CVE-2021-47139

CVE-2021-47139 affects the Linux kernel hns3 driver. A race occurs because the netdevice is registered before client initialization completes, creating a window where changes to channels or rx CPU map can trigger hns3_set_rx_cpu_rmap() twice, leading to a crash (BUG at lib/cpu_rmap.c). The fix, a...

CVE-2021-47150

CVE-2021-47150 is a Linux kernel issue in the network driver fec/enet: the fix addresses a potential memory leak in fec_enet_init(). When cbd_base allocation fails, memory allocated for the queues must be freed; otherwise a leak occurs. If allocation for the queues fails, the function now returns...

CVE-2021-47159

CVE-2021-47159 — In the Linux kernel net/dsa path, a crash could occur if ds->ops->get_sset_count() returns a negative error (e.g., -EOPNOTSUPP). Because i is unsigned, the negative value is promoted to a large positive, causing memory corruption in the loop. The fix changes i to a signed i...

CVE-2021-47248

The CVE-2021-47248 entry concerns a race in the Linux kernel UDP path between close() and udp_abort(). The root cause is udp_abort() racing with close(), with both paths acquiring the socket lock, while udp{v6}_destroy_sock() releases it before performing destructive actions. The fix uses the SOC...

CVE-2021-47361

CVE-2021-47361 – Linux kernel mcb_alloc_bus() use-after-free fix. The vulnerability arises from two bugs in mcb_alloc_bus(): (1) calling put_device(carrier) after ida_simple_get() failure without a prior get_device(), risking use-after-free; (2) not balancing device lifecycles after device_initia...

CVE-2021-47364

Summary (CVE-2021-47364) The Linux kernel vulnerability in the comedi subsystem affects the 32-bit version of the COMEDI_INSNLIST ioctl when CONFIG_COMPAT is enabled. The issue is a memory leak in compat_insnlist(): memory was allocated to hold a converted array of struct comedi_insn and only fre...

CVE-2021-47513

CVE-2021-47513 is a Linux kernel vulnerability affecting the net: dsa: felix MMIO filtering path. The issue is a memory leak in felix_setup_mmio_filtering that occurs if there is no CPU port defined. The vulnerability is fixed in the kernel by addressing the resource leak in the felix MMIO filter...

CVE-2021-47523

CVE-2021-47523 affects the Linux kernel’s IB/hfi1 path. The issue is a leak of rcvhdrtail_dummy_kvaddr which is allocated in hfi1_init() and can be overwritten on a reinit path, leading to a memory leak. The fix moves the allocation to hfi1_alloc_devdata() and deallocation to hfi1_free_devdata(),...

CVE-2021-47539

CVE-2021-47539 affects the Linux kernel RxRPC code. The issue is a use-after-free-like leak where a rxrpc_peer may be leaked during rxrpc_look_up_bundle() when handling a bundle candidate. The provided data states the root cause is a leak of the rxrpc_peer and the remediation is to call rxrpc_put...

CVE-2021-47578

CVE-2021-47578 impacts the Linux kernel. The vulnerability stems from the scsi_debug path calling memory allocation with a zero size: if size == 0, kcalloc() returns ZERO_SIZE_PTR, which can break a following NULL-pointer check. The fix is to return early (do not call kcalloc()) when the size arg...

CVE-2021-47655

CVE-2021-47655 affects the Linux kernel component media: venus: vdec. The root cause is a memory-leak risk in venus_helper_alloc_dpb_bufs() where an early return on an error path (ida_alloc_min()) could skip releasing previously allocated buffers. The fix moves the direct kfree() from the dma_all...

CVE-2022-3595

CVE-2022-3595 affects the Linux kernel CIFS component, specifically the function sess_free_buffer in fs/cifs/sess.c , where the issue causes a double free . The root cause is improper buffer management leading to memory corruption with a direct impact on availability (as per CVSS metrics: Availab...

