CVE-2022-48851

CVE-2022-48851 is a Linux kernel issue in the staging: gdm724x driver. The root cause is a use-after-free in gdm_lte_rx(), where netif_rx_ni() frees the skb, making it unsafe to dereference to read skb->len. The connected sources confirm the vulnerability and its resolution in the kernel, with...

CVE-2022-48855

CVE-2022-48855: The connected advisories confirm a Linux kernel SCTP kernel-infoleak fix. The issue arose because r->idiag_expires was not initialized when inet_sctp_diag_fill() invoked inet_diag_msg_common_fill(), enabling a potential 4-byte kernel infoleak via SCTP sockets. The fix requires ...

CVE-2022-48864

CVE-2022-48864 (Linux kernel) : The issue arises in the vdpa/mlx5 component where a VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET command from a driver could pass an unvalidated number of queue pairs or an unnegotiated multiqueue state, potentially triggering a kernel panic due to uninitialized resources. The ...

CVE-2022-48902

CVE-2022-48902 is a Linux kernel issue in the btrfs extent_io path where a warned-on condition could occur when a page with PageError is encountered during extent buffer ops. The vulnerability arises from using assert_eb_page_uptodate() on non-uptodate pages, potentially exposing instability warn...

CVE-2022-48920

CVE-2022-48920: In the Linux kernel, the btrfs flushoncommit path could trigger a warning in __writeback_inodes_sb_nr() during transaction commits. The fix avoids deadlock risks by replacing writeback_inodes_sb() with try_to_writeback_inodes_sb(), which reads sb->s_umount and only calls writeb...

CVE-2022-49050

CVE-2022-49050 maps to a Linux kernel issue in memory: renesas-rpc-if where a flash platform-device leak could occur in the error path if registration fails during probe. The fixed code ensures the flash platform device is freed on probe error. The vulnerability is local in scope with a medium ba...

CVE-2022-49083

CVE-2022-49083 concerns a kernel-level regression in the iommu/omap path that can trigger a NULL pointer dereference during device probe. The issue arises when a commit altered probe behavior (3f6634d997db) so that omap iommu probe returns 0 instead of ERR_PTR(-ENODEV), making probe_iommu_group-&...

CVE-2022-49144

CVE-2022-49144 pertains to the Linux kernel io_uring subsystem. The issue stems from a memory-leak when registering files: if there are no files to process in __io_sqe_files_scm(), the code frees resources but forgets to restore the uid, leading to a leak. The connected documents confirm this exa...

CVE-2022-49200

CVE-2022-49200 (Linux kernel): A bug in Bluetooth btmtksdio handling caused a kernel oops when btmtksdio_interrupt ran before sdio_set_drvdata was initialized. The issue happened because hdev->power_on could be queued and execute prior to sdio_set_drvdata being filled during btmtksdio_probe, a...

CVE-2022-49213

CVE-2022-49213 affects the Linux kernel, specifically the ath10k subsystem in the error path of ath10k_setup_msa_resources. The root cause is that the device_node pointer returned by of_parse_phandle() is assigned a refcount that is not always released on error paths, causing a refcount leak. The...

CVE-2022-49392

CVE-2022-49392 affects the Linux kernel’s serial driver for ASPEED vuart (8250_aspeed_vuart). The vulnerability arises from a NULL pointer dereference in aspeed_vuart_probe when platform_get_resource() returns NULL. The patch adds a check for the resource return value to avoid dereferencing NULL,...

CVE-2022-49421

CVE-2022-49421 affects the Linux kernel’s video fbdev clcdfb code. The vulnerability arises from a refcount leak in clcdfb_of_vram_setup caused by of_parse_phandle() returning a node pointer with an incremented refcount that is not released. The provided description states that of_node_put() is r...

CVE-2022-49488

In CVE-2022-49488, the Linux kernel subsystem drm/msm/mdp5 is affected. The root cause is that mdp5_get_global_state could return the error -EDEADLK while acquiring the modeset lock, but mdp5_mixer_release did not propagate this error, risking a NULL dereference. The mitigation is a patch to have...

CVE-2022-49591

CVE-2022-49591 relates to the Linux kernel, specifically the DSA Microchip ksz_common path. The root cause is a refcount leak in ksz_switch_register(): the reference returned by of_get_child_by_name() is not released. The fix is to call of_node_put() on that reference (which has increased the ref...

CVE-2022-49656

The CVE-2022-49656 entry concerns the Linux kernel ARM meson driver, where of_find_compatible_node() returns a node pointer with an incremented refcount. The flaw leads to a refcount leak, fixed by adding of_node_put() after use. Multiple connected advisories reiterate this mitigation (kernel pat...

CVE-2022-49786

The CVE-2022-49786 issue affects the Linux kernel’s blk-cgroup subsystem. Root cause: blkcg_css_online incorrectly pinned the parent after a 397c9f46 refactor, pinning the css instead of the parent blkcg, which leads to extra pins and leakage of blkcgs and cgroups. Impact stated: leakage of blkcg...

CVE-2022-49800

CVE-2022-49800 is a Linux kernel issue addressed by multiple advisories. The root cause was a memory-leak in the tracing tests (test_gen_synth_cmd and test_empty_synth_event) where allocated buffers were freed only on failure paths; the fix adds kfree(buf) to ensure no leak. The Nessus/OpenVAS en...

CVE-2022-49835

CVE-2022-49835 relates to the Linux kernel ALSA: hda subsystem where memory leaks could occur in add_widget_node due to how kobject_add allocates kobject->name and may not free the kobject on error. The root cause is failure to recycle resources when kobject_add fails, leading to a potential m...

CVE-2022-49880

CVE-2022-49880 : Linux kernel ext4 inline-data migration may trigger a reliable warning in ext4_da_release_space when a writeback path releases space with to_free=1 but i_reserved_data_blocks==0. The issue is resolved by forbidding inodes with inline data from migration (ext4 inline data handling...

CVE-2022-49888

CVE-2022-49888 affects the ARM64 Linux kernel entry path. The Cortex-A76 erratum workaround (cortex_a76_erratum_1463225_debug_handler) was not inlined due to a patch, allowing a kprobe to probe the function and potentially trigger recursive exceptions and a stack overflow when a probed function e...

CVE-2022-49945

The CVE-2022-49945 issue affects the Linux kernel hwmon gpio-fan driver. The vulnerability occurs because gpio_fan_set_cur_state() does not validate the cooling state against fan_data->num_speeds, allowing an out-of-bounds index in set_fan_speed(). Practical impact is potential kernel oops or ...

CVE-2022-49973

The CVE-2022-49973 entry concerns a Linux kernel vulnerability in sk_msg_recvmsg triggered by an incorrect last scatter-gather (sg) check. The root cause is a change to the last sg validation (to sg_is_last()) in sk_msg_recvmsg(), but the end of the scatterlist was not marked in sockmap redirecti...

CVE-2022-49981

CVE-2022-49981 is a Linux kernel vulnerability where HID hidraw released reports memory was leaked due to missing cleanup; the fix frees buffered reports before deleting the list entry. Affected component: HID subsystem (hidraw) in the Linux kernel. Impact described as memory leak with availabili...

CVE-2022-49993

CVE-2022-49993 affects the Linux kernel loop subsystem. The vulnerability stems from overflow when configuring a loop via ioctl: the code copies info->lo_offset (loop_info64) into lo_offset (loff_t), enabling an overflow that can trigger a warning in iomap_iter() (via iomap_iter_done). The iss...

CVE-2022-50003

CVE-2022-50003 describes a Linux kernel issue in the ice driver where XSK (AF_XDP) pool assignment can occur for a non-balanced queue id, enabling an out-of-bounds access to the Rx ring when attaching an XSK socket in tx-only mode to a queue id without a corresponding Rx queue. The fix rewrites t...

CVE-2022-50010

CVE-2022-50010 affects the Linux kernel’s fbdev i740fb driver. If a user space ioctl supplies a pixclock value causing the argument to i740_calc_vclk() to be less than I740_RFREQ_FIX, a divide-by-zero can occur in p_best calculation (drivers/video/fbdev/i740fb.c:353). The vulnerability arises bec...

CVE-2022-50026

CVE-2022-50026 concerns a Linux kernel vulnerability where the NIC queue offset calculation could shift out of bounds during NIC queue validation. The root cause is related to how habanalabs/gaudi handling interacts with NIC queues, leading to potential out-of-bounds access. The CVSS metrics indi...

CVE-2022-50028

CVE-2022-50028 affects gadgetfs ep_io in the Linux kernel (drivers/usb/gadget/legacy/inode.c). After usb_ep_queue(), if wait_for_completion_interruptible() is interrupted, code must wait for IRQ completion; otherwise epio_complete() may corrupt the stack. The vulnerability is fixed in the Linux k...

CVE-2022-50046

In CVE-2022-50046, the Linux kernel fixes a memory-leak and potential NULL-dereference in net/sunrpc rpc_sysfs_xprt_state_change(): on error paths, xprt may fail to decrement the reference count of xps and may use an invalid xps. The issue arises because the function does not always handle errors...

CVE-2022-50055

The CVE-2022-50055 entry pertains to the Linux kernel vulnerability in the iavf driver: Fix adminq error handling. The issue arises in iavf_alloc_asq_bufs/iavf_alloc_arq_bufs where DMA-coherent memory is allocated for the VF mailbox, and DMA regions for ASQ/ARQ were not freed if configuration err...

CVE-2022-50116

The CVE refers to a Linux kernel flaw in tty n_gsm where deadlocks and link starvation could occur in the outgoing data path under ldisc congestion. The fix adds an additional control-channel data queue and processes it before the user-channel queue in gsm_data_kick(), moving this work to a dedic...

CVE-2022-50129

The CVE-2022-50129 entry concerns the Linux kernel RDMA/srpt use-after-free issue. The fix changes the lifetime of LIO port data by converting LIO port members inside struct srpt_port from regular members to pointers and by allocating/freeing the LIO port data structures from inside srpt_make_tpo...

CVE-2022-50133

CVE-2022-50133 concerns the Linux kernel where a NULL dereference could occur in usb: xhci_plat_remove due to xhci->shared_hcd being NULL after a specific commit. The vulnerability manifests as an Oops during reboot when the USB xHCI host controller is removed, potentially causing a system cra...

CVE-2023-52645

CVE-2023-52645 is a Linux kernel race condition affecting mediatek power domains managed by genpd. The issue arises if power domains are registered first with genpd and later powered on in the driver’s probe, creating a potential race with genpd’s on/off operations. The described fix involves seq...

CVE-2023-52677

CVE-2023-52677 is a Linux kernel vulnerability affecting riscv where the patch must check whether the code to patch lies in the exit section. If not, execution may fall through to vmalloc_to_page() and panic because the address is not in the vmalloc region. The connected advisories confirm the is...

CVE-2023-52787

CVE-2023-52787: Linux kernel vulnerability in blk-mq handling of bio integrity. The issue could cause a kernel panic when queue usage counters aren’t properly held during bio_integrity_prep and bio merge. Fixes in updated kernels require calling bio_integrity_prep() with a reliably grabbed queue ...

CVE-2023-52828

CVE-2023-52828 (Linux kernel) : The vulnerability arises from BPF verifier handling after a bpf_throw call. Because bpf_throw is the first noreturn call in the verifier, dead code elimination causes subsequent instructions to be treated as unseen, which can affect stack unwinding when a program t...

