CVE-2022-49948

CVE-2022-49948 affects the Linux kernel VT subsystem. When changing the console font via ioctl(KDFONTOP), the new font size may exceed the previous screen, potentially making a prior selection fall outside the new viewport and cause out-of-bounds accesses to graphics memory if the selection is re...

CVE-2022-50026

CVE-2022-50026 concerns a Linux kernel vulnerability where the NIC queue offset calculation could shift out of bounds during NIC queue validation. The root cause is related to how habanalabs/gaudi handling interacts with NIC queues, leading to potential out-of-bounds access. The CVSS metrics indi...

CVE-2022-50028

CVE-2022-50028 affects gadgetfs ep_io in the Linux kernel (drivers/usb/gadget/legacy/inode.c). After usb_ep_queue(), if wait_for_completion_interruptible() is interrupted, code must wait for IRQ completion; otherwise epio_complete() may corrupt the stack. The vulnerability is fixed in the Linux k...

CVE-2022-50037

CVE-2022-50037 concerns the Linux kernel: the drm/i915/ttm path could leak CCS state between users. The issue is resolved by applying the patch that prevents leaking CCS state (cherry-picked from commit 353819d85f87be46aeb9c1dd929d445a006fc6ec). Affected product is the Linux kernel (ttm subsystem...

CVE-2022-50109

The CVE-2022-50109 issue is a Linux kernel vulnerability in the video: fbdev: amba-clcd driver. The root cause is refcount leaks from references returned by of_graph_get_next_endpoint() and of_graph_get_remote_port_parent() in clcdfb_of_init_display(). Mitigation described in the referenced discl...

CVE-2022-50112

The CVE-2022-50112 issue concerns the Linux kernel: a refcount leak in rpmsg qcom_smd parsing logic. Specifically, of_parse_phandle() returns a node pointer with an incremented refcount, which must be balanced with of_node_put() when the node is no longer needed. The vulnerability affects the ker...

CVE-2022-50196

In the Linux kernel, the vulnerability CVE-2022-50196 affects the soc: qcom: ocmem path. It stems from a refcount leak in of_parse_phandle() where the returned node pointer’s refcount isn’t released; a missing of_node_put() caused the leak. The fix adds a proper of_node_put() on the node when it ...

CVE-2023-52559

CVE-2023-52559 concerns the Linux kernel iommu/vt-d suspension path. The issue arises because iommu_suspend() is called with IRQs disabled and memory could be allocated with GFP_KERNEL during the suspend callback, potentially re-enabling IRQs and causing intermittent suspend/hibernate problems. O...

CVE-2023-52636

CVE-2023-52636 involves a flaw in the Linux kernel libceph messenger (net/ceph/messenger_v1.c) where a short read of a socket footer may lead to read_partial_sparse_msg_data() not bailing as intended. When the socket is ready for a subsequent read, the sparse-read state machine can misinterpret p...

CVE-2023-52671

CVE-2023-52671 : Linux kernel vulnerability in drm/amd/display related to ODM4:1 transition. The issue could hang or underflow when disabling an OPTC and reclaiming its OPPs for a different OPTC, due to OPPs not being properly disconnected from the disabled OPTC. The published description states ...

CVE-2023-52677

CVE-2023-52677 is a Linux kernel vulnerability affecting riscv where the patch must check whether the code to patch lies in the exit section. If not, execution may fall through to vmalloc_to_page() and panic because the address is not in the vmalloc region. The connected advisories confirm the is...

CVE-2023-52739

CVE-2023-52739 affects the Linux kernel and is caused by a race in the page freeing path (__free_pages) that could lead to page corruption and crashes. The issue stems from a race around PageHead after the page reference has been dropped, which could cause double-free of tail pages for compound p...

CVE-2023-52761

The CVE-2023-52761 entry concerns a Linux kernel vulnerability on riscv where VMAP_STACK overflow detection was made thread-safe. The patch (commit 31da94c25aea) adds support for CONFIG_VMAP_STACK and optimizes overflow handling by directly using the per-cpu overflow_stack, removing the shadow_st...

