CVE-2022-49088

CVE-2022-49088 affects the Linux kernel: a refcount leak in dpaa2_ptp_probe where the of_find_compatible_node() result is returned with an incremented refcount. The fix is to call of_node_put() to release the reference and avoid the leak. References point to kernel patches that implement this cor...

CVE-2008-5713

The CVE-2008-5713 vulnerability affects the Linux kernel (pre-2.6.25) on SMP systems, where the __qdisc_run function in net/sched/sch_generic.c can be abused to cause a soft lockup/DoS by issuing a large volume of traffic (demonstrated with Netperf UDP_STREAM). Connected advisories note a mitigat...

CVE-2010-1085

CVE-2010-1085 affects the Linux kernel before 2.6.32.x/2.6.33-rc4 on the AMD780V chipset. The vulnerability is in the azx_position_ok function in hda_intel.c, where certain inputs can trigger a divide-by-zero and cause a crash (DoS). Public advisories from MiracleLinux and Oracle Linux list this ...

CVE-2011-0699

The CVE-2011-0699 entry affects the Linux kernel 2.6.37, where an integer signedness error in the btrfs_ioctl_space_info function can allow a local user to trigger a denial of service via a heap-based buffer overflow or potentially other impact through a crafted slot value. Affected component: ke...

CVE-2011-1012

CVE-2011-1012 affects the Linux kernel, in particular the LDM partition handling. The flaw lies in ldm_parse_vmdb in fs/partitions/ldm.c, which does not validate the VBLK size in the VMDB structure of an LDM partition table. A crafted partition table can trigger a divide-by-zero and cause a kerne...

CVE-2013-1797

CVE-2013-1797 describes a use-after-free in arch/x86/kvm/x86.c of the Linux kernel up to version 3.8.4. The issue allows a guest OS user to trigger a GPA-related path during an MSR_KVM_SYSTEM_TIME kvm_set_msr_common operation, potentially causing host memory corruption and a denial of service, wi...

CVE-2013-2140

CVE-2013-2140 affects the Linux kernel before 3.10.5, via dispatch_discard_io in Xen blkback (drivers/block/xen-blkback/blkback.c). It enables a guest OS user to trigger a denial of service (data loss) through write operations on read-only disks that support BLKIF_OP_DISCARD/TRIM or SCSI UNMAP. T...

CVE-2013-3224

The CVE-2013-3224 issue affects the Linux kernel’s Bluetooth path: bt_sock_recvmsg in net/bluetooth/af_bluetooth.c before 3.9-rc7 does not fully initialize a length variable, enabling local attackers to leak sensitive data from kernel stack memory via crafted recvmsg/recvfrom calls. Impact is inf...

CVE-2013-3229

CVE-2013-3229 affects the Linux kernel and is caused by iucv_sock_recvmsg in net/iucv/af_iucv.c not initializing a length variable, enabling local attackers to read kernel stack memory via crafted recvmsg/recvfrom calls. Affected version: kernel builds before 3.9-rc7. Consequences: information di...

CVE-2013-7271

The CVE-2013-7271 issue affects the Linux kernel up to versions before 3.12.4. The vulnerability exists in x25_recvmsg (net/x25/af_x25.c), where a length value is updated without ensuring the associated data structure is initialized, enabling local attackers to disclose kernel memory content via ...

CVE-2014-7283

The vulnerability CVE-2014-7283 affects the Linux kernel xfs implementation: xfs_da3_fixhashpath in fs/xfs/xfs_da_btree.c fails to compare btree hash values correctly, before 3.14.2. This can allow local users to trigger filesystem corruption and OOPs/panic via operations on directories with hash...

CVE-2016-4440

The CVE-2016-4440 issue affects the Linux kernel (up to 4.6.3) in arch/x86/kvm/vmx.c where APICv on/off state is mishandled. This allows guest OS users to access direct host APIC MSRs via x2APIC, enabling potential host denial of service (crash) or arbitrary code execution. A fix exists in the up...

