CVE-2010-4648

CVE-2010-4648 affects the Linux kernel wireless orinoco driver (orinoco_ioctl_set_auth in drivers/net/wireless/orinoco/wext.c) prior to 2.6.37, where TKIP protection was not correctly implemented. This could allow a remote attacker to read Wi‑Fi frames and gain access to the network. The issue is...

CVE-2011-3593

CVE-2011-3593 : The Linux kernel 2.6.32 on Red Hat Enterprise Linux 6 is affected by a vulnerability in the VLAN patch within net/8021q/vlan_core.c (vlan_hwaccel_do_receive). This enables remote attackers to cause a denial of service (system crash) via priority-tagged VLAN frames. Connected advis...

CVE-2013-0313

CVE-2013-0313 affects the Linux kernel: when EVM is enabled, the evm_update_evmxattr function in security/integrity/evm/evm_crypto.c in versions before 3.7.5 is vulnerable to a local-denial-of-service via an attempted removexattr operation on a sockfs inode, causing a NULL pointer dereference and...

CVE-2015-8950

CVE-2015-8950 affects the Linux kernel (arch/arm64/mm/dma-mapping.c) prior to 4.0.3, where uninitialized data structures in the ION memory-management path can be exposed via dma_mmap. This local-access vulnerability could allow a non-privileged user to read kernel memory. The public references in...

CVE-2021-4218

CVE-2021-4218 concerns a flaw in the Linux kernel related to reading the SVC RDMA counters. The vulnerability occurs when a local attacker with access triggers reading the counter via a sysctl, which panics the system and can cause a denial of service during reboot. The issue is described as spec...

CVE-2021-47088

CVE-2021-47088 concerns the Linux kernel where the DAMON debugfs interface could trigger a use-after-free by destructing monitoring targets without holding the required lock. The root cause was iterating targets in dbgfs_target_ids_read() while also destroying them in dbgfs_before_terminate() wit...

CVE-2021-47096

CVE-2021-47096 affects the Linux kernel ALSA rawmidi/sequencer component. The issue is a bug in the open() path where the user_pversion field for the user-space file structure was left uninitialized due to kmalloc usage for the file private structure; the ALSA sequencer code later clears the file...

CVE-2021-47120

CVE-2021-47120 : Linux kernel HID issue where Apple Magic Trackpad/Mouse disconnect could dereference an uninitialized driver pointer due to a faulty disconnect path. The patch added a sanity check but returned success instead of -ENODEV when the check failed, causing a potential NULL-deref on dr...

CVE-2021-47233

Summary of CVE-2021-47233 (Linux kernel): The issue is a NULL pointer dereference in regulator rt4801 when priv->enable_gpios is NULL, with devm_gpiod_get_array_optional possibly returning NULL if no GPIO is assigned. The vulnerability has been resolved in the Linux kernel; multiple advisories...

CVE-2021-47242

CVE-2021-47242 affects the Linux kernel and is tied to a fix for an issue in MPTCP subflow error reporting. The root cause was a soft lookup caused when subflow_error_report() attempted to acquire mptcp_data_lock across call paths that could already hold other locks, triggering a soft lockup unde...

CVE-2021-47255

In CVE-2021-47255, the Linux kernel vulnerability affects KVM LAPIC: a read access path in kvm_lapic_reg_read could touch bytes 4–15 of an APIC register, risking leakage of kernel stack contents. The issue was resolved by restoring a guard removed in a prior commit and aligning with the SDM requi...

CVE-2021-47305

In CVE-2021-47305, the Linux kernel’s dma-buf/sync_file implementation leaks fences on error paths due to missing dma_fence_put() calls when merging fences and in krealloc_array failure. The fix ensures i and the fences array are zero-initialized and that all fences are dma_fence_put() and the fe...

