15062 matches found
CVE-2022-49799
Summary of CVE-2022-49799 (Linux kernel): The vulnerability resides in the tracing subsys, specifically register_synth_event(), where if set_synth_event_print_fmt() fails, the code may call trace_remove_event_call() and unregister_trace_event() twice, causing the trace_event_call to invoke __unre...
CVE-2017-18218
CVE-2017-18218 affects the Linux kernel's HNS Ethernet driver (drivers/net/ethernet/hisilicon/hns/hns_enet.c) pre-4.13. Local users can trigger a denial of service via use-after-free/BUG by exploiting differences in skb handling between hns_nic_net_xmit_hw and hns_nic_net_xmit. The connected docu...
CVE-2017-7277
CVE-2017-7277 affects the Linux kernel TCP stack up to version 4.10.6. It arises from mishandling SCM_TIMESTAMPING_OPT_STATS in net/core/skbuff.c and net/socket.c, enabling local users to read sensitive kernel socket data or cause a denial of service (out-of-bounds read) via crafted syscalls. Ups...
CVE-2019-16230
CVE-2019-16230 in Linux kernel 5.2.14 (drivers/gpu/drm/radeon/radeon_display.c) does not check the return value of alloc_workqueue, enabling a NULL pointer dereference during device initialization (boot). Unity Linux 20.1070e and Unity UTSA-2026 advisories reproduce this issue for kernel 5.2.14; ...
CVE-2021-4454
CVE-2021-4454 affects the Linux kernel CAN/J1939 subsystem. In concurrent paths, j1939_session_deactivate() can be invoked with a session ref-count
CVE-2021-47169
CVE-2021-47169 : In the Linux kernel, the serial rp2 driver could NULL-dereference if a firmware load via request_firmware_nowait occurred before ports were initialized. The fix was to use a synchronous firmware load (request_firmware) during rp2_probe to ensure interrupts are not handled before ...
CVE-2021-47254
In CVE-2021-47254, the Linux kernel gfs2 subsystem has a use-after-free in gfs2_glock_shrink_scan. The GLF_LRU flag is checked under lru_lock to remove the glock from the lru list in __gfs2_glock_put(), but cond_resched_lock(&lru_lock) allows progress on the put side without deleting the glock fr...
CVE-2021-47281
CVE-2021-47281 affects the Linux kernel ALSA seq subsystem: snd_seq_timer_open() has a race on timeri allocation per queue, allowing a later concurrent call to override the timer and cause a use-after-free until the queue closes. The vulnerability is caused by missing protection when checking the...
CVE-2021-47307
CVE-2021-47307 affects the Linux kernel CIFS implementation. The issue is a NULL dereference in cifs_compose_mount_options() when the optional ref parameter contains a NULL node_name. The vulnerability was fixed in the Linux kernel (details in the cited commits). CVSS data in the document set sho...
CVE-2021-47314
CVE-2021-47314 refers to a Linux kernel issue in the fsl_ifc memory handling: on probe failure the driver could leak private memory. The connected Astra/OpenVAS/Nessus advisories reproduce that the fix was to switch to resource-managed allocation to free memory when probe errors occur, mitigating...
CVE-2021-47328
CVE-2021-47328 corresponds to a Linux kernel vulnerability in the SCSI/iSCSI subsystem. The issue is a use-after-free condition in the iscsi_conn structure during resets if an unbind_target call has not occurred, allowing a race where iscsi_conn_teardown frees a connection while EH threads may st...
CVE-2021-47381
The CVE-2021-47381 vulnerability is addressed in the Linux kernel under the ASoC: SOF component. The issue involved the DSP oops stack dump output contents, with the fix targeting the @buf argument passed to hex_dump_to_buffer() and the stack address used in the dump error output. The patch preve...
CVE-2021-47445
CVE-2021-47445 : In the Linux kernel, the drm/msm driver has a fixed null dereference involving the pointer edp. The initialization path dereferenced edp before checking for null, causing a potential NULL pointer dereference. The update fixes the issue by dereferencing edp only after it has been ...