CVE-2016-9754

CVE-2016-9754 affects the Linux kernel’s ring_buffer_resize in the profiling subsystem, where integer calculations in ring_buffer.c before 4.6.1 allow a local user to gain privileges by writing to /sys/kernel/debug/tracing/buffer_size_kb. The issue is fixed in kernel 4.6.1 and later. Affected pro...

CVE-2021-47189

CVE-2021-47189 concerns the Linux kernel, specifically the btrfs subsystem. The vulnerability arises from memory ordering between normal and ordered work functions; the existing synchronization via WORK_DONE_BIT and the used bitops do not guarantee ordering. On ARM64 this can cause a crash when a...

CVE-2021-47232

CVE-2021-47232 affects the Linux kernel CAN/J1939 subsystem. The root cause is a Use‑After‑Free caused by taking a skb from the per‑session skb queue without incrementing its refcount, which can occur concurrently due to CTS. The patch fixes this by ensuring skb refcounting is handled correctly w...

CVE-2021-47343

CVE-2021-47343 concerns the Linux kernel dm_btree_remove path (drivers/md/persistent-data/dm-btree-remove.c). In remove_raw(), IO read errors can leave shadow_spine.root uninitialized and still be assigned to new_root at function end, and for dm-thin, pmd->details_root/details_root can become ...

CVE-2021-47361

CVE-2021-47361 – Linux kernel mcb_alloc_bus() use-after-free fix. The vulnerability arises from two bugs in mcb_alloc_bus(): (1) calling put_device(carrier) after ida_simple_get() failure without a prior get_device(), risking use-after-free; (2) not balancing device lifecycles after device_initia...

CVE-2021-47369

The Linux kernel contains a NULL pointer dereference vulnerability in the qeth_clear_working_pool_list() function within the s390/qeth driver. The issue occurs when qeth_set_online() calls the vulnerable function during a rollback after an error in qeth_hardsetup_card(), specifically if card->...

CVE-2021-47396

CVE-2021-47396 is a Linux kernel issue affecting mac80211-hwsim beacon timing. The root cause is improper late hrtimer handling: when a timer fires late, the code re-arms for the next deadline, which can already be in the past, causing repeated misalignment and potential stalls. The fix, as descr...

CVE-2021-47422

CVE-2021-47422 affects the Linux kernel’s drm/nouveau/kms/nv50- component. The issue is a memory leak where an op allocated by single_open() is not freed if single_release() is not called. The vulnerability is described as a local-privilege context with a potential availability impact, with CVSS ...

CVE-2021-47439

A vulnerability exists in the Linux kernel 's net subsystem within the dsa module for microchip devices. Specifically, the ksz_switch_remove function in drivers/net/dsa/microchip/ksz_common.c can cause a null pointer dereference leading to a kernel crash. This occurs when the ksz module is instal...

CVE-2021-47562

Summary (CVE-2021-47562) : In Linux kernel ice driver, a mismatch in XDP/Rx/Tx queue sizing caused by vsi->txq_map being sized to the doubled vsi->alloc_txq could trigger a kernel NULL pointer dereference when ethtool -L configures XDP rings and Rx/Tx counts differ. The root cause is the tx...

CVE-2021-47620

CVE-2021-47620 affects the Linux kernel Bluetooth subsystem. The vulnerability arose from an out-of-bounds read in the malicious advertising data check, observed at the end of the while num_reports loop. A guard was added at the beginning of loop processing to ensure the pointer isn’t advanced be...

CVE-2022-48648

Technical details (affected software, versions, root cause, impact, and fixes) for CVE-2022-48648 are not provided in the supplied documents. Monitor vendor advisories and CVE entries for updates.

CVE-2022-48726

CVE-2022-48726 affects the Linux kernel’s RDMA/ucma code path, specifically a use-after-free in ucma_cleanup_multicast and related flows (ucma_destroy_private_ctx, ucma_write) caused by touching a concurrently freed multicast structure during a multicast leaves operation. The description notes th...

