CVE-2021-47537

CVE-2021-47537 affects the Linux kernel in the octeontx2-af component, where in rvu_mbox_init() the mbox_regions pointer could be leaked on the switch-default path. The bug was a memory leak due to not freeing or returning the regions, and it is fixed by replacing a plain return err with a goto f...

CVE-2021-47619

CVE-2021-47619 concerns the i40e Linux kernel XDP path. A PF queue pile fragmentation caused by placing a flow director VSI immediately after the main VSI could prevent the main VSI from resizing its queue allocation when XDP is enabled on systems with many CPUs and an X722 NIC, leading to a NULL...

CVE-2022-1943

CVE-2022-1943 describes an out-of-bounds memory write in the Linux kernel UDF file system, triggered by user-initiated file operations that invoke udf_write_fi(). The flaw could allow a local attacker to crash the system (and, per connected advisories, is associated with Ubuntu and other mappings...

CVE-2022-20107

CVE-2022-20107 affects the subtitle service and is caused by an integer overflow that can crash the application, enabling local denial of service with SYSTEM privileges. The vulnerability is exploitable locally (attack vector: LOCAL, attack complexity: LOW) and does not require user interaction. ...

CVE-2022-48693

CVE-2022-48693 affects the Linux kernel’s brcmstb PM subsystem (soc: brcmstb: pm-arm). The two leak bugs are in brcmstb_pm_probe() and include: (1) missing of_node_put() when for_each__matching_node() breaks, and (2) missing iounmap() for each iomap in the failure path. Public information in conn...

CVE-2022-48710

CVE-2022-48710 concerns the Linux kernel Radeon driver. Inradeon_fp_native_mode() , the code assigns the return ofdrm_mode_duplicate() to a mode pointer and may dereference a NULL on failure. The issue is resolved by adding a NULL-pointer check to avoid NP: when drm_mode_duplicate() fails, and th...

CVE-2022-48711

The CVE pertains to the Linux kernel TIPC protocol. The issue is in tipc_mon_rcv(), which processes domain_record structures and could overflow the kernel stack if the number of domain members exceeds MAX_MON_DOMAIN. To mitigate, the patch adds a sanity check in tipc_link_proto_rcv() to ensure th...

CVE-2022-48739

CVE-2022-48739 affects the Linux kernel ASoC hdmi-codec subsystem. The vulnerability arises from out-of-bounds memory accesses during memcpy(), caused by an incorrect size for the iec_status array. The fix aligns the size of iec_status with the status array of struct snd_aes_iec958, eliminating t...

CVE-2022-48744

In CVE-2022-48744, the Linux kernel net/mlx5e driver was made resilient to field-bound checking by avoiding a field-overflowing memcpy() across neighboring fields. The root cause involved copying MLX5E_XDP_MIN_INLINE bytes into a 2-byte inline_hdr.start, causing writes to adjacent data (vlan_tci,...

CVE-2022-48935

CVE-2022-48935 concerns a Linux kernel vulnerability in netfilter nf_tables. The issue arises when unregistering flowtable hooks on netns exit: if flowtable hooks are not unregistered before nf_tables_flowtable_destroy(), the hook core can report a use-after-free (KASAN) in nf_hook_entries_grow. ...

CVE-2022-48972

CVE-2022-48972 affects the Linux kernel’s mac802154 code path. The issue arises in ieee802154_if_add() where a wpan_dev private data structure’s list is not initialized, potentially leading to a NULL pointer dereference during notifier handling (cfg802154_netdev_notifier_call) as devices are regi...

CVE-2022-49051

CVE-2022-49051 concerns the Linux kernel USB driver net: usb: aqc111, specifically the aqc111_rx_fixup() function. The advisory states multiple out-of-bounds accesses that a malicious or defective USB device can trigger, including OOB reads in the metadata array (desc_offset..desc_offset+2*pkt_co...

