14999 matches found
CVE-2021-47160
CVE-2021-47160 corresponds to a Linux kernel vulnerability where PCR_MATRIX was set to all-ones when VLAN filtering was enabled and not reset when disabled, potentially allowing VLAN traffic leaks between bridges br0 and br1. The issue is addressed by removing the PCR_MATRIX write from mt7530_por...
CVE-2021-47187
CVE-2021-47187 concerns arm64: dts: qcom: msm8998 in the Linux kernel. The issue was a miscalculation of min-residency-us and conflicting idle-time parameters between CPU sleep and L2 power-collapse timings, which could cause SoC instability (random reboots/lockups) when CPU scaling is enabled. A...
CVE-2021-47302
In CVE-2021-47302, the Linux kernel igc driver is affected by a use-after-free during TX ring reset. The fix cleans the next_to_watch descriptor when cleaning the TX ring, preventing a possible free of an skb that was already freed if igc_poll() runs during a reset. The described impact is memory...
CVE-2021-47529
CVE-2021-47529: Linux kernel vulnerability in iwlwifi memory management where memory allocated in reduce_power_data could leak on error (invalid TLV len or memory allocation failure). The issue has been fixed in the Linux kernel by freeing allocated memory in the error path before return. Connect...
CVE-2022-48725
CVE-2022-48725: Linux kernel RDMA/siw: fix refcounting leak in siw_create_qp by ensuring atomic_inc() is paired with atomic_dec() on the error path. The issue allows a leak on error handling during QP creation; remediation is a kernel patch (e.g., commits listed in the references) that corrects t...
CVE-2022-48810
In CVE-2022-48810, the Linux kernel fixes a RTNL lock handling issue in IPv4/IPv6 multicast code: ipmr and ip6mr_free_table() could be called on the failure path without proper RTNL protection. The patch ensures RTNL is held before freeing mroute tables, preventing an assertion failure observed i...
CVE-2022-48860
CVE-2022-48860 affects the Linux kernel ethernet xemaclite_of_probe. The issue is a refcount leak from of_parse_phandle() that is addressed by calling of_node_put() in the probe/remove path. Impact is locally accessible with high availability risk stated; no exploitation details provided in the c...
CVE-2022-48933
CVE-2022-48933 affects the Linux kernel nf_tables stateful object update path. The issue arises when updating stateful objects from the control plane: a temporary object is created, but its destruction path leaks resources because the update flow does not increment the module refcount. The fix is...
CVE-2022-49071
CVE-2022-49071 affects the Linux kernel where drm/panel: ili9341 handling of an optional regulator could dereference a NULL or error pointer if the regulator lookup fails. The patch ensures that a failed optional regulator lookup resets the pointer to NULL, and notes that related functions like m...
CVE-2022-49088
CVE-2022-49088 affects the Linux kernel: a refcount leak in dpaa2_ptp_probe where the of_find_compatible_node() result is returned with an incremented refcount. The fix is to call of_node_put() to release the reference and avoid the leak. References point to kernel patches that implement this cor...
CVE-2022-49108
CVE-2022-49108 concerns the Linux kernel Mediatek clock driver, where memory leaks occur on probe due to not freeing memory in error handling paths. The vulnerability is resolved by handling error branches to free allocated memory, addressing a resource leak (Coverity ID 1491825). Connected sourc...
CVE-2022-49262
CVE-2022-49262 (Linux kernel) : In the Linux kernel crypto/otx2 driver, the CONFIG_DM_CRYPT check was removed. This resolves a NULL pointer dereference in the driver release path when CONFIG_DM_CRYPT is enabled, and was verified to cause a NULL dereference in the call chain during crypto_unregist...
CVE-2022-49266
CVE-2022-49266 (Linux kernel) : The vulnerability arises in the block layer where the patch that prevents calling rq_qos_done_bio() for untracked bios caused blk-iocost to mis-handle merged bios, leaving them “in-flight.” The fix adds a new flag BIO_QOS_MERGED to mark merged bios and ensures rq_q...