CVE-2021-47546
CVE-2021-47546 is a Linux kernel vulnerability affecting IPv6 nftables rules. When a fib6_rule_suppress path and a suppress_prefix rule exist, memory leaks occur in ip6_dst_cache per-packet allocations. The root cause is a mismatch between generic FIB_LOOKUP_NOREF and the IPv6-specific RT6_LOOKUP...
CVE-2021-47565
The CVE-2021-47565 issue is in the Linux kernel, specifically the scsi: mpt3sas path. The root cause is a race/NULL-check problem when iterating over a host (shost) sdev list: a drive may be removed and its sas_target object freed while its sdev remains, allowing code to access sas_target->sas...
CVE-2021-47610
CVE-2021-47610: In the Linux kernel, a NULL pointer dereference in the DRM MSM GEM submit path (msm_ioctl_gem_submit) could trigger a kernel panic (Oops) and crash the system. The vulnerability arises from dereferencing a NULL in msm_ioctl_gem_submit, leading to a trace via kref_put and drm ioctl...
CVE-2022-48652
CVE-2022-48652 affects the Linux kernel ice driver. The vulnerability arises when updating Traffic Classes (TCs) to more queues than allocated, or vice versa, which can leave stale values in num_txq/num_rq and tc_cfg in a VSI and lead to invalid pointer access. The provided diagnostics show a cra...
CVE-2022-48711
The CVE pertains to the Linux kernel TIPC protocol. The issue is in tipc_mon_rcv(), which processes domain_record structures and could overflow the kernel stack if the number of domain members exceeds MAX_MON_DOMAIN. To mitigate, the patch adds a sanity check in tipc_link_proto_rcv() to ensure th...
CVE-2022-48957
Summary: CVE-2022-48957 is a Linux kernel issue in the dpaa2-switch component where a memory leak can occur because cmd_buff is not freed on error in dpaa2_switch_acl_entry_add() and dpaa2_switch_acl_entry_remove(). The connected documents confirm the root cause and that a fix was applied, e.g., ...
CVE-2022-48959
CVE-2022-48959 affects the Linux kernel net: dsa: sja1105 code path. The root cause is a memory leak when dsa_devlink_region_create fails in sja1105_setup_devlink_regions(), where priv->regions is not released. The vulnerability resolution is a fix in the kernel that releases the leaked memory...
CVE-2022-49012
In CVE-2022-49012, the Linux kernel fixes an afs_put_server cleanup leak where atomic_read was inadvertently replaced with atomic_inc_return, preventing server cleanup and causing rmmod to hang with a purge warning. The vulnerability is tied to the AFS server cleanup path and affects server deall...
CVE-2022-49019
Converging sources confirm CVE-2022-49019 affects the Linux kernel nixge Ethernet driver. The issue is a NULL dereference in nixge_hw_dma_bd_release() when priv->rx_bd_v is invalid due to a prior allocation failure in nixge_hw_dma_bd_init(). A fix exists that moves the for() loop dereferencing...
CVE-2022-49051
CVE-2022-49051 concerns the Linux kernel USB driver net: usb: aqc111, specifically the aqc111_rx_fixup() function. The advisory states multiple out-of-bounds accesses that a malicious or defective USB device can trigger, including OOB reads in the metadata array (desc_offset..desc_offset+2*pkt_co...
CVE-2022-49092
CVE-2022-49092 is a Linux kernel vulnerability in the IPv4 routing path related to nexthop objects. FRR reported a kernel warning when deleting routes that point to a nexthop id without nhid while the route matched an interface. The root cause is in fib_nh_match in include/net/nexthop.h, which ca...
CVE-2022-49212
Vulnerability (CVE-2022-49212) in the Linux kernel affects the MTD/Rawnand Atmel NAND driver. A refcounting bug on a refcounted object nc->dmac can miss a balance in several error paths after dma_request_channel(), potentially leaking a reference. The issue is fixed by decrementing the refcoun...
CVE-2022-49420
CVE-2022-49420 documents a data race in the Linux kernel involving UDP path: UDP sendmsg() reads sk->sk_bound_dev_if while it can be changed by another thread, and UDP wake/receive paths around __ip6_datagram_connect and udpv6_sendmsg. The issue is in net/ipv6/udp.c and related dgram/connect c...
CVE-2022-49437
CVE-2022-49437 affects the Linux kernel (powerpc/xive) where a refcount leak occurs in xive_spapr_init due to a missing of_node_put() after of_find_compatible_node() returns a node with an incremented refcount. The provided description specifies that the fix adds the missing of_node_put() to avoi...
CVE-2022-49484
CVE-2022-49484 is a Linux kernel issue related to the mt76/mt7915 MAC RX vector handling. The provided documents state a fix for a possible NULL pointer dereference in mt7915_mac_fill_rx_vector that could occur when the chip does not support dbdc and the hardware reports band_idx = 1. The fix is ...
CVE-2022-49502
CVE-2022-49502 relates to the Linux kernel, specifically the media driver component for the rga (graphics) device. The issue was a memory leak in rga_probe where the rga->m2m_dev could remain allocated if rga_probe failed, and the resolution requires freeing m2m_dev on probe failure. The vulne...
CVE-2022-49670
CVE-2022-49670 affects the Linux kernel RDMA DIM path (linux/dim). The issue is a divide-by-zero in rdma_dim_stats_compare() when prev->cpe_ratio == 0. A fix/backport was applied (backport_rdma_dim in mlx_compat), as documented in multiple advisories (e.g., Unity/Astra/Miracle/RO). The vulnera...
CVE-2022-49703
Conforms to Mode C. The CVE-2022-49703 issue affects the Linux kernel ibmvfc driver: the back pointer from a SCSI queue to the vhost adapter was not set during subcrq allocation, which could allow a stale backpointer to be dereferenced during IRQ handling. This could cause a kernel NULL pointer d...
CVE-2022-49742
The CVE-2022-49742 issue affects the Linux kernel’s f2fs code. It describes a lock initialization order problem where spin_lock(&sbi->error_lock) is taken before spin_lock_init() is called, flagging a lockdep warning in f2fs_handle_error(). The recommended remediation is to initialize locks (a...
CVE-2022-49881
CVE-2022-49881 – Linux kernel wifi cfg80211 memory leak in query_regdb_file() Root cause: in query_regdb_file(), the alpha2 data is duplicated with kmemdup() and freed in regdb_fw_cb(), but request_firmware_nowait() may fail and skip regdb_fw_cb(), leaking memory. The connected advisories confirm...
CVE-2022-49892
CVE-2022-49892 — Linux kernel (ftrace): A use-after-free was fixed in dynamic ftrace_ops handling. KASAN reported use-after-free when two dynamic ftrace_ops with identical content were registered, and on unregistering the second op, FTRACE_UPDATE_CALLS and FTRACE_UPDATE_TRACE_FUNC could be skippe...
CVE-2022-49926
CVE-2022-49926: Linux kernel vulnerability in net: dsa: Fix possible memory leaks in dsa_loop_init() was addressed. The issue, reported by kmemleak, involved two leaks in dsa_loop_init(): (1) memory allocated for phy_device via phy_device_create() was not freed because fixed_phy_unregister() only...
CVE-2022-49936
Summary (CVE-2022-49936) In the Linux kernel, the USB core vulnerable path is “Prevent nested device-reset calls.” The accompanying analysis shows a recursive locking violation in usb-storage when a nested reset occurs during device removal, caused by a reset being invoked while another is in pro...
CVE-2022-50044
CVE-2022-50044 stems from a race in the Linux kernel’s net: qrtr MHI channel handling. After enabling, an MHI event/interrupt can occur either before dev_set_drvdata is completed (causing qrtr-ns to fail service enumeration) or after dev_set_drvdata but before qrtr_endpoint_register (potential ke...
CVE-2022-50051
CVE-2022-50051 affects the Linux kernel’s ASoC: SOF subsystem, specifically a debug path where a buffer overflow could occur due to using snprintf(). The vulnerability arises because snprintf() returns the would‑be‑filled size when the string exceeds the destination buffer, which can lead to an o...
CVE-2022-50229
CVE-2022-50229 is a Linux kernel vulnerability in the ALSA bcd2000 driver. The issue is a use-after-free (UAF) bug that occurs on the error path during probing: when snd_card_register() fails, the driver frees midi_out_urb before it is killed, enabling a UAF condition. The observed log pattern me...
CVE-2023-31081
CVE-2023-31081 affects Linux kernel 6.2 in drivers/media/test-drivers/vidtv/vidtv_bridge.c, where a NULL pointer dereference occurs in vidtv_mux_stop_thread. The issue arises because, in vidtv_stop_streaming, after dvb->mux is set to NULL, vidtv_mux_stop_thread is invoked with the NULL pointer...
CVE-2023-52611
CVE-2023-52611 (Linux kernel, wifi: rtw88 SDIO): Fixes address skb_over_panic by ensuring the driver can receive more than 1536 bytes from the SDIO card. Root causes include an Amlogic A311D (G12B) SDIO controller hardware bug (DMA transfers blocked; uses SRAM up to 1536 bytes) and rtw88 not spli...
CVE-2023-52678
CVE-2023-52678 is a Linux kernel vulnerability in drm/amdkfd: Confirm list is non-empty before using list_first_entry in kfd_topology.c. The fix adds a check that returns -ENODATA when the list is empty, preventing a potential NULL dereference; this is documented as resolved in the Linux kernel a...
CVE-2023-52742
The CVE-2023-52742 entry concerns the Linux kernel USB plusb driver. The vulnerability arises from treating a zero-length control-OUT transfer as a read instead of a write, triggering a WARNING in urb.c when usb_submit_urb is executed. The provided connected details specify the root cause as inco...
CVE-2023-52838
A resource leak exists in the Linux kernel within the fbdev: imsttfb component during the probe process. The vulnerability is caused by a failure to call iounmap(par->cmap_regs) when the init_imstt() function fails. This issue has been resolved in recent kernel updates. No specific exploit det...
CVE-2023-52850
CVE-2023-52850 affects Linux kernel media: hantro: the i.MX8MM/N/P VPU reset is done by genpd, and the .reset op may be undefined. The fix removes the .reset op from i.MX8M hantro G2 implementation and adds a check for definition before calling .reset to avoid NULL pointer dereference. In public ...
CVE-2023-52863
CVE-2023-52863 affects the Linux kernel hwmon driver for axi-fan-control. The flaw arises when axi_fan_control_irq_handler() runs before the hwmon device is registered, potentially dereferencing a NULL axi_fan_control_data pointer and causing a kernel NULL pointer dereference. The issue is eviden...
CVE-2023-52876
CVE-2023-52876 relates to the Linux kernel clk-mt7629-eth path where mtk_alloc_clk_data() could return NULL, risking a NULL pointer dereference. The fix adds a check on the return value to prevent dereferencing NULL and thus mitigates local privilege/escalation risk as described in the CVE detail...
CVE-2023-53091
CVE-2023-53091 is an ext4 kernel issue fixed in EulerOS kernel advisories. When mounting a crafted ext4 image, s_journal_inum may change after journal replay, which could bypass checks in ext4_get_journal and trigger a null pointer dereference. The patch resolves this by ignoring the inum change ...
CVE-2023-53111
CVE-2023-53111 affects the Linux kernel loop subsystem. The vulnerability arises from a use-after-free in loop_handle_cmd() after do_req_filebacked() completes, which may dereference cmd or rq depending on whether the request was completed when using asynchronous I/O. The issue can lead to a kern...