CVE-2022-50028

CVE-2022-50028 affects gadgetfs ep_io in the Linux kernel (drivers/usb/gadget/legacy/inode.c). After usb_ep_queue(), if wait_for_completion_interruptible() is interrupted, code must wait for IRQ completion; otherwise epio_complete() may corrupt the stack. The vulnerability is fixed in the Linux k...

CVE-2022-50085

The CVE-2022-50085 issue is present in the Linux kernel’s dm-raid path and affects the raid_resume flow. A KASAN warning is triggered when lvmetad tests exercise mddev->raid_disks vs rs->raid_disks, causing an out-of-bounds access in the raid resume loop. The connected OpenVAS/Nessus entrie...

CVE-2022-50091

CVE-2022-50091 concerns the Linux kernel where the boot-time parameter csdlock_debug was parsed via early_param, enabling static_branch in a manner that could dereference NULL under specific sparse memory configurations (arm64 with CONFIG_SPARSEMEM and SPARSEMEM_VMEMMAP settings, and powerpc due ...

CVE-2022-50131

CVE-2022-50131 : In the Linux kernel HID MCP2221 driver, the function mcp_smbus_write() could overflow a destination buffer because the length (0–255) was derived from user data without a proper bound check on the write buffer. The Smatch warnings show &mcp->txbuf[5] and buf being too small fo...

CVE-2022-50138

The CVE-2022-50138 entry describes a memory-leak in Linux kernel RDMA qedr: __qedr_alloc_mr() allocates mr->info.pbl_table; if rdma_alloc_tid() and rdma_register_tid() fail, the 'mr' is released but mr->info.pbl_table isn’t, causing a leak. The fix is to release mr->info.pbl_table with q...

CVE-2022-50153

CVE-2022-50153 concerns a Linux kernel USB host (EHCI) vulnerability affecting PPC configurations where of_find_compatible_node() returns a node pointer with a refcount incremented and is not released, causing a refcount leak. The connected Nessus/OpenVAS documents quote the fix: add missing of_n...

CVE-2022-50178

The CVE-2022-50178 issue is in Linux kernel wifi support for rtw89 (8852a) where a negative RF calibration result in the DPK could trigger a divisor-by-zero and a core dump. The root cause is division in the calibration logic; the fix guards division by zero by having phy_div() perform division o...

CVE-2023-52506

CVE-2023-52506 affects the Linux kernel on LoongArch. Root cause: early memblock_reserve() during memblock_init sets node id to MAX_NUMNODES, causing NODE_DATA(nid) NULL dereferences in reserve_bootmem_region() and chain calls, triggering a kernel panic on boot when DEFERRED_STRUCT_PAGE_INIT is e...

CVE-2023-52682

CVE-2023-52682 is a Linux kernel vulnerability affecting the f2fs file system. The issue occurs when an inode is compressed but not encrypted, where the code misses calling f2fs_wait_on_block_writeback() to wait for GCed page writeback in the IPU write path, allowing out-of-order GC and IO to cau...

CVE-2023-52767

CVE-2023-52767 : In the Linux kernel, a NULL dereference could occur in the TLS path when tls_sw_splice_eof() runs as part of sendfile() with an empty plaintext/ciphertext sk_msg. The issue caused tls_push_record() to take the split path and tls_merge_open_record(), which assumed at least one pop...

CVE-2023-52983

The CVE-2023-52983 issue affects the Linux kernel’s bfq (multiqueue block I/O) subsystem. It describes a use-after-free (UAF) where bic_set_bfqq() could access a bfqq after it had been freed in certain contexts. The root cause was that bfqq was freed in the wrong place relative to bic_set_bfqq(),...

CVE-2023-53093

CVE-2023-53093 affects the Linux kernel tracing subsystem, where histogram values are not allowed to use certain modifiers. The root cause is that histogram code was not prepared to handle modifiers for histograms, leading to a NULL pointer dereference and kernel oops when printing histograms via...

CVE-2023-53118

CVE-2023-53118 affects the Linux kernel SCSI subsystem: a regression in host procfs directory removal in the core SCSI layer. The vulnerable code path centers on scsi_proc_hostdir_rm(), which decreases a reference counter and must be invoked only once per host removal. The issue is resolved by th...

CVE-2023-53372

CVE-2023-53372 — Linux kernel SCTP vulnerability. The issue arises in sctp_ifwdtsn_skip where, while traversing ifwdtsn skips via _sctp_walk_ifwdtsn, the code may read beyond the chunk boundary because the remaining data can be smaller than sizeof(struct sctp_ifwdtsn_skip). This can cause a cover...

CVE-2024-26730

The CVE-2024-26730 entry concerns the Linux kernel hwmon/nct6775 driver. The vulnerability arises from a mismatch between the number of temperature configuration registers and the total temperature registers, which can trigger out-of-bounds access (KASAN) in nct6775_probe/nct6775_core. The issue ...

CVE-2024-26789

CVE-2024-26789 concerns the Linux kernel crypto path for ARM64 AES-CTR. The bit-sliced NEON implementation could perform out-of-bounds reads when processing short inputs or tail blocks that do not align to 128-byte blocks, because it would jump into the plain NEON helper which handles memory in 1...

