CVE-2022-49650

The CVE-2022-49650 entry is a Linux kernel security fix for the dmaengine: qcom: bam_dma path. The root cause described is an unbalanced pm_runtime_get()/pm_runtime_put() when the BAM is controlled remotely, caused by a prior commit; the fix reverts that change and enables pm_runtime in all cases...

CVE-2022-49676

CVE-2022-49676 refers to a Linux kernel issue for the Samsung Exynos5422 DMC memory controller where a refcount leak in of_get_dram_timings could occur due to missing of_node_put() in error paths. The bug stems from of_parse_phandle() returning a node pointer with an incremented refcount that was...

CVE-2022-49762

CVE-2022-49762: In the Linux kernel, ntfs_attr_find() can overflow when iterating ATTR_RECORDs in MFT records, due to adding le32_to_cpu(a->length) to the current pointer and wrapping on 32‑bit systems. A patch adds bounds checks when computing the end address of the current ATTR_RECORD to pre...

CVE-2022-49792

CVE-2022-49792 corresponds to a Linux kernel vulnerability in the iio: adc MP2629 driver. The issue is a potential array out-of-bounds access, mitigated by adding a sentinel at the end of maps in the iio core. Affected component is the IIO subsystem’s mp2629 ADC path; root cause is improper bound...

CVE-2022-49810

The CVE-2022-49810 issue affects the Linux kernel netfs/xarray iteration under RCUp where missing xas_retry() checks could cause a NULL-pointer dereference in netfs_rreq_unlock and related code paths. Connected documents confirm the root cause in netfslib’s xarray iteration under RCU read lock an...

CVE-2022-49833

The CVE-2022-49833 issue affects the Linux kernel's btrfs zoned handling: when cloning a btrfs_device, the associated btrfs_zoned_device_info is not cloned for zoned filesystems, which can lead to a NULL pointer dereference when accessing the device’s zone_info (e.g., when activating a zone). The...

CVE-2022-49840

CVE-2022-49840 affects the Linux kernel's BPF test_run path (bpf_prog_test_run_skb) where an odd-sized user-supplied BPF program could trigger an alignment fault on aarch64 leading to use-after-free in skb handling. The issue is caused by unaligned access to skb_shared_info when KFENCE is enabled...

CVE-2022-49869

CVE-2022-49869 (bnxt_en): In the Linux kernel bnxt_hwrm_set_coal() may crash during error recovery because rtnl_lock isn’t held for the entire sequence, allowing freed datastructures. The fix uses BNXT_STATE_OPEN rather than netif_running() to ensure the device is fully operational before reconfi...

CVE-2022-49954

The CVE-2022-49954 issue concerns the Linux kernel and a race where, after clearing IFORCE_XMIT_RUNNING, wake_up was not invoked, causing a hung task in input handling (hang at __input_unregister_device() during iforce_close and input_disconnect_device()). The root cause per the provided descript...

CVE-2022-50000

CVE-2022-50000 affects the Linux kernel netfilter flowtable cleanup. The vulnerability arises when cleaning up the flowtable: if a flow entry already has pending HW stats/add work, the sequence may skip queuing HW del work, causing a stall on teardown and a potential use-after-free during flowtab...

CVE-2022-50084

CVE-2022-50084 - Kernel dm-raid KASAN warning fix Context: Linux kernel vulnerability resolved in the dm-raid area, where an AddressSanitizer slab-out-of-bounds read could occur in raid_status. The fault manifested as a read of 4 bytes from conf->max_nr_stripes when mddev->private was cast ...

CVE-2022-50185

In CVE-2022-50185, the Linux kernel drm/radeon path ni_set_mc_special_registers() is vulnerable to a potential buffer overflow. The last case label could write mