CVE-2017-0525

CVE-2017-0525 is an elevation-of-privilege issue in the Qualcomm IPA driver on Android, enabling a local attacker to execute code in kernel context. Affected: Android devices using Kernel-3.10 or Kernel-3.18 with the Qualcomm IPA driver. Impact per sources: local privilege escalation requiring pr...

CVE-2017-18552

CVE-2017-18552 affects the Linux kernel up to version 4.10 in net/rds/af_rds.c, where rds_recv_track_latency contains an out-of-bounds write and read. The connected Nessus advisories (Unity Linux UTSA advisories) mirror this issue and reference kernel versions before 4.11, with a commit in the Li...

CVE-2021-47218

CVE-2021-47218: Linux kernel SELinux hashtab allocation failure could lead to NULL dereference. Root cause: on hashtab_init() allocation failure, h->size remains non-zero while h->htable is NULL, breaking hashtab_map() and hashtab_destroy() which assume non-empty hashtab. Mitigation in the ...

CVE-2021-47232

CVE-2021-47232 affects the Linux kernel CAN/J1939 subsystem. The root cause is a Use‑After‑Free caused by taking a skb from the per‑session skb queue without incrementing its refcount, which can occur concurrently due to CTS. The patch fixes this by ensuring skb refcounting is handled correctly w...

CVE-2021-47255

In CVE-2021-47255, the Linux kernel vulnerability affects KVM LAPIC: a read access path in kvm_lapic_reg_read could touch bytes 4–15 of an APIC register, risking leakage of kernel stack contents. The issue was resolved by restoring a guard removed in a prior commit and aligning with the SDM requi...

CVE-2021-47290

CVE-2021-47290 affects the Linux kernel SCSI target path (XCOPY completion) where a NULL pointer dereference could occur due to an NULL se_tpg_wwn pointer in the extended copy workflow. The root cause is that LIO’s EXTENDED COPY worker dispatches reads/writes via a global xcopy_pt_tpg, which may ...

CVE-2021-47306

CVE-2021-47306 pertains to the Linux kernel FDDI driver: in net: fddi: fza_probe, the private data fp of a netdev is used after a free_netdev() call, causing a use-after-free (UAF). The fix reorders cleanup by moving free_netdev() after the error handling message to prevent UAF. Multiple connecte...

CVE-2021-47367

Affected software: Linux kernel virtio-net component. Issue: when using build_skb() in big mode, unused pages chained via private in big mode were not released, causing page leakage. Root cause: failure to release those pages after skb construction in big mode. Impact: potential resource leak; CV...

CVE-2021-47447

The CVE-2021-47447 issue concerns the Linux kernel DRM MSM A3XX driver: drm/msm/a3xx_gpu_init() contained error paths that returned 1 on failure instead of a negative error code, and a check for ret != -ENODATA failed because ret was 1, risking an Oops in the caller. Astra Linux advisory confirms...

CVE-2021-47510

CVE-2021-47510 affects the Linux kernel's btrfs implementation. A write-hole during tree-log node freeing on zoned devices can trigger a transaction abort (-11) with -EAGAIN when the tree-log depth is ≥ 2, causing write failures during fsync/write paths. The issue is fixed by correctly re-dirtyin...

CVE-2021-47530

CVE-2021-47530: Linux kernel vulnerability in drm/msm where the submitqueue reference leak was not dropped across all paths, notably when the fence had already signaled. The fix (described as extracting a helper to normalize handling across different returns) resolves the leak. Public advisories ...

CVE-2021-47536

CVE-2021-47536 (Linux kernel, net/smc) is confirmed fixed. The issue was in smc_lgr_cleanup_early, which intended to delete a link group from the link group list but mistakenly deleted the list head. This caused memory corruption because the actual link group remained in the list and was later me...

CVE-2021-47554

CVE-2021-47554 affects the Linux kernel vdpa_sim code. Root cause: in error paths of vdpasim_create(), an uninitialized iova_domain could be freed, causing a NULL pointer dereference when put_iova_domain is executed, potentially crashing the system. The fix requires iova_domain to be initialized ...