CVE-2022-48642

Summary: CVE-2022-48642 is a Linux kernel vulnerability in netfilter/nf_tables that causes a percpu memory leak in nf_tables_addchain(), linked to nf_chain_offload_priority() error handling. The leak was observed since a prior commit and has been fixed in the kernel by the referenced changes (e.g...

CVE-2022-48647

CVE-2022-48647 is a Linux kernel issue in the sfc driver where legacy interrupt TX channel handling used a fixed tx_channel_offset of 1, which is incorrect when efx_sepparate_tx_channels is false. The queues reside in a single channel (index 0) with RX, so the offset should be 0; using 1 can caus...

CVE-2022-48691

CVE-2022-48691 is a Linux kernel vulnerability affecting nf_tables offload hook handling. The issue arises from clean up of the hook list when offload flag checks fail, enabling a memory leak of an unreferenced object and preventing nft_chain_release_hook() from freeing hooks. The connected Nessu...

CVE-2022-48715

CVE-2022-48715 is a Linux kernel vulnerability related to the SCSI driver bn x2fc. The issue stems from bnx2fc_recv_frame() modifying per-CPU lport stats counters in a non-MP-safe way, which could occur in a preemptible context when SMP features are enabled. The resolved fix restores the old get_...

CVE-2022-48723

CVE-2022-48723 : In the Linux kernel, the uniphier SPI driver’s probe code leaks refcounts for the dma_rx and dma_tx objects on several error paths when dma_get_slave_caps() or devm_spi_register_master() fail. The leak occurs because the reference count is not decremented in those error paths. Th...

CVE-2022-48732

The CVE-2022-48732 issue affects the Linux kernel’s DRM Nouveau component, caused by an off-by-one error in BIOS boundary parsing of embedded init scripts. This bounds-checking flaw can reject access to the last byte, causing driver initialization to fail on Apple eMac systems with GeForce 2 MX G...

CVE-2022-48734

CVE-2022-48734 affects the Linux kernel in the btrfs subsystem. The issue is a deadlock caused by quota disable interactions with the qgroup rescan worker and other transactions (e.g., block group relocation) when quota is disabled. The described sequence involves Task A starting a transaction an...

CVE-2022-48768

CVE-2022-48768 concerns a memory‑leak in the Linux kernel tracing/histogram path. The issue arises where kstrdup() allocates memory but kfree() is not called on an error path, leaving the memory allocated for data->params[i] (p) potentially unreleased. The described fix is to free the allocate...

CVE-2022-48809

In CVE-2022-48809, the Linux kernel fixes a memory leak in net handling when uncloning an skb destination and its metadata. The root cause is that the uncloned dst+metadata is initialized with refcount 1 and briefly increased to 2 before attachment, leaving a path where the refcount cannot drop t...

CVE-2022-48856

CVE-2022-48856 concerns the Linux kernel needing a fix for a refcount leak in the gfar_get_ts_info path used by gianfar/ethtool. The description states that of_find_compatible_node() returns a node pointer with an incremented refcount and that the code must call of_node_put() when done to release...

CVE-2022-48909

The CVE-2022-48909 entry relates to the Linux kernel net/smc subsystem. A connection leak could occur during a sequence where, after initiating a close, a tcp_abort() may discard pending CLC CONFIRM messages in the TCP send buffer, preventing delivery of the connection token and blocking passive ...

CVE-2022-49001

CVE-2022-49001 describes a race condition in the Linux kernel riscv path where, during vmap stack overflow handling, multiple harts can contend on the same shadow stack. The root cause is a race between switching to the shadow stack and calling get_overflow_stack() when more than one hart uses th...

CVE-2022-49108

CVE-2022-49108 concerns the Linux kernel Mediatek clock driver, where memory leaks occur on probe due to not freeing memory in error handling paths. The vulnerability is resolved by handling error branches to free allocated memory, addressing a resource leak (Coverity ID 1491825). Connected sourc...