CVE-2023-52782

The CVE-2023-52782 entry pertains to the Linux kernel net/mlx5e driver: it fixes a race in tracking xmit metadata for PTP WQ where the skb may not be present in the mapping when the metadata index is tracked, risking a null pointer dereference. The fix ensures skb is in metadata mapping before tr...

CVE-2023-52903

CVE-2023-52903 refers to a Linux kernel issue in the io_uring subsystem, specifically a lock overflow in IOPOLL CQ processing. The description shows a syzkaller-triggered overflow path in io_cqring_event_overflow, with call traces through io_req_cqe_overflow, io_fill_cqe_req, and io_do_iopoll, an...

CVE-2023-53067

CVE-2023-53067: Concrete details in connected docs show a LoongArch Linux kernel issue where get_timer_irq() is invoked multiple times in constant_clockevent_init(), causing a sleeping function to be called from an invalid context under CONFIG_DEBUG_ATOMIC_SLEEP=y and CONFIG_DEBUG_PREEMPT=y. The ...

CVE-2023-53074

CVE-2023-53074 relates to Linux kernel AMDGPU code: a calltrace warning in ttm_bo during psp_hw_fini when amdgpu is removed after mode1 reset. The issue arises because the ta firmware buffer reinitialization is unnecessary during mode1 reset, causing an extra bo pin_count increment. The vulnerabi...

CVE-2024-26716

CVE-2024-26716 affects the Linux kernel USB subsystem, specifically the USB core’s update_port_device_state. The vulnerability arises when actconfig or maxchild is 0, causing usb_hub to be NULL and leading to a NULL pointer dereference when accessing port_dev. The provided description states the ...

CVE-2024-26728

Summary (CVE-2024-26728) : The Linux kernel module path drm/amd/display contains a fixed null-pointer dereference in EDID reading. The underlining issue occurs when EDID data is read without an aux_mode in the dc_link, leading to a kernel oops during i2c_edid probing in systems with DCN2.1 and HD...

CVE-2024-26799

CVE-2024-26799: Linux kernel vulnerability in ASoC qcom where __lpass_get_dmactl_handle could leave dmactl uninitialized if dai_id is invalid. The fix initializes dmactl to NULL, preventing a potential null check bypass. References show Debian 12 Root (rootio-linux) patching this CVE in ROOT-OS-D...

CVE-2024-26806

CVE-2024-26806 : In the Linux kernel, the cadence-qspi driver’s runtime PM hooks were calling spi_controller_suspend()/resume(), which was not expected and could cause a deadlock when the bus lock is held. The fix removes these calls from cadence-qspi, since cadence-qspi is not queued, and notes ...

CVE-2024-26867

CVE-2024-26867 concerns the Linux kernel issue in comedi_8255: subdevice initialization. The root cause, described across multiple sources, is a refactoring in comdrivers/comedi_8255.c where the io field in subdev_8255_private could be left NULL after initialization, because __subdev_8255_init() ...

CVE-2024-35798

CVE-2024-35798 — Linux kernel, btrfs race in read_extent_buffer_pages() A race occurs when reading an extent buffer: after acquiring EXTENT_BUFFER_READING, the uptodate flag isn’t rechecked promptly, allowing a concurrent read to start and potentially return while another read is in progress. Thi...

CVE-2024-35953

The CVE-2024-35953 issue affects the Linux kernel’s accel/ivpu code: ivpu_device->context_xa could deadlock because the XA lock could be held in a thread and interrupted by IRQs that also lock it. The fix is to pass XA_FLAGS_LOCK_IRQ during initialization to prevent the second lock in IRQ cont...

CVE-2024-36027

CVE-2024-36027 affects the Linux kernel’s BTRFS zoned write path. The issue arises when btrfs_clear_buffer_dirty() marks an extent buffer as EXTENT_BUFFER_ZONED_ZEROOUT and a write IO is in progress (WRITEBACK, not DIRTY); a ZEROOUT flag could be added just before bio submission, potentially clea...

