CVE-2016-10764

In CVE-2016-10764, the vulnerability is in the Linux kernel before 4.9.6: the cadence-quadspi.c file in drivers/mtd/spi-nor contains an off-by-one error in cqspi_setup_flash() where the f_pdata array uses CQSPI_MAX_CHIPSELECT elements and the comparison should be >= instead of >. This is co...

CVE-2016-6187

CVE-2016-6187 : The Linux kernel before 4.6.5 contains a vulnerability in the AppArmor LSM path. The function apparmor_setprocattr in security/apparmor/lsm.c does not validate the buffer size, enabling a local user to gain privileges by triggering a setprocattr hook. This is a local privilege-esc...

CVE-2018-20449

CVE-2018-20449 affects the Linux kernel 4.14.90, specifically the hidma_chan_stats function in drivers/dma/qcom/hidma_dbg.c. It allows local users to obtain sensitive address information by reading callback= lines in a debugfs file. The issue is evidenced across multiple feeds (NVD, Red Hat, SUSE...

CVE-2018-5873

The CVE-2018-5873 entry refers to a race-condition induced Use-After-Free in the Linux kernel before 4.11, specifically in __ns_get_path within fs/nsfs.c. This affects the mainline Linux kernel and Android builds derived from CAF for Android kernels (Android for MSM, Firefox OS for MSM, QRD Andro...

CVE-2021-47160

CVE-2021-47160 corresponds to a Linux kernel vulnerability where PCR_MATRIX was set to all-ones when VLAN filtering was enabled and not reset when disabled, potentially allowing VLAN traffic leaks between bridges br0 and br1. The issue is addressed by removing the PCR_MATRIX write from mt7530_por...

CVE-2021-47200

CVE-2021-47200 is a Linux kernel security issue affecting DRM/GEM objects during mmap via drm_gem_ttm_mmap. The root cause is dropping a gem object's reference on success and subsequently dereferencing after a potential use-after-free if the object’s refcount was 1 on entry to drm_gem_prime_mmap(...

CVE-2021-47223

The CVE-2021-47223 issue is a Linux kernel vulnerability in the bridge/net subsystem: a tunnel_dst null pointer dereference during VLAN tunnel egress caused by a lockless access pattern when deleting a VLAN tunnel. The patch fixes this by using READ/WRITE_ONCE for tunnel_id, applying RCUs for tun...

CVE-2021-47241

The Linux kernel contains a vulnerability in the ethtool component, specifically within the strset message length calculation. The outer nesting of ETHTOOL_A_STRSET_STRINGSETS is not properly accounted for, which can cause ETHTOOL_MSG_STRSET_GET to produce a warning and a splat . This occurs only...

CVE-2021-47248

The CVE-2021-47248 entry concerns a race in the Linux kernel UDP path between close() and udp_abort(). The root cause is udp_abort() racing with close(), with both paths acquiring the socket lock, while udp{v6}_destroy_sock() releases it before performing destructive actions. The fix uses the SOC...

CVE-2021-47262

The Linux kernel contains a vulnerability in the KVM x86 virtualization subsystem regarding the liveliness of the nested VM-Enter fail tracepoint message. The issue occurs because the tracepoint may outlive the memory it consumes, leading to the dereference of stale memory if the kvm-intel or kvm...

CVE-2021-47294

The CVE-2021-47294 issue affects the Linux kernel NETROM implementation where sock timer handling changed to sock timer API. sk_reset_timer() may increase the sock refcount when called on an inactive timer, so if the timer expires the handler must decrease the refcount to avoid a leak. A patch (c...

CVE-2021-47316

CVE-2021-47316: In the Linux kernel, nfsd: fix NULL dereference in nfs3svc_encode_getaclres where error cases may leave dentry NULL. Affected component is the NFS daemon encoder (nfs3acl.c); root cause is improper handling in the XDR encoder initialization leading to a NULL dereference. The issue...