CVE-2021-47524

CVE-2021-47524 : In the Linux kernel, the serial driver (liteuart) leaked a minor number on probe errors. The fix ensures the allocated minor number is released before returning from probe errors. This entry is tied to kernel versions affected by the liteuart minor-number leak and has been resolv...

CVE-2021-47554

CVE-2021-47554 affects the Linux kernel vdpa_sim code. Root cause: in error paths of vdpasim_create(), an uninitialized iova_domain could be freed, causing a NULL pointer dereference when put_iova_domain is executed, potentially crashing the system. The fix requires iova_domain to be initialized ...

CVE-2021-47585

CVE-2021-47585 concerns a memory leak in the Linux kernel's btrfs __add_inode_ref path. The issue arises from allocating victim_name with kmalloc at two points (lines 1104 and 1169) and returning from the function without freeing the previously allocated memory when backref_in_log() returns an er...

CVE-2021-47591

CVE-2021-47591 affects the Linux kernel. The vulnerability arises from the TCP_ULP setsockopt mechanism, which is no longer supported for MPTCP as it is already used internally to connect subflow sockets to the MPTCP layer. In syzbot testing, a crash (KASAN null dereference) was observed on mptcp...

CVE-2022-48644

Summary (CVE-2022-48644): A Linux kernel net/sched taprio offload bug could crash the kernel when disabling offload if flags were left at TAPRIO_FLAGS_INVALID after an error path. The code evaluated FULL_OFFLOAD_IS_ENABLED(q->flags) on an invalid flag value (U32_MAX), causing a crash when tapr...

CVE-2022-48645

CVE-2022-48645 – Linux kernel ENETC offload: The TSN features (taprio, cbs, gate, police) could be configured via PF registers but were not intended to be accessible from VFs. Accessing VF-exposed registers could trigger kernel paging faults and a crash. The fix split enetc_setup_tc() into separa...

CVE-2022-48657

CVE-2022-48657 is a Linux kernel vulnerability affecting the arm64 topology code. The root cause is an overflow risk in amu_fie_setup due to cpufreq_get_hw_max_freq() returning the max frequency in kHz as an unsigned int, while freq_inv_set_max_ratio() expects that value in Hz as a 64-bit type. M...

CVE-2022-48727

CVE-2022-48727 affects the Linux kernel KVM arm64 code. When exceptions other than IRQ occur, ESR_EL2 is updated; if an IRQ synchronises an SError, the vcpu ESR may become stale and ELR_EL2 could be corrupted, risking duplication of guest instructions. The fix ensures ARM_EXCEPTION_CODE() is chec...

CVE-2022-48779

In the Linux kernel, a use-after-free was fixed in the net: mscc: ocelot driver (ocelot_vlan_del). The bug occurred because ocelot_vlan_member_del() freed the ocelot_bridge_vlan struct which could still be accessed via the port’s pvid_vlan. The fix determines whether to clear ocelot_port->pvid...

CVE-2022-48907

CVE-2022-48907 is a Linux kernel memory-leak bug in the auxdisplay LCD2S path. The issue was that the lcd2s_data struct was allocated but never freed in ->remove(), allowing memory to leak. The fix switches allocation to devm_kzalloc(), ensuring automatic freeing with device lifecycle. Affecte...

CVE-2022-49069

The CVE-2022-49069 issue affects the Linux kernel’s DRM AMD Display path, where a general protection fault was observed when WebGL Aquarium ran for extended periods. The provided technical details show the root cause as a calculation/validation path in dcn30_internal_validate_bw, leading to fault...

CVE-2022-49117

The CVE-2022-49117 issue is in the Linux kernel (mips/ralink): a refcount leak in ill_acc_of_setup() that requires of_node_put(np) when pdev == NULL. The vulnerability is addressed by applying the fix that ensures proper reference counter management, preventing the leak and potential use-after-fr...

