CVE-2022-49353

The CVE-2022-49353 entry affects the Linux kernel’s powerpc/papr_scm PMU code. A NULL pointer and kernel panic could be triggered when a zero-sized stat_buffer is passed to drc_pmem_query_stats() for NVDIMM performance IDs because papr_scm_pmu_check_events() did not verify p->stat_buffer_len b...

CVE-2022-49357

CVE-2022-49357 is a Linux kernel issue affecting Apple T2 Macs during early boot. The vulnerability arises when Linux reads UEFI Secure Boot variables (db and dbx) and imports certificates, triggering a page fault in Apple firmware that disables EFI runtime services. The consequence is EFI Runtim...

CVE-2022-49613

CVE-2022-49613 affects the Linux kernel serial driver 8250 console handover. When a console is enabled, univ8250_console_setup() runs before .dev is bound to the uart_port, so pm_runtime_get_sync() is skipped. Later, during handover, serial8250_console_exit() may call pm_runtime_put_sync() with a...

CVE-2022-49619

CVE-2022-49619 affects the Linux kernel net/sfp path. The vulnerability stems from sfp_probe() allocating memory via sfp_alloc() and not freeing it when devm_add_action() fails, causing a memory leak. The connected Astra/Tencent/Tenable entries confirm the fix is to replace devm_add_action() with...

CVE-2022-49775

CVE-2022-49775 (Linux kernel) affects the tcp_cdg congestion control. The advisory notes that when MPTCP calls tcp_disconnect() on an already-disconnected flow under CDG, it may trigger a double-free in the SLAB allocator. The vulnerability arises from the ability to call tcp_cdg_release() multip...

CVE-2022-49789

The CVE-2022-49789 entry documents a Linux kernel issue in the SCSI zfcp path: double free of an FSF request due to caching the FSF request ID in a signed 32-bit int, causing truncation and sign-extension when converting to 64-bit, leading to mismatches in the internal hash table and a stale poin...

CVE-2022-49878

Summary: CVE-2022-49878 is a Linux kernel vulnerability in the bpf verifier’s array reallocation. When realloc_array() errors (krealloc() returns NULL), callers previously set their pointers to NULL, but krealloc() leaves the original allocation untouched, causing a memory leak. The description i...

CVE-2022-49879

CVE-2022-49879 affects the Linux kernel ext4 code. A corrupted directory entry where rec_len is invalid (not a multiple of 4) can cause a kernel BUG() in ext4_rec_len_to_disk() called from make_indexed_dir(). The fix adds a validation step via ext4_check_dir_entry(), returning -EFSCORRUPTED for i...

CVE-2022-49905

In the Linux kernel, the net/smc subsystem has a vulnerability disclosed as CVE-2022-49905 due to a missing error path in smc_init(). register_pernet_subsys(&smc_net_stat_ops) is called without proper rollback handling; if it fails, the registration of &smc_net_ops may not be reverted, and if smc...

CVE-2022-49915

The CVE-2022-49915 issue affects the Linux kernel mISDN path and is caused by a memory leak in mISDN_register_device due to how device names were allocated. After the commit 1fa5ae857bb1 (driver core: get rid of struct device's bus_id string array), the device name is allocated dynamically and fr...

CVE-2022-49986

CVE-2022-49986 : In the Linux kernel, the storvsc driver’s storvsc_error_wq was incorrectly marked as WQ_MEM_RECLAIM, risking deadlock while flushing disk events. The supplied advisories state that removing WQ_MEM_RECLAIM from storvsc_error_wq fixes the issue, preventing forward-progress requirem...

CVE-2022-50021

CVE-2022-50021 documents a Linux kernel ext4 bug where a validated block range for freeing blocks could be altered after validation on bigalloc filesystems, potentially triggering a kernel BUG in ext4_free_blocks() / ext4_mb_clear_bb(). The issue arises because the range may be adjusted after val...