CVE-2024-36943

CVE-2024-36943 involves the Linux kernel’s fs/proc/task_mmu code. The race condition occurs in make_uffd_wp_pte() where ptep modifications could race with concurrent accesses, risking loss of the young/dirty bits during pagemap scanning. The incorrect sequence (pte = ptep_get(ptep); ptep_modify_p...

CVE-2024-38566

CVE-2024-38566: In the Linux kernel, the bpf verifier had an incorrect assumption that socket->sk is valid when a trusted socket is used, which may not hold for sockets just created and passed to LSM socket_accept hooks. The fix relaxes the verifier assumption and updates tests. The vulnerabil...

CVE-2024-38569

CVE-2024-38569 concerns the Linux kernel driver for HISI PCIe in the perf subsystem. Description: the perf tool allows creating event groups; if the number of events in an event_group exceeds HISI_PCIE_MAX_COUNTERS, the driver may write past the end of the event_group array, causing an out-of-bou...

CVE-2024-38585

CVE-2024-38585 — Linux kernel memory corruption in realloc . The issue arises in tools/nolibc/stdlib where realloc() could copy beyond the allocated region because memcpy() used heap->len instead of the input user_p_len. The vulnerability was resolved by passing user_p_len to memcpy() to preve...

CVE-2024-40918

CVE-2024-40918 affects PA-RISC Linux kernels (PA8800/PA8900) where large L2 caches and non‑equivalent aliasing made random segmentation faults possible due to memory corruption in mmap/malloc; root cause centers on cache move-in and racy PTE bits. The fix modernizes parisc code to flush via tmpal...

CVE-2024-42242

In CVE-2024-42242, the Linux kernel mmc: sdhci driver had a mismatch between two checks for max_segment_size. max_size was forced to PAGE_SIZE by blk_queue_max_segment_size() when it was below PAGE_SIZE, while blk_validate_limits() treated a max_segment_size below PAGE_SIZE as an error (returning...

CVE-2024-44973

The CVE-2024-44973 vulnerability in the Linux kernel concerns the SLUB allocator when freeing kfence objects. The issue arose because the kfence object free path was moved out of do_slab_free but one spot in __kmem_cache_free_bulk was missed, risking a crash (example stack trace shown in the init...

CVE-2024-44980

CVE-2024-44980 relates to the Linux kernel’s DRM/ XE opregion handling. The advisory reports a leak in opregion cleanup within xe_display_init_noirq/ intel_opregion_setup, traced to kmemleak_alloc/kmalloc_trace_noprof paths, resulting in an unreferenced object during probe/modprobe cleanup. The b...

CVE-2024-44997

CVE-2024-44997 affects the Linux kernel’s net: ethernet: mtk_wed component. The issue is a use-after-free/panic in MT798X when turning down an interface on a band with multiple AP interfaces and WED enabled. The root cause: cb_priv was freed in mtk_wed_setup_tc_block() without nulling the pointer...

CVE-2024-57943

CVE-2024-57943 affects the Linux kernel exFAT path where a newly allocated buffer head could write uninitialized data from the page cache. The root cause is that buffers marked as new were not zeroed before write_end(), risking data leakage or corruption. The remediation is a kernel commit that c...

CVE-2025-21974

CVE-2025-21974 affects the Linux kernel with the bnxt ethernet driver. The vulnerability stems from bnxt_queue_mem_alloc() dereferencing an rx buffer descriptor when a queue restarts while the interface is down, which can trigger a kernel panic. The issue is resolved in the Linux kernel via fixes...

CVE-2025-37825

CVE-2025-37825 – Linux kernel (nvmet): A vulnerability in nvmet_enable_port can cause a global out-of-bounds access when enabling a port with no transport configured yet. The code queried the transports array using NVMF_TRTYPE_MAX (255), leading to an out-of-bounds read. The fix prevents this by ...

CVE-2025-37919

CVE-2025-37919 affects the Linux kernel (AMD SoC ASoC/ACPi2S) via a NULL pointer dereference in the function acp_i2s_set_tdm_slot . The root cause is dereferencing a NULL chip data reference when updating ACPI/I2S state. The remediation, as stated in the description, is to update chip data using ...