CVE-2021-47567

CVE-2021-47567 describes a Linux kernel vulnerability in the powerpc/32 code where a vmap stack overflow could lead to a hard lockup when the data MMU is not active. The root cause is that emergency_ctx was accessed with a virtual address during MMU inactivity; the fix uses a physical address ins...

CVE-2022-3636

CVE-2022-3636 is a Linux kernel vulnerability affecting the function __mtk_ppe_check_skb in drivers/net/ethernet/mediatek/mtk_ppe.c (Ethernet Handler). The issue is a use-after-free in the MTK PPE path, leading to potential corruption or crash. A patch is recommended to fix the issue. The vulnera...

CVE-2022-48671

CVE-2022-48671 affects the Linux kernel in the cgroup subsystem: a missing cpus_read_lock() in cgroup_attach_task_all() allowed a deadlock with threadgroup_rwsem, mitigated by adding cpus_read_lock() (aligned with cgroup_procs_write_start()). The issue was observed by syzbot at cpuset_attach() an...

CVE-2022-48706

The CVE-2022-48706 entry concerns the Linux kernel and a memory-leak in the virtual data path (vdpa) IFCVF path. Root cause: ifcvf_mgmt_dev leaks memory if not freed on exit and the existing cleanup in ifcvf_init_hw does not handle it, so the fix adds proper cleanup at the return path to ensure m...

CVE-2022-48861

CVE-2022-48861 is a Linux kernel use-after-free vulnerability in the vdpa/vp_vdpa path. When the vp_vdpa driver is unbound, vp_vdpa is freed in vdpa_unregister_device, after which vp_vdpa->mdev.pci_dev is dereferenced in vp_modern_remove, causing a use-after-free. The provided call traces show...

CVE-2022-49069

The CVE-2022-49069 issue affects the Linux kernel’s DRM AMD Display path, where a general protection fault was observed when WebGL Aquarium ran for extended periods. The provided technical details show the root cause as a calculation/validation path in dcn30_internal_validate_bw, leading to fault...

CVE-2022-49169

CVE-2022-49169 concerns the Linux kernel’s f2fs module and a race/lock issue that could cause a hang. The connected advisories document that the fix is to replace a mutex-based path with a spin_lock, specifically to avoid hang scenarios in f2fs when handling certain task reads and statistics oper...

CVE-2022-49192

Technical details about CVE-2022-49192 are not publicly available in the provided Connected documents. The CVE entry describes a fix in cpsw but lacks vendor/product/version specifics, exploit info, or remediation steps beyond the general change. Monitor for updates.

CVE-2022-49496

The CVE-2022-49496 entry concerns the Linux kernel Mediatek vcodec driver (mtk_vcodec_dec). If the driver runs in subdev mode, dev->pm.dev can be NULL during mtk_vcodec_dec_remove, causing a kernel crash on rmmod mtk-vcodec-dec.ko. All connected documents describe the crash scenario and indica...

CVE-2022-49528

CVE-2022-49528 pertains to the Linux kernel: the dw9714 I2C regulator driver regression during probe could leave the regulator enabled, triggering a warning path in regulator core and a failed probe. The vulnerability arises from not disabling the regulator in error handling, which can lead to a ...

CVE-2022-49706

CVE-2022-49706—zonefs contains a read handling bug in zonefs_iomap_begin() where a readahead to a zone file with an offset equal to the current file size can set iomap type to IOMAP_UNWRITTEN with length 0, triggering a WARN_ON in iomap_iter and causing iomap_readahead() to loop. The patch fixes ...

CVE-2022-49762

CVE-2022-49762: In the Linux kernel, ntfs_attr_find() can overflow when iterating ATTR_RECORDs in MFT records, due to adding le32_to_cpu(a->length) to the current pointer and wrapping on 32‑bit systems. A patch adds bounds checks when computing the end address of the current ATTR_RECORD to pre...