CVE-2022-50146

CVE-2022-50146 concerns the Linux kernel PCI-DWC stack. If dw_pcie_ep_init() initializes EPC memory and allocates MSI memory but fails to perform a subsequent action, the MSI region leak is not cleaned up, creating a memory leak. The fix, described in the commit log referenced by multiple advisor...

CVE-2022-50178

The CVE-2022-50178 issue is in Linux kernel wifi support for rtw89 (8852a) where a negative RF calibration result in the DPK could trigger a divisor-by-zero and a core dump. The root cause is division in the calibration logic; the fix guards division by zero by having phy_div() perform division o...

CVE-2023-52516

CVE-2023-52516 affects the Linux kernel’s dma-debug path. The root cause is that __dma_entry_alloc_check_leak() could be invoked while holding free_entries_lock and then call printk/serial console while port->lock is held, creating a reverse locking dependency chain: console_owner -> port_l...

CVE-2023-52573

In the Linux kernel, CVE-2023-52573 is a NULL-pointer dereference in the RDS path. Specifically, rds_rdma_cm_event_handler_cmn() now checks conn before dereferencing it as an rdma_set_service_type() argument. This fixes a possible NULL-pointer dereference. Connected advisories also reiterate the ...

CVE-2023-52611

CVE-2023-52611 (Linux kernel, wifi: rtw88 SDIO): Fixes address skb_over_panic by ensuring the driver can receive more than 1536 bytes from the SDIO card. Root causes include an Amlogic A311D (G12B) SDIO controller hardware bug (DMA transfers blocked; uses SRAM up to 1536 bytes) and rtw88 not spli...

CVE-2023-52826

CVE-2023-52826 : In the Linux kernel, a null pointer dereference in the DRM panel path was addressed. Specifically, in drm/panel/panel-tpo-tpg110, tpg110_get_modes() previously assigned the return value of drm_mode_duplicate() to mode and did not check for failure, risking an NP dereference on NU...

CVE-2023-52874

CVE-2023-52874 (Linux kernel) concerns x86/tdx: after TDCALL, RSI was not cleared when zeroing the guest-visible register bitmap in the TDX_HYPERCALL path. The description notes the RSI bit was present in the bitmap when first added, removed later, and subsequently not XORed back after a pop RSI ...

CVE-2023-52903

CVE-2023-52903 refers to a Linux kernel issue in the io_uring subsystem, specifically a lock overflow in IOPOLL CQ processing. The description shows a syzkaller-triggered overflow path in io_cqring_event_overflow, with call traces through io_req_cqe_overflow, io_fill_cqe_req, and io_do_iopoll, an...

CVE-2023-53053

CVE-2023-53053 affects the Linux kernel: erspan handling relied on skb_mac_header() in ndo_start_xmit(), with drivers incorrectly assuming skb_mac_header(skb) == skb->data. The issue is fixed by using skb_network_offset() and skb_transport_offset() in erspan_fb_xmit() and ip6erspan_tunnel_xmit...

CVE-2023-53111

CVE-2023-53111 affects the Linux kernel loop subsystem. The vulnerability arises from a use-after-free in loop_handle_cmd() after do_req_filebacked() completes, which may dereference cmd or rq depending on whether the request was completed when using asynchronous I/O. The issue can lead to a kern...

CVE-2023-53119

CVE-2023-53119 : In the Linux kernel, the pn533 NFC driver (pn533_out_arg) uses a temporary context for out_urb that is not fully initialized; the uninitialized field ‘phy’ may be dereferenced in error paths inside pn533_out_complete(), causing a general protection fault and a KASAN null-deref. T...

CVE-2023-53138

CVE-2023-53138 corresponds to a Linux kernel vulnerability in the net/caif stack (cfusbl_device_notify). When NETDEV_UNREGISTER is delivered multiple times during device teardown, a use-after-free can occur and there can be an imbalance in the module’s reference count, potentially freeing the par...

