CVE-2022-48857

CVE-2022-48857 affects the Linux kernel NFC port100 driver (drivers/nfc/port100.c). The vulnerability is a use-after-free in port100_send_complete caused by freed devm memory on probe failure due to missing usb_kill_urb() calls on the error path. Impact is described as use-after-free; remediation...

CVE-2022-48891

CVE-2022-48891 – Linux kernel regulator (da9211): The issue arises if the IRQ handler is enabled before regulator structures are ready (e.g., when booting from kexec), potentially causing a crash due to an unreadable memory access. The patch fixes the initialization order to ensure the IRQ handle...

CVE-2022-48901

CVE-2022-48901 affects the Linux kernel’s btrfs implementation, addressing a race where relocation could start during a pending snapshot drop. The bug manifested when a recovering relocation on mount could clash with a concurrent snapshot deletion under balance, potentially leading to a state wit...

CVE-2022-49230

CVE-2022-49230 concerns the Linux kernel, specifically the mt76 mt7915 driver. The issue was a memory-leak in mt7915_mcu_add_sta where allocated skbs could be leaked on failures. The resolution is to free the allocated skb in the failure path. The CVE’s CVSSv3 base score is 5.5 (Medium) with LOCA...

CVE-2022-49243

CVE-2022-49243 is a Linux kernel vulnerability affecting ASoC: atmel via the at91sam9g20ek_audio_probe path. The issue is a refcount mismatch: of_parse_phandle() returns a node pointer with a refcount that is incremented in the probe function, but a missing of_node_put() caused a leak. A fix was ...

CVE-2022-49396

CVE-2022-49396 affects the Linux kernel component phy: qcom-qmp, leaking the reset-controller on probe errors. The described fix releases the lane reset controller on late probe errors (e.g., probe deferral) and notes that the reset controller is defined in devicetree in the "lane" child nodes, w...

CVE-2022-49446

CVE-2022-49446 affects the Linux kernel’s NVDIMM path, describing deadlock risks in CXL/NVDIMM interactions. The advisory notes possible unsafe locking scenarios involving nd_region keys, nvdimm_bus->reconfig_mutex, system_transition_mutex, and cxl_root/acpi_scan_lock chains, triggered by hold...

CVE-2022-49490

CVE-2022-49490: In the Linux kernel, drm/msm/mdp5 had a NULL dereference risk in mdp5_pipe_release when mdp5_get_global_state could return an error (-EDEADLK) during modeset lock handling. The fix propagates such errors from mdp5_get_global_state to mdp5_pipe_release and returns a proper error in...

CVE-2022-49493

CVE-2022-49493: Linux kernel ASoC rt5645 cleanup order bug can cause use-after-free due to rt5645_i2c_remove() cancelling jack_detect_work before del_timer_sync, which may race with rt5645_btn_check_callback(). The fix moves del_timer_sync before cancel_delayed_work_sync, addressing the race. Con...

CVE-2022-49506

The CVE-2022-49506 issue affects the Linux kernel DRM/Mediatek path, where a race between the vblank callback registration and disabling vblank could yield NULL callback data in the ovl IRQ path, risking kernel panic. The documented fix adds a vblank callback registration flow: register callback ...

CVE-2022-49518

The CVE-2022-49518 entry maps to a Linux kernel issue in ASoC SOF ipc3-topology where sof_get_control_data() could perform out-of-bounds access if the payload is not bytes. The fix adjusts control counting and data storage: for non-bytes controls, store a pointer to the data and its size (instead...

CVE-2022-49609

CVE-2022-49609 affects the Linux kernel component power/reset for the arm-versatile family. Root cause: of_find_matching_node_and_match() returns a node pointer with refcount incremented and was not balanced with of_node_put() when no longer needed, causing a refcount leak in versatile_reboot_pro...