CVE-2022-49363
CVE-2022-49363 concerns a vulnerability in the Linux kernel’s F2FS filesystem. Public descriptions and related advisories (Astra Linux, Unity Linux, OSV, NVD, Red Hat, etc.) confirm the root issue: after fuzzing, inode block mappings could become inconsistent with the SIT (Segment Information Tab...
CVE-2022-49386
CVE-2022-49386 concerns the Linux kernel net: ethernet: ti: am65-cpsw-nuss driver. The bug leaks refcounts because of_get_child_by_name() returns a node pointer with an incremented refcount and the code fails to call of_node_put() when the node is no longer needed; am65_cpsw_init_cpts() and am65_...
CVE-2022-49485
CVE-2022-49485 describes a Linux kernel issue in drm/v3d: a null pointer dereference of pointer perfmon where WARN_ON happens after the pointer has been dereferenced. The fix is to dereference perfmon only after it has been null-checked. Affected component: Linux kernel (drm/v3d path). Impact, pe...
CVE-2022-49487
CVE-2022-49487 affects the Linux kernel mtd/rawnand/syscalls for Intel NAND, where a null pointer dereference could occur if platform_get_resource() returns NULL. The fix moves using the resource after devm_ioremap_resource(), which checks for NULL to prevent dereference. Connected Astra Linux ad...
CVE-2022-49571
CVE-2022-49571 : In the Linux kernel, a data-race around reading sysctl_tcp_max_reordering could occur as the value is updated concurrently while being read. The fix adds READ_ONCE() to the readers of sysctl_tcp_max_reordering. Affected/affected-by notices appear in multiple advisories (EulerOS, ...
CVE-2022-49752
CVE-2022-49752 concerns a node refcount leak in the Linux kernel function fwnode_graph_get_next_endpoint . The root cause is that the parent returned by _fwnode_graph_get_port_parent() is refcounted when a previous node is non-NULL and not released. The documented fix introduces a new variable to...
CVE-2022-49792
CVE-2022-49792 corresponds to a Linux kernel vulnerability in the iio: adc MP2629 driver. The issue is a potential array out-of-bounds access, mitigated by adding a sentinel at the end of maps in the iio core. Affected component is the IIO subsystem’s mp2629 ADC path; root cause is improper bound...
CVE-2022-49812
CVE-2022-49812 describes a Linux kernel vulnerability in the bridge driver’s VLAN offload path. When VLANs are offloaded via switchdev, the bridge marks them with BR_VLFLAG_ADDED_BY_SWITCHDEV. Changing the VLAN protocol triggers notifications to switchdev drivers and also to the 8021q driver, whi...
CVE-2022-49830
CVE-2022-49830 affects the Linux kernel’s DRM subsystem. The issue occurs in drm_dev_init(), which adds drm_dev_init_release() as a callback; if drmm_add_action() fails, the release callback isn’t registered, causing the refcnt from device_get() in drm_dev_init() to leak instead of being released...
CVE-2022-49834
CVE-2022-49834 concerns a use-after-free in nilfs2 when downgrading to read-only and remounting read/write, risking access to a freed nilfs_writer. The issue arises during a race between log-writer detachment and remount/downgrade, potentially allowing a Task1 thread to dereference a freed pointe...
CVE-2022-49836
The CVE-2022-49836 issue in the Linux kernel concerns a memory leak in siox_device_add() if device_register() fails. The fix ensures proper reference handling: after an error, the name allocated by dev_set_name() is freed by freeing the reference with put_device(), allowing kobject_cleanup() to f...
CVE-2022-49845
CVE-2022-49845 – Linux kernel CAN/j1939 header initialization fix . The issue related to can: j1939_send_one() involved uninitialized CAN header fields in CAN frames created for j1939 messages, exposing a read access to canxl_frame::len due to uninitialized reserved and later-filled fields in str...
