CVE-2022-50021

CVE-2022-50021 documents a Linux kernel ext4 bug where a validated block range for freeing blocks could be altered after validation on bigalloc filesystems, potentially triggering a kernel BUG in ext4_free_blocks() / ext4_mb_clear_bb(). The issue arises because the range may be adjusted after val...

CVE-2022-50054

The CVE-2022-50054 entry concerns a Linux kernel vulnerability in the iavf driver: a NULL pointer dereference in iavf_get_link_ksettings when vf_res has been freed in iavf_init_get_resources. The issue arises after a regression that could allow netdev to call ethtool_ops while vf_res is gone, lea...

CVE-2022-50085

The CVE-2022-50085 issue is present in the Linux kernel’s dm-raid path and affects the raid_resume flow. A KASAN warning is triggered when lvmetad tests exercise mddev->raid_disks vs rs->raid_disks, causing an out-of-bounds access in the raid resume loop. The connected OpenVAS/Nessus entrie...

CVE-2022-50153

CVE-2022-50153 concerns a Linux kernel USB host (EHCI) vulnerability affecting PPC configurations where of_find_compatible_node() returns a node pointer with a refcount incremented and is not released, causing a refcount leak. The connected Nessus/OpenVAS documents quote the fix: add missing of_n...

CVE-2022-50201

CVE-2022-50201 affects the Linux kernel SELinux path: memleak in security_read_state_kernel() where the function returns the result of __security_read_policy without freeing allocated memory in *data. This memory leak occurs when __security_read_policy fails. The issue is addressed by freeing the...

CVE-2022-50220

CVE-2022-50220 is a Linux kernel vulnerability in the usbnet subsystem where a use-after-free can occur on disconnect due to linkwatch handling after unregister_netdev. The issue stems from usbnet_deferred_kevent() being awaited in a path that may access freed netdev state, potentially enabling m...

CVE-2023-2898

CVE-2023-2898 is a Linux kernel vulnerability: a null-pointer dereference in f2fs_write_end_io (fs/f2fs/data.c) can be triggered by a local, privileged user to cause a denial of service. Public documentation confirms this flaw and ties it to the f2fs filesystem on the Linux kernel, with advisorie...

CVE-2023-52573

In the Linux kernel, CVE-2023-52573 is a NULL-pointer dereference in the RDS path. Specifically, rds_rdma_cm_event_handler_cmn() now checks conn before dereferencing it as an rdma_set_service_type() argument. This fixes a possible NULL-pointer dereference. Connected advisories also reiterate the ...

CVE-2023-52577

CVE-2023-52577 pertains to the Linux kernel DCCP handling. The issue stems from an incorrect assumption about the DCCP header field dh->dccph_x (the 9th byte, offset 8) and related ICMP message sizing, which could affect processing of DCCP packets and ICMP responses. The description notes that...

CVE-2023-52678

CVE-2023-52678 is a Linux kernel vulnerability in drm/amdkfd: Confirm list is non-empty before using list_first_entry in kfd_topology.c. The fix adds a check that returns -ENODATA when the list is empty, preventing a potential NULL dereference; this is documented as resolved in the Linux kernel a...

CVE-2023-52836

CVE-2023-52836 concerns Linux kernel workqueue handling in the ww_mutex test. The connected advisories confirm the issue was a lifetime problem where the workqueue’s work_struct node lived inside the stress struct; the work_struct could be freed before the worker finished, causing premature flush...

CVE-2023-52842

CVE-2023-52842 affects the Linux kernel virtio_vsock path. The issue arises from uninitialized buf_alloc and fwd_cnt fields in struct virtio_vsock_hdr when a new skb is allocated in virtio_transport_init_hdr(), leading to a KMSAN-uninitialized-value report. The connected Astra/SUSE advisories con...