CVE-2022-49061

The CVE-2022-49061 issue affects the Linux kernel net: ethernet: stmmac altr_tse_pcs when using a fixed-link. The driver crashes with a null-pointer dereference because phy_device is not provided to tse_pcs_fix_mac_speed. The patch adds a check for phy_dev before calling tse_pcs_fix_mac_speed() a...

CVE-2022-49094

CVE-2022-49094 affects the Linux kernel net/tls decrypt_internal path handling AES128-CCM. The bug arises because tls_ctx->rx.iv is 12 bytes while crypto_aead_ivsize("ccm(aes)") returns 16, causing a slab-out-of-bounds read during memcpy. The described fixes replace the call to crypto_aead_ivs...

CVE-2022-49118

CVE-2022-49118 relates to the Linux kernel SCSI driver for Hisilicon SAS v3 hardware. The vulnerability arises when the driver probe fails to request the channel IRQ or a fatal IRQ, causing the driver to free IRQ vectors before freeing the IRQs in free_irq(), which can trigger a kernel BUG. The d...

CVE-2022-49341

The CVE-2022-49341 entry concerns the Linux kernel vulnerability where bpf, arm64 paths could reveal kernel memory via copy_to_user() in bpf_prog_get_info_by_fd() due to incorrect handling of prog->jited_len. The issue arises when prog->jited_len is set (e.g., to 43) but prog->bpf_func i...

CVE-2022-49342

CVE-2022-49342 affects the Linux kernel net/ethernet/bgmac path (bcma_mdio_mii_register) where of_get_child_by_name() increases the node refcount, causing a refcount leak. The root cause is missing of_node_put() on unused nodes. Patches add the missing of_node_put() to prevent leaks. Patched stat...

CVE-2022-49359

CVE-2022-49359 : In Linux kernel’s DRM Panfrost handling, a use-after-free occurs when a panfrost_priv is freed but a job structure continues to reference it to obtain the MMU context. The fix drops the panfrost_priv reference from the job and adds a direct reference to the MMU structure that is ...

CVE-2022-49431

CVE-2022-49431 concerns the Linux kernel powerpc iommu: a missing of_node_put in iommu_init_early_dart leads to a refcount leak for the device_node returned by of_find_compatible_node. The issue is local in scope (AV:L, AC:L, PR:L, UI:N) with a high impact on availability and a moderate base scor...

CVE-2022-49438

CVE-2022-49438 : In the Linux kernel, the refcount leak occurs in the path handling for device tree lookups. Specifically, of_find_node_by_path() using of_find_node_opts_by_path() returns a node pointer with an incremented refcount, but the code did not call of_node_put() when done, causing a ref...

CVE-2022-49440

CVE-2022-49440 affects the Linux kernel (PowerPC RTAS path). The root cause is MSR[RI] not being preserved when entering RTAS, while RTAS runs in real mode and may trigger a panic/ watchdog lockup if MSR[RI] is unset. The fix updates how MSR is computed before calling RTAS, ensuring a hardcoded v...

CVE-2022-49505

Mode C: The CVE-2022-49505 issue affects the Linux kernel NFC subsystem. The root cause is a UAF (use-after-free) of the rfkill object in the NFC device handling: during nfc_dev_up() and related operations, the rfkill state could be dereferenced if the device is removed via nfc_unregister_device(...

CVE-2022-49617

The CVE-2022-49617 issue affects the Linux kernel ASoC: Intel sof_sdw driver, where on card-registration failure (often deferred probes) headset codec device properties are not removed, leading to kernel oops in driver bind/unbind tests. Provided connected documents confirm this exact description...

CVE-2022-49618

In CVE-2022-49618, the Linux kernel pinctrl: aspeed driver fixes a potential NULL pointer dereference in aspeed_pinmux_set_mux() where pdesc could be null but dereferenced pdesc->name. The patch adds a null check before dereferencing, preventing null pointer access. Connected Astra Linux advis...