CVE-2023-53139

The CVE-2023-53139 issue is in the Linux kernel’s NFC FDP code: it adds a null check for devm_kmalloc_array in fdp_nci_i2c_read_device_properties. If devm_kmalloc_array fails and fw_vsc_cfg is NULL, an out-of-bounds write can occur in device_property_read_u8_array. The vulnerability is addressed ...

CVE-2024-26910

CVE-2024-26910 – Linux kernel netfilter ipset swap operation is fixed by patch 28628fa9, which resolves a race between swap/destroy and kernel side add/del/test. The issue arose because a synchronize_rcu() added to the swap path slowed it down; the patch moves the synchronization to destroy and u...

CVE-2024-35247

Summary of CVE-2024-35247 (Linux kernel): The fpga region handling was fixed by adding a module owner pointer to the fpga_region struct and using it to take the module’s refcount. The region registration APIs were updated to accept an additional owner module parameter and renamed to avoid conflic...

CVE-2024-35798

CVE-2024-35798 — Linux kernel, btrfs race in read_extent_buffer_pages() A race occurs when reading an extent buffer: after acquiring EXTENT_BUFFER_READING, the uptodate flag isn’t rechecked promptly, allowing a concurrent read to start and potentially return while another read is in progress. Thi...

CVE-2024-38547

The CVE-2024-38547 issue is a concrete Linux kernel vulnerability affecting media: atomisp, ssh_css path load_video_binaries. The root cause is a null-pointer dereference: allocation failure of mycs->yuv_scaler_binary in load_video_binaries followed by dereferencing mycs->yuv_scaler_binary ...

CVE-2024-39296

CVE-2024-39296 affects the Linux kernel bonding subsystem. The issue is a race during module removal (rmmod bonding) caused by a removed NULL check in the bonding debugfs cleanup path, which can lead to an oops in bond_uninit()/bond_debug_unregister() via debugfs_remove or recursive removal. The ...

CVE-2024-44951

Idea: CVE-2024-44951 affects the Linux kernel’s serial driver for sc16is7xx (TX/RX channel handling).What’s affected: The regression caused by commit 4409df5866b7 that changed EFR locking to operate per channel introduced TX buffer data corruption where data from channel A could be written into c...

CVE-2024-45001

The CVE-2024-45001 issue affects the Linux kernel, specifically the MANA driver’s RX buffer allocation. The root cause is misalignment of alloc_size passed to napi_build_skb(), which places skb_shinfo(skb) at the end of the SKB. On ARM64, certain MTU settings (e.g., 4000) can cause alignment faul...

CVE-2024-45012

The CVE-2024-45012 issue is in the Linux kernel related to the nouveau driver when SG_DEBUG is enabled with an active iommu. The crash trace shows a kernel BUG triggered in sg_init_one, indicating a failure in DMA handling within the nouveau firmware/driver path. The published fixes in connected ...

CVE-2024-46703

The CVE-2024-46703 issue is in the Linux kernel and stems from reverting the change “serial: 8250_omap: Set the console genpd always on if no console suspend,” which Kevin reported can crash during suspend on platforms that don’t use PM domains. The fix is to revert that commit, resolving the cra...

CVE-2024-50204

CVE-2024-50204 affects the Linux kernel: during namespace copying, the code may call free_mnt_ns() to remove the new copy from the rbtree before the copy is actually added, leading to an invalid rbtree operation. The fix is to free the namespace skeleton directly after a successful copy, rather t...

CVE-2024-56673

Technical details about CVE-2024-56673 are not provided in the supplied documents. Monitor for updates from the vendors/security advisories for affected products, fixes, and mitigations.

CVE-2024-58091

In CVE-2024-58091, the Linux kernel DRM fbdev code (drm/fbdev-dma) was updated to add a shadow buffer for deferred I/O because DMA areas are not always backed by struct page. The root cause is that deferred I/O cannot reliably rely on struct page backing for those DMA areas, so the fix introduces...