CVE-2023-53054

CVE-2023-53054 affects the Linux kernel’s USB DWC2 driver (dwc2) where suspend/resume could leak device resources: __dwc2_lowlevel_hw_enable calls devm_add_action_or_reset() on every PM cycle, creating new devres entries; there is also a second issue where regulator_bulk_disable() is never invoke...

CVE-2024-26716

CVE-2024-26716 affects the Linux kernel USB subsystem, specifically the USB core’s update_port_device_state. The vulnerability arises when actconfig or maxchild is 0, causing usb_hub to be NULL and leading to a NULL pointer dereference when accessing port_dev. The provided description states the ...

CVE-2024-26799

CVE-2024-26799: Linux kernel vulnerability in ASoC qcom where __lpass_get_dmactl_handle could leave dmactl uninitialized if dai_id is invalid. The fix initializes dmactl to NULL, preventing a potential null check bypass. References show Debian 12 Root (rootio-linux) patching this CVE in ROOT-OS-D...

CVE-2024-26867

CVE-2024-26867 concerns the Linux kernel issue in comedi_8255: subdevice initialization. The root cause, described across multiple sources, is a refactoring in comdrivers/comedi_8255.c where the io field in subdev_8255_private could be left NULL after initialization, because __subdev_8255_init() ...

CVE-2024-35882

CVE-2024-35882 affects the Linux kernel SUNRPC over TCP, causing a slow server-side memory leak. A bisect identifies the first bad commit as e18e157bb5c8, which changed RPC message sending on TCP with a single sock_sendmsg() call. The issue occurs because sock_sendmsg() does not release all pages...

CVE-2024-38566

CVE-2024-38566: In the Linux kernel, the bpf verifier had an incorrect assumption that socket->sk is valid when a trusted socket is used, which may not hold for sockets just created and passed to LSM socket_accept hooks. The fix relaxes the verifier assumption and updates tests. The vulnerabil...

CVE-2024-38623

CVE-2024-38623 : The issue in the Linux kernel relates to the ntfs3 code using a fixed-size array, leading to a memcpy overflow in ntfs_set_label about uni->name (20 vs 256). The fix is to switch to a variable-length array (fs/ntfs3) to prevent the overflow. Connected Astra Linux advisories co...

CVE-2024-43816

CVE-2024-43816 affects the Linux kernel SCSI lpfc driver (lpfc_prep_embed_io in drivers/scsi/lpfc/lpfc_sli.c). On big-endian systems, a memory out-of-bounds dereference can occur when FCP targets are zoned due to memcpy(ptr, fcp_cmnd, sgl->sge_len) referencing a little-endian formatted sgl-&gt...

CVE-2024-52560

CVE-2024-52560 concerns Linux kernel’s NTFS-3G support. A change in fs/ntfs3 extends the mi_enum_attr() interface by adding a new parameter, struct ntfs_inode *ni, enabling the kernel to mark the inode as bad as soon as an error is detected. The vulnerability discussion and multiple sources (NVD ...

CVE-2024-57941

CVE-2024-57941 concerns the Linux kernel netfs cache handling. When the cache is temporarily disabled, netfs_advance_write() may bail out without subrequests, leaving folios with PG_private_2 and discarding the request. The root cause is the use of the deprecated PG_private_2 path by netfslib (e....

CVE-2024-57942

CVE-2024-57942 (Linux kernel) affects netfs by addressing how ceph copy to cache is handled on write-begin. The vulnerability arises in netfs_unlock_read_folio() where folios marked for cache copy are not consistently queued, and netfs_pgpriv2_write_to_the_cache() expects to traverse folio_queue ...

CVE-2024-58074

Technical details and impact for CVE-2024-58074 are not publicly provided in the supplied documents; monitor for updates.

CVE-2025-37783

CVE-2025-37783 — Linux kernel (drm/msm/dpu) The issue occurs where dpu_plane_virtual_atomic_check could dereference pointers returned by drm_atomic_get_plane_state without verifying for errors, leading to undefined behavior. The fix adds IS_ERR checks to ensure plane_state is valid before derefer...