CVE-2024-35798

CVE-2024-35798 — Linux kernel, btrfs race in read_extent_buffer_pages() A race occurs when reading an extent buffer: after acquiring EXTENT_BUFFER_READING, the uptodate flag isn’t rechecked promptly, allowing a concurrent read to start and potentially return while another read is in progress. Thi...

CVE-2024-35914

The CVE-2024-35914 vulnerability affects the Linux kernel’s NFS server (nfsd) rename error cleanup path. The issue arose when a remount protection acquired during a cleanup path was not dropped, potentially enabling a deadlock or inconsistency. The fix, tracked in the commit a8b0026847b8, updates...

CVE-2022-49649

CVE-2022-49649 affects the Linux kernel under xen_netback, where xenvif_rx_next_skb() can be called with an empty RX queue during repeated iterations in xenvif_rx_action(), risking a kernel NULL pointer dereference. The provided crash trace centers on xenvif_rx_skb() and the related netback loop....

CVE-2022-49668

The CVE-2022-49668 entry corresponds to a Linux kernel issue where refcount leaks occur in the devfreq helper path: of_get_child_by_name() returns a node with an incremented refcount, and of_node_put() was missing in error paths. The fix adds the missing of_node_put() calls to prevent a refcount ...

CVE-2022-49713

In CVE-2022-49713, the Linux kernel vulnerability affects the USB-DWC2 HCD initialization path. The issue is a memory leak in dwc2_hcd_init where usb_create_hcd allocates memory for hcd but may fail to free it if platform_get_resource() fails; the fix moves the error path from error1 to error2 an...

CVE-2022-49727

CVE-2022-49727 : In the Linux kernel, the vulnerability affects the IPv6 L2TP send path (ipv6_sendmsg) where a signed integer overflow can occur when len >= INT_MAX - transhdrlen, causing ulen = len + transhdrlen to overflow. The fix mirrors the approach used in udpv6 by subtracting transhdrle...

CVE-2022-49763

Summary (CVE-2022-49763) In the Linux kernel NTFS code, the use-after-free issue in ntfs_attr_find() stems from missing bounds checks on the attrs_offset field after loading the first MFT record. The vulnerability was exposed by KASAN reports (use-after-free read) during NTFS attribute handling, ...

CVE-2022-49913

CVE-2022-49913 concerns a memory leak in the Linux kernel’s btrfs backref walking code. During find_parent_nodes() on data extents, if an error occurs while resolving indirect backrefs (resolve_indirect_refs()) or while iterating direct refs in the rbtree, inode lists attached to direct refs not ...

CVE-2022-49983

The issue CVE-2022-49983 affects the Linux kernel udmabuf driver. If the udmabuf DMA mask is not set explicitly, userspace DMA-BUF access via the CPU can trigger a warning in dma_map_sg_attrs (kernel/dma/mapping.c) during dma-buf CPU access flows (as shown in the stack trace). The vulnerability i...

CVE-2022-49984

CVE-2022-49984 is a Linux kernel vulnerability in the HID Steam driver: the code dereferences a HID report pointer without validating it, enabling a local attacker with a malicious HID device to trigger a NULL pointer dereference in steam_recv/steam_send_report. The issue has been fixed in the ke...

CVE-2022-50194

The CVE-2022-50194 issue affects the Linux kernel, specifically the soc: qcom: aoss path, where for_each_available_child_of_node() leaks a refcount when breaking out of iteration. The root cause is a missing of_node_put() after iterating, leading to a refcount leak on the previously referenced no...

CVE-2023-20844

CVE-2023-20844 affects the imgsys_cmdq component in MediaTek devices. The issue is an out-of-bounds read caused by missing valid range checking, potentially enabling local information disclosure with system-execution privileges required. Exploitation requires user interaction. The vulnerability i...

CVE-2023-52568

CVE-2023-52568 affects the Linux kernel SGX path, specifically the EAUG race with page-fault handling. The vulnerability arises when the SGX EPC reclaimer (ksgxd) reclaims the SECS EPC page and sets secs.epc_page to NULL; EAUG and ELDU both use this page, but the NULL check was only applied to EL...

CVE-2023-52646

CVE-2023-52646 concerns the Linux kernel. A null-deref can occur when mremap is invoked on an old aio mapping after a fork because mm->ioctx_table is NULL. The issue was introduced by the patch that made it possible to remap the aio ring and has been fixed by the accompanying commit (e4a0d3e72...

CVE-2023-52804

CVE-2023-52804 affects the Linux kernel (fs/jfs) where db_maxag and db_agpref were used as indexes into db_agfree without validity checks. This could trigger an array-index-out-of-bounds UB in fs/jfs/jfs_dmap.c:639:20 (index 7936 out of range for atomic_t[128]). The issue has been addressed by ad...

CVE-2023-52826

CVE-2023-52826 : In the Linux kernel, a null pointer dereference in the DRM panel path was addressed. Specifically, in drm/panel/panel-tpo-tpg110, tpg110_get_modes() previously assigned the return value of drm_mode_duplicate() to mode and did not check for failure, risking an NP dereference on NU...