CVE-2022-48748

A memory leak vulnerability exists in the Linux kernel 's net: bridge: vlan component within the __allowed_ingress function. When using per-vlan state with VLAN snooping and stats disabled , untagged or priority-tagged ingress frames may be dropped if the port state is forwarding and the pvid sta...

CVE-2022-48809

In CVE-2022-48809, the Linux kernel fixes a memory leak in net handling when uncloning an skb destination and its metadata. The root cause is that the uncloned dst+metadata is initialized with refcount 1 and briefly increased to 2 before attachment, leaving a path where the refcount cannot drop t...

CVE-2022-48864

CVE-2022-48864 (Linux kernel) : The issue arises in the vdpa/mlx5 component where a VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET command from a driver could pass an unvalidated number of queue pairs or an unnegotiated multiqueue state, potentially triggering a kernel panic due to uninitialized resources. The ...

CVE-2022-48895

CVE-2022-48895 affects the Linux kernel iommu/arm-smmu component, specifically an issue where shutdown unregistration could trigger a NULL pointer dereference in the IOMMU path during reboot sequences. The issue was observed in stack traces leading to Oops in interrupt and kernel panic scenarios,...

CVE-2022-48926

CVE-2022-48926 affects the Linux kernel USB gadget rndis path. The vulnerability arises from a missing spinlock protecting the rndis response list, enabling potential list corruption when two list_add operations occur concurrently. The provided traces show corruption of next->prev and a corres...

CVE-2022-49163

CVE-2022-49163 is a Linux kernel issue affecting the media/imx-jpeg driver. When parsing JPEGs, if an error occurs before a slot is acquired, a default MXC_MAX_SLOTS may be used and the driver can access the slot with an incorrect slot number, causing an out-of-bounds access. This leads to a chan...

CVE-2022-49213

CVE-2022-49213 affects the Linux kernel, specifically the ath10k subsystem in the error path of ath10k_setup_msa_resources. The root cause is that the device_node pointer returned by of_parse_phandle() is assigned a refcount that is not always released on error paths, causing a refcount leak. The...

CVE-2022-49270

The Linux kernel contains a use-after-free vulnerability in the dm (Device Mapper) component, specifically within the dm_cleanup_zoned_dev() function. The root cause is a race condition where dm_cleanup_zoned_dev() must be executed before blk_cleanup_disk() begins its execution; otherwise, an RCU...

CVE-2022-49361

The CVE-2022-49361 entry concerns a Linux kernel issue in f2fs where inline inode sanity checks were strengthened. The bug arose when a fuzzed inode had both inline_data and encrypted flags, and during f2fs_evict_inode() invoked by a rename(), inline data could be converted due to flag conflicts,...

CVE-2022-49392

CVE-2022-49392 affects the Linux kernel’s serial driver for ASPEED vuart (8250_aspeed_vuart). The vulnerability arises from a NULL pointer dereference in aspeed_vuart_probe when platform_get_resource() returns NULL. The patch adds a check for the resource return value to avoid dereferencing NULL,...

CVE-2022-49656

The CVE-2022-49656 entry concerns the Linux kernel ARM meson driver, where of_find_compatible_node() returns a node pointer with an incremented refcount. The flaw leads to a refcount leak, fixed by adding of_node_put() after use. Multiple connected advisories reiterate this mitigation (kernel pat...

CVE-2022-49724

CVE-2022-49724 affects the Linux kernel’s goldfish TTY driver. The bug arises from passing an incorrect dev_id to free_irq() during driver removal, which can lead to a splat and attempts to free an already-free IRQ (IRQ 65). A fix was implemented to pass the correct dev_id in the remove path (gol...