CVE-2022-49369

CVE-2022-49369 concerns a memory leak in the Linux kernel’s amt_rcv() path: when an amt packet is received and no matching socket is found, the received skb is not freed, potentially leaking memory. The issue is described as resolved in the kernel; connected docs reference patches addressing the ...

CVE-2022-49419

The CVE-2022-49419 issue affects the Linux kernel vesafb (video: fbdev) where use-after-free can occur if the fb_info is freed in the .remove path before or after .fb_destroy. The underlying cause is an ordering bug: the code previously freed fb_info in .remove, which could reference freed memory...

CVE-2022-49509

CVE-2022-49509 : In the Linux kernel, the vulnerability arises when removing the max9286 I2C driver, causing a kernel oops due to the I2C client data potentially pointing to a freed v4l2_subdev instead of max9286_priv. The fix updates max9286_remove/max9286_probe/max9286_init so that the driver n...

CVE-2022-49597

In CVE-2022-49597, the Linux kernel tcp code suffers a data-race around sysctl_tcp_base_mss when reading sysctl_tcp_base_mss concurrently. The fix adds READ_ONCE() to the readers to prevent races. Connected advisories (Astra Unity/ EulerOS OSS) echo the same description and reference kernel commi...

CVE-2022-49683

The CVE-2022-49683 entry concerns the Linux kernel, specifically the IIO ADC driver for adi-axi-adc. The root cause is a refcount leak where of_parse_phandle() returns a node pointer with an incremented refcount, and the patch adds a missing of_node_put() when the node is no longer needed. The ch...

CVE-2022-49706

CVE-2022-49706—zonefs contains a read handling bug in zonefs_iomap_begin() where a readahead to a zone file with an offset equal to the current file size can set iomap type to IOMAP_UNWRITTEN with length 0, triggering a WARN_ON in iomap_iter and causing iomap_readahead() to loop. The patch fixes ...

CVE-2022-49738

Summary (CVE-2022-49738) : In the Linux kernel’s f2fs subsystem, a sanity check missing for .i_extra_isize in is_alive() leads to a potential slab-out-of-bounds access in data_blkaddr during garbage collection, as observed in the f2fs_gc path (gc_data_segment -> is_alive -> data_blkaddr -&g...

CVE-2022-49767

CVE-2022-49767 affects the Linux kernel 9p/trans_fd path. The issue arises because p9_mux_poll_stop() could fail to interrupt blocking kernel_read()/kernel_write() on pipes due to fd_open() not setting O_NONBLOCK, whereas socket paths already use O_NONBLOCK. A minimal patch makes O_NONBLOCK alway...

CVE-2022-49771

CVE-2022-49771 affects the Linux kernel’s dm-thin/ioctl path. The vulnerability arises when __list_versions uses dm_target_iterate twice under race conditions between the first size estimation and the second information retrieval, allowing module loading to occur between the two calls. The second...

CVE-2022-49807

CVE-2022-49807 affects the Linux kernel nvmet subsystem, addressing a memory leak in nvmet_auth_set_key when changing dhchap secrets. The fix releases the old secrets to prevent unreferenced memory leaks (kmemleak). Impact details in the provided sources indicate a local issue within nvmet key ma...

CVE-2022-49812

CVE-2022-49812 describes a Linux kernel vulnerability in the bridge driver’s VLAN offload path. When VLANs are offloaded via switchdev, the bridge marks them with BR_VLFLAG_ADDED_BY_SWITCHDEV. Changing the VLAN protocol triggers notifications to switchdev drivers and also to the 8021q driver, whi...

CVE-2022-49891

CVE-2022-49891 concerns a Linux kernel memory-leak in tracing/kprobe handling. The root cause is that test_gen_kprobe_cmd() frees buf only on the fail path, causing a leak when no failure occurs; the patch moves kfree(buf) from the fail path to the common path, and applies the same fix to test_ge...

CVE-2022-49907

CVE-2022-49907 is a Linux kernel issue in net: mdio related to undefined behavior from shifting a signed 32-bit value by 31 bits in __mdiobus_register. The root cause is an out-of-bounds bit shift in mdiobus initialization; the code was changed to use an unsigned type to avoid UB. A UBSAN warning...