CVE-2021-47387

CVE-2021-47387 is a Linux kernel vulnerability in the cpufreq: schedutil governor related to freeing sugov_tunables. The original sugov_tunables_free() was split: sugov_clear_global_tunables() clears the global_tunables, and a new sugov_tunables_free() is used as kobj_type::release to safely free...

CVE-2021-47427

The CVE-2021-47427 issue in the Linux kernel concerns iscsi_task use-after-free during abort handling in the SCSI iscsi path. Root cause: after commit d39df158518c, abort handling added iscsi_get_conn()/iscsi_put_conn() but the code path could goto common cleanup and perform a second put on the i...

CVE-2021-47444

CVE-2021-47444 relates to the Linux kernel DRM/EDID handling. The issue stems from connector_bad_edid() assuming the EDID buffer could hold edid[0x7e] + 1 blocks, while ignoring the actual allocated size indicated by num_blocks. A bounds check was added to prevent reading beyond allocated memory,...

CVE-2021-47481

CVE-2021-47481 concerns the Linux kernel RDMA mlx5 path. The connected sources confirm a concrete flaw where the ODP xarray was not initialized when creating an ODP MR, allowing an out-of-bounds/invalid access that triggers a crash (page fault) due to reg_create() setting a desc_size. The fix des...

CVE-2021-47513

CVE-2021-47513 is a Linux kernel vulnerability affecting the net: dsa: felix MMIO filtering path. The issue is a memory leak in felix_setup_mmio_filtering that occurs if there is no CPU port defined. The vulnerability is fixed in the kernel by addressing the resource leak in the felix MMIO filter...

CVE-2021-47523

CVE-2021-47523 affects the Linux kernel’s IB/hfi1 path. The issue is a leak of rcvhdrtail_dummy_kvaddr which is allocated in hfi1_init() and can be overwritten on a reinit path, leading to a memory leak. The fix moves the allocation to hfi1_alloc_devdata() and deallocation to hfi1_free_devdata(),...

CVE-2021-47536

CVE-2021-47536 (Linux kernel, net/smc) is confirmed fixed. The issue was in smc_lgr_cleanup_early, which intended to delete a link group from the link group list but mistakenly deleted the list head. This caused memory corruption because the actual link group remained in the list and was later me...

CVE-2021-47567

CVE-2021-47567 describes a Linux kernel vulnerability in the powerpc/32 code where a vmap stack overflow could lead to a hard lockup when the data MMU is not active. The root cause is that emergency_ctx was accessed with a virtual address during MMU inactivity; the fix uses a physical address ins...

CVE-2021-47655

CVE-2021-47655 affects the Linux kernel component media: venus: vdec. The root cause is a memory-leak risk in venus_helper_alloc_dpb_bufs() where an early return on an error path (ida_alloc_min()) could skip releasing previously allocated buffers. The fix moves the direct kfree() from the dma_all...

CVE-2022-48732

The CVE-2022-48732 issue affects the Linux kernel’s DRM Nouveau component, caused by an off-by-one error in BIOS boundary parsing of embedded init scripts. This bounds-checking flaw can reject access to the last byte, causing driver initialization to fail on Apple eMac systems with GeForce 2 MX G...

CVE-2022-48734

CVE-2022-48734 affects the Linux kernel in the btrfs subsystem. The issue is a deadlock caused by quota disable interactions with the qgroup rescan worker and other transactions (e.g., block group relocation) when quota is disabled. The described sequence involves Task A starting a transaction an...

CVE-2022-48740

CVE-2022-48740 refers to a Linux kernel vulnerability where on error paths from cond_read_list() and duplicate_policydb_cond_list(), cond_list_destroy() could be called twice, causing a NULL pointer dereference. The fix zeroes cond_list_len in cond_list_destroy() and sets cond_list to NULL after ...

CVE-2022-48767

CVE-2022-48767 affects the Linux kernel and relates to a leak of the ceph_string reference after an async create attempt. The description in the initial document states that the reference acquired by try_prep_async_create is leaked and must be put back, and connected sources (Astra Linux bulletin...