CVE-2022-49645

CVE-2022-49645 affects the Linux kernel (drm/panfrost). The issue occurs when the madvise IOCTL is called twice on a BO: the memory shrinker list is corrupted because the BO is already on the list and is re-added without removing it first, leading to a kernel crash. The connected documents confir...

CVE-2022-49705

CVE-2022-49705 - Linux kernel 9p fid refcount leak . A fix was implemented for the 9p fid refcount leak in v9fs_vfs_atomic_open_dotl, ensuring the directory fid is released if the open() sequence fails partway. This prevents fid leaks observed with xfstests generic 531. The description in the ini...

CVE-2022-49714

The CVE-2022-49714 item concerns a refcount leak in the Linux kernel’s irqchip/realtek-rtl code within map_interrupts. The root cause was that of_find_node_by_phandle() returned a node pointer with an incremented refcount and missing of_node_put() on all paths, including error paths. The fix is t...

CVE-2022-49768

CVE-2022-49768 is associated with the Linux kernel 9p subsystem, specifically in trans_fd/p9_conn_cancel, where a double-lock issue was reported by syzbot and is mitigated by dropping the client lock earlier after requests move to the local list. Public sources in connected documents (Astra Linux...

CVE-2022-49772

CVE-2022-49772 affects the Linux kernel’s ALSA USB audio driver (snd_usbmidi_output_open). The vulnerability arises from a NULL port check that used snd_BUG_ON(); although the check is valid for unexpected NULL ports, this scenario can occur when a device reports an invalid endpoint during descri...

CVE-2022-49823

In CVE-2022-49823, the Linux kernel’s ata_tdev_add() in libata-transport is vulnerable because it does not verify the return value of transport_add_device(). If transport_add_device() fails, the subsequent removal path calls transport_remove_device() and device_del() on a device that may not have...

CVE-2022-49826

CVE-2022-49826 — Linux kernel (ata: libata-transport) The vulnerability arises in the error path of ata_tport_add() where put_device() followed by ata_tport_release() can cause an extra decrement of the refcount on ap->host, leading to a NULL pointer dereference during unbind/stop (as ports ar...

CVE-2022-49916

CVE-2022-49916 covers a NULL pointer dereference in the Linux kernel’s Rose protocol path (rose_send_frame). The issue surfaces when rose_loopback_neigh's neigh->dev is NULL, causing access to neigh->dev->dev_addr and triggering a NULL dereference in rose_send_frame (rose_link.c: rose_se...

CVE-2022-50012

CVE-2022-50012 affects the Linux kernel on 64-bit PowerPC (powerpc/64). The root cause is that jump_label_init() is invoked in setup_feature_keys() too late, since static keys may be used by subroutines of parse_early_param(), which itself is a subroutine of early_init_devtree(). The result is th...

CVE-2022-50085

The CVE-2022-50085 issue is present in the Linux kernel’s dm-raid path and affects the raid_resume flow. A KASAN warning is triggered when lvmetad tests exercise mddev->raid_disks vs rs->raid_disks, causing an out-of-bounds access in the raid resume loop. The connected OpenVAS/Nessus entrie...

CVE-2022-50131

CVE-2022-50131 : In the Linux kernel HID MCP2221 driver, the function mcp_smbus_write() could overflow a destination buffer because the length (0–255) was derived from user data without a proper bound check on the write buffer. The Smatch warnings show &mcp->txbuf[5] and buf being too small fo...

CVE-2022-50206

The CVE-2022-50206 issue affects the Linux kernel (ARM64) where emulation_proc_handler() concurrently updates table->data for proc_dointvec_minmax, allowing a NULL pointer dereference Oops. The fix is to keep table->data as &insn->current_mode and to retrieve the insn pointer with contai...

CVE-2022-50215

The CVE-2022-50215 entry refers to the Linux kernel SCSI sg subsystem issue: when a SCSI device is removed during active use, sg previously returned -ENODEV for waiting commands, risking memory corruption for READs and data corruption for WRITEs that rely on SG_FLAG_DIRECT_IO. The description and...