CVE-2022-49670

CVE-2022-49670 affects the Linux kernel RDMA DIM path (linux/dim). The issue is a divide-by-zero in rdma_dim_stats_compare() when prev->cpe_ratio == 0. A fix/backport was applied (backport_rdma_dim in mlx_compat), as documented in multiple advisories (e.g., Unity/Astra/Miracle/RO). The vulnera...

CVE-2022-49705

CVE-2022-49705 - Linux kernel 9p fid refcount leak . A fix was implemented for the 9p fid refcount leak in v9fs_vfs_atomic_open_dotl, ensuring the directory fid is released if the open() sequence fails partway. This prevents fid leaks observed with xfstests generic 531. The description in the ini...

CVE-2022-49754

CVE-2022-49754: Linux kernel Bluetooth mgmt_mesh_add() contains a buffer overflow risk in mgmt_util.c. Smatch indicates mesh_tx->param is 48 bytes while the destination can reach 50 bytes; caller rejects only when len > 50, creating a potential overflow window. Multiple connected sources co...

CVE-2022-49789

The CVE-2022-49789 entry documents a Linux kernel issue in the SCSI zfcp path: double free of an FSF request due to caching the FSF request ID in a signed 32-bit int, causing truncation and sign-extension when converting to 64-bit, leading to mismatches in the internal hash table and a stale poin...

CVE-2022-49870

In CVE-2022-49870, the Linux kernel fixes undefined behavior in the CAP_TO_MASK bit-shift operation. The issue arises when shifting a signed 32-bit value by 31 bits, triggering UBSAN warnings (shift-out-of-bounds) reported in security/commoncap.c. The vulnerability stems from shifting a value tha...

CVE-2022-49874

CVE-2022-49874 concerns the Linux kernel HID subsystem, specifically a memory-leak in the Hyper-V mousevsc_probe path. The vulnerability arises when hid_add_device() returns an error and the allocated hid_dev is not freed, potentially leaking memory. The referenced fix ensures hid_destroy_device(...

CVE-2022-49875

CVE-2022-49875: In the Linux kernel, bpftool can cause a NULL pointer dereference when pinning BPFFS objects (PROG, MAP, LINK) without a FILE, leading to a local segmentation fault. The root cause is strlen being invoked on a NULL name during mount_bpffs_for_pin. The mitigation provided in the so...

CVE-2022-49892

CVE-2022-49892 — Linux kernel (ftrace): A use-after-free was fixed in dynamic ftrace_ops handling. KASAN reported use-after-free when two dynamic ftrace_ops with identical content were registered, and on unregistering the second op, FTRACE_UPDATE_CALLS and FTRACE_UPDATE_TRACE_FUNC could be skippe...

CVE-2022-49986

CVE-2022-49986 : In the Linux kernel, the storvsc driver’s storvsc_error_wq was incorrectly marked as WQ_MEM_RECLAIM, risking deadlock while flushing disk events. The supplied advisories state that removing WQ_MEM_RECLAIM from storvsc_error_wq fixes the issue, preventing forward-progress requirem...

CVE-2022-50034

CVE-2022-50034 affects the Linux kernel USB cdns3 gadget workaround 2. A use-after-free occurs in cdns3_wa2_remove_old_request when priv_req->request.buf is freed before the list node is removed with list_del_init(), leaving a dangling pointer in the list. The patch reorders the sequence, movi...

CVE-2022-50115

CVE-2022-50115 : In the Linux kernel, the ASoC: SOF: ipc3-topology vulnerability caused potential memory corruption due to a double free of ipc_control_data in error/rollback paths when load_bytes-related validation fails. The issue arose because scontrol->ipc_control_data could be freed but n...

CVE-2022-50146

CVE-2022-50146 concerns the Linux kernel PCI-DWC stack. If dw_pcie_ep_init() initializes EPC memory and allocates MSI memory but fails to perform a subsequent action, the MSI region leak is not cleaned up, creating a memory leak. The fix, described in the commit log referenced by multiple advisor...