CVE-2022-50045
CVE-2022-50045 is a Linux kernel issue affecting the powerpc/pci path. The vulnerability arose from a locking interaction in get_phb_number(), which could cause a DEBUG_ATOMIC_SLEEP warning when sleep-prone OF routines are called while a hose_spinlock is held. The resolution involves modifying ge...
CVE-2023-1295
CVE-2023-1295 describes a time-of-check to time-of-use issue in the Linux kernel io_uring IORING_OP_CLOSE path, affecting kernels 5.6–5.11 (inclusive). The flaw, a local privilege escalation, is introduced by the commit b5dba59e0cf7e2cc4d3b3b1ac5fe81ddf21959eb and patched in 9eac1904d3364254d622b...
CVE-2023-52559
CVE-2023-52559 concerns the Linux kernel iommu/vt-d suspension path. The issue arises because iommu_suspend() is called with IRQs disabled and memory could be allocated with GFP_KERNEL during the suspend callback, potentially re-enabling IRQs and causing intermittent suspend/hibernate problems. O...
CVE-2023-52613
CVE-2023-52613 affects the Linux kernel loongson2_thermal driver. The root cause is an incorrect PTR_ERR() check that can return -ENODEV when thermal-zones are undefined, causing tz->type to be NULL and a kernel OOPS. The fixes in the connected docs indicate that PTR_ERR() should yield -ENODEV...
CVE-2023-52936
CVE-2023-52936 affects the Linux kernel, specifically the irqdomain.c path where debugfs_lookup() results were not being released with dput(), causing a memory leak over time. The advisory notes the fix is to replace the call with debugfs_lookup_and_remove(), which handles the necessary cleanup i...
CVE-2023-52998
CVE-2023-52998 — In the Linux kernel’s fec driver, freeing RX buffers used page_pool_release_page, which unmaps but doesn’t recycle pages, enabling memory exhaustion after repeated eth0 up/down. A fix replaces it with page_pool_put_full_page, recycling the page when refcnt == 1. The vulnerability...
CVE-2023-53041
CVE-2023-53041 has concrete details in the Connected documents. The issue is in the Linux kernel’s qla2xxx SCSI driver: during controller add/remove, abort path completes commands with a lock still held, causing a lock-warning in dma_free_attrs. The observed call trace centers on qla2x00_async_sn...
CVE-2023-53099
CVE-2023-53099 concerns a Linux kernel issue where a sleepable memory allocation was performed from an atomic context in the Xilinx firmware driver, triggering a lockdep-detected “sleeping function called from invalid context” condition. The advisory notes the root cause is in firmware: xilinx an...
CVE-2023-53133
CVE-2023-53133 affects the Linux kernel’s BPF sockmap path (tcp_bpf_recvmsg_parser) where a 0-length recvmsg can loop indefinitely. The description and connected advisories confirm the root cause is an infinite loop when len is 0 and that the fix is to return 0 for length 0 in tcp_bpf_recvmsg_par...
CVE-2024-26806
CVE-2024-26806 : In the Linux kernel, the cadence-qspi driver’s runtime PM hooks were calling spi_controller_suspend()/resume(), which was not expected and could cause a deadlock when the bus lock is held. The fix removes these calls from cadence-qspi, since cadence-qspi is not queued, and notes ...
CVE-2024-35858
CVE-2024-35858 affects the Linux kernel bcmasp component. The issue cause is a memory leak when bringing down the TX rings, where flushed DMA buffers are not freed, and TX control block corruption can occur during power-management interface shutdown. Connected sources (e.g., Astra Linux bulletin ...
CVE-2024-38625
CVE-2024-38625 affects the Linux kernel ntfs3 NTFS driver. The root cause is a NULL folio pointer in fs/ntfs3 checks when bmap is invoked; this can lead to a crash. The CVSSv3.1 vector indicates Local, Low attack complexity, Low privileges, no user interaction, with Availability impact HIGH (I=NO...