CVE-2022-49814

CVE-2022-49814 affects the Linux kernel KCM (kernel-based communications) sockets. The issue is a race on sk_receive_queue where the RX path for KCM sockets uses mux->rx_lock to protect more than just the skb queue, but kcm_recvmsg() only reuses the skb queue lock, leaving a window for race co...

CVE-2022-49868

CVE-2022-49868 relates to a Linux kernel quirk involving the mt7621 PCI PHY/staging driver. The issue arises when mt7621_soc_dev_attr registers the SoC as a device, causing an oops in soc_device_match_attr. The quirk was introduced in the staging driver (staging: mt7621-pci-phy) and was later re-...

CVE-2022-49880

CVE-2022-49880 : Linux kernel ext4 inline-data migration may trigger a reliable warning in ext4_da_release_space when a writeback path releases space with to_free=1 but i_reserved_data_blocks==0. The issue is resolved by forbidding inodes with inline data from migration (ext4 inline data handling...

CVE-2022-49887

The CVE-2022-49887 entry relates to the Linux kernel: the media/ Meson vdec code could leak a refcount due to a failed vdec_probe or during vdec_remove, and requires v4l2_device_unregister to decrement the refcount obtained from v4l2_device_register. The vulnerability affects kernel components ha...

CVE-2022-49888

CVE-2022-49888 affects the ARM64 Linux kernel entry path. The Cortex-A76 erratum workaround (cortex_a76_erratum_1463225_debug_handler) was not inlined due to a patch, allowing a kprobe to probe the function and potentially trigger recursive exceptions and a stack overflow when a probed function e...

CVE-2022-50003

CVE-2022-50003 describes a Linux kernel issue in the ice driver where XSK (AF_XDP) pool assignment can occur for a non-balanced queue id, enabling an out-of-bounds access to the Rx ring when attaching an XSK socket in tx-only mode to a queue id without a corresponding Rx queue. The fix rewrites t...

CVE-2022-50032

CVE-2022-50032 concerns the Linux kernel USB Renesas driver fix for a refcount leak. The issue arises in usbhs_rza1_hardware_init() where of_find_node_by_name() returns a node pointer with an elevated refcount; the correct handling is to call of_node_put() when the node is no longer needed. The c...

CVE-2022-50076

CVE-2022-50076 concerns the Linux kernel CIFS implementation: a memory leak in the deferred close path has been fixed. The description from multiple sources (NVD entry and connected advisories) shows the issue manifests as a kmemleak report during SMB2/xfstests (xfstests on smb21 report kmemleak)...

CVE-2022-50111

CVE-2022-50111 concerns a Linux kernel issue in the ASoC mt6359 driver where a refcount leak occurs. The root cause is that in mt6359_parse_dt() and mt6359_accdet_parse_dt(), a reference returned by of_get_child_by_name() is not balanced with of_node_put(), leaving a leaked reference. The availab...

CVE-2022-50116

The CVE refers to a Linux kernel flaw in tty n_gsm where deadlocks and link starvation could occur in the outgoing data path under ldisc congestion. The fix adds an additional control-channel data queue and processes it before the user-channel queue in gsm_data_kick(), moving this work to a dedic...

CVE-2022-50139

CVE-2022-50139 affects the Linux kernel’s usb: aspeed-vhub component. The root cause is a refcount leak in ast_vhub_init_desc() caused by not releasing a reference from of_get_child_by_name(). The fix is to call of_node_put() on that reference. This remediation prevents the refcount from being in...

CVE-2022-50201

CVE-2022-50201 affects the Linux kernel SELinux path: memleak in security_read_state_kernel() where the function returns the result of __security_read_policy without freeing allocated memory in *data. This memory leak occurs when __security_read_policy fails. The issue is addressed by freeing the...

CVE-2023-52559

CVE-2023-52559 concerns the Linux kernel iommu/vt-d suspension path. The issue arises because iommu_suspend() is called with IRQs disabled and memory could be allocated with GFP_KERNEL during the suspend callback, potentially re-enabling IRQs and causing intermittent suspend/hibernate problems. O...