CVE-2025-37955

CVE-2025-37955 concerns a memory leak in the Linux kernel virtio-net driver. The issue occurs on the error path of virtnet_xsk_pool_enable(), where xsk_buffs are not freed, leading to an unreferenced 2048-byte object in the xdp helper path. The backtrace points to virtnet_xsk_pool_enable and rela...

CVE-2025-37988

CVE-2025-37988 concerns the Linux kernel and involves a race condition in MNT_TREE_BENEATH handling within do_move_mount(). The vulnerability arises because the object locked during mount changes is the mountpoint of path->mnt, not the path itself, allowing mnt_parent to change under weak lock...

CVE-2025-38013

CVE-2025-38013 (Linux kernel) : Affected component is the wifi/mac80211 path. The issue is a UBSAN/array-index-out-of-bounds condition reported when setting n_channels during scan request construction, caused by allocating the scan request before the int_scan_req structure is allocated. The fix r...

CVE-2025-38034

CVE-2025-38034 : The connected Azure Linux 3.0 Nessus entry confirms a Linux kernel issue affecting btrfs paths where btrfs__prelim_ref calls wrong order of oldref/newref, causing a NULL pointer dereference in trace_btrfs_prelim_ref_insert(). The backtrace shows the call path ending in prelim_ref...

CVE-2025-38075

CVE-2025-38075 affects the Linux kernel iscsi target/scsi subsystem. A NOPIN response timer could be restarted on expiration for a deleted connection, causing a NULL pointer dereference and a crash in iscsit_fill_cxn_timeout_err_stats during timeout handling. The root cause is the nopin timer bei...

CVE-2025-38088

CVE-2025-38088 affects the Linux kernel’s memtrace mmap in the PowerPC powernv memory tracing path. The root cause is an out-of-bounds issue when mmap-ing within the memtrace region. The patch fixes this by validating that the requested mapping size does not exceed the allocated memtrace region, ...

CVE-2025-38122

In CVE-2025-38122, the Linux kernel vulnerability is due to a missing NULL check in gve_alloc_pending_packet() used by gve_tx_add_skb_dqo(). The function can return NULL, but the caller did not guard against this, risking NULL pointer dereference in low‑memory scenarios. The fix adds the missing ...

CVE-2025-38143

CVE-2025-38143 (Linux kernel) is addressed in Azure Linux 3.0 by a patch that fixes a NULL-dereference in backlight pm8941 when devm_kasprintf() returns NULL. The issue occurs in wled_configure() due to a missing NULL check after allocation. The fix adds the necessary NULL check after devm_kaspri...

CVE-2025-38187

Root-cause: In Linux kernel DRM Nouveau, a use-after-free occurs when sending large RPC fragments because the RPC container is freed prematurely after being passed to r535_gsp_rpc_send(). Fix: allocate a temporary RPC container for the initial fragment and free the caller’s container only after a...

CVE-2025-38188

CVE-2025-38188 affects the Linux kernel DRM MSM (a7xx) path. The vulnerability arises from missing CP_RESET_CONTEXT_STATE handling when switching contexts, risking userspace submissions in one context causing another context to hang (DoS) without data leakage. The fix ensures CP_RESET_CONTEXT_STA...

CVE-2025-38194

CVE-2025-38194 affects the Linux kernel’s JFFS2 file system. The issue arises when jffs2_sum_write_sumnode does not validate the return value of jffs2_prealloc_raw_node_refs, allowing an preallocation error to propagate into jffs2_link_node_ref and potentially cause a kernel BUG at fs/jffs2/nodel...

CVE-2025-38202

CVE-2025-38202 affects the Linux kernel: bpf_map_lookup_percpu_elem() used by BPF per-CPU hashmap lookups may trigger a warning when used in a sleepable BPF program if BPF JIT is disabled or on 32-bit hosts, due to a missing rcu_read_lock_trace_held() check. The patch adds the missing check to cl...