CVE-2022-49202

CVE-2022-49202 concerns a missing NULL check in Linux kernel Bluetooth hci_uart path (h5_enqueue), where a Syzbot general protection fault occurred in __pm_runtime_resume() due to blindly passing a possibly NULL serdev pointer (hu->serdev). The issue could lead to GPF if hu->serdev is NULL....

CVE-2022-49252

Technical details for CVE-2022-49252 are not present in the provided documents. The connected Astra/SUSE/EUVD entries reference kernel issues but do not disclose specifics for this CVE. Monitor for updates in the supplied feeds.

CVE-2022-49400

CVE-2022-49400 concerns a Linux kernel RAID subsystem issue where in reshape the code path freed the mddev and set mddev->private to NULL, causing NULL dereference when a new raid tried to reuse mddev. The fix is to remove the code path that sets mddev->private to NULL in raid0_free, preven...

CVE-2022-49477

CVE-2022-49477 affects the Linux kernel’s ASoC Samsung code for aries_audio_probe. The vulnerability arises from a refcount leak: of_parse_phandle() returns a node pointer with an incremented refcount, and of_node_put() must be called on it when done. If extcon_find_edev_by_node() fails, of_node_...

CVE-2022-49628

Linux kernel CVE-2022-49628 concerns the net: stmmac driver leaking resources during probe. Connected documents confirm the vulnerability and provide a fix: two error paths in probe are corrected to clean up before returning, addressing leaks in the probe sequence. The affected component is the L...

CVE-2022-49650

The CVE-2022-49650 entry is a Linux kernel security fix for the dmaengine: qcom: bam_dma path. The root cause described is an unbalanced pm_runtime_get()/pm_runtime_put() when the BAM is controlled remotely, caused by a prior commit; the fix reverts that change and enables pm_runtime in all cases...

CVE-2022-49676

CVE-2022-49676 refers to a Linux kernel issue for the Samsung Exynos5422 DMC memory controller where a refcount leak in of_get_dram_timings could occur due to missing of_node_put() in error paths. The bug stems from of_parse_phandle() returning a node pointer with an incremented refcount that was...

CVE-2022-49797

CVE-2022-49797 concerns the Linux kernel tracing subsystem. The vulnerability is a potential NULL pointer dereference in the kprobe path: when trace_get_event_file() fails, gen_kretprobe_test may be marked as the error code, and if the kprobe_event_gen_test module is removed, a dereference can oc...

CVE-2022-49814

CVE-2022-49814 affects the Linux kernel KCM (kernel-based communications) sockets. The issue is a race on sk_receive_queue where the RX path for KCM sockets uses mux->rx_lock to protect more than just the skb queue, but kcm_recvmsg() only reuses the skb queue lock, leaving a window for race co...

CVE-2022-49900

CVE-2022-49900 affects the Linux kernel i2c piix4 driver. In the single-adapter removal path, piix4_adapter_count is not set (default zero) during piix4_probe(), so piix4_remove() fails to remove the adapter, leaking resources (i2c client and device). This can allow leaked adapters to be accessed...

CVE-2022-49946

CVE-2022-49946 affects the Linux kernel component handling Raspberry Pi clocks (clk: bcm: rpi). The vulnerability arises in raspberrypi_discover_clocks() where the loop relies on the last clock element’s id being zero, a property not guaranteed by Videocore firmware, which could lead to an out-of...

CVE-2022-50002

CVE-2022-50002 concerns the Linux kernel where the LAG logic for MLX5 was fixed so that MLX5_LAG_FLAG_NDEVS_READY is set only when both netdevices are registered. The root cause was an asymmetry in how the flag is set vs cleared, which could leave the ready state set after one PF is unloaded, lea...

CVE-2022-50112

The CVE-2022-50112 issue concerns the Linux kernel: a refcount leak in rpmsg qcom_smd parsing logic. Specifically, of_parse_phandle() returns a node pointer with an incremented refcount, which must be balanced with of_node_put() when the node is no longer needed. The vulnerability affects the ker...

