CVE-2021-47228

CVE-2021-47228 affects the Linux kernel x86/ioremap code. The issue arises when EFI boot services memory is preserved with efi_mem_reserve() and marked EFI_MEMORY_RUNTIME; under SEV, such memory must be mapped encrypted, otherwise the kernel may crash during boot. The public docs indicate a fix t...

CVE-2021-47277

CVE-2021-47277 affects the Linux kernel KVM path for guest memory translation. The issue arises when speculative execution may use an invalid guest frame number (gfn) to compute an out-of-bounds host virtual address (hva) in __gfn_to_hva_memslot, enabling a potential two-read Spectre gadget where...

CVE-2021-47297

CVE-2021-47297 (Linux kernel) affects the net/caif/caif_socket.c path, specifically caif_seqpkt_sendmsg. The root cause is a KMSAN-uninit value in caif_seqpkt_sendmsg when nr_segs in iovec_from_user is zero, leading to uninit stack memory in msg->msg_iter.iov. The provided sources state that t...

CVE-2021-47329

CVE-2021-47329 affects the Linux kernel driver for Megaraid SAS (scsi: megaraid_sas). The issue is a resource leak: if probe fails during PCI device initialization, resources allocated by scsi_add_host() or megasas_start_aen() are not fully cleaned up, potentially leaving allocated resources unre...

CVE-2021-47333

CVE-2021-47333 (Linux kernel) affects the misc: alcor_pci path. In configurations where a device is connected directly to the root complex, bus->self (bridge) can be NULL, leading to priv->parent_pdev being NULL. The vulnerability stems from alcor_pci_init_check_aspm(priv->parent_pdev) r...

CVE-2021-47433

CVE-2021-47433 concerns the Linux kernel’s btrfs subsystem, specifically a faulty abort logic in the function replace_file_extents that could corrupt a filesystem by leaving a missing extent in the middle of a file. The issue arises because the abortion condition was incorrect, causing aborts to ...

CVE-2021-47640

CVE-2021-47640 describes a Linux kernel vulnerability in the powerpc/KASAN pathway where the shadow page table was not updated correctly when PTE_RPN_SHIFT = 24 and PAGE_SHIFT = 12. The issue caused false positives and false negatives in KASAN reports (vmalloc-out-of-bounds in pcpu_alloc) and was...

CVE-2022-48646

CVE-2022-48646 affects the Linux kernel; it fixes a NULL pointer dereference in sfc/siena within efx_hard_start_xmit. The patch prevents a potential NULL dereference in the network path, addressing a local-execution vulnerability. The CVSS v3.1 base score is 6.2 (MEDIUM) with LOCAL exploitability...

CVE-2022-48654

The CVE-2022-48654 issue affects the Linux kernel netfilter nfnetlink_osf component, where nf_osf_find() could incorrectly return true on a mismatch. This causes copying of an uninitialized memory area in nft_osf, potentially leaking stale kernel stack data to userspace. The connected advisories ...

CVE-2022-48673

CVE-2022-48673 affects the Linux kernel net/smc; the issue is a use-after-free where, after modifying the QP to ERROR, RX work completions could access freed memory because the QP and link group were destroyed before completion. This can lead to kernel crashes as shown by the sample BUG/PF. The v...

CVE-2022-48692

The CVE-2022-48692 issue affects the Linux kernel RDMA/srp path. A NULL dereference was mitigated by changing the code to set scmnd->result only when scmnd is not NULL, addressing a kernel NULL pointer dereference that could be reproduced by blktests srp/007. Connected advisories (Astra Linux,...

CVE-2022-48698

CVE-2022-48698 affects the Linux kernel’s drm/amd/display path, causing a memory leak when using debugfs_lookup if the returned object isn’t released with dput(). The provided documents confirm the issue and describe the fix as correctly releasing the object via dput(), preventing unbounded memor...