CVE-2022-48810

In CVE-2022-48810, the Linux kernel fixes a RTNL lock handling issue in IPv4/IPv6 multicast code: ipmr and ip6mr_free_table() could be called on the failure path without proper RTNL protection. The patch ensures RTNL is held before freeing mroute tables, preventing an assertion failure observed i...

CVE-2022-48823

CVE-2022-48823 affects the Linux kernel SCSI qedf driver. The issue is a refcount bug triggered when a LOGO is received during a TMF, which can cause an I/O to hang in the qedf driver. The provided connected advisories confirm the root cause (refcount during TMF/LOGO) and note that a fix was impl...

CVE-2022-48855

CVE-2022-48855: The connected advisories confirm a Linux kernel SCTP kernel-infoleak fix. The issue arose because r->idiag_expires was not initialized when inet_sctp_diag_fill() invoked inet_diag_msg_common_fill(), enabling a potential 4-byte kernel infoleak via SCTP sockets. The fix requires ...

CVE-2022-48860

CVE-2022-48860 affects the Linux kernel ethernet xemaclite_of_probe. The issue is a refcount leak from of_parse_phandle() that is addressed by calling of_node_put() in the probe/remove path. Impact is locally accessible with high availability risk stated; no exploitation details provided in the c...

CVE-2022-48920

CVE-2022-48920: In the Linux kernel, the btrfs flushoncommit path could trigger a warning in __writeback_inodes_sb_nr() during transaction commits. The fix avoids deadlock risks by replacing writeback_inodes_sb() with try_to_writeback_inodes_sb(), which reads sb->s_umount and only calls writeb...

CVE-2022-49071

CVE-2022-49071 affects the Linux kernel where drm/panel: ili9341 handling of an optional regulator could dereference a NULL or error pointer if the regulator lookup fails. The patch ensures that a failed optional regulator lookup resets the pointer to NULL, and notes that related functions like m...

CVE-2022-49165

CVE-2022-49165 is a Linux kernel vulnerability in the media: imx-jpeg decoding path. When an NV12M JPEG is queued as an output buffer but a single-planar capture buffer is queued, the kernel could crash with a NULL pointer dereference in mxc_jpeg_addrs. The mitigation in the patch is to finish th...

CVE-2022-49222

In CVE-2022-49222, the Linux kernel drm/bridge anx7625 EDID reader was vulnerable because edid_pos was stored in a u8, allowing overflow when EDID blocks exceed 256 bytes. The documented fix changes edid_pos to an int to safely read longer EDID blocks. The CVE is categorized with LOCAL attack vec...

CVE-2022-49419

The Linux kernel contains a use-after-free vulnerability in the vesafb driver (specifically in the vesafb_remove() function). The issue arises from incorrect cleanup logic for the fb_info pointer; while a previous fix addressed cases where .fb_destroy followed .remove, a secondary scenario exists...

CVE-2022-49459

Mode C: CVE-2022-49459 affects the Linux kernel (notably kernel 5.10/5.15 in Astra Linux) with a NULL-dereference risk in sr_thermal_probe due to platform_get_resource() possibly returning NULL. The vulnerability stems from insufficient NULL checks, and a fix adds a proper NULL check to prevent d...

CVE-2022-49487

CVE-2022-49487 affects the Linux kernel mtd/rawnand/syscalls for Intel NAND, where a null pointer dereference could occur if platform_get_resource() returns NULL. The fix moves using the resource after devm_ioremap_resource(), which checks for NULL to prevent dereference. Connected Astra Linux ad...

CVE-2022-49571

CVE-2022-49571 : In the Linux kernel, a data-race around reading sysctl_tcp_max_reordering could occur as the value is updated concurrently while being read. The fix adds READ_ONCE() to the readers of sysctl_tcp_max_reordering. Affected/affected-by notices appear in multiple advisories (EulerOS, ...