CVE-2023-52577

CVE-2023-52577 pertains to the Linux kernel DCCP handling. The issue stems from an incorrect assumption about the DCCP header field dh->dccph_x (the 9th byte, offset 8) and related ICMP message sizing, which could affect processing of DCCP packets and ICMP responses. The description notes that...

CVE-2023-52761

The CVE-2023-52761 entry concerns a Linux kernel vulnerability on riscv where VMAP_STACK overflow detection was made thread-safe. The patch (commit 31da94c25aea) adds support for CONFIG_VMAP_STACK and optimizes overflow handling by directly using the per-cpu overflow_stack, removing the shadow_st...

CVE-2023-52794

CVE-2023-52794 is a Linux kernel vulnerability in the intel_powerclamp implementation under thermal: intel: powerclamp, where a mismatch between param_get_int and the max_idle definition can trigger a global out-of-bounds read (KASAN report). The bug stems from reading a 32-bit int where a smalle...

CVE-2023-52841

CVE-2023-52841 concerns the Linux kernel component for media: vidtv: mux. The fix, described in the public description and echoed by Astra Linux security bulletin, adds a check for the return value of kstrdup() and returns an error if it fails to avoid a NULL pointer dereference. It also updates ...

CVE-2023-52866

CVE-2023-52866 affects Linux kernel HID uclogic code. A user-memory-access path occurs when hid_test_uclogic_params_cleanup_event_hooks() invokes uclogic_params_ugee_v2_init_event_hooks() with a NULL first argument, causing hid_get_drvdata() to access hdev->dev with hdev=NULL. The fix introduc...

CVE-2023-52886

The CVE-2023-52886 entry describes a race in the Linux kernel USB core where hub_port_init() can overwrite udev->descriptor while read_descriptors() (sysfs.c) is reading it, enabling a slab-out-of-bounds read (KASAN) observed in syzbot. The root cause is a race between read_descriptors() and h...

CVE-2023-53067

CVE-2023-53067: Concrete details in connected docs show a LoongArch Linux kernel issue where get_timer_irq() is invoked multiple times in constant_clockevent_init(), causing a sleeping function to be called from an invalid context under CONFIG_DEBUG_ATOMIC_SLEEP=y and CONFIG_DEBUG_PREEMPT=y. The ...

CVE-2023-53081

CVE-2023-53081 affects the Linux kernel’s ocfs2 function. When a buffered write fails to copy data into the page cache, ocfs2_write_end_nolock() zeroes the page and dirties it, which can leave a dirty page beyond EOF. If writeback occurs before i_size is expanded, the page can reach an inconsiste...

CVE-2023-53093

CVE-2023-53093 affects the Linux kernel tracing subsystem, where histogram values are not allowed to use certain modifiers. The root cause is that histogram code was not prepared to handle modifiers for histograms, leading to a NULL pointer dereference and kernel oops when printing histograms via...

CVE-2023-53123

The CVE-2023-53123 issue affects Linux kernel on s390 where per-function PCI hot-plugging left stale MMIO resources in the PCI and zpci_bus structures, enabling a use-after-free when a VFs are removed and re-added. The fix removes the individually hot-unplugged PCI function’s resources from the P...

CVE-2024-35846

CVE-2024-35846 affects the Linux kernel’s zswap shrinker under memcg-disabled (boot flag cgroup_disable=memory). A NULL memcg (sc->memcg == NULL) could cause a NULL dereference in memcg_page_state(), leading to a crash. The issue has been fixed in the kernel (as described in the connected docu...

CVE-2024-35916

CVE-2024-35916 affects the Linux kernel: a NULL pointer dereference in the dma-buf sanitycheck() path when mock_chain() returns NULL due to allocation failure. The fix is to call dma_fence_enable_sw_signaling() only if mock_chain() succeeds. Affected products/versions are not listed in the initia...