CVE-2025-21641

CVE-2025-21641 concerns the Linux kernel, where the mptcp: sysctl: blackhole timeout vulnerability could occur from using current->nsproxy. The issue arises from reading net namespace data via the current task, which could be NULL for certain states (e.g., task exiting), risking a null pointer...

CVE-2025-21746

The CVE-2025-21746 issue affects the Linux kernel Input: synaptics path for enabling a pass-through port. Root cause: when enabling a pass-through port, an interrupt may arrive before the psmouse driver binds, and the synaptics sub-driver may access a psmouse instance not yet attached, potentiall...

CVE-2025-22000

CVE-2025-22000 affects the Linux kernel. The flaw is in mm/huge_memory where, after splitting a folio for EOF, folio refs may not be fully dropped unless folio_put_refs(folio, folio_nr_pages(folio)) is used. This can cause a memory leak when the blocksize > page_size and truncation creates fol...

CVE-2025-22052

The CVE-2025-22052 issue affects the Linux kernel (staging gpib driver, ni_usb). It causes a NULL dereference Oops after a USB dongle disconnect because bus_interface is set to NULL; previously NULL checks existed only in select paths. The fix adds a NULL check for bus_interface across all interf...

CVE-2025-37816

Technical details for CVE-2025-37816 are not publicly available in the provided documents. Monitor for updates.

CVE-2025-37846

CVE-2025-37846 (Linux kernel, arm64) is a vulnerability in the mops path that incorrectly dereferenced the source register during a SET* sequence. The root cause is that the source register (not used for SET* operations) could be read, leading to a UBSAN out-of-bounds array access when the MOPS e...

CVE-2025-37855

The CVE-2025-37855 entry concerns the Linux kernel drm/amd/display component, where a null pointer dereference could occur when dc->res_pool is NULL. The fix implemented guards against this by checking the pointer before dereferencing it. The vulnerability is described as a local issue with a ...

CVE-2025-37898

CVE-2025-37898 affects the Linux kernel’s powerpc64/ftrace module loading path. The issue arises from get_stubs_size assuming at least one patchable function entry; modules exporting data but no code could yield a zero sh_size. During module_memory_alloc(), the size is page-aligned and becomes ze...

CVE-2025-37988

CVE-2025-37988 concerns the Linux kernel and involves a race condition in MNT_TREE_BENEATH handling within do_move_mount(). The vulnerability arises because the object locked during mount changes is the mountpoint of path->mnt, not the path itself, allowing mnt_parent to change under weak lock...

CVE-2025-38043

CVE-2025-38043 affects the Linux kernel firmware/arm_ffa path: a fix sets the dma_mask for FFA devices to prevent DMA allocation using a raw device pointer, which previously triggered a kernel warning “dma_alloc_attrs” in mapping.c. The vulnerability’s impact, per the description, is to avoid mis...

CVE-2025-38057

CVE-2025-38057 affects the Linux kernel espintcp driver, where skb leaks occurred due to missing kfree_skb on certain error paths. Connected advisories (Astra Linux, Debian, CIRCL, and others) confirm the issue and indicate a fix has been applied in the kernel; Debian LTS references linux-6.1 wit...

CVE-2025-38065

CVE-2025-38065: In the Linux kernel’s OrangeFS inode handling, the len variable used to store the result of i_size_read() becomes a size_t, causing truncation to 4 GiB on 32-bit systems. This can lead to incorrect file size handling and potential impact on local processes that rely on accurate si...

CVE-2025-38090

The CVE-2025-38090 issue affects the Linux kernel module drivers/rapidio/rio_cm.c, specifically riocm_cdev_ioctl path through cm_chan_msg_send() to riocm_ch_send(). The root cause is that riocm_ch_send() did not verify that the entire rio_ch_chan_hdr was copied from userspace, letting writes occu...