CVE-2023-52886

The CVE-2023-52886 entry describes a race in the Linux kernel USB core where hub_port_init() can overwrite udev->descriptor while read_descriptors() (sysfs.c) is reading it, enabling a slab-out-of-bounds read (KASAN) observed in syzbot. The root cause is a race between read_descriptors() and h...

CVE-2023-53005

CVE-2023-53005 concerns a Linux kernel vulnerability in trace_events_hist where create_hist_field could be called recursively and return NULL, risking a NULL pointer dereference. The fixed advisory notes adding a check for the return value of create_hist_field (trace_events_hist.c:1954). Related ...

CVE-2023-53031

In CVE-2023-53031, the Linux kernel vulnerability affects the POWER9/PowerPC imc-pmu code where a mutex is used in sections where IRQs are disabled. The underlying issue is that mutex_lock may call __might_resched(), which can emit a warning when IRQs are disabled, potentially triggering sleep-re...

CVE-2023-53091

CVE-2023-53091 is an ext4 kernel issue fixed in EulerOS kernel advisories. When mounting a crafted ext4 image, s_journal_inum may change after journal replay, which could bypass checks in ext4_get_journal and trigger a null pointer dereference. The patch resolves this by ignoring the inum change ...

CVE-2024-1312

CVE-2024-1312 is a Linux kernel vulnerability: a use-after-free in the Memory Management subsystem caused by a race in mas_prev_slot can allow a local user to crash the system. The issue affects the kernel code path handling virtual memory areas, with exploitation described as a local privilege c...

CVE-2024-26709

CVE-2024-26709 (Linux kernel, PowerPC). A refcount leak in spapr_tce_platform_iommu_attach_dev() occurs because iommu_group_put() is not called when the domain is already set, leading to a leak and a BUG_ON() during DLPAR remove on POWER10/pSeries platforms. The connected patch adds the missing i...

CVE-2024-26914

CVE-2024-26914 concerns the Linux kernel DRM/AMD display path. The root cause is an incorrect mpc_combine array size:MAX_SURFACES was used instead of MAX_PLANES, causing an overflow when more than 3 planes are present. The patch uses MAX_PLANES as the array size, addressing the issue. The vulnera...

CVE-2024-35247

Summary of CVE-2024-35247 (Linux kernel): The fpga region handling was fixed by adding a module owner pointer to the fpga_region struct and using it to take the module’s refcount. The region registration APIs were updated to accept an additional owner module parameter and renamed to avoid conflic...

CVE-2024-35975

CVE-2024-35975 concerns the Linux kernel, specifically the octeontx2-pf Netdev driver, where a bug in the Round Robin scheduling patch caused transmit schedulers to not be freed after a class deletion. The vulnerability is described as a transmit scheduler resource leak that arises during shaping...

CVE-2024-35987

CVE-2024-35987 relates to the Linux kernel on RISCV NOMMU. The issue arose from enabling a linear mapping that used RAM below the kernel load address, which breaks NOMMU because PAGE_OFFSET is fixed to the load address. As a result mm initialization can start at mem_map and corrupt adjacent kerne...

CVE-2024-35994

CVE-2024-35994 concerns the Linux kernel firmware driver for Qualcomm QSEE/QSEECom (uefisecapp). The issue stems from the QSEECOM APP_SEND command handling: the driver originally treated request and response buffers as separate DMA regions, but the firmware expects both buffers to live in a singl...

CVE-2024-39296

CVE-2024-39296 affects the Linux kernel bonding subsystem. The issue is a race during module removal (rmmod bonding) caused by a removed NULL check in the bonding debugfs cleanup path, which can lead to an oops in bond_uninit()/bond_debug_unregister() via debugfs_remove or recursive removal. The ...

CVE-2024-42261

CVE-2024-42261 – Linux kernel drm/v3d: fix for invalid drm_syncobj handles in the timestamp extension. The vulnerability occurs when userspace supplies an unknown/invalid handle in a handle array, which can cause the rest of the driver to behave poorly. The fix inserts a check that the handle was...