CVE-2022-48721

CVE-2022-48721 – Linux kernel net/smc wakeup handling after fallback Affected: Linux kernel with net/smc subsystem using SMC fallback to TCP. Issue: when switching from SMC to TCP, some socket waitqueue entries (e.g., eppoll_entries) remain in smc socket->wq. After fallback, only clcsocket-&gt...

CVE-2022-48920

CVE-2022-48920: In the Linux kernel, the btrfs flushoncommit path could trigger a warning in __writeback_inodes_sb_nr() during transaction commits. The fix avoids deadlock risks by replacing writeback_inodes_sb() with try_to_writeback_inodes_sb(), which reads sb->s_umount and only calls writeb...

CVE-2022-49052

Summary (CVE-2022-49052) : The Linux kernel memory management path mm/page_io.c with zram swap could expose zeroed data to a process during CLONE_VM cloning, leading to potential data corruption. The root cause was the bogus swap_slot_free_notify in the CLONE_VM scenario, which didn’t correctly t...

CVE-2022-49075

CVE-2022-49075 is a Linux kernel issue in btrfs where qgroup reserve tracking used an unsigned int for bytes_changed, allowing overflow when fallocate exceeds 4 GiB. This caused incorrect qgroup accounting and could breach the qgroup limit. The published fixes switch bytes_changed to a 64-bit fie...

CVE-2022-49121

CVE-2022-49121 involves the Linux kernel SCSI pm8001 driver and is resolved in the kernel updates. The issue is a tag leak in error paths where tags allocated by pm8001_mpi_build_cmd() may not be freed when cmd building fails, and similarly when the chip task abort path fails, a missing call to p...

CVE-2022-49191

Concrete details found: CVE-2022-49191 affects the Linux kernel mxser code path, where xmit_buf leaks in activate() when LSR == 0xff and ->shutdown() is not called on failure, leaving the buffer unfreed. The fix adds a proper free path to a designated label and ensures the code jumps there fro...

CVE-2022-49251

The CVE-2022-49251 entry refers to a Linux kernel vulnerability in ASoC: codecs: va-macro where accessing enums via integers could trigger array bounds access on aarch64 (where long is 8 bytes vs a 4-byte enum). The connected Astra/SUSE OSV entries reiterate the same vulnerability and indicate a ...

CVE-2022-49463

CVE-2022-49463 refers to a Linux kernel issue where thermal/drivers/imx_sc_thermal_probe could leak a device tree node reference. The root cause is that of_find_node_by_name() returns a node pointer with refcount incremented and was not paired with a corresponding of_node_put() when done, causing...

CVE-2022-49479

CVE-2022-49479 corresponds to a Linux kernel vulnerability in the mt76 driver: a race condition (use-after-free) during station removal can cause a skb to be added to a status-tracking idr after the idr has been cleaned, leaving a wcid linked in the status poll list. The root cause is a race betw...

CVE-2022-49714

The CVE-2022-49714 item concerns a refcount leak in the Linux kernel’s irqchip/realtek-rtl code within map_interrupts. The root cause was that of_find_node_by_phandle() returned a node pointer with an incremented refcount and missing of_node_put() on all paths, including error paths. The fix is t...

CVE-2022-49718

CVE-2022-49718 concerns a Linux kernel issue in the irqchip/apple-aic path. The root cause is a refcount leak in aic_of_ic_init: of_get_child_by_name() returns a node pointer with an incremented refcount, and the patch adds a missing of_node_put() to release it when no longer needed. The connecte...

CVE-2022-49768

CVE-2022-49768 is associated with the Linux kernel 9p subsystem, specifically in trans_fd/p9_conn_cancel, where a double-lock issue was reported by syzbot and is mitigated by dropping the client lock earlier after requests move to the local list. Public sources in connected documents (Astra Linux...

CVE-2022-49769

CVE-2022-49769 corresponds to a Linux kernel fix for the gfs2 filesystem: after reading a superblock, the sb_bsize_shift field is now validated to match the expected value, preventing shift/out-of-bounds and related mount errors. The available details describe the root cause (unchecked sb_bsize_s...