CVE-2022-49597

In CVE-2022-49597, the Linux kernel tcp code suffers a data-race around sysctl_tcp_base_mss when reading sysctl_tcp_base_mss concurrently. The fix adds READ_ONCE() to the readers to prevent races. Connected advisories (Astra Unity/ EulerOS OSS) echo the same description and reference kernel commi...

CVE-2022-49682

CVE-2022-49682 is a Linux kernel issue: in xtensa, a refcount leak bug in time.c occurred where calibrate_ccount() could return a node with an incremented refcount. The fix requires using of_node_put() when the node is no longer used (to avoid a leak). Connected advisories (Astra Linux and Unity/...

CVE-2022-49706

CVE-2022-49706—zonefs contains a read handling bug in zonefs_iomap_begin() where a readahead to a zone file with an offset equal to the current file size can set iomap type to IOMAP_UNWRITTEN with length 0, triggering a WARN_ON in iomap_iter and causing iomap_readahead() to loop. The patch fixes ...

CVE-2022-49756

CVE-2022-49756 is about a Linux kernel issue in the USB sunplus PHY path. A null pointer dereference could occur in sp_usb_phy_probe() because platform_get_resource_byname() may fail and yield NULL, and devm_ioremap() could then use usbphy->moon4_res_mem->start as input. The fixes described...

CVE-2022-49802

CVE-2022-49802 affects the Linux kernel ftrace: a NULL pointer dereference can occur in ftrace_add_mod() when ftrace_mod was not initialized as a list head. The issue arises because kzalloc() can leave list pointers NULL and code may call list_del() on an uninitialized entry, triggering an Oops a...

CVE-2022-49813

In CVE-2022-49813, the vulnerability is in the Linux kernel ena driver. The root cause is in ena_init() where the workqueue created by create_singlethread_workqueue() is not destroyed if pci_register_driver() fails, causing a resource leak. The fix adds a call to destroy_workqueue() on pci_regist...

CVE-2022-49824

In the Linux kernel, CVE-2022-49824 affects the ata_tlink_add() path in libata-transport. The root cause is that transport_add_device()'s return value is not checked, which can lead to a NULL pointer dereference during module removal when transport_remove_device() is called for a device that wasn...

CVE-2022-49829

CVE-2022-49829 pertains to the Linux kernel DRM scheduler exhibit: fix of fence ref counting to prevent leaking dependency fences when processes are killed. The issue involved grabbing a reference to the last scheduled fence and leaks occur due to improper fence ref counts. Connected advisories (...

CVE-2022-49918

CVE-2022-49918 concerns the Linux kernel IPVS subsystem. The vulnerability arises from the initialization path in ip_vs_conn_net_init() where failure to create ip_vs_conn or ip_vs_conn_sync files still leaves initialization “successful by default.” As a result, during removal, the proc entries ma...

CVE-2022-49935

CVE-2022-49935 affects the Linux kernel’s dma-buf/dma-resv code. The vulnerability arises from assuming a newly added fence is newer than all existing fences; with the explicit UAPI export/import, this assumption was removed, creating a path where userspace could force the kernel into a use-after...

CVE-2022-50054

The CVE-2022-50054 entry concerns a Linux kernel vulnerability in the iavf driver: a NULL pointer dereference in iavf_get_link_ksettings when vf_res has been freed in iavf_init_get_resources. The issue arises after a regression that could allow netdev to call ethtool_ops while vf_res is gone, lea...

CVE-2022-50088

CVE-2022-50088 affects the Linux kernel’s damon_reclaim_init() path. The function allocates a ctx via damon_new_ctx(); if damon_select_ops() fails, the ctx is not released, causing a memory leak. The documented fix releases the ctx with damon_destroy_ctx() when damon_select_ops() fails. Connected...

CVE-2022-50149

CVE-2022-50149 : Linux kernel driver core vulnerability in __driver_attach where async probing could deadlock with dev locks. Reproduced when async probes are allowed but memory/work limits force synchronous execution, causing ABBA-style deadlock with __driver_attach_async_helper holding device l...