE-2022-49096 issue in the Linux kernel affects the sfc (Solarflare) network driver: after ethtool -G changes to rx/tx ring buffer sizes, the driver reallocates/reinitializes queues but fails to reinitialize the XDP TX queues (efx->xdp_tx_queues). This can lead to the XDP path using an un...

CVE-2022-49131

CVE-2022-49131 concerns a Linux kernel kernel-panic in the ath11k driver while unloading/loading modules on some ARM platforms. The root cause is a dereference path leading to an OOPS in napi_by_id during netif_napi_add, which could occur over repeated unload/load cycles. The fixed fix is to call...

CVE-2022-49201

CVE-2022-49201 concerns the Linux kernel, specifically the ibmvnic driver race between reset and xmit paths. The provided data describes a vulnerability where ibmvnic_xmit() may access tx_scrq after it has been freed in the reset path, caused by a race with in-flight ibmvnic_complete_tx() and a r...

CVE-2022-49327

The CVE-2022-49327 issue affects the Linux kernel and is described in multiple advisories (e.g., Unity Linux and SUSE/SUSE-SU family) as a fix for bcached journal no-space deadlock. The vulnerability arises when journal replay during cache set registration can stall if journal buckets are exhaust...

CVE-2022-49440

CVE-2022-49440 affects the Linux kernel (PowerPC RTAS path). The root cause is MSR[RI] not being preserved when entering RTAS, while RTAS runs in real mode and may trigger a panic/ watchdog lockup if MSR[RI] is unset. The fix updates how MSR is computed before calling RTAS, ensuring a hardcoded v...

CVE-2022-49445

CVE-2022-49445 is described in the initial document as a Linux kernel vulnerability where pinctrl: renesas: core could dereference a NULL pointer in sh_pfc_map_resources() if platform_get_resource() returns NULL. The fix moves using the resource after devm_ioremap_resource() (which checks NULL) a...

CVE-2022-49472

CVE-2022-49472 affects the Linux kernel PHY Micrel driver: if a .probe is present and .driver_data is missing, a NULL pointer dereference can occur. The fix adds NULL checks for priv->type to allow probing without .driver_data. Connected advisories (Astra/Unity Linux) reference Linux kernel ve...

CVE-2022-49474

CVE-2022-49474 (Linux kernel) affects the Bluetooth SCO path. The issue arises when connecting the same SCO socket twice (sco_sock_connect), which can create two sco_conn objects but only one is bound to the socket. If the socket closes before the SCO connection is established, the timer for the ...

CVE-2022-49527

In CVE-2022-49527, the Linux kernel media/venus/hfi path was fixed to avoid a null-dereference during deinitialization. If venus_probe fails at pm_runtime_put_sync, the error path previously called hfi_destroy (which sets core->ops to NULL) and then attempted hfi_core_deinit, which would deref...

CVE-2022-49627

CVE-2022-49627 targets the Linux kernel’s Integrity Measurement Architecture (IMA). The advisory notes a memory leak possibility in ima_init_crypto() if SHA1 tfm allocation fails, where the ima_algo_array may not be freed. The documented fix adds the missing kfree() for ima_algo_array to prevent ...

CVE-2022-49640

The CVE-2022-49640 issue affects the Linux kernel’s sysctl path, specifically proc_douintvec_minmax(). A concurrent access to a sysctl variable led to potential data races; the fix patches the function to use READ_ONCE() and WRITE_ONCE() internally, addressing the data-race on the sysctl side. Th...

CVE-2022-49703

Conforms to Mode C. The CVE-2022-49703 issue affects the Linux kernel ibmvfc driver: the back pointer from a SCSI queue to the vhost adapter was not set during subcrq allocation, which could allow a stale backpointer to be dereferenced during IRQ handling. This could cause a kernel NULL pointer d...