CVE-2022-49916

CVE-2022-49916 covers a NULL pointer dereference in the Linux kernel’s Rose protocol path (rose_send_frame). The issue surfaces when rose_loopback_neigh's neigh->dev is NULL, causing access to neigh->dev->dev_addr and triggering a NULL dereference in rose_send_frame (rose_link.c: rose_se...

CVE-2022-49964

CVE-2022-49964 affects the Linux kernel arm64 cacheinfo path. The root cause was assigning a signed error value (-ENOENT) returned by acpi_find_last_cache_level() to an unsigned fw_level, causing the number of cache leaves to become an enormous value and triggering a warning in __alloc_pages. The...

CVE-2022-50003

CVE-2022-50003 describes a Linux kernel issue in the ice driver where XSK (AF_XDP) pool assignment can occur for a non-balanced queue id, enabling an out-of-bounds access to the Rx ring when attaching an XSK socket in tx-only mode to a queue id without a corresponding Rx queue. The fix rewrites t...

CVE-2022-50010

CVE-2022-50010 affects the Linux kernel’s fbdev i740fb driver. If a user space ioctl supplies a pixclock value causing the argument to i740_calc_vclk() to be less than I740_RFREQ_FIX, a divide-by-zero can occur in p_best calculation (drivers/video/fbdev/i740fb.c:353). The vulnerability arises bec...

CVE-2022-50046

In CVE-2022-50046, the Linux kernel fixes a memory-leak and potential NULL-dereference in net/sunrpc rpc_sysfs_xprt_state_change(): on error paths, xprt may fail to decrement the reference count of xps and may use an invalid xps. The issue arises because the function does not always handle errors...

CVE-2022-50111

CVE-2022-50111 concerns a Linux kernel issue in the ASoC mt6359 driver where a refcount leak occurs. The root cause is that in mt6359_parse_dt() and mt6359_accdet_parse_dt(), a reference returned by of_get_child_by_name() is not balanced with of_node_put(), leaving a leaked reference. The availab...

CVE-2022-50116

The CVE refers to a Linux kernel flaw in tty n_gsm where deadlocks and link starvation could occur in the outgoing data path under ldisc congestion. The fix adds an additional control-channel data queue and processes it before the user-channel queue in gsm_data_kick(), moving this work to a dedic...

CVE-2022-50129

The CVE-2022-50129 entry concerns the Linux kernel RDMA/srpt use-after-free issue. The fix changes the lifetime of LIO port data by converting LIO port members inside struct srpt_port from regular members to pointers and by allocating/freeing the LIO port data structures from inside srpt_make_tpo...

CVE-2022-50149

CVE-2022-50149 : Linux kernel driver core vulnerability in __driver_attach where async probing could deadlock with dev locks. Reproduced when async probes are allowed but memory/work limits force synchronous execution, causing ABBA-style deadlock with __driver_attach_async_helper holding device l...

CVE-2022-50214

CVE-2022-50214 affects the Linux kernel coresight subsystem. Vulnerability: coresight_remove_match() does not clear the fwnode field when dropping references, causing a use-after-free and extra refcount drops if a device is removed after its peer. Impact: potential local use-after-free conditions...

CVE-2023-52506

CVE-2023-52506 affects the Linux kernel on LoongArch. Root cause: early memblock_reserve() during memblock_init sets node id to MAX_NUMNODES, causing NODE_DATA(nid) NULL dereferences in reserve_bootmem_region() and chain calls, triggering a kernel panic on boot when DEFERRED_STRUCT_PAGE_INIT is e...

CVE-2023-52655

The CVE-2023-52655 issue affects the Linux kernel usb aqc111 driver. Root cause: when a device sends a packet with a length between 0 and sizeof(u64), the length passed to skb_trim() wraps to a very large value due to an incorrect check against 0. The driver currently validates against 0 instead ...

CVE-2023-52681

Summary (CVE-2023-52681) : In the Linux kernel, efivarfs allocated a s_fs_info on filesystem context creation but did not Free it when the superblock is unmounted, leading to a potential resource lifecycle issue. The vulnerability is resolved by ensuring proper cleanup of the s_fs_info structure ...