CVE-2022-49929

CVE-2022-49929 relates to the Linux kernel RDMA/rxe path. The issue is a use-after-free-like leak in MR handling: rxe_recheck_mr() increments mr ref_cnt and, during RESPST_ERR_RNR, the code must call rxe_put(mr) to drop the extra reference to avoid a warning in __rxe_cleanup. The vulnerability is...

CVE-2022-50079

CVE-2022-50079 affects the Linux kernel’s DRM AMD display driver (DCN303). The issue is a boundary check error in drm/amd/display where eng_id for DCN303 must not exceed 1, since there are only two stream-encoder instances. The root cause is an incorrect boundary condition that could allow an out...

CVE-2022-50120

The CVE-2022-50120 issue in the Linux kernel’s remoteproc driver (imx_rproc) is documented in multiple sources. It concerns a refcount leak in imx_rproc_addr_init caused by of_parse_phandle() returning a node pointer with an incremented refcount; the fix is to call of_node_put() on it when it is ...

CVE-2022-50124

The CVE-2022-50124 entry concerns the Linux kernel ASoC driver mt6797-mt6351 (mt6797_mt6351_dev_probe). Technical detail: of_parse_phandle() returns a node pointer with a refcount increment; the correct remediation is to call of_node_put() when the node is no longer needed to avoid a refcount lea...

CVE-2022-50214

CVE-2022-50214 affects the Linux kernel coresight subsystem. Vulnerability: coresight_remove_match() does not clear the fwnode field when dropping references, causing a use-after-free and extra refcount drops if a device is removed after its peer. Impact: potential local use-after-free conditions...

CVE-2023-52512

CVE-2023-52512 affects the Linux kernel pinctrl/nuvoton/wpcm450 driver. The root cause is an out-of-bounds write to pctrl->gpio_bank because the GPIO index validity check runs after the write, potentially causing a crash. Red Hat’s advisory notes a crash risk; other sources confirm the issue i...

CVE-2023-52765

CVE-2023-52765 relates to the Linux kernel mfd: qcom-spmi-pmic revid lookup. The issue caused potential NULL‑pointer dereferences, due to: (1) assuming a sibling base device bound to a driver simply because it is registered; (2) unsafely accessing driver data of a sibling device without locking, ...

CVE-2023-52782

The CVE-2023-52782 entry pertains to the Linux kernel net/mlx5e driver: it fixes a race in tracking xmit metadata for PTP WQ where the skb may not be present in the mapping when the metadata index is tracked, risking a null pointer dereference. The fix ensures skb is in metadata mapping before tr...

CVE-2023-52786

CVE-2023-52786 affects the Linux kernel ext4 subsystem. The issue is a race in the inline data check during direct IO (dio) writes: ext4_iomap_begin() can observe inline data concurrently with MAY_INLINE_DATA state clearing across a lock cycle, potentially allowing a dio write to proceed in an un...

CVE-2023-52792

Summary (CVE-2023-52792) The Linux kernel cxl/region cleanup path incorrectly reused resources when cxl_region_setup_targets() failed, risking -EBUSY on decoder region and possible resource leakage. The fix short-circuits cleanup on initialization failure (return immediately) and adds a guard to ...

CVE-2023-52797

CVE-2023-52797 is a Linux kernel vulnerability resolved by ensuring find_first_bit() return values are checked before using them as an index (prevents overflow and panic). Affected component: drivers perf in the kernel. The fix (cited in connected advisories) adds a check on the return value to a...

CVE-2023-52998

CVE-2023-52998 — In the Linux kernel’s fec driver, freeing RX buffers used page_pool_release_page, which unmaps but doesn’t recycle pages, enabling memory exhaustion after repeated eth0 up/down. A fix replaces it with page_pool_put_full_page, recycling the page when refcnt == 1. The vulnerability...