CVE-2022-49742

The CVE-2022-49742 issue affects the Linux kernel’s f2fs code. It describes a lock initialization order problem where spin_lock(&sbi->error_lock) is taken before spin_lock_init() is called, flagging a lockdep warning in f2fs_handle_error(). The recommended remediation is to initialize locks (a...

CVE-2022-49799

Summary of CVE-2022-49799 (Linux kernel): The vulnerability resides in the tracing subsys, specifically register_synth_event(), where if set_synth_event_print_fmt() fails, the code may call trace_remove_event_call() and unregister_trace_event() twice, causing the trace_event_call to invoke __unre...

CVE-2022-49983

The issue CVE-2022-49983 affects the Linux kernel udmabuf driver. If the udmabuf DMA mask is not set explicitly, userspace DMA-BUF access via the CPU can trigger a warning in dma_map_sg_attrs (kernel/dma/mapping.c) during dma-buf CPU access flows (as shown in the stack trace). The vulnerability i...

CVE-2022-50012

CVE-2022-50012 affects the Linux kernel on 64-bit PowerPC (powerpc/64). The root cause is that jump_label_init() is invoked in setup_feature_keys() too late, since static keys may be used by subroutines of parse_early_param(), which itself is a subroutine of early_init_devtree(). The result is th...

CVE-2022-50034

CVE-2022-50034 affects the Linux kernel USB cdns3 gadget workaround 2. A use-after-free occurs in cdns3_wa2_remove_old_request when priv_req->request.buf is freed before the list node is removed with list_del_init(), leaving a dangling pointer in the list. The patch reorders the sequence, movi...

CVE-2022-50041

CVE-2022-50041 (Linux kernel, ice driver) : The issue arises from a WARN_ON() checking for a null VSI in ice_reset_vf during VF reset, which can trigger a call trace under stress (VF attach/detach with spoofcheck/trust changes). The connected advisories and Nessus/NVL references confirm the fix: ...

CVE-2022-50087

The CVE-2022-50087 issue affects the Linux kernel firmware for arm_scpi. The vulnerability arises when scpi_info is left non-null if a probe fails, exposing memory freed by a failed devm_kzalloc() and leading to a use-after-free. The description in the advisories specifies that scpi_info must not...

CVE-2022-50095

The CVE-2022-50095 issue affects the Linux kernel posix-cpu-timers: when a non-leader thread execs, the timer’s task reference may point to the old PID, so exit_itimers cannot disarm armed timers. This could leave timers in the timerqueue_list and, during processing, cause a use-after-free. The r...

CVE-2023-22997

CVE-2023-22997 affects the Linux kernel prior to 6.1.2. The vulnerability resides in module/decompress.c where the function module_get_next_page can return an error pointer, but code treats it as NULL in the error case, potentially causing a denial of service. The issue is local in scope; CVSS in...

CVE-2023-52523

CVE-2023-52523 – Linux kernel vulnerability (bpf, sockmap): A BPF sk_msg redirect can target a non-TCP exit socket (via SOCKMAP/SOCKHASH), which previously could downcast to a tcp_sock and crash. The issue arose after enabling redirects to non-TCP sockets, breaking assumptions that the egress soc...

CVE-2023-52531

The provided connected document confirms CVE-2023-52531 affects Linux kernel wifi (iwlwifi mvm) memory corruption in the handling of the nvm_data/bands/bitrates structure. Root cause: incorrect pointer arithmetic due to a cast on the flex array, leading to misaddressing after channels and potenti...

CVE-2023-52673

CVE-2023-52673 — Linux kernel (drm/amd/display): A debugfs-related NULL pointer error was fixed in the AMD display code. The root cause was calling the get_subvp_en() callback without verifying its existence. The fix adds a check for the callback before invocation, preventing potential NULL deref...

CVE-2023-52701

The CVE-2023-52701 entry concerns Linux kernel net handling: copying skb marks and skb_cb data led to a memory exposure via usercopy checks, observed as a kernel crash on arm64 when CONFIG_HARDENED_USERCOPY=y. Root cause: copying data from skb->cb[] and skb->mark can bypass size checks; pat...

