CVE-2022-49483

CVE-2022-49483 affects the Linux kernel code path for DRM MSM Display (drm/msm/disp/dpu1). The issue is a NULL pointer dereference that can occur when uninitializing DRM, specifically if hw_intr is NULL and the driver clears interrupts during drm uninit or during probe/bind failure paths, leading...

CVE-2024-35836

CVE-2024-35836 affects the Linux kernel's dpll/pin handling logic. When a kernel module is unbound but pin resources for the same PCI device persist in memory, rebinding can leave the prop pointer stale to deallocated module memory. Invoking a pin-dump in this state crashes the kernel. The fix st...

CVE-2022-48767

CVE-2022-48767 affects the Linux kernel and relates to a leak of the ceph_string reference after an async create attempt. The description in the initial document states that the reference acquired by try_prep_async_create is leaked and must be put back, and connected sources (Astra Linux bulletin...

CVE-2022-48818

The CVE-2022-48818 entry refers to a Linux kernel issue in the MDIO/MV88E6xxx DSA path where devres usage around mdiobus led to a kernel OOPS during shutdown. The root cause is interaction between devm_mdiobus_free() and devres_release_all() if the MDIO bus is unregistered late due to a shutdown‑...

CVE-2022-48923

The CVE-2022-48923 entry concerns a Linux kernel vulnerability in the btrfs code path, specifically for LZO compression. The root cause is that a compressed length could be corrupted to exceed allocated memory, allowing memcpy to write beyond bounds in copy_compressed_segment. This can cause a ke...

CVE-2022-49170

CVE-2022-49170 concerns the F2FS implementation in the Linux kernel. The root cause was a missing sanity check on curseg->alloc_type, which could widen an array-bounds access of sbi->block_count[] (UBSAN: array-index-out-of-bounds) when mounting/operating a corrupted image. The issue manife...

CVE-2022-49208

CVE-2022-49208 : Linux kernel RDMA/irdma vulnerability where an integer underflow may occur in irdma_sc_ceq_init() when subtracting info->dev->hmc_fpm_misc.max_ceqs. This value may come from firmware (irdma_sc_parse_fpm_query_buf()) and could be zero, enabling a potential underflow. The iss...

CVE-2022-49239

CVE-2022-49239 : The Linux kernel ASoC codecs wcd934x path is fixed by addressing a missing of_node_put() after of_parse_phandle() returned a device_node with an incremented refcount. The bug resembles a leaked reference fix in a related commit. The connected advisories (Astra Linux, SUSE, Nessus...

CVE-2022-49250

CVE-2022-49250 : In the Linux kernel ASoC codecs rx-macro path, the AUX interpolator may access compander data without checking that compander exists, potentially causing an out-of-bounds access in the comp_enabled[] array. The issue is resolved by adding a guard before accessing compander data. ...

CVE-2022-49261

CVE-2022-49261 affects the Linux kernel’s drm/i915/gem subsystem, where a missing boundary check in vm_access allows an out-of-bounds read/write via an unvalidated len before memcpy, potentially triggering a kernel page fault. The issue is illustrated by an access path that hits memcopy_erms and ...

CVE-2022-49324

CVE-2022-49324 affects the Linux kernel via a refcount leak in the mips CPC default physical base. The root cause is a missing of_node_put() to release a refcount incremented by of_find_compatible_node(), leading to a leak. The primary fix is to add the missing of_node_put() to release the refcou...

CVE-2022-49388

CVE-2022-49388 affects the Linux kernel ubi_create_volume() in the UBI subsystem. The issue is an use-after-free involving the 'eba_tbl' in the error handling path: ubi_eba_replace_table(vol, eba_tbl) assigns vol->eba_tbl = tbl, then on error the code path leads to ubi_eba_destroy_table(eba_tb...

CVE-2022-49459

Mode C: CVE-2022-49459 affects the Linux kernel (notably kernel 5.10/5.15 in Astra Linux) with a NULL-dereference risk in sr_thermal_probe due to platform_get_resource() possibly returning NULL. The vulnerability stems from insufficient NULL checks, and a fix adds a proper NULL check to prevent d...

CVE-2022-49487

CVE-2022-49487 affects the Linux kernel mtd/rawnand/syscalls for Intel NAND, where a null pointer dereference could occur if platform_get_resource() returns NULL. The fix moves using the resource after devm_ioremap_resource(), which checks for NULL to prevent dereference. Connected Astra Linux ad...

CVE-2022-49682

CVE-2022-49682 is a Linux kernel issue: in xtensa, a refcount leak bug in time.c occurred where calibrate_ccount() could return a node with an incremented refcount. The fix requires using of_node_put() when the node is no longer used (to avoid a leak). Connected advisories (Astra Linux and Unity/...

CVE-2022-49683

The CVE-2022-49683 entry concerns the Linux kernel, specifically the IIO ADC driver for adi-axi-adc. The root cause is a refcount leak where of_parse_phandle() returns a node pointer with an incremented refcount, and the patch adds a missing of_node_put() when the node is no longer needed. The ch...

CVE-2022-49724

CVE-2022-49724 affects the Linux kernel’s goldfish TTY driver. The bug arises from passing an incorrect dev_id to free_irq() during driver removal, which can lead to a splat and attempts to free an already-free IRQ (IRQ 65). A fix was implemented to pass the correct dev_id in the remove path (gol...

CVE-2022-49755

CVE-2022-49755 affects the Linux kernel’s USB gadget path (usb: gadget: f_fs) and specifically the ffs_ep0_queue_wait flow. The vulnerability arises from a race between ffs_ep0_write/ffs_ep0_read and functionfs_unbind, where ep0req can be freed and there is no NULL check in ffs_ep0_queue_wait, ri...

CVE-2022-49764

CVE-2022-49764 (Linux kernel) : A vulnerability in BPF raw tracepoint handling allows a BPF program to recursion-trigget the same tracepoint via bpf_trace_printk, causing spinlock contention paths to recurse and potentially affecting tracing by taking the slow path. Root cause: a BPF program atta...

CVE-2022-49771

CVE-2022-49771 affects the Linux kernel’s dm-thin/ioctl path. The vulnerability arises when __list_versions uses dm_target_iterate twice under race conditions between the first size estimation and the second information retrieval, allowing module loading to occur between the two calls. The second...

CVE-2022-49822

The CVE refers to a Linux kernel CIFS issue: when tlink setup fails, connections may not be released, causing a refcount leak in the CIFS module and leaking fscache info, which can lead to errors on subsequent mounts (e.g., CIFS: Cache volume key already in use). The vulnerability is tied to the ...

CVE-2022-49824

In the Linux kernel, CVE-2022-49824 affects the ata_tlink_add() path in libata-transport. The root cause is that transport_add_device()'s return value is not checked, which can lead to a NULL pointer dereference during module removal when transport_remove_device() is called for a device that wasn...

CVE-2022-49829

CVE-2022-49829 pertains to the Linux kernel DRM scheduler exhibit: fix of fence ref counting to prevent leaking dependency fences when processes are killed. The issue involved grabbing a reference to the last scheduled fence and leaks occur due to improper fence ref counts. Connected advisories (...

CVE-2022-49861

The CVE-2022-49861 issue is in the Linux kernel DMAENGINE mv_xor_v2 driver, where a clk_prepare_enable() call in probe is not balanced by clk_disable_unprepare() in remove, causing a resource leak. A fix adds the missing clk_disable_unprepare() in mv_xor_v2_remove(). Connected advisories (Unity L...

CVE-2022-49887

The CVE-2022-49887 entry relates to the Linux kernel: the media/ Meson vdec code could leak a refcount due to a failed vdec_probe or during vdec_remove, and requires v4l2_device_unregister to decrement the refcount obtained from v4l2_device_register. The vulnerability affects kernel components ha...

CVE-2022-49888

CVE-2022-49888 affects the ARM64 Linux kernel entry path. The Cortex-A76 erratum workaround (cortex_a76_erratum_1463225_debug_handler) was not inlined due to a patch, allowing a kprobe to probe the function and potentially trigger recursive exceptions and a stack overflow when a probed function e...

CVE-2022-50127

CVE-2022-50127 affects the Linux kernel RDMA/rxe path. The vulnerability occurs in rxe_create_qp() where rxe_qp_from_init() initializes qp before spinlocks are set up (before rxe_qp_init_req()). If an error happens prior to the proper initialization, an unwind path calls rxe_cleanup()/rxe_qp_do_c...

CVE-2022-50152

CVE-2022-50152 is resolved in the Linux kernel via a fix for usb: ohci-nxp: refcount leak in ohci_hcd_nxp_probe. The issue arises because of_parse_phandle() returns a node pointer with an incremented refcount and lacks a corresponding of_node_put() when the node is no longer needed. The patch add...

CVE-2023-1295

CVE-2023-1295 describes a time-of-check to time-of-use issue in the Linux kernel io_uring IORING_OP_CLOSE path, affecting kernels 5.6–5.11 (inclusive). The flaw, a local privilege escalation, is introduced by the commit b5dba59e0cf7e2cc4d3b3b1ac5fe81ddf21959eb and patched in 9eac1904d3364254d622b...

CVE-2023-52660

CVE-2023-52660 concerns the Linux kernel media rkisp1 driver. The vulnerability arises from IRQ handling configured with IRQF_SHARED, which allows an interrupt to fire when the ISP is powered down, causing the SoC to hang as the driver accesses ISP registers. The provided details state the bug is...

CVE-2023-52767

CVE-2023-52767 : In the Linux kernel, a NULL dereference could occur in the TLS path when tls_sw_splice_eof() runs as part of sendfile() with an empty plaintext/ciphertext sk_msg. The issue caused tls_push_record() to take the split path and tls_merge_open_record(), which assumed at least one pop...

CVE-2023-52780

CVE-2023-52780 concerns the mvneta Ethernet driver in the Linux kernel. The issue arises from calls to page_pool_get_stats in mvneta without proper checks, potentially triggering a kernel NULL pointer dereference when the page pool is unavailable (e.g., port down, unallocated during errors) and c...

CVE-2023-52786

CVE-2023-52786 affects the Linux kernel ext4 subsystem. The issue is a race in the inline data check during direct IO (dio) writes: ext4_iomap_begin() can observe inline data concurrently with MAY_INLINE_DATA state clearing across a lock cycle, potentially allowing a dio write to proceed in an un...

CVE-2023-52828

CVE-2023-52828 (Linux kernel) : The vulnerability arises from BPF verifier handling after a bpf_throw call. Because bpf_throw is the first noreturn call in the verifier, dead code elimination causes subsequent instructions to be treated as unseen, which can affect stack unwinding when a program t...

CVE-2023-52852

CVE-2023-52852 concerns a Linux kernel vulnerability in f2fs compression code where a use-after-free can occur for the dic pointer during readahead/multi-page decompress flow. The root cause, as described in the connected docs, is that after f2fs_decompress_cluster() is invoked and a cached page ...

CVE-2023-52872

The CVE-2023-52872 vulnerability affects the Linux kernel tty/n_gsm subsystem. A race in gsm_cleanup_mux() during the cleanup of GSM DLCIs can spuriously change virtual modem status lines while data/timers are being torn down, risking a kernel panic when resources have already been removed. The f...

CVE-2023-53007

The CVE-2023-53007 issue affects the Linux kernel tracing path, specifically trace_printk(): the vulnerability arises because trace_printk() can be used before the ftrace events are fully registered, leading to missing trace output after a crash if ftrace_dump_on_oops is enabled. The fix register...

CVE-2023-53041

CVE-2023-53041 has concrete details in the Connected documents. The issue is in the Linux kernel’s qla2xxx SCSI driver: during controller add/remove, abort path completes commands with a lock still held, causing a lock-warning in dma_free_attrs. The observed call trace centers on qla2x00_async_sn...

CVE-2023-53138

CVE-2023-53138 corresponds to a Linux kernel vulnerability in the net/caif stack (cfusbl_device_notify). When NETDEV_UNREGISTER is delivered multiple times during device teardown, a use-after-free can occur and there can be an imbalance in the module’s reference count, potentially freeing the par...

CVE-2024-26765

CVE-2024-26765 concerns the Linux kernel on LoongArch. The issue arises when hotplugging nonboot CPUs: IRQs are disabled before calling init_fn(), intended to silence warnings and avoid interrupts, but this is tied to the rcu_cpu_starting warning path (CPU: 1, pid: 0). The result is a race where ...

CVE-2024-35832

CVE-2024-35832 : In the Linux kernel, a memory-management bug in bcachefs caused a local denial of service when unmounting, due to incorrect freeing of snapshots. Specifically, bch_fs::snapshots is allocated with kvzalloc but freed with kvfree, whereas it should be freed with kvfree to avoid a pa...

CVE-2024-35882

CVE-2024-35882 affects the Linux kernel SUNRPC over TCP, causing a slow server-side memory leak. A bisect identifies the first bad commit as e18e157bb5c8, which changed RPC message sending on TCP with a single sock_sendmsg() call. The issue occurs because sock_sendmsg() does not release all pages...

CVE-2024-36935

CVE-2024-36935 : In the Linux kernel, a memory copy from userspace into a kernel buffer for the ice path could miss a terminating NUL, enabling an OOB read when sscanf() is used. The fix uses memdup_user_nul instead of memdup_user to guarantee NUL termination. Affected component is the kernel’s i...

CVE-2024-38622

CVE-2024-38622 concerns a Linux kernel issue in drm/msm/dpu where dpu_core_irq_callback_handler() checks a callback pointer for NULL but then unconditionally calls it. The vulnerability arises from calling a possibly NULL function pointer, which could lead to kernel behavior disruption. The fix a...

CVE-2024-46741

The CVE-2024-46741 issue is in the Linux kernel’s misc/fastrpc subsystem. The root cause is a double free of the fastrpc buffer in the error path of fastrpc_req_mmap(): the buffer is freed in fastrpc_req_munmap_impl() on a successful unmap, but there is an unconditional call to fastrpc_buf_free()...

CVE-2024-46764

CVE-2024-46764 affects Linux kernel’s BPF/BTF handling: btf_name_valid_section() can pass an invalid 1-byte name if name[0] is a NULL byte, enabling an out-of-bounds condition. The fix adds a check for a NULL first byte and that the first character is printable. The initial entry indicates the vu...

CVE-2024-46833

CVE-2024-46833 is a Linux kernel vulnerability in the net:hns3 driver where SSU reg info reads loop up to tnl_num, which is hw-derived and not the array length, causing an out-of-bounds read. The description states the fix is to bound the loop so it does not exceed the array length. The connected...

CVE-2024-50277

In CVE-2024-50277, the Linux kernel fixes a crash in the device-mapper path when blk_alloc_disk fails. Specifically, if blk_alloc_disk returns an error, md->disk is set to an error value and cleanup_mapped_device may still access it, leading to a crash at md->disk->private_data = NULL. T...

CVE-2024-56618

CVE-2024-56618 : In the Linux kernel, the pmdomain: imx: gpcv2 handshake delay caused a kernel panic when the handshake ended early. The fix involves waiting longer after the handshake (udelay) due to BUS clock enablement being handled by a separate driver; the observed data suggested udelay(10) ...

CVE-2024-57918

The CVE-2024-57918 fix targets the Linux kernel’s DRM/AMD display (DC) driver. Root cause: a surface-definition mismatch between MAX_SURFACES and MAX_SURFACE_NUM caused a page fault when updating surfaces (affecting Cosmic users with two overlay planes after cursor overlay introduction). The patc...