14999 matches found
CVE-2022-49075
CVE-2022-49075 is a Linux kernel issue in btrfs where qgroup reserve tracking used an unsigned int for bytes_changed, allowing overflow when fallocate exceeds 4 GiB. This caused incorrect qgroup accounting and could breach the qgroup limit. The published fixes switch bytes_changed to a 64-bit fie...
CVE-2022-49132
CVE-2022-49132 : Linux kernel vulnerability in ath11k PCI suspend handling where board file not found could crash the system. Connected documents confirm the issue arises because board file loading can occur after ath11k_pci_probe() returns and suspend handler remains active, causing a crash on s...
CVE-2022-49221
The CVE-2022-49221 issue affects the Linux kernel DRM MSM DP driver. A NULL pointer dereference could occur because struct dp_panel::connector was never assigned (connector stored in msm_dp::connector). The problem manifested during DP CTS test 4.2.2.6 when reading EDID, causing a NULL dereferenc...
CVE-2022-48751
CVE-2022-48751 pertains to the Linux kernel net/smc code, where a race on clcsock could allow access to a window where clcsock had been released, causing a NULL pointer dereference in smc_setsockopt. The documented fix introduces clcsock_release_lock protection and checks that clcsock is not rele...
CVE-2022-48759
CVE-2022-48759 describes a race in the Linux kernel between releasing rpmsg_ctrldev and its associated cdev, potentially freeing rpmsg_ctrldev before the cdev is fully released. The issue affects rpmsg_ctrldev which includes a struct cdev; freeing the rpmsg_ctrldev via rpmsg_ctrldev_release_devic...
CVE-2022-48806
The CVE-2022-48806 issue is confirmed in the Linux kernel under ee1004 EEPROM reads. The root cause was that ee1004_eeprom_read() could read more than the i2c block data limit because i2c_smbus_read_i2c_block_data_or_emulated() uses an unsigned 8-bit length; if the requested read spanned a 256-by...
CVE-2022-48818
The CVE-2022-48818 entry refers to a Linux kernel issue in the MDIO/MV88E6xxx DSA path where devres usage around mdiobus led to a kernel OOPS during shutdown. The root cause is interaction between devm_mdiobus_free() and devres_release_all() if the MDIO bus is unregistered late due to a shutdown‑...
CVE-2022-48834
CVE-2022-48834 refers to a Linux kernel issue in the usb: usbtmc driver where usbtmc_ioctl_request incorrectly used usb_rcvctrlpipe() for all transfers (in or out). The fix separates control transfers by direction. The vulnerability impact described is a local issue tied to incorrect control pipe...
CVE-2022-48872
CVE-2022-48872 concerns a Linux kernel use-after-free race in the fastrpc maps. The vulnerability arises between fastrpc_map_get() and fastrpc_free_map(), where a concurrent thread could call fastrpc_map_lookup() and obtain a reference to a map about to be deleted, leading to a potential use-afte...
CVE-2022-49163
CVE-2022-49163 is a Linux kernel issue affecting the media/imx-jpeg driver. When parsing JPEGs, if an error occurs before a slot is acquired, a default MXC_MAX_SLOTS may be used and the driver can access the slot with an incorrect slot number, causing an out-of-bounds access. This leads to a chan...
CVE-2022-49250
CVE-2022-49250 : In the Linux kernel ASoC codecs rx-macro path, the AUX interpolator may access compander data without checking that compander exists, potentially causing an out-of-bounds access in the comp_enabled[] array. The issue is resolved by adding a guard before accessing compander data. ...
CVE-2022-49270
CVE-2022-49270 : In the Linux kernel, a use-after-free can occur in dm_cleanup_zoned_dev() if it is not called before blk_cleanup_disk() proceeds through its cleanup path (blk_cleanup_disk->blk_cleanup_queue()->kobject_put()->blk_release_queue()->…->blk_free_queue_rcu()). This raci...
CVE-2022-49427
The CVE pertains to the Linux kernel’s MTK IOMMU driver. After a patch (mtk_iommu_remove) removing clk_disable and relying on a runtime clock-control callback, the clock is now managed by runtime, eliminating the previous disable path. This addresses a warning trace seen when unbinding the MTK IO...
CVE-2022-49475
The connected advisories confirm CVE-2022-49475 affects the Linux kernel in the spi-fsl-qspi driver, where a missing check of the resource returned by platform_get_resource_byname() can lead to a NULL pointer dereference. The root cause is not validating the resource handle before use, causing a ...
CVE-2022-49479
CVE-2022-49479 corresponds to a Linux kernel vulnerability in the mt76 driver: a race condition (use-after-free) during station removal can cause a skb to be added to a status-tracking idr after the idr has been cleaned, leaving a wcid linked in the status poll list. The root cause is a race betw...
CVE-2022-49483
CVE-2022-49483 affects the Linux kernel code path for DRM MSM Display (drm/msm/disp/dpu1). The issue is a NULL pointer dereference that can occur when uninitializing DRM, specifically if hw_intr is NULL and the driver clears interrupts during drm uninit or during probe/bind failure paths, leading...
CVE-2022-49656
The CVE-2022-49656 entry concerns the Linux kernel ARM meson driver, where of_find_compatible_node() returns a node pointer with an incremented refcount. The flaw leads to a refcount leak, fixed by adding of_node_put() after use. Multiple connected advisories reiterate this mitigation (kernel pat...
CVE-2022-49724
CVE-2022-49724 affects the Linux kernel’s goldfish TTY driver. The bug arises from passing an incorrect dev_id to free_irq() during driver removal, which can lead to a splat and attempts to free an already-free IRQ (IRQ 65). A fix was implemented to pass the correct dev_id in the remove path (gol...
CVE-2022-49755
CVE-2022-49755 affects the Linux kernel’s USB gadget path (usb: gadget: f_fs) and specifically the ffs_ep0_queue_wait flow. The vulnerability arises from a race between ffs_ep0_write/ffs_ep0_read and functionfs_unbind, where ep0req can be freed and there is no NULL check in ffs_ep0_queue_wait, ri...
CVE-2022-49802
CVE-2022-49802 affects the Linux kernel ftrace: a NULL pointer dereference can occur in ftrace_add_mod() when ftrace_mod was not initialized as a list head. The issue arises because kzalloc() can leave list pointers NULL and code may call list_del() on an uninitialized entry, triggering an Oops a...
CVE-2022-49861
The CVE-2022-49861 issue is in the Linux kernel DMAENGINE mv_xor_v2 driver, where a clk_prepare_enable() call in probe is not balanced by clk_disable_unprepare() in remove, causing a resource leak. A fix adds the missing clk_disable_unprepare() in mv_xor_v2_remove(). Connected advisories (Unity L...
CVE-2022-49887
The CVE-2022-49887 entry relates to the Linux kernel: the media/ Meson vdec code could leak a refcount due to a failed vdec_probe or during vdec_remove, and requires v4l2_device_unregister to decrement the refcount obtained from v4l2_device_register. The vulnerability affects kernel components ha...
CVE-2022-49964
CVE-2022-49964 affects the Linux kernel arm64 cacheinfo path. The root cause was assigning a signed error value (-ENOENT) returned by acpi_find_last_cache_level() to an unsigned fw_level, causing the number of cache leaves to become an enormous value and triggering a warning in __alloc_pages. The...
CVE-2022-50032
CVE-2022-50032 concerns the Linux kernel USB Renesas driver fix for a refcount leak. The issue arises in usbhs_rza1_hardware_init() where of_find_node_by_name() returns a node pointer with an elevated refcount; the correct handling is to call of_node_put() when the node is no longer needed. The c...
CVE-2022-50111
CVE-2022-50111 concerns a Linux kernel issue in the ASoC mt6359 driver where a refcount leak occurs. The root cause is that in mt6359_parse_dt() and mt6359_accdet_parse_dt(), a reference returned by of_get_child_by_name() is not balanced with of_node_put(), leaving a leaked reference. The availab...
CVE-2022-50127
CVE-2022-50127 affects the Linux kernel RDMA/rxe path. The vulnerability occurs in rxe_create_qp() where rxe_qp_from_init() initializes qp before spinlocks are set up (before rxe_qp_init_req()). If an error happens prior to the proper initialization, an unwind path calls rxe_cleanup()/rxe_qp_do_c...
CVE-2022-50177
CVE-2022-50177 concerns the Linux kernel where rcutorture ksoftirqd boosting timing/iteration could fail, causing RCU priority boosting to break under certain CPU configurations. The documented root causes are: (1) when the total CPUs exceed booted online CPUs, leading to boosting not applying to...
CVE-2023-52506
CVE-2023-52506 affects the Linux kernel on LoongArch. Root cause: early memblock_reserve() during memblock_init sets node id to MAX_NUMNODES, causing NODE_DATA(nid) NULL dereferences in reserve_bootmem_region() and chain calls, triggering a kernel panic on boot when DEFERRED_STRUCT_PAGE_INIT is e...
CVE-2023-52671
CVE-2023-52671 : Linux kernel vulnerability in drm/amd/display related to ODM4:1 transition. The issue could hang or underflow when disabling an OPTC and reclaiming its OPPs for a different OPTC, due to OPPs not being properly disconnected from the disabled OPTC. The published description states ...
CVE-2023-52705
CVE-2023-52705 is a kernel vulnerability affecting the nilfs2 filesystem code in Linux. The issue is an underflow/incorrect boundary calculation in NILFS_SB2_OFFSET_BYTES that computes the position of the second superblock, which can underflow when the device size is smaller than 4096 bytes. This...
CVE-2023-52739
CVE-2023-52739 affects the Linux kernel and is caused by a race in the page freeing path (__free_pages) that could lead to page corruption and crashes. The issue stems from a race around PageHead after the page reference has been dropped, which could cause double-free of tail pages for compound p...
CVE-2023-52780
CVE-2023-52780 concerns the mvneta Ethernet driver in the Linux kernel. The issue arises from calls to page_pool_get_stats in mvneta without proper checks, potentially triggering a kernel NULL pointer dereference when the page pool is unavailable (e.g., port down, unallocated during errors) and c...
CVE-2023-53007
The CVE-2023-53007 issue affects the Linux kernel tracing path, specifically trace_printk(): the vulnerability arises because trace_printk() can be used before the ftrace events are fully registered, leading to missing trace output after a crash if ftrace_dump_on_oops is enabled. The fix register...
CVE-2024-26765
CVE-2024-26765 concerns the Linux kernel on LoongArch. The issue arises when hotplugging nonboot CPUs: IRQs are disabled before calling init_fn(), intended to silence warnings and avoid interrupts, but this is tied to the rcu_cpu_starting warning path (CPU: 1, pid: 0). The result is a race where ...
CVE-2024-26849
CVE-2024-26849 is a Linux kernel vulnerability affecting netlink attribute policy for NFTA_TARGET_REV. The minlen entry for NLA_BE32 is zero, causing validation to read past a malformed attribute (risk of kernelread). Concrete details appear in connected advisories (e.g., kernel commits a2ab02815...
CVE-2024-36033
CVE-2024-36033 refers to a vulnerability in the Linux kernel where the Bluetooth: qca driver could leak slab data when fetching the board id. The issue was fixed by adding a missing sanity check during the board-id fetch, preventing leakage of slab data when firmware is subsequently requested. Th...
CVE-2024-38569
CVE-2024-38569 concerns the Linux kernel driver for HISI PCIe in the perf subsystem. Description: the perf tool allows creating event groups; if the number of events in an event_group exceeds HISI_PCIE_MAX_COUNTERS, the driver may write past the end of the event_group array, causing an out-of-bou...
CVE-2024-38585
CVE-2024-38585 — Linux kernel memory corruption in realloc . The issue arises in tools/nolibc/stdlib where realloc() could copy beyond the allocated region because memcpy() used heap->len instead of the input user_p_len. The vulnerability was resolved by passing user_p_len to memcpy() to preve...
CVE-2024-38595
CVE-2024-38595 affects the Linux kernel mlx5 subsystem: a patch changing register devlink flow did not update the peer devlink set logic, triggering a call trace when peer devlink set is done after devl_register. The fix aligns peer devlink set logic with the register flow to prevent the trace. I...
CVE-2024-38622
CVE-2024-38622 concerns a Linux kernel issue in drm/msm/dpu where dpu_core_irq_callback_handler() checks a callback pointer for NULL but then unconditionally calls it. The vulnerability arises from calling a possibly NULL function pointer, which could lead to kernel behavior disruption. The fix a...
CVE-2024-41021
CVE-2024-41021: Linux kernel (s390) fixes VM_FAULT_HWPOISON handling in do_exception. The s390 arch has no HWPOISON/MEMORY_FAILURE/ARCH_HAS_COPY_MC, so HWPOISON was not expected here; fix makes HWPOISON behave like VM_FAULT_SIGBUS (as for MEMORY_FAILURE on x86) and adds printing of unexpected fau...
CVE-2024-43875
CVE-2024-43875 affects the Linux kernel PCI endpoint code, specifically vpci_scan_bus in drivers/pci/endpoint/functions/pci-epf-vntb.c. The issue is improper NULL checking and error handling: Smatch reported that vpci_bus could be NULL, leading to an error path that would crash instead of returni...
CVE-2024-43877
The CVE-2024-43877 vulnerability affects the Linux kernel’s media: pci: ivtv implementation. When DMA mapping fails, dma->SG_length can be 0, and code later accesses dma->SGarray[dma->SG_length - 1], causing an out-of-bounds read. The fix adds an early return on invalid DMA map results a...
CVE-2024-44994
CVE-2024-44994 affects the Linux kernel IOMMU code: when iommu_report_device_fault processes a partial fault, the return path was accidentally removed, risking a crash. The issue is resolved by restoring the return statement, effectively fixing the crash during partial fault handling. Public advi...
CVE-2024-46764
CVE-2024-46764 affects Linux kernel’s BPF/BTF handling: btf_name_valid_section() can pass an invalid 1-byte name if name[0] is a NULL byte, enabling an out-of-bounds condition. The fix adds a check for a NULL first byte and that the first character is printable. The initial entry indicates the vu...
CVE-2024-49570
The CVE is in the Linux kernel DRM- XE tracing code. A potential use-after-free (UAF) arises from TP_printk dereferencing xe_mem_type_to_name[] during tracing of xe_bo_move in the xe trace event, exposing a TP_printk-time UAF. The fix avoids dereferencing xe_mem_type_to_name[] at TP_printk time b...
CVE-2024-50277
In CVE-2024-50277, the Linux kernel fixes a crash in the device-mapper path when blk_alloc_disk fails. Specifically, if blk_alloc_disk returns an error, md->disk is set to an error value and cleanup_mapped_device may still access it, leading to a crash at md->disk->private_data = NULL. T...
CVE-2024-53204
CVE-2024-53204 affects the Linux kernel Realtek USB PHY driver (rtk_usb3phy_probe). The root cause is a NULL dereference: devm_kzalloc() may return NULL in rtk_usb3phy_probe() and the value is not checked. The CVSS data indicates a Local attack vector, Low complexity, and High impact on availabil...
CVE-2024-56618
CVE-2024-56618 : In the Linux kernel, the pmdomain: imx: gpcv2 handshake delay caused a kernel panic when the handshake ended early. The fix involves waiting longer after the handshake (udelay) due to BUS clock enablement being handled by a separate driver; the observed data suggested udelay(10) ...