CVE-2022-49833

The CVE-2022-49833 issue affects the Linux kernel's btrfs zoned handling: when cloning a btrfs_device, the associated btrfs_zoned_device_info is not cloned for zoned filesystems, which can lead to a NULL pointer dereference when accessing the device’s zone_info (e.g., when activating a zone). The...

CVE-2022-49845

CVE-2022-49845 – Linux kernel CAN/j1939 header initialization fix . The issue related to can: j1939_send_one() involved uninitialized CAN header fields in CAN frames created for j1939 messages, exposing a read access to canxl_frame::len due to uninitialized reserved and later-filled fields in str...

CVE-2022-49889

In CVE-2022-49889, the Linux kernel ring-buffer wake path could dereference a NULL or invalid buffer when waking waiters during ring-buffer shutdown on systems where listed CPUs > online CPUs. The fix adds a NULL check for the buffer and validates the allocation against online CPUs; it also no...

CVE-2022-49942

CVE-2022-49942 affects the Linux kernel wifi/mac80211 code. The issue occurs when CSA (channel switch announcement) is finalized in IBSS mode while the device is not connected to a channel; the BSS list is empty, cfg80211_get_bss() can return NULL, triggering a WARN_ON() in ieee80211_ibss_csa_bea...

CVE-2022-49943

In CVE-2022-49943, the Linux kernel USB gadget udc_mutex scope was too large, allowing a lockdep alert/circular locking dependency when the gadget core invoked driver bind/unbind or started/stopped a UDC. The root cause is a widened udc_lock footprint that protected udc->driver among other thi...

CVE-2022-49944

CVE-2022-49944 : Linux kernel USB Type-C UCSI code regression caused NULL dereference when reading the power supply sysfs due to a change in error handling after the commit that added ucsi_unregister_connectors(); the stale sysfs entry remained with NULL ops. The fix is a straight revert of that ...

CVE-2022-49946

CVE-2022-49946 affects the Linux kernel component handling Raspberry Pi clocks (clk: bcm: rpi). The vulnerability arises in raspberrypi_discover_clocks() where the loop relies on the last clock element’s id being zero, a property not guaranteed by Videocore firmware, which could lead to an out-of...

CVE-2022-50002

CVE-2022-50002 concerns the Linux kernel where the LAG logic for MLX5 was fixed so that MLX5_LAG_FLAG_NDEVS_READY is set only when both netdevices are registered. The root cause was an asymmetry in how the flag is set vs cleared, which could leave the ready state set after one PF is unloaded, lea...

CVE-2022-50011

The CVE-2022-50011 issue affects the Linux kernel code path used by the Venus driver, where the OPP (Operating Performance Points) core warns during probe due to misordered configuration options. The root cause is that the OPP core expects all configuration options to be provided before the OPP t...

CVE-2022-50019

CVE-2022-50019 concerns the Linux kernel tty: serial path, specifically the ucc_uart.c refcount leak. In soc_info(), of_find_node_by_type() may return a node pointer with an incremented refcount that is not released, leading to a resource leak. The documented fix is to call of_node_put() when the...

CVE-2022-50036

CVE-2022-50036 affects the Linux kernel component drm/sun4i: dsi. The underflow occurred when computing packet sizes due to subtracting packet overhead with unsigned arithmetic; with a short sync pulse the subtraction could wrap to a large unsigned value. The remediation is a fix that uses signed...

CVE-2022-50084

CVE-2022-50084 - Kernel dm-raid KASAN warning fix Context: Linux kernel vulnerability resolved in the dm-raid area, where an AddressSanitizer slab-out-of-bounds read could occur in raid_status. The fault manifested as a read of 4 bytes from conf->max_nr_stripes when mddev->private was cast ...

CVE-2022-50137

CVE-2022-50137 (Linux kernel) affects RDMA/irdma by a window for use-after-free during CQ destruction. An interrupt could cause CQE processing after CQ resources are freed by irdma_cq_free_rsrc(). The fix moves irdma_cq_free_rsrc() to run after irdma_sc_cleanup_ceqes() (which executes under cq_lo...