CVE-2024-35985

CVE-2024-35985 concerns the Linux kernel vulnerability where the eevdf scheduler could yield an out-of-bounds vlag and a NULL-deref in certain edge cases. The connected Astra/Nessus documents reiterate that reweight_eevdf() could compute vlag beyond the intended bound, since the vlag is used with...

CVE-2024-36001

Mode C (detailed). CVE-2024-36001 affects the Linux kernel netfs write path for buffered files under write-through caching. The root cause: in netfs_perform_write(), when a file is marked for writethrough or O_*SYNC/RWF_*SYNC, the code previously skipped the flush and wait if writing at/above EOF...

CVE-2024-36935

CVE-2024-36935 : In the Linux kernel, a memory copy from userspace into a kernel buffer for the ice path could miss a terminating NUL, enabling an OOB read when sscanf() is used. The fix uses memdup_user_nul instead of memdup_user to guarantee NUL termination. Affected component is the kernel’s i...

CVE-2024-36958

In CVE-2024-36958, the vulnerability resides in the Linux kernel’s NFSD path, specifically the nfsd4_encode_fattr4() function in fs/nfsd/nfs4xdr.c. The root cause is an initialization omission: args.acl is not initialized early, leading to an unconditional kfree() on exit of nfsd4_encode_fattr4()...

CVE-2024-38561

CVE-2024-38561 is a Linux kernel vulnerability in kunit: Fix kthread reference. A race exists where a kthread finishes after the deadline but before kthread_stop(), which may lead to a use-after-free. The connected Nessus/NASL entry confirms a patch addressing the kunit kthread reference issue (C...

CVE-2024-46682

The CVE-2024-46682 issue affects the Linux kernel NFS server (nfsd) handling of nfsv4.0 closed opens. A root cause was that states_show() relied on sc_type being valid, and after a commit splitting sc_status from sc_type, unhashing a stateid could leave sc_file NULL, causing an oops in nfs4_show_...

CVE-2024-57928

CVE-2024-57928 (Linux kernel) : The vulnerability is in netfs buffered reads. When netfs_read_to_pagecache() encounters an error from either ->prepare_read() or netfs_prepare_read_iterator(), it must decrement ->nr_outstanding, cancel the subrequest, and break the issuing loop. The patch fi...

CVE-2024-57975

CVE-2024-57975 concerns the Btrfs code path in the Linux kernel where run_delalloc_nocow() can fail and leave folios unlocked, triggering a VM_BUG_ON_FOLIO in mm/page-writeback.c. The root cause is error handling in the NOCOW/COW cleanup sequence (cow_file_range and related paths) which may not c...

CVE-2025-21807

CVE-2025-21807 (Linux kernel) affects the block subsystem. queue_attr_store() previously freezes the device queue before invoking the attribute store operation. For attributes controlling queue limits, the store could lock queue limits via queue_limits_start_update(), creating an ABBA deadlock if...

CVE-2025-21827

Technical details for CVE-2025-21827 are not provided in the connected documents. Affected product/version/impact is not disclosed here; monitor for updates from vendors and vulnerability feeds.

CVE-2025-21880

Linux kernel CVE-2025-21880 affects the DRM XE userptr flow (drm/xe/userptr), specifically xe_vm_userptr_pin and EFAULT handling from hmm_range_fault(). The issue arose when EFAULT was treated as non-fatal, which could leave the userptr VMA on the rebind list during preempt_rebind_work_func(), le...

CVE-2025-22067

Technical details about CVE-2025-22067 (affected products, versions, root cause, impact, or fixes) are not provided in the connected documents. Monitor for updates from official advisories and vulnerability feeds.

CVE-2025-22084

CVE-2025-22084 : In the Linux kernel, a NULL pointer dereference can occur in the serdev path due to a race: w1_uart_probe() calls w1_uart_serdev_open() (which includes devm_serdev_device_open()) before configuring client ops with serdev_device_set_client_ops(), causing serdev->ops to be unini...