CVE-2023-52838

CVE-2023-52838 – Linux kernel fbdev: imsttfb resource leak (probe) . The issue arises when init_imstt() fails and the code does not call iounmap(par->cmap_regs), leading to a resource leak in probe. The vulnerability is addressed by rewriting the error handling to ensure iounmap(par->cmap_r...

CVE-2023-53081

CVE-2023-53081 affects the Linux kernel’s ocfs2 function. When a buffered write fails to copy data into the page cache, ocfs2_write_end_nolock() zeroes the page and dirties it, which can leave a dirty page beyond EOF. If writeback occurs before i_size is expanded, the page can reach an inconsiste...

CVE-2023-53123

The CVE-2023-53123 issue affects Linux kernel on s390 where per-function PCI hot-plugging left stale MMIO resources in the PCI and zpci_bus structures, enabling a use-after-free when a VFs are removed and re-added. The fix removes the individually hot-unplugged PCI function’s resources from the P...

CVE-2023-53128

CVE-2023-53128 affects the Linux kernel via a memory-leak in the SCSI mpi3mr driver (throttle_groups). The issue is resolved by adding a missing kfree(), as documented in multiple sources (Linux kernel patch notes and related advisories). The provided materials do not specify affected kernel vers...

CVE-2024-26789

CVE-2024-26789 concerns the Linux kernel crypto path for ARM64 AES-CTR. The bit-sliced NEON implementation could perform out-of-bounds reads when processing short inputs or tail blocks that do not align to 128-byte blocks, because it would jump into the plain NEON helper which handles memory in 1...

CVE-2024-26841

Exposed CVE-2024-26841 affecting LoongArch Linux kernels: when disabling nonboot CPUs, cpu_sibling_map is not updated, risking negative jump-label counts on SMT systems. A fix defines and calls clear_cpu_sibling_map() to refresh the mapping, mitigating a potential kernel instability (jump_label w...

CVE-2024-26910

CVE-2024-26910 – Linux kernel netfilter ipset swap operation is fixed by patch 28628fa9, which resolves a race between swap/destroy and kernel side add/del/test. The issue arose because a synchronize_rcu() added to the swap path slowed it down; the patch moves the synchronization to destroy and u...

CVE-2024-35903

The CVE-2024-35903 entry: In the Linux kernel, x86/bpf: Fix IP after emitting call depth accounting. The issue adjusts the IP passed to emit_patch to compute the correct offset for a CALL when x86_call_depth_emit_accounting emits code; without this, instructions may be skipped and the system coul...

CVE-2024-35968

In CVE-2024-35968, the Linux kernel pds_core/pdsc health path was fixed to avoid a deadlock when fw_status == 0xff. Previously, the driver attempted a PCI reset from within the health thread, while pdsc_reset_prepare tried to stop/flush that health thread. The fix queues a new pdsc_pci_reset_thre...

CVE-2024-36931

The CVE-2024-36931 issue affects the Linux kernel on s390 architecture, specifically in s390/cio where a copied user buffer (lbuf-sized) is not guaranteed to be NUL-terminated before a scanf, enabling an out-of-bounds read. The root cause is missing termination inside the copied buffer, which is ...

CVE-2024-39462

CVE-2024-39462 : Linux kernel vulnerability in bcm clk DV P. Root cause: after commit that annotated clk_hw_onecell_data with __counted_by, hws[] was accessed before ->num was initialized, triggering UBSAN array-index-out-of-bounds (drivers/clk/bcm/clk-bcm2711-dvp.c:59). Impact : potential out...

CVE-2024-42066

CVE-2024-42066 is a Linux kernel vulnerability affecting DRM Xe: a potential integer overflow in page size calculation when computing min_page_size. The issue stems from not casting tbo->page_alignment to a 64-bit type before bit-shifting, enabling overflow in the calculation. The connected As...