CVE-2022-50154

CVE-2022-50154 (Linux kernel limit): The issue is a refcount leak in the Mediatek Gen3 PCI IRQ domain initialization. Specifically, of_get_child_by_name() returns a node pointer with a bumped refcount; the fix is to call of_node_put() when the node is no longer needed. Affected area: PCI subsyste...

CVE-2022-50229

CVE-2022-50229 is a Linux kernel vulnerability in the ALSA bcd2000 driver. The issue is a use-after-free (UAF) bug that occurs on the error path during probing: when snd_card_register() fails, the driver frees midi_out_urb before it is killed, enabling a UAF condition. The observed log pattern me...

CVE-2023-20844

CVE-2023-20844 affects the imgsys_cmdq component in MediaTek devices. The issue is an out-of-bounds read caused by missing valid range checking, potentially enabling local information disclosure with system-execution privileges required. Exploitation requires user interaction. The vulnerability i...

CVE-2023-52516

CVE-2023-52516 affects the Linux kernel’s dma-debug path. The root cause is that __dma_entry_alloc_check_leak() could be invoked while holding free_entries_lock and then call printk/serial console while port->lock is held, creating a reverse locking dependency chain: console_owner -> port_l...

CVE-2023-52742

The CVE-2023-52742 entry concerns the Linux kernel USB plusb driver. The vulnerability arises from treating a zero-length control-OUT transfer as a read instead of a write, triggering a WARNING in urb.c when usb_submit_urb is executed. The provided connected details specify the root cause as inco...

CVE-2023-52808

Summary: CVE-2023-52808 affects the Linux kernel driver path for the Hisilicon SAS host bus adapter (hisi_sas). The root cause is that after a failed init path, debugfs_remove_recursive() is called but debugfs_dir is not set to NULL, causing a NULL pointer dereference during device removal. Impac...

CVE-2023-52829

The connected documents do not provide additional technical details beyond the initial description. Public information on CVE-2023-52829 is not expanded here; monitor for updates.

CVE-2023-52844

CVE-2023-52844: Linux kernel vulnerability in media: vidtv psi where kstrdup() return value wasn't checked. The fix adds a check for kstrdup() and returns an error to avoid NULL pointer dereference. Affected kernel versions (Linux kernel series) have been updated with this patch; references point...

CVE-2023-52853

Technical details about CVE-2023-52853 (affected product, exact root cause, impact, and fixed versions) are not provided in the connected documents. The supplied materials only contain vendor advisories; monitor for official updates for concrete details.

CVE-2023-52862

CVE-2023-52862 is a Linux kernel vulnerability in the DRM/AMD display path (Display Core) where a null pointer dereference could occur when printing the error message if the DC fails to initialize. The fix prevents dereferencing a DC version field that may be undefined when DC initialization has ...

CVE-2023-52863

CVE-2023-52863 affects the Linux kernel hwmon driver for axi-fan-control. The flaw arises when axi_fan_control_irq_handler() runs before the hwmon device is registered, potentially dereferencing a NULL axi_fan_control_data pointer and causing a kernel NULL pointer dereference. The issue is eviden...

CVE-2023-52873

The CVE-2023-52873 issue affects the Linux kernel clock driver for Mediatek (clk-mt6779). Root cause: missing validation of the return value from mtk_alloc_clk_data(), which could lead to a NULL pointer dereference. Impact is local with possible kernel gains if exploited. The connected sources in...

CVE-2023-52898

CVE-2023-52898 is a Linux kernel vulnerability in the xHCI USB host controller code. The issue is a potential null pointer dereference when the host dies, caused by a race between xhci_free_dev() freeing virt devices and xhci_kill_endpoint_urbs() iterating endpoints. The fix synchronizes access b...

CVE-2023-52940

CVE-2023-52940 affects the Linux kernel; it concerns the multi-gen LRU code during cgroup migration. The issue arises in lru_gen_migrate_mm(), which assumes lru_gen_add_mm() runs before it, but in a specific cross-CPU sequence (clone, cgroup_fork, cgroup_procs_write, cgroup_post_fork, task_lock, ...