CVE-2024-26841

Exposed CVE-2024-26841 affecting LoongArch Linux kernels: when disabling nonboot CPUs, cpu_sibling_map is not updated, risking negative jump-label counts on SMT systems. A fix defines and calls clear_cpu_sibling_map() to refresh the mapping, mitigating a potential kernel instability (jump_label w...

CVE-2024-26849

CVE-2024-26849 is a Linux kernel vulnerability affecting netlink attribute policy for NFTA_TARGET_REV. The minlen entry for NLA_BE32 is zero, causing validation to read past a malformed attribute (risk of kernelread). Concrete details appear in connected advisories (e.g., kernel commits a2ab02815...

CVE-2024-33847

The CVE-2024-33847 issue concerns the Linux kernel F2FS file system where compressed inodes could be corrupted after unaligned or partial truncation. The vulnerability arises when a released compress inode with reserved blocks undergoes truncation that changes valid_block_count without updating i...

CVE-2024-35948

In the Linux kernel (bcachefs), a missing bounds check in superblock validation allowed journal entries to overrun the end of the clean section. The issue has been fixed with a bounds-check in the superblock validation path. No repair code for individual items is available; the entire superblock ...

CVE-2024-36033

CVE-2024-36033 refers to a vulnerability in the Linux kernel where the Bluetooth: qca driver could leak slab data when fetching the board id. The issue was fixed by adding a missing sanity check during the board-id fetch, preventing leakage of slab data when firmware is subsequently requested. Th...

CVE-2024-38539

CVE-2024-38539 — Linux kernel (RDMA/cma) kmemleak issue Summary: The kmemleak memory-leak issue observed during blktests nvme/rdma involving siw was fixed in the RDMA/cma code path of the Linux kernel. The root cause was that rdma_put_gid_attr is not called when sgid_attr is set to ERR_PTR(-ENODE...

CVE-2024-38585

CVE-2024-38585 — Linux kernel memory corruption in realloc . The issue arises in tools/nolibc/stdlib where realloc() could copy beyond the allocated region because memcpy() used heap->len instead of the input user_p_len. The vulnerability was resolved by passing user_p_len to memcpy() to preve...

CVE-2024-38595

CVE-2024-38595 affects the Linux kernel mlx5 subsystem: a patch changing register devlink flow did not update the peer devlink set logic, triggering a call trace when peer devlink set is done after devl_register. The fix aligns peer devlink set logic with the register flow to prevent the trace. I...

CVE-2024-40969

CVE-2024-40969 (Linux kernel, f2fs) is confirmed to affect the f2fs shutdown path. The root cause is that shutdown does not verify the thaw error when the filesystem is read-only, which can lead to a deadlock during shutdown (via s b_start_write, set RO, and then thaw). The available connected do...

CVE-2024-46734

CVE-2024-46734 — Linux kernel race between direct IO writes and fsync . In scenarios where two threads share the same fd opened with O_DIRECT, one performing direct IO writes and the other calling fsync, a race can occur that may trigger an assertion failure (inode lock not held) or a memory acce...

CVE-2024-56646

Technical details about CVE-2024-56646 are not provided in the supplied documents. Monitor official advisories for affected products, impact, and fixes.

CVE-2024-57918

The CVE-2024-57918 fix targets the Linux kernel’s DRM/AMD display (DC) driver. Root cause: a surface-definition mismatch between MAX_SURFACES and MAX_SURFACE_NUM caused a page fault when updating surfaces (affecting Cosmic users with two overlay planes after cursor overlay introduction). The patc...

CVE-2025-21778

CVE-2025-21778 (Linux kernel) involves a crash when mmap() is used on a persistent tracing ring buffer that is attached to reserve_mem. The root cause is that the code maps ring buffer pages using virt_to_page() on memory that is vmap()’d, which is invalid for that memory type and can trigger a p...

CVE-2025-21827

Technical details for CVE-2025-21827 are not provided in the connected documents. Affected product/version/impact is not disclosed here; monitor for updates from vendors and vulnerability feeds.

CVE-2025-37863

CVE-2025-37863 affects the Linux kernel overlayfs (ovl). The issue arises when a data-only layer is pointed to by an upper layer, something not currently used but previously allowed only via the datadir+ feature, which could trigger an Oops. The documented fix disables datadir without a lowerdir,...

CVE-2025-37888

Technical details for CVE-2025-37888 are not provided in the supplied documents; only a high-level description of the Linux kernel fix is shown. Please monitor for vendor advisories for affected products and remediation.

CVE-2025-38010

CVE-2025-38010 – Linux kernel patch replaces a single reference counter for UTMI pad power with a per-pad bitmask (utmi_pad_enabled) to track all four USB2 UTMI PHY pads. The root cause was an unbalanced reference count when suspending with connected USB devices, due to power-downs not validating...

CVE-2025-38013

CVE-2025-38013 (Linux kernel) : Affected component is the wifi/mac80211 path. The issue is a UBSAN/array-index-out-of-bounds condition reported when setting n_channels during scan request construction, caused by allocating the scan request before the int_scan_req structure is allocated. The fix r...

