CVE-2022-48668

CVE-2022-48668 relates to the Linux kernel SMB3 implementation. The issue was that collapse range did not discard the affected cached region, risking temporary data corruption of the file during operations (as observed in xfstest generic/031). The fix stabilizes collapse range behavior and also i...

CVE-2022-48690

Insight : CVE-2022-48690 refers to a Linux kernel fix in the ice driver for a DMA mappings leak when reallocating RX buffers while changing ring parameters. The leak occurred because kfree on rx_buf freed DMA mappings that were still active, leading to leaked DMA mappings during buffer substituti...

CVE-2022-48698

CVE-2022-48698 affects the Linux kernel’s drm/amd/display path, causing a memory leak when using debugfs_lookup if the returned object isn’t released with dput(). The provided documents confirm the issue and describe the fix as correctly releasing the object via dput(), preventing unbounded memor...

CVE-2022-48717

CVE-2022-48717 concerns the Linux kernel ASoC max9759 driver, where an underflow could occur in speaker_gain_control_put() if priv->gain is negative, risking out-of-bounds access via snd_ctl_elem_write_user()/snd_ctl_elem_write()/kctl->put(). The fix adds a check for negative values of priv...

CVE-2022-48724

CVE-2022-48724 concerns a memory leak in the Linux kernel’s IOMMU VT-d path during intel_setup_irq_remapping. The description in multiple connected documents states that after commit e3beca48a45b, the tear-down path could leak memory when dmar_enable_qi() errors, and that free() of the function p...

CVE-2022-48726

CVE-2022-48726 affects the Linux kernel’s RDMA/ucma code path, specifically a use-after-free in ucma_cleanup_multicast and related flows (ucma_destroy_private_ctx, ucma_write) caused by touching a concurrently freed multicast structure during a multicast leaves operation. The description notes th...

CVE-2022-49077

CVE-2022-49077 — Linux kernel : A vulnerability where an mremap(old_size=0) path could reach move_page_tables() and trigger unnecessary invalidate_range_start()/invalidate_range_end() on an empty range, causing a WARN in KVM mmu_notifier. The published fix is to short‑circuit with an early return...

CVE-2022-49169

CVE-2022-49169 concerns the Linux kernel’s f2fs module and a race/lock issue that could cause a hang. The connected advisories document that the fix is to replace a mutex-based path with a spin_lock, specifically to avoid hang scenarios in f2fs when handling certain task reads and statistics oper...

CVE-2022-49686

CVE-2022-49686 affects the Linux kernel USB gadget UVC path (configfs-gadget: uvc) where uvcg_video_pump can double-add a request to the free list, leading to a kernel BUG and panic when an endpoint is disabled and the request is re-queued. The issue is demonstrated by kernel BUG at lib/list_debu...

CVE-2022-49738

Summary (CVE-2022-49738) : In the Linux kernel’s f2fs subsystem, a sanity check missing for .i_extra_isize in is_alive() leads to a potential slab-out-of-bounds access in data_blkaddr during garbage collection, as observed in the f2fs_gc path (gc_data_segment -> is_alive -> data_blkaddr -&g...

CVE-2022-49829

CVE-2022-49829 pertains to the Linux kernel DRM scheduler exhibit: fix of fence ref counting to prevent leaking dependency fences when processes are killed. The issue involved grabbing a reference to the last scheduled fence and leaks occur due to improper fence ref counts. Connected advisories (...

CVE-2022-49833

The CVE-2022-49833 issue affects the Linux kernel's btrfs zoned handling: when cloning a btrfs_device, the associated btrfs_zoned_device_info is not cloned for zoned filesystems, which can lead to a NULL pointer dereference when accessing the device’s zone_info (e.g., when activating a zone). The...

CVE-2022-49868

CVE-2022-49868 relates to a Linux kernel quirk involving the mt7621 PCI PHY/staging driver. The issue arises when mt7621_soc_dev_attr registers the SoC as a device, causing an oops in soc_device_match_attr. The quirk was introduced in the staging driver (staging: mt7621-pci-phy) and was later re-...