CVE-2023-52886

The CVE-2023-52886 entry describes a race in the Linux kernel USB core where hub_port_init() can overwrite udev->descriptor while read_descriptors() (sysfs.c) is reading it, enabling a slab-out-of-bounds read (KASAN) observed in syzbot. The root cause is a race between read_descriptors() and h...

CVE-2023-53005

CVE-2023-53005 concerns a Linux kernel vulnerability in trace_events_hist where create_hist_field could be called recursively and return NULL, risking a NULL pointer dereference. The fixed advisory notes adding a check for the return value of create_hist_field (trace_events_hist.c:1954). Related ...

CVE-2024-23196

CVE-2024-23196 : Astra Linux security bulletin reports a race condition in the Linux kernel sound/hda driver, in snd_hdac_regmap_sync(), which can trigger a NULL pointer dereference and may lead to a kernel panic or denial of service. This mirrors the initial description. The connected documents ...

CVE-2024-26690

In CVE-2024-26690, the Linux kernel stmmac driver fix avoids 32-bit seqcount race conditions in u64_stats_sync by splitting 64-bit statistics into three context-specific groups and introducing a per-cpu stats structure (stmmac_pcpu_stats). The tx, napi/poll, and interrupt contexts now update disj...

CVE-2024-26910

CVE-2024-26910 – Linux kernel netfilter ipset swap operation is fixed by patch 28628fa9, which resolves a race between swap/destroy and kernel side add/del/test. The issue arose because a synchronize_rcu() added to the swap path slowed it down; the patch moves the synchronization to destroy and u...

CVE-2024-26914

CVE-2024-26914 concerns the Linux kernel DRM/AMD display path. The root cause is an incorrect mpc_combine array size:MAX_SURFACES was used instead of MAX_PLANES, causing an overflow when more than 3 planes are present. The patch uses MAX_PLANES as the array size, addressing the issue. The vulnera...

CVE-2024-35834

Technical details for CVE-2024-35834 are not provided in the supplied documents. No specifics on affected products/versions, root cause, or fixes are present; please monitor for official updates.

CVE-2024-35975

CVE-2024-35975 concerns the Linux kernel, specifically the octeontx2-pf Netdev driver, where a bug in the Round Robin scheduling patch caused transmit schedulers to not be freed after a class deletion. The vulnerability is described as a transmit scheduler resource leak that arises during shaping...

CVE-2024-36965

CVE-2024-36965 affects the Linux kernel remoteproc mediatek by adding a guard to ensure the IPI buffer fits in L2TCM. The IPI buffer address is read from firmware loaded to the System Companion Processor, and the SRAM/L2TCM size defined in the devicetree may be insufficient, especially for multi-...

CVE-2024-38547

The CVE-2024-38547 issue is a concrete Linux kernel vulnerability affecting media: atomisp, ssh_css path load_video_binaries. The root cause is a null-pointer dereference: allocation failure of mycs->yuv_scaler_binary in load_video_binaries followed by dereferencing mycs->yuv_scaler_binary ...

CVE-2024-38620

Summary: Linux kernel Bluetooth stack removed HCI_AMP support; with BT_HS removed, AMP controllers are no longer used, leading to removal of AMP capability and hdev->dev_type. What changes: removal of HCI_AMP controllers, elimination of AMP vs Primary differentiation, and associated dev_type f...

CVE-2024-41061

CVE-2024-41061: In the Linux kernel’s DRM/AMD display code, an array-index-out-of-bounds can occur in dml2/FCLKChangeSupport when using out_lowest_state_idx as an index. The core fix is to always use index 0 in the condition to prevent out-of-bounds access. The vulnerability impact is rated HIGH ...

CVE-2024-42066

CVE-2024-42066 is a Linux kernel vulnerability affecting DRM Xe: a potential integer overflow in page size calculation when computing min_page_size. The issue stems from not casting tbo->page_alignment to a 64-bit type before bit-shifting, enabling overflow in the calculation. The connected As...

CVE-2024-42260

CVE-2024-42260 - Linux kernel drm/v3d validation issue : The vulnerability occurred in the DRM/V3D path where userspace could pass unknown or invalid drm_syncobj handles in the performance extension. The description states that if an invalid handle appears anywhere in the handle array, the rest o...

CVE-2024-43845

CVE-2024-43845 concerns the Linux kernel udf implementation. The documented issue is a bogus checksum computation in udf_rename(), triggered when updating the checksum of the '..' directory entry in a moved directory. Syzbot noted an uninitialized memory access because on-stack diriter.fi is pass...

CVE-2024-46701

CVE-2024-46701 affects the Linux kernel, where libfs offset-dir reads could loop infinitely during concurrent readdir/rename operations after switching tmpfs dir operations to simple_offset_dir_operations. The issue arose because each rename could insert a new dentry into dest dir’s maple tree wi...

CVE-2024-46709

The CVE-2024-46709 issue affects the Linux kernel drm/vmwgfx driver, fixed by ensuring external buffers map through the dma_buf interface instead of direct page access. The vulnerability arises because external buffers may not expose readable/writable pages, so media buffers (bo) created from ext...