CVE-2024-38636
CVE-2024-38636 (Linux kernel, f2fs multi-device support) : The issue occurs when using multiple block devices with F2FS where reads on the non-primary device are mapped to the first block (address 0). This causes f2fs_map_blocks() to return a valid zero block address, but f2fs_iomap_begin() treat...
CVE-2024-42118
CVE-2024-42118 – Linux kernel / drm/amd display : The issue arises in resource_stream_to_stream_idx where an array index can be -1 if not found. The code currently asserts and then returns 0, preventing a negative index and thereby avoiding an OVERRUN and NEGATIVE_RETURNS. Connected sources ident...
CVE-2024-42275
Summary of CVE-2024-42275 : In the Linux kernel DRM subsystem, the bug is in the drm_client_buffer_vmap_local() function (drivers/gpu/drm/drm_client.c). The function can return zero on the failure path, which causes locking issues and leaves the caller’s _map_copy uninitialized. This is a local, ...
CVE-2024-57799
CVE-2024-57799 — Linux kernel rockchip PHY (samsung-hdptx): The NULL pointer dereference can occur if rk_hdptx_phy_runtime_resume() runs before platform_set_drvdata() in probe. Fix: call platform_set_drvdata() before devm_pm_runtime_enable(). See kernel commits: https://git.kernel.org/stable/c/70...
CVE-2025-21751
CVE-2025-21751 affects the Linux kernel net/mlx5 HWS: when a firmware error occurs during the matcher disconnect flow, the kernel previously attempted to reconnect the matcher and could free a matcher that was still on the list, causing use-after-free and a crash. The patch changes the error path...
CVE-2025-21851
CVE-2025-21851 is fixed in the Linux kernel for aarch64 systems using 64 KB page size. The issue originated in arena_map_free() calling apply_to_pte_range() with a non-page-aligned address returned by bpf_arena_get_kern_vm_start(), which could cause a segmentation fault and soft lockup during are...
CVE-2025-21939
CVE-2025-21939 affects the Linux kernel DRM: XEHmm code path. The root cause is dereference of struct page pointers obtained from hmm_range_fault() without holding the notifier lock (and with an invalid/unstable seqno), risking access to pages not owned by the kernel during sg-table construction....
CVE-2025-37845
CVE-2025-37845: Linux kernel tracing fprobe events fix prevents use-after-free by unloading a module during tprobe/tracepoint handling. Root cause: a previous relocation of try_module_get() from __find_tracepoint_module_cb() to find_tracepoint() could access a freed module object; the patch resto...
CVE-2025-37847
CVE-2025-37847: In the Linux kernel, a deadlock could occur in accel/ivpu during ivpu_ms_cleanup() when runtime resume acquires file_priv->ms_lock, leading to a cold boot path that calls ivpu_ms_cleanup_all(). The issue is resolved by preventing runtime resume after ms_lock is acquired, avoidi...
CVE-2025-38016
The CVE-2025-38016 issue concerns the Linux kernel HID-BPF path. Root cause: HID-BPF dispatch may access a cleaned SRCU after hid_bpf_destroy_device() when a device with LEDs is active and hid_ll_driver->request() is unimplemented, causing a potential use-after-free-like access to not-present ...
CVE-2025-38099
CVE-2025-38099 : In the Linux kernel, a SCO Bluetooth connection could lock up the controller if voice settings are not properly read or supported. SUSE/OpenSUSE advisories (e.g., openSUSE-SU-2025-20081-1) list CVE-2025-38099 among fixed kernel vulnerabilities with MEDIUM/LOW to HIGH impact range...
CVE-2025-38132
CVE-2025-38132 : Linux kernel coresight race condition when removing cscfg from csdev. The issue occurs if a module load and config deactivate path races with iterating/removing config_csdev_list entries while holding csdev->cscfg_csdev_lock, allowing an entry delete to race with an active con...