CVE-2022-50037

CVE-2022-50037 concerns the Linux kernel: the drm/i915/ttm path could leak CCS state between users. The issue is resolved by applying the patch that prevents leaking CCS state (cherry-picked from commit 353819d85f87be46aeb9c1dd929d445a006fc6ec). Affected product is the Linux kernel (ttm subsystem...

CVE-2022-50092

CVE-2022-50092 affects the Linux kernel dm-thin component. The issue is a use-after-free in dm_pool_register_metadata_threshold called during metadata-threshold registration for a thin-pool, leading to a potential use-after-free in dm_sm_register_threshold_callback. Reproduction involves manipula...

CVE-2022-50102

CVE-2022-50102 affects the Linux kernel’s fbdev arkfb driver. A user-controlled ioctl can cause a divide-by-zero in ark_set_pixclock, e.g. with hdiv=1, pixclock=1, hmul=2, producing (1*1)/2 = 0 and leading to division by zero later in arkfb.c when computing 1000000000 / pixclock. The vulnerabilit...

CVE-2022-50125

CVE-2022-50125 is a Linux kernel issue affecting ASoC: cros_ec_codec through a refcount leak in cros_ec_codec_platform_probe. The root cause is that of_parse_phandle() returns a node pointer with its refcount incremented, and the fix adds of_node_put() when the node is no longer needed to avoid t...

CVE-2022-50140

CVE-2022-50140 affects the Linux kernel memstick/ms_block subsystem. The root cause is a memory leak where erased_blocks_bitmap is allocated with used_blocks_bitmap but not freed; the patch adds bitmap_free() in msb_data_clear() to free erased_blocks_bitmap. The CVSS 3.1 base score is 5.5 (MEDIUM...

CVE-2022-50185

In CVE-2022-50185, the Linux kernel drm/radeon path ni_set_mc_special_registers() is vulnerable to a potential buffer overflow. The last case label could write mc_reg_address[j] and mc_data[j] when j equals SMC_NISLANDS_MC_REGISTER_ARRAY_SIZE due to missing bounds checks after the last j++. The f...

CVE-2023-52745

The CVE-2023-52745 entry concerns the Linux kernel’s IPoIB (IB/IPoIB) legacy interface handling. The issue arises when a netlink operation creates child PKEY interfaces with multiple transmit/receive queues, while some devices support only a single tx/rx queue. This mismatch can trigger a NULL-po...

CVE-2023-53035

CVE-2023-53035 : Linux kernel nilfs2 information-leak in nilfs_ioctl_wrap_copy() fixed. The ioctl helper may copy uninitialized buffers to user space for NILFS_IOCTL_GET_SUINFO/GET_CPINFO when the user-space metadata size (v_size) exceeds the on-disk element size. The issue is demonstrated via KM...

CVE-2024-26755

CVE-2024-26755 affects the Linux kernel's MD (multiple devices) subsystem. When a reshape is interrupted, a race can occur between an IO operation crossing the reshape position and a potential suspend of the array triggered by md_start_sync() finding a spare to add/remove from conf. This can dead...

CVE-2024-38306

The CVE-2024-38306 issue resides in the Linux kernel’s BTRFS extent IO path. A race stems from how folio::private is managed during attach of extent folios: after the commit that refactored alloc_extent_buffer() to an allocate-then-attach flow, code guarded by mapping->i_private_lock was moved...

CVE-2024-38624

CVE-2024-38624 affects the Linux kernel NTFS3 file system code. The issue arises from using 32-bit arithmetic in a computing expression (for example, vbo = 2 * vbo + skip), risking overflow; the fix is to switch to a 64-bit variable to prevent 32-bit overflow. Multiple advisories (e.g., Ubuntu US...