CVE-2024-46748

The CVE-2024-46748 entry concerns the Linux kernel cachefiles subsystem. It fixes a write-size issue by setting the maximum subrequest size for cache writes to MAX_RW_COUNT, preventing overruns on backing filesystems. Connected docs confirm the fix applies to Linux kernel versions using this code...

CVE-2024-46768

CVE-2024-46768 is rejected/not active. The connected Nessus entry explicitly states that this CVE ID was rejected/withdrawn by its CVE Numbering Authority, so it does not represent an active vulnerability in the published records.

CVE-2024-50190

Summary (CVE-2024-50190) : The vulnerability is in the Linux kernel ice driver where a memory leak (memleak) occurs during ice_init_tx_topology(), leaking the FW blob for each PF. The root cause is that ice_cfg_tx_topo() did not need to copy the entire FW blob; the fix makes ice_cfg_tx_topo() @bu...

CVE-2024-50266

CVE-2024-50266 concerns the Linux kernel clk/qcom/videocc-sm8350 path where a venus driver change could cause a stuck vcodec clock (example: video_cc_mvs0_clk) on certain ThinkPad hardware. The issue is triggered by runtime control mode in GDSCs and was resolved by using HW_CTRL_TRIGGER for vcode...

CVE-2024-50270

CVE-2024-50270 targets the Linux kernel, specifically in mm/damon/core where damon_feed_loop_next_input() contains overflow-prone calculations (score_goal_diff_bp, compensation, etc.) related to a constant target score of 10,000. The fix rewrites the function to avoid overflows and removes the un...

CVE-2024-56673

Technical details about CVE-2024-56673 are not provided in the supplied documents. Monitor for updates from the vendors/security advisories for affected products, fixes, and mitigations.

CVE-2024-56706

Summary of CVE-2024-56706: In Linux kernel s390 perf_cpum_sf, memory allocation for Sample Data Blocks (SDBs) could be performed concurrently outside the PMU reservation mutex, allowing multiple allocations for the same PMU when perf_event_init() runs in parallel. The fix is to protect SDB memory...

CVE-2025-22052

The CVE-2025-22052 issue affects the Linux kernel (staging gpib driver, ni_usb). It causes a NULL dereference Oops after a USB dongle disconnect because bus_interface is set to NULL; previously NULL checks existed only in select paths. The fix adds a NULL check for bus_interface across all interf...

CVE-2025-37802

CVE-2025-37802 affects the ksmbd path in the Linux kernel. The issue arises when wait_event_timeout() sets the current task state to TASK_UNINTERRUPTIBLE before the condition check, causing a possible blocking operation to occur while the task is not RUNNING, with ksmbd_durable_scavenger_alive() ...

CVE-2025-37806

CVE-2025-37806 affects Linux kernel fs/ntfs3 write path. A NULL pointer dereference can occur in __generic_file_write_iter when an ioctl clears the file’s compress flag during a write, causing is_compressed() to return 0 and the code to call the wrong AOP, leading to a null dereference in write_b...

CVE-2025-37826

CVE-2025-37826 pertains to the Linux kernel, specifically the SCSI: UFS core. The root cause is a missing NULL check on the hwq pointer returned by ufshcd_mcq_req_to_hwq(), which can occur in ufshcd_mcq_compl_pending_transfer(). The available connected documents describe a patch that adds a NULL ...

CVE-2025-37877

CVE-2025-37877 : Linux kernel iommu-dma cleanup after iommu_device_register() errors may leave devices connected to iommu-dma, risking crashes in iommu-dma. The fix adds cleaning of the dev->dma_iommu flag along with other cleanup when probe/registration fails. Affected component: kernel IOMMU...

CVE-2025-38018

Technical details for CVE-2025-38018 are not publicly provided in the supplied documents; monitor for updates.

CVE-2025-38040

CVE-2025-38040 affects the Linux kernel’s serial/mctrl_gpio path. The advisory reports a fix for a denial of service/privilege implications by splitting the disabling of modem lines (disable_ms) into two APIs: sync and no_sync, addressing a sleeping function being called from an atomic context (d...

CVE-2025-38066

CVE-2025-38066 affects the Linux kernel in the dm-cache subsystem (policy SMQ). The issue arises when a cache device fails to resume due to mapping errors and a resumed operation is retried, which can leave a partially initialized policy object and trigger a BUG_ON during mapping reload. The conn...

CVE-2025-38173

CVE-2025-38173 affects the Linux kernel crypto path (marvell/cesa) in Mariner builds, specifically for kernel packages older than 6.6.96.1-1. The issue is described as handling zero-length skcipher requests to avoid accessing random memory; the fix returns 0 for zero-length requests. A patched ke...

CVE-2025-38293

The CVE-2025-38293 entry documents a Linux kernel vulnerability in ath11k: arvifs handling. Root cause: during WLAN halt, ath11k_core_halt() reinitializes only the arvifs list head, leaving the subsequent node in arvifs invalid; this makes list_del() detect an invalid node during vif removal if a...