CVE-2024-44968

The connected Nessus entry for CVE-2024-44968 confirms a Linux kernel tick/broadcast timer regression where per-CPU pointer access was taken in a preemptible region due to compiler behavior. The fix moves the per-CPU pointer retrieval to the actual usage site, which is in a non-preemptible region...

CVE-2024-46701

CVE-2024-46701 affects the Linux kernel, where libfs offset-dir reads could loop infinitely during concurrent readdir/rename operations after switching tmpfs dir operations to simple_offset_dir_operations. The issue arose because each rename could insert a new dentry into dest dir’s maple tree wi...

CVE-2024-46709

The CVE-2024-46709 issue affects the Linux kernel drm/vmwgfx driver, fixed by ensuring external buffers map through the dma_buf interface instead of direct page access. The vulnerability arises because external buffers may not expose readable/writable pages, so media buffers (bo) created from ext...

CVE-2024-49943

CVE-2024-49943 affects the Linux kernel DRM XE driver (guc_submit_wedged_fini). A missing locking around wedged_fini permits a use-after-free when a non-wedged queue is dereferenced concurrently with an async queue destroy. The fix is to hold the submission_state lock during the wedge-status chec...

CVE-2024-50270

CVE-2024-50270 targets the Linux kernel, specifically in mm/damon/core where damon_feed_loop_next_input() contains overflow-prone calculations (score_goal_diff_bp, compensation, etc.) related to a constant target score of 10,000. The fix rewrites the function to avoid overflows and removes the un...

CVE-2024-51729

Technical details for CVE-2024-51729 are not provided in the connected documents. The supplied items reference a kernel fix at a high level but do not enumerate affected products/versions beyond generic kernel context; monitor for updates.

CVE-2024-56559

CVE-2024-56559 : Linux kernel vulnerability in vmalloc/KASAN shadow VA handling where the TLB flush of multiple uses was not consolidated, causing a soft lockup on a 256-core machine during drain_vmap_area_work and Kasan vmap allocations. The issue is resolved by combining all TLB flush operation...

CVE-2025-21695

Summary: CVE-2025-21695 relates to a race condition in the Linux kernel platform/x86 dell-uart-backlight, where dell_uart_bl_serdev_probe() opens the serdev device before initializing client ops. This can trigger a NULL pointer dereference in the serdev controller’s receive_buf handler when SERPO...

CVE-2025-21990

This CVE affects the Linux kernel DRM/AMDGPU path. The vulnerability arises when determining GFX12 page table entry (PTE) flags for BOs (backing stores). Specifically, PRT BOs may have no backing store, making bo->tbo.resource NULL. If this NULL is dereferenced, it can lead to a crash or other...

CVE-2025-22082

CVE-2025-22082 affects the Linux kernel IIO subsystem: iio_backend_debugfs_write_reg() could pass an uninitialized stack buffer to sscanf() due to missing NULL termination. The root cause is a stack buffer not guaranteed to be 0-initialized, leading to potential uncontrolled reads. The vulnerabil...

CVE-2025-22098

CVE-2025-22098 affects the Linux kernel’s DRM for ZynqMP DP. The issue is a deadlock in zynqmp_dp_ignore_hpd_set caused by attempting to lock the same mutex twice; the fix is to lock and unlock it properly (instead of locking twice). The vulnerability was identified by the Clang thread-safety ana...

CVE-2025-37774

The CVE-2025-37774 entry describes a Linux kernel slab allocator issue where slab->obj_exts may be left non-zero on newly allocated slabs, causing invalid pointer dereferences and potential Oops/panic during buffered I/O operations. Investigation notes that bits in slab->obj_exts could esca...

CVE-2025-37806

CVE-2025-37806 affects Linux kernel fs/ntfs3 write path. A NULL pointer dereference can occur in __generic_file_write_iter when an ioctl clears the file’s compress flag during a write, causing is_compressed() to return 0 and the code to call the wrong AOP, leading to a null dereference in write_b...