CVE-2024-42146

CVE-2024-42146: Linux kernel DRM/XE vulnerability fixed by adding outer runtime PM protection to xe_live_ktest@xe_dma_buf. The issue arose because kunit tests performing memory access did not use outer runtime_pm protections, leaving inner callers unprotected. Root cause: missing outer runtime PM...

CVE-2024-56682

Summary (CVE-2024-56682) : In the Linux kernel RISCV IRQ domain handling, probing the APLIC driver before IMSIC can leave the parent MSI domain missing, causing a NULL pointer dereference in msi_create_device_irq_domain(). The fix defers the APLIC probe until the parent MSI domain is available an...

CVE-2024-57839

Technical details for CVE-2024-57839 are not provided in the connected documents. Public info appears limited to the initial description; monitor for official advisories for affected products, impact, and fixes.

CVE-2024-57891

The CVE refers to a Linux kernel issue fixed in the sched_ext subsystem: an invalid IRQ restore could occur due to improper conversion of an inner rq_unlock_irqrestore() to rq_unlock() when adding outer irqsave/restore locking in scx_ops_bypass(). This could lead to the IRQs being re-enabled at a...

CVE-2024-58089

CVE-2024-58089 affects the Linux kernel: a double accounting race in btrfs_run_delalloc_range() can occur when 4K block size is smaller than 64K page size (aarch64), potentially leading to kernel panics and oops during delalloc handling (as seen in the provided trace: can_finish_ordered_extent, b...

CVE-2025-21900

CVE-2025-21900 : In the Linux kernel, a deadlock can occur in NFSv4 state recovery for a sillyrenamed file scheduled for delete-on-close, when a server reboot triggers an open reclaim and races with close(). The root cause is a synchronous delegreturn call from put_nfs_open_context() that isn’t m...

CVE-2025-38160

CVE-2025-38160 affects the Linux kernel due to a NULL pointer dereference in the Raspberry Pi clock registration path. Specifically, raspberrypi_clk_register() does not handle a NULL return from devm_kasprintf(), which can occur if memory allocation fails. A fix has added a NULL check after devm_...

CVE-2025-38210

CVE-2025-38210 concerns the Linux kernel in the configfs-tsm-report path. The root cause is a NULL-dereference risk when tsm_ops have been unregistered but certain code paths (tsm_report_privlevel_store(), tsm_report_provider_show()) did not verify the removal, leading to potential config-item ac...

CVE-2025-38238

The CVE-2025-38238 issue affects the Linux kernel SCSI fnic driver, where a crash could occur when both FDMI RHBA and RPA requests time out and a frame is reused to send ABTS, leading to a double-free on completion. The fix allocates separate frames for RHBA and RPA and updates the ABTS handling ...

CVE-2025-38272

CVE-2025-38272 : In the Linux kernel, the bcm63xx DSA switch could attempt to enable EEE on external PHYs connected to multiple RGMII ports, causing a system hang when accessing non-existent EEE registers. The fix is to gate EEE configuration by actually checking switch support before enabling it...

CVE-2025-38275

The CVE-2025-38275 entry concerns the Linux kernel, fixing a NULL vs IS_ERR() bug in the qcom-qmp-usb driver. The qmp_usb_iomap() helper previously returned devm_ioremap() results directly for non-exclusive mappings, which could be NULL. If callers only checked IS_ERR(), a NULL pointer could bypa...

CVE-2025-38287

Technical details about CVE-2025-38287 are not publicly provided in the supplied documents. Monitor official advisories for updates, affected products, and fixes.

CVE-2025-38391

CVE-2025-38391 in the Linux kernel addresses a vulnerability in USB Type-C Alt Mode handling for DisplayPort. A misbehaving port partner could claim pin assignment capabilities beyond the valid range, causing an out-of-bounds access in pin_assignment_show. The fix adds a DP_PIN_ASSIGN_MAX constan...

CVE-2025-38417

The CVE-2025-38417 issue affects the Linux kernel ice/eswitch path where memory for VF port representors could be allocated during reset and not freed in legacy (non-switchdev) mode. The fix adds a mode check to allocate required port memory only in switchdev mode and prevents blindly allocating ...