CVE-2022-50158

CVE-2022-50158 relates to the Linux kernel vulnerability in mtd: partitions where of_get_child_by_name() returns a node pointer with an incremented refcount and is not put back, leading to a refcount leak. The issue is fixed by adding a missing of_node_put() when the pointer is no longer needed. ...

CVE-2022-50166

CVE-2022-50166 affects the Linux kernel Bluetooth HCI subsystem. When the HCI work queue is drained, a delayed command could still be queued to the drained workqueue, triggering a timeout in hci_cmd_timeout and a kernel warning. The root cause is the draining of the command/event/data processing ...

CVE-2023-3359

CVE-2023-3359 concerns the Linux kernel’s brcm_nvram_parse in drivers/nvmem/brcm_nvram.c, where the return value of kzalloc() is not checked, potentially causing a NULL pointer dereference. The issue is listed with a local attack vector and a high availability impact (CVSS v3.1: AV:L/AC:L/PR:L/UI...

CVE-2023-52748

CVE-2023-52748 is a Linux kernel vulnerability related to f2fs. The issue stems from a format-overflow during a call to sprintf in fs/f2fs/compress.c within f2fs_init_page_array_cache, triggered when formatting the string "f2fs_page_array_entry-%u:%u" with MAJOR(dev) and MINOR(dev). The computed ...

CVE-2023-52900

CVE-2023-52900: Linux kernel nilfs2 vulnerability in nilfs_btree_insert() can cause a general protection fault when a corrupted disk image leads __nilfs_btree_get_block() to return -ENOENT. The patch changes this to -EINVAL, causing subsequent b-tree operations to report corruption and return -EI...

CVE-2023-52901

The CVE-2023-52901 entry affects the Linux kernel USB xHCI host controller handling. The vulnerability arises when URBs are queued to all endpoints while the host is unresponsive, risking a NULL pointer dereference and kernel panic if an endpoint is dereferenced after becoming invalid. The fix ad...

CVE-2023-53049

CVE-2023-53049 – Linux kernel USB-C/UCSI pointer dereference . A NULL pointer dereference in ucsi_connector_change() could occur if ucsi_init() failed and an event arrives via ucsi_acpi, dereferencing unable ucsi->connector. The fix prevents ntfy from being set until ucsi_init() succeeds, so e...

CVE-2023-53133

CVE-2023-53133 affects the Linux kernel’s BPF sockmap path (tcp_bpf_recvmsg_parser) where a 0-length recvmsg can loop indefinitely. The description and connected advisories confirm the root cause is an infinite loop when len is 0 and that the fix is to return 0 for length 0 in tcp_bpf_recvmsg_par...

CVE-2023-53135

The CVE-2023-53135 entry describes a Linux kernel vulnerability in riscv where, if CONFIG_FRAME_POINTER is unset, the stack unwinding function walk_stackframe may read the stack non-atomically in imprecise unwinding mode, enabling a KASAN-detected stack-out-of-bounds condition. The identified fix...

CVE-2023-53143

CVE-2023-53143 is a Linux kernel ext4 off-by-one fsmap bug for 1k-block filesystems. The crash stems from insufficient range validation in ext4_getfsmap_datadev when querying GETFSMAP, due to s_first_data_block being nonzero on 1k blocks, causing an underflow and invalid group calculation. A fix ...

CVE-2024-27060

The CVE-2024-27060 issue affects the Linux kernel Thunderbolt driver, specifically a NULL pointer dereference in tb_port_update_credits() when handling Thunderbolt 1 devices with a single lane. The crash path traces to tb_port_do_update_credits and related hotplug/scan routines, leading to kernel...

CVE-2024-35793

The CVE-2024-35793 issue affects the Linux kernel’s debugfs code (fs/debugfs) where remove cancellation/wait logic could deadlock during concurrent debugfs removal while files are being accessed. The root cause was that the loop triggering cancellations could never be entered due to incorrect ref...