CVE-2023-52768

CVE-2023-52768 is a Linux kernel wireless (wilc1000) vulnerability. The issue arises from how wilc_wlan_init allocates memory for vmm_table: the allocation size omits a multiplication by sizeof(u32), allowing a slab-out-of-bounds write in wilc_wlan_handle_txq (KASAN detects a write of 4 bytes at ...

CVE-2023-52899

CVE-2023-52899 – kernel vulnerability (Linux kernel) has concrete details in connected advisories: a missing protection in the AXI channel error handling path (axi_chan_handle_err) for the vd signal can lead to a NULL pointer dereference and kernel panic. The issue is described as “Add exception ...

CVE-2023-52985

The CVE-2023-52985 entry relates to the Linux kernel, specifically arm64 systems with imx8mm-verdin support. The vulnerability concerns the fec driver attempting to power down the ethernet PHY during suspend (freeze or memory state), which can crash the kernel. The underlying cause is that the PH...

CVE-2023-53019

CVE-2023-53019 concerns the Linux kernel: the net/mdio subsystem allowed an out-of-bounds access in mdiobus_get_phy() when an invalid addr is passed (e.g., -1 in stmmac_init_phy). The advisory notes that addr must be validated before use to prevent access to mdio_map. Impact is described as high,...

CVE-2023-53106

CVE-2023-53106 is a Linux kernel use-after-free in the NFC st-nci driver (ndlc_remove) caused by a race between scheduled work (llt_ndlc_sm_work) and driver removal. The race may allow use-after-free of ndlc->ndev during ndlc_rcv_queue/nci_recv_frame, affecting both st_nci_i2c_remove and st_nc...

CVE-2024-1312

CVE-2024-1312 is a Linux kernel vulnerability: a use-after-free in the Memory Management subsystem caused by a race in mas_prev_slot can allow a local user to crash the system. The issue affects the kernel code path handling virtual memory areas, with exploitation described as a local privilege c...

CVE-2024-26760

Summary: CVE-2024-26760 affects the Linux kernel, specifically the SCSI PSCI path (scsi: target: pscsi). The issue stems from memory handling in bio_kmalloc: after a non-success path, bio_uninit() and kfree() are not reliably invoked, which can lead to a WARN and a NULL pointer dereference in bio...

CVE-2024-26913

Mode C: The CVE-2024-26913 issue concerns the Linux kernel DRM/AMD display driver (dcn35 8k30) where odm calculation was missing for pipe-split policy, causing Underflow/Corruption. The fix adds the missing odm calculation. Public references in connected docs point to kernel commits addressing th...

CVE-2024-35247

Summary of CVE-2024-35247 (Linux kernel): The fpga region handling was fixed by adding a module owner pointer to the fpga_region struct and using it to take the module’s refcount. The region registration APIs were updated to accept an additional owner module parameter and renamed to avoid conflic...

CVE-2024-35919

CVE-2024-35919: The Linux kernel vulnerability involves a race/NULL dereference in media: mediatek: vcodec code where vpu_enc_ipi_handler may access a deleted ctx_list, potentially leading to a NULL pointer dereference when SCP IP block behavior deletes the list. A lock was added to protect the e...

CVE-2024-36966

CVE-2024-36966 affects the Linux kernel EROFS file system. Root cause: in block device based mode, s_bdev could be uninitialised and misidentified as fscache mode when CONFIG_EROFS_FS_ONDEMAND is enabled, leading to ida_free on an unallocated id. The issue is resolved by ensuring erofs_sb_info is...

CVE-2024-36975

CVE-2024-36975 is a Linux kernel issue: when asn1_encode_sequence() fails, using WARN is inappropriate. The function is located in lib/asn1_encode.c and is not an internal helper, which makes the stack trace less useful. On certain paths, this can crash the kernel if panic_on_warn is set. The rec...