CVE-2025-38027

The CVE-2025-38027 entry describes a Linux kernel vulnerability in the regulator max20086 code path. The root cause is that max20086_parse_regulators_dt() uses an on-stack array of struct of_regulator_match for matches and then relies on devm_of_regulator_put_matches(), which allocates a devm_of_...

CVE-2025-38081

CVE-2025-38081 affects the Linux kernel with a fix for spi-rockchip that prevents register out-of-bounds access. The issue occurred when handling GPIO chip selects, where GPIOs can be numbered higher than native chip selects, making the previous code logic invalid. The description notes the vulne...

CVE-2025-38126

CVE-2025-38126 affects the Linux kernel’s stmmac driver in timestamp configuration. The root cause is that clk_ptp_rate can become 0 (if clk_get_rate returns 0 and the driver does not override it), leading to a division by zero during PTP initialization. The issue is fixed by adding an explicit c...

CVE-2025-38142

The CVE-2025-38142 issue affects the Linux kernel hwmon path (asus-ec-sensors) where read_string() could read a non-existent sensor because find_ec_sensor_index() returned a negative value (for example -ENOENT) and was used without validation. The fix introduces a check to ensure sensor_index is ...

CVE-2025-38153

CVE-2025-38153 (Linux kernel) is documented in connected sources as a vulnerability in the aqc111 USB network driver. The issue arises from incomplete sanitation of usbnet read results, where usbnet_read_cmd() may return fewer bytes than expected and aqc111_read_cmd() may not validate the result,...

CVE-2025-38185

CVE-2025-38185 (Linux kernel) : The vulnerability in the ATM subsystem (atm/atmtcp.c) arises from freeing an skb with an invalid length in atmtcp_c_send(). The code checks skb->len == 0 but does not fully guard against using skb->data as an atmtcp_hdr when len is non-zero, and when len == 0...

CVE-2025-38188

CVE-2025-38188 affects the Linux kernel DRM MSM (a7xx) path. The vulnerability arises from missing CP_RESET_CONTEXT_STATE handling when switching contexts, risking userspace submissions in one context causing another context to hang (DoS) without data leakage. The fix ensures CP_RESET_CONTEXT_STA...

CVE-2025-38256

CVE-2025-38256 involves io_uring/rsrc folio unpinning in the Linux kernel. The issue arises when pinning a folio’s tail page and then unpinning the head page via unpin_user_page*, which can trigger a debug warning in mm/gup.c. The provided connected Astra Linux bulletin confirms the root cause an...

CVE-2025-38297

CVE-2025-38297: In the Linux kernel, a division-by-zero could occur in em_compute_costs() for non-CPU devices due to uninitialized table[i].performance. The fix adds a _is_cpu_device(dev) check to em_init_performance() paths to prevent the division. Public advisories (e.g., openSUSE SUSE-SU-2026:...

CVE-2025-38307

CVE-2025-38307 refers to a Linux kernel vulnerability in the ASoC: Intel: avs driver. The issue arises from how parse_int_array() returns content: the first element stores the array length, and if that length is 0, manipulating beyond index 0 can cause a null-ptr-deref. The vulnerability is trigg...

CVE-2025-38343

CVE-2025-38343 relates to the Linux kernel wifi mt76 mt7996 handling of 802.11 fragmentation. A patch ensures multicast/broadcast frames are not fragmented, since IEEE 802.11 fragmentation is limited to unicast frames; this addresses the underlying issue referenced by CVE-2020-26145. Connected so...

CVE-2025-38481

Technical details for CVE-2025-38481 are not provided in the connected documents. The initial description notes a comedi kernel fix (n_insns limit) but contains no vendor/product/version/exploit details beyond that.

CVE-2025-38487

CVE-2025-38487 relates to the Linux kernel ASPEED SoC LPC snoop driver. The vulnerability arises from disabling channels that aren’t enabled, which can lead to a NULL pointer dereference and a kernel Oops on ARM systems, as illustrated by the provided trace. The Ubuntu/Astra Linux advisory confir...

CVE-2026-31432

CVE-2026-31432 affects the Linux kernel ksmbd component. Affected handling of compound requests (e.g., READ + QUERY_INFO(Security)) could allow an out-of-bounds write when the first READ command consumes most of the response buffer and ksmbd builds a security descriptor. The root cause is that sm...

CVE-2026-64192

CVE-2026-64192 affects the Linux kernel (BPF inode storage maps). When CONFIG_BPF_LSM=y and the BPF LSM is not enabled at boot, lsm_prepare() doesn’t run, so the BPF LSM blob size (lbs_inode) remains at the compiled default (8 bytes) instead of a larger offset. This lets a privileged user create/...

CVE-2004-0186

CVE-2004-0186 is a local privilege-escalation in Samba (2.x/3.x) on Linux 2.6 where the setuid-smounted utility smbmnt can be exploited: when a setuid root binary is present on a mounted share, a local user can execute it to gain root privileges. The underlying issue is that setuid attributes are...