CVE-2023-52776

CVE-2023-52776 affects the Linux kernel wifi driver ath12k (DFS radar and temperature event handling). The root cause was that DFS-radar and temperature event code calling ath12k_mac_get_ar_by_pdev_id() was not in an RCU read-side critical section, risking use-after-free scenarios. The fix marks ...

CVE-2023-52910

Summary (CVE-2023-52910) : In the Linux kernel’s iommu/iova, a defect in __alloc_and_insert_iova_range can cause an overflow when retry_pfn is updated. This can allow allocation to succeed incorrectly if retry_pfn overflows (scenario 1: first iova exceeds domain size; scenario 2: domain node with...

CVE-2023-52983

The CVE-2023-52983 issue affects the Linux kernel’s bfq (multiqueue block I/O) subsystem. It describes a use-after-free (UAF) where bic_set_bfqq() could access a bfqq after it had been freed in certain contexts. The root cause was that bfqq was freed in the wrong place relative to bic_set_bfqq(),...

CVE-2023-53092

The CVE-2023-53092 entry concerns a Linux kernel interconnect driver (exynos) where a node leak could occur in the PM QoS error path during probe. The documented fix ensures that the newly allocated interconnect node is added to the provider before the PM QoS request is applied, so that the node ...

CVE-2024-24864

Technical details about CVE-2024-24864 are not provided in the supplied connected documents. Monitor for updates and forthcoming disclosures.

CVE-2024-35792

CVE-2024-35792 refers to a Linux kernel issue in the crypto/rk3288 path where a use-after-free could occur due to an incorrect call order. The description in the connected documents states: the unprepare call must be carried out before the finalize call, as the finalize can free the request. The ...

CVE-2024-35873

CVE-2024-35873 is a Linux kernel vulnerability affecting the RISC-V vector state handling during rt_sigreturn. A bug in the restoration path with vector state discard could cause the live vector state and vstate to diverge, and when the vectorized path of user_from_copy() is chosen (CONFIG_RISCV_...

CVE-2024-38551

CVE-2024-38551 : In the Linux kernel, the ASoC Mediatek path assigns a dummy codec to a DAI link if no real codec is present, to avoid NULL pointer errors during string comparisons. This vulnerability was resolved by the kernel fix described in the initial document, with MediaTek sound card drive...

CVE-2024-38563

CVE-2024-38563 affects the Linux kernel wifi driver for the MT76 MT7996. When reading the chip temperature, a memory leak could occur prior to the fix. The issue is resolved by a kernel commit that patches the MT7996 temperature-reading path; details are in the vendor/kernel advisories and linked...

CVE-2024-40926

CVE-2024-40926 affects the Linux kernel DRM Nouveau driver. The issue occurs when runtime PM resumes on headless cards that lack display hardware, where hpd_work and hpd_lock are left uninitialized and scheduling hpd_work triggers a BUG. The patch adds a headless flag to DRM and instructs the sys...

CVE-2024-41003

The CVE-2024-41003 entry concerns a Linux kernel BPF verifier bug: after a prior OR, line 19 triggers a REG INVARIANTS VIOLATION due to a corrupted fake_reg when reg_set_min_max is applied to a known-constant branch. The issue arises in the BPF subsystem’s handling of register invariants during a...

CVE-2024-42072

Summary of CVE-2024-42072 (Linux kernel, bpf may_goto with negative offset) The issue, reported through the Linux kernel, stems from two bugs exposed by a syzbot-facilitated bpf program: (1) the patching of may_goto when the offset is negative, which requires a different handling; and (2) a verif...

CVE-2024-49573

CVE-2024-49573 relates to the Linux kernel scheduler (sched/fair.c). The fix patches NEXT_BUDDY handling in pick_next_entity() by moving clear_buddies() before the delayed dequeue logic and ensuring no new next buddy starts as delayed. This addresses a WARN triggered by enabling NEXT_BUDDY, with ...