CVE-2025-37826

CVE-2025-37826 pertains to the Linux kernel, specifically the SCSI: UFS core. The root cause is a missing NULL check on the hwq pointer returned by ufshcd_mcq_req_to_hwq(), which can occur in ufshcd_mcq_compl_pending_transfer(). The available connected documents describe a patch that adds a NULL ...

CVE-2025-37904

CVE-2025-37904 affects the Linux kernel (btrfs) where a bug in btrfs_iget() can leak an inode if btrfs_alloc_path() fails, leaving a busy inode and triggering a kernel BUG in fs/super.c during unmount. The root cause is failure to release the previously allocated inode when btrfs_alloc_path() fai...

CVE-2025-37934

CVE-2025-37934 affects the Linux kernel’s ASoC simple-card-utils, specifically the graph_util_parse_link_direction pointer checks. The issue arises from writing to potentially-invalid pointers when playback_only is absent, causing UBSAN invalid-load warnings (example in imx-card.c). The vulnerabi...

CVE-2025-38014

CVE-2025-38014 : In the Linux kernel’s dmaengine idxd subsystem, a removal path was refactored to use an idxd_cleanup() helper, which fixes code duplication and also corrects a missing put_device() for idxd groups, engines, and work queues. The vulnerability is described as a local-access issue w...

CVE-2025-38035

CVE-2025-38035 affects the Linux kernel NVMe over Fabrics target code (nvmet-tcp). The fix prevents restoring sock->sk->sk_state_change when queue->state_change is NULL, avoiding a NULL pointer dereference in nvmet_tcp_set_queue_sock() / nvmet_tcp_set_queue_sock() call paths. Impact is a...

CVE-2025-38094

CVE-2025-38094 (Linux kernel, macb deadlock) Fix for a possible deadlock in the macb driver under cadence when THALT is high and TGO remains high. The issue occurred in contexts with interrupts disabled, where jiffies were not updated and the loop wouldn’t exit, potentially locking a sama5d4 devi...

CVE-2025-38103

CVE-2025-38103 relates to the Linux kernel HID path (usbhid). The issue, described in connected sources, is an out-of-bounds bug in usbhid_parse() that could arise from HID descriptor handling. The fix updates the HID descriptor struct to align with USB HID 1.11 (reflecting mandatory vs. optional...

CVE-2025-38146

The CVE CVE-2025-38146 concerns the Linux kernel net/openvswitch MPLS parsing dead loop when handling MPLS stacks, where the label count may wrap and an invalid index (-1) can occur in key_extract_l3l4, causing a potential soft lockup/CPU stall. Affected: Linux kernel with openvswitch MPLS flow p...

CVE-2025-38298

CVE-2025-38298 corresponds to a Linux kernel EDAC issue (EDAC/skx_common) where reloading i10nm_edac after unloading and reloading can trigger a general protection fault. The root cause was that the adxl_component_count variable, which tracks ADXL components, was not reset during the reload seque...

CVE-1999-0138

CVE-1999-0138 affects the suidperl and sperl programs, which do not relinquish root privileges when reverting UIDs to the original user. This can grant root access with impact on confidentiality, integrity, and availability as described (local, low complexity, no auth required). The vulnerability...

CVE-2004-0186

CVE-2004-0186 is a local privilege-escalation in Samba (2.x/3.x) on Linux 2.6 where the setuid-smounted utility smbmnt can be exploited: when a setuid root binary is present on a mounted share, a local user can execute it to gain root privileges. The underlying issue is that setuid attributes are...

CVE-2005-0815

CVE-2005-0815 affects the Linux kernel iso9660 filesystem handler in versions up to 2.6.11 (and earlier). The issue is described as multiple range-checking flaws in the ISO-9660 file system code, which could be triggered by mounting a crafted/corrupted ISO image on CD-ROM. Impact stated in connec...