CVE-2025-38418

CVE-2025-38418 affects the Linux kernel remoteproc subsystem. The root cause is a failure path in rproc_attach() where, if rproc_handle_resources() fails while the remote processor is in state RPROC_DETACHED, rproc->clean_table is not released, leading to a memory leak (observed in a kworker t...

CVE-2025-38462

CVE-2025-38462 affects the Linux kernel vsock subsystem. Root cause is a TOCTOU race in vsock_find_cid() and vsock_dev_do_ioctl() with module unload, where transport_g2h/h2g can become NULL after a NULL check, causing null-pointer derefs. The patch adds vsock_transport_local_cid() to guard agains...

CVE-2025-38568

In the Linux kernel, net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (CVE-2025-38568). The TCA_MQPRIO_TC_ENTRY_INDEX policy allowed up to TC_QOPT_MAX_QUEUE (16), causing a 4-byte out-of-bounds write in the fp[] stack array. The fix changes the policy to allow only up to TC_QO...

CVE-2025-38616

CVE-2025-38616 (Linux kernel TLS ULP issue) affects the kernel TLS path handling data that may disappear from under the TLS ULP when the socket reader predated TLS installation or uses non-standard read APIs. The bug could lead to an out-of-bounds read or TLS state corruption if data is partially...

CVE-2025-39866

CVE-2025-39866 concerns a use-after-free in the Linux kernel’s fs writeback path, specifically __mark_inode_dirty() when the inode’s wb switching occurs. The root cause is a race during switching inode_writeback backends (wb) which can lead to use-after-free via wb_wakeup_delayed() accessing a fr...

CVE-2026-23247

CVE-2026-23247 is a Linux kernel TCP/TCP options issue that reintroduces port inclusion in the TS offset to mitigate an off-path TCP source port leakage via a SYN-cookie side-channel. The vulnerability is resolved by reverting a previous downgrade of timestamp offsets and performing a single siph...

CVE-2026-31700

Summary (CVE-2026-31700): In the Linux kernel, a TOCTOU race in tpacket_snd() when PACKET_VNET_HDR is enabled allows a user-space race on vnet_hdr fields between validation and use, bypassing safety checks. The vulnerability affects the mmap’d TX ring buffer where vnet_hdr points into user-contro...

CVE-2026-43329

CVE-2026-43329 concerns the Linux kernel netfilter flowtable where the maximum number of hardware offload actions for IPv6 was exceeded (17 used vs 16 allowed). The fixes update flow_action_entry_next() to enforce the limit and raise the per-flow action cap from 16 to 24, enabling IPv6 setups to ...

CVE-1999-0183

CVE-1999-0183 affects Linux implementations of TFTP, described as allowing traversal to read files outside the restricted directory. The OpenVAS/Nessus entries confirm a directory-traversal vulnerability enabling arbitrary file reads via TFTP server responses (e.g., tftpd misconfiguration allows ...

CVE-2004-0178

The vulnerability lies in the Linux 2.4.x sb16 Sound Blaster driver (OSS) in 16-bit mode; under odd-sized samples it can crash local users. Affects Linux 2.4.x before 2.4.26. Remediation: upgrade to Linux 2.4.26 or newer.

CVE-2005-2456

CVE-2005-2456 refers to an array index overflow in the Linux kernel 2.6, in xfrm_user.c within xfrm_sk_policy_insert. A local user can trigger the overflow by supplying a p->dir value larger than XFRM_POLICY_OUT, causing writes beyond sock->sk_policy and resulting in a kernel crash (DoS) an...

CVE-2005-4605

CVE-2005-4605 concerns the Linux kernel procfs implementation. A signedness error in the proc_misc.c code (pre-2.6.15) allows a local attacker to read sensitive kernel memory by manipulating a signed value added to an unsigned value, disclosed via /proc interactions. Public reports document the a...