CVE-2007-5093

The CVE-2007-5093 issue affects the Linux kernel pwc (Philips USB Webcam) driver in 2.6.x up to 2.6.22.5, where disconnect relies on user space to close the device. This can allow a user-assisted local attacker to cause a denial of service (USB subsystem hang and khubd CPU usage) by not closing t...

CVE-2008-3275

The CVE-2008-3275 issue affects the Linux kernel before 2.6.25.15, where the real_lookup and __lookup_hash functions in fs/namei.c fail to prevent creating a child dentry for a deleted (S_DEAD) directory. This enables a local attacker to trigger a denial of service by repeatedly creating files wi...

CVE-2009-0029

This CVE affects the Linux kernel 2.6.28 and earlier on s390, powerpc, sparc64, and mips 64-bit platforms. The root cause is that a 32-bit user-space argument in a 64‑bit register was not verifiably sign-extended when passed to a system call, allowing local users to crash the kernel or potentiall...

CVE-2009-1046

CVE-2009-1046 affects the Linux kernel (2.6.28 prior to 2.6.28.4, 2.6.25, and possibly earlier). When the UTF-8 console is used, selecting certain 3-byte UTF-8 characters can trigger an off-by-two memory error, leading to memory corruption and a possible denial of service. The impact is described...

CVE-2009-1883

CVE-2009-1883 affects the Linux kernel z90crypt driver, where a missing capability check in the z90crypt_unlocked_ioctl for the Z90QUIESCE operation can let a local user with an effective UID of 0 bypass restrictions, potentially forcing a driver outage and enabling privilege escalation. The issu...

CVE-2010-0291

CVE-2010-0291 is a Linux kernel local privilege/escalation/DoS issue described in connected advisories as affecting the kernel before 2.6.32.4. The vulnerability stems from the do_mremap/mmap handling, allowing local users to gain privileges or trigger a panic. The MiracleLinux AXSA:2010-377:12 a...

CVE-2010-2478

CVE-2010-2478: The Linux kernel before 2.6.33.7 on 32-bit platforms has an integer overflow in ethtool_get_rxnfc(), triggered by a large info.rule_cnt via ETHTOOL_GRXCLSRLALL. Local users can cause a denial of service or potentially other impact (as described in the connected Mirage/Linux advisor...

CVE-2011-4081

CVE-2011-4081 affects the Linux kernel crypto/ghash-generic.c. The vulnerability arises when a missing or failed ghash_setkey is followed by ghash_update or ghash_final (demonstrated via AF_ALG socket write), potentially causing a NULL pointer dereference and OOPS. Connected advisories (e.g., Mir...

CVE-2011-4347

CVE-2011-4347 affects the Linux kernel KVM: kvm_vm_ioctl_assign_device in virt/kvm/assigned-dev.c fails to verify permissions for PCI config space and BAR resources, enabling a local attacker (host OS user) to assign PCI devices via KVM_ASSIGN_PCI_DEVICE and cause a host crash; fixed in Linux ker...

CVE-2012-2137

CVE-2012-2137 describes a buffer overflow in virt/kvm/irq_comm.c within the Linux kernel's KVM subsystem, exploitable by local users on kernel versions before 3.2.24. The flaw enables denial of service (crash) and potentially arbitrary code execution via vectors involving Message Signaled Interru...

CVE-2013-3229

CVE-2013-3229 affects the Linux kernel and is caused by iucv_sock_recvmsg in net/iucv/af_iucv.c not initializing a length variable, enabling local attackers to read kernel stack memory via crafted recvmsg/recvfrom calls. Affected version: kernel builds before 3.9-rc7. Consequences: information di...

CVE-2014-3535

CVE-2014-3535 affects the Linux kernel prior to 2.6.36, specifically the include/linux/netdevice.h logging macros. The root cause is incorrect use of macros for netdev_printk, enabling a remote attacker to trigger a NULL pointer dereference and system crash by sending invalid packets to a VxLAN i...

CVE-2015-5706

CVE-2015-5706 is a local-use-after-free vulnerability in the Linux kernel (path_openat in fs/namei.c) affecting 3.x and 4.x before 4.0.4. An attacker can trigger a denial of service (and possibly other impact) via O_TMPFILE filesystem operations that leverage a duplicate cleanup operation. Remedi...

CVE-2017-18261

CVE-2017-18261 : The issue is in the Linux kernel, specifically the arch_timer_reg_read_stable macro in arch/arm64/include/asm/arch_timer.h, with versions before 4.13. It allows a local user to trigger a denial of service (infinite recursion) by writing to a file under /sys/kernel/debug in certai...

CVE-2018-1095

CVE-2018-1095 concerns the Linux kernel up to 4.15.15, where ext4_xattr_check_entries in fs/ext4/xattr.c fails to validate xattr sizes, causing misinterpretation of a size as an error code. This can enable a crafted ext4 image to trigger a get_acl NULL pointer dereference and crash the system, i....

CVE-2021-4440

CVE-2021-4440 (Linux kernel) fixed by commit afd30525a659ac0ae0904f0cb4a2ca75522c3123 upstream: in x86/xen, the paravirt USERGS_SYSRET64 path was dropped and the exit from user space now uses the iret exit from the start instead of sysret, avoiding stack-mangling prerequisites in Xen PV guests. T...

CVE-2021-47059

CVE-2021-47059 concerns a memory leak in the Linux kernel crypto: sun8i-ss component, resolved by a patch that fixes a leak on an error path. The available connected documents indicate the affected code path and the underlying fix but do not provide exploitation details, affected release versions...

CVE-2021-47134

CVE-2021-47134 affects the Linux kernel boot path: if no valid FDT is found, setup_arch() calls efi_init()->efi_get_fdt_params() and initial_boot_params becomes NULL, causing a panic. The patch fixes this by stopping further FDT processing when no valid FDT is found (observed on riscv). Remedi...

CVE-2021-47145

CVE-2021-47145 affects the Linux kernel (btrfs) where a BUG_ON in link_to_fixup_dir can trigger a kernel panic during error paths in log recovery. The description shows a replay/recover flow (replay_one_buffer, btrfs_recover_log_trees, open_ctree) panicking with an invalid opcode in fs/btrfs/tree...

CVE-2021-47281

CVE-2021-47281 affects the Linux kernel ALSA seq subsystem: snd_seq_timer_open() has a race on timeri allocation per queue, allowing a later concurrent call to override the timer and cause a use-after-free until the queue closes. The vulnerability is caused by missing protection when checking the...

CVE-2021-47350

Affected software: Linux kernel on PowerPC. The issue stems from is_exec_fault() returning false for exec faults taken by the kernel, causing set_access_flags_filter() not to set PAGE_EXEC and leading to a perpetual minor exec fault. Root cause traced through a sequence of commits (notably d7df24...

CVE-2021-47376

CVE-2021-47376 is a Linux kernel issue where an oversize allocation in kmalloc path could trigger a warning during BPF verification. The provided description and connected advisories indicate the fix adds an oversize check before kvcalloc() via the commit that introduces the guard in mm/kvmalloc(...

CVE-2021-47389

CVE-2021-47389 is a Linux kernel/KVM SVM issue related to SevReceiveStart and SEV context decommission. The root cause was a missing SEV decommission step when ASID binding fails after RECEIVE_START, which can leak firmware memory and eventually prevent allocating new SEV guest contexts, causing ...

CVE-2021-47451

The provided documents confirm CVE-2021-47451 affects the Linux kernel’s netfilter xt_IDLETIMER implementation, where idletimer_tg_create initializes timer_type via kmalloc, leaving timer->timer_type garbage and causing a kernel panic. The fix, described in the sources, initializes timer->t...

CVE-2021-47620

CVE-2021-47620 affects the Linux kernel Bluetooth subsystem. The vulnerability arose from an out-of-bounds read in the malicious advertising data check, observed at the end of the while num_reports loop. A guard was added at the beginning of loop processing to ensure the pointer isn’t advanced be...

CVE-2021-47635

CVE-2021-47635 concerns a Linux kernel ubifs page refcount bug when a page is marked with PG_private. The connected documents describe that UBIFS did not increase the page’s refcount after SetPagePrivate, causing the migration code to overestimate zero references and migrate pages still in use, p...

CVE-2021-47636

CVE-2021-47636 relates to the Linux kernel ubifs_wbuf_write_nolock() reading beyond buf bounds, causing a slab-out-of-bounds read in KASAN/ubifs paths. The vulnerability arises when len is not 8-byte aligned and the function writes via ubifs_leb_write(), potentially reading past the end of the bu...

CVE-2022-48775

CVE-2022-48775 concerns a memory leak in the Linux kernel under the hv: vmbus driver: the function kobject_init_and_add() can return an error without releasing the allocated object, leading to a leak. The documented fix is to call kobject_put() when an error occurs, preventing memory retention. T...

CVE-2022-48826

Mode C: CVE-2022-48826 affects the Linux kernel drm/vc4, where a deadlock can occur during DSI device attach error when the host device lock is held. Specifically, in the device attach error path, un-registering the host can deadlock with a call trace involving device_del/unregister, mipi_dsi_hos...

CVE-2022-49089

Summary (CVE-2022-49089) The Linux kernel vulnerability stems from a race condition in IB/rdmavt code where a call to rvt_error_qp was not consistently guarded by the required locks (r_lock and s_lock) due to a commit in Fixes. The function’s documentation requires both locks to be held and lockd...

CVE-2022-49148

The CVE-2022-49148 entry concerns a Linux kernel vulnerability where, during dismantling of watch_queue, the page array was not freed, leaving a memory leak. The issue was addressed by a patch sequence that first frees the alloc bitmap when tearing down watch_queue (commit 7ea1a0124b6d) and then ...

CVE-2022-49260

CVE-2022-49260 affects the Linux kernel crypto path: crypto: hisilicon/sec, where the aead software fallback for the engine could mismanage private context memory due to a subreq pointer mishandling, potentially causing an OS panic when configuring a 64K page. The connected documents confirm a fi...

CVE-2022-49310

CVE-2022-49310 corresponds to a Linux kernel vulnerability in the xillybus driver where a refcount leak occurs in cleanup_dev(). The root cause is the sequence: usb_get_dev is acquired in xillyusb_probe and usb_put_dev is not paired before xdev is released, leading to a potential resource leak. T...

CVE-2022-49317

CVE-2022-49317 relates to the Linux kernel’s f2fs code, where an infinite loop could occur while flushing node pages, triggered by certain xfstests/generic/475 scenarios that could yield sustained EIO. The provided documents indicate a resolved issue in f2fs: avoid infinite loop to flush node pag...

CVE-2022-49399

CVE-2022-49399 affects the Linux kernel tty driver for the goldfish port. In goldfish_tty_probe(), the port created by tty_port_init() can leak resources if error paths don’t destroy it; in goldfish_tty_remove(), the port must also be destroyed. The fix is to call tty_port_destroy() to release th...

CVE-2022-49444

CVE-2022-49444: Linux kernel vulnerability in module loading (e_shstrndx).sh_size) leading to an out-of-bounds access; described as exploitable by crafting a module. The issue is resolved by a patch that was rebased onto modules-next. Affected systems require updating to a kernel version containi...

CVE-2022-49446

CVE-2022-49446 affects the Linux kernel’s NVDIMM path, describing deadlock risks in CXL/NVDIMM interactions. The advisory notes possible unsafe locking scenarios involving nd_region keys, nvdimm_bus->reconfig_mutex, system_transition_mutex, and cxl_root/acpi_scan_lock chains, triggered by hold...

CVE-2022-49490

CVE-2022-49490: In the Linux kernel, drm/msm/mdp5 had a NULL dereference risk in mdp5_pipe_release when mdp5_get_global_state could return an error (-EDEADLK) during modeset lock handling. The fix propagates such errors from mdp5_get_global_state to mdp5_pipe_release and returns a proper error in...

CVE-2022-49522

CVE-2022-49522 concerns a Linux kernel MMC driver issue (mmc: jz4740) where DMA maps could exceed the DMA engine’s capabilities. The root cause is not a research-level flaw but an inadequate limit on the maximum segment size for DMA data transfers. The fix enforces DMA engine limits on the jz4740...

CVE-2022-49609

CVE-2022-49609 affects the Linux kernel component power/reset for the arm-versatile family. Root cause: of_find_matching_node_and_match() returns a node pointer with refcount incremented and was not balanced with of_node_put() when no longer needed, causing a refcount leak in versatile_reboot_pro...

CVE-2022-49645

CVE-2022-49645 affects the Linux kernel (drm/panfrost). The issue occurs when the madvise IOCTL is called twice on a BO: the memory shrinker list is corrupted because the BO is already on the list and is re-added without removing it first, leading to a kernel crash. The connected documents confir...

CVE-2022-49679

The CVE-2022-49679 entry concerns a Linux kernel ARM refcount leak in axxia_boot_secondary. The flaw arises because of_find_compatible_node() returns a node pointer with an incremented refcount and is not paired with a corresponding of_node_put(). The connected Astra Linux and Unity/OSV entries r...

CVE-2022-49742

The CVE-2022-49742 issue affects the Linux kernel’s f2fs code. It describes a lock initialization order problem where spin_lock(&sbi->error_lock) is taken before spin_lock_init() is called, flagging a lockdep warning in f2fs_handle_error(). The recommended remediation is to initialize locks (a...

CVE-2022-49773

CVE-2022-49773 affects the Linux kernel (drm/amd/display for DCN314). Root cause: optc2_configure_crc() wraps optc1_configure_crc() plus extra registers not applicable to dcN314, which can trigger a warning trace. Mitigation/Fix: use optc1_configure_crc() directly. References note patches in kern...

CVE-2022-49776

CVE-2022-49776 affects the Linux kernel macvlan code; it fixes a low-level issue by enforcing a minimal MTU of 68 at link creation to prevent crashes in the IPv6 stack. The advisory notes that macvlan0 should reject mtu values below the device minimum (e.g., 67 rejected, 68 accepted), with the fi...

CVE-2022-49915

The CVE-2022-49915 issue affects the Linux kernel mISDN path and is caused by a memory leak in mISDN_register_device due to how device names were allocated. After the commit 1fa5ae857bb1 (driver core: get rid of struct device's bus_id string array), the device name is allocated dynamically and fr...

CVE-2022-50021

CVE-2022-50021 documents a Linux kernel ext4 bug where a validated block range for freeing blocks could be altered after validation on bigalloc filesystems, potentially triggering a kernel BUG in ext4_free_blocks() / ext4_mb_clear_bb(). The issue arises because the range may be adjusted after val...

CVE-2022-50054

The CVE-2022-50054 entry concerns a Linux kernel vulnerability in the iavf driver: a NULL pointer dereference in iavf_get_link_ksettings when vf_res has been freed in iavf_init_get_resources. The issue arises after a regression that could allow netdev to call ethtool_ops while vf_res is gone, lea...

CVE-2022-50085

The CVE-2022-50085 issue is present in the Linux kernel’s dm-raid path and affects the raid_resume flow. A KASAN warning is triggered when lvmetad tests exercise mddev->raid_disks vs rs->raid_disks, causing an out-of-bounds access in the raid resume loop. The connected OpenVAS/Nessus entrie...

CVE-2022-50153

CVE-2022-50153 concerns a Linux kernel USB host (EHCI) vulnerability affecting PPC configurations where of_find_compatible_node() returns a node pointer with a refcount incremented and is not released, causing a refcount leak. The connected Nessus/OpenVAS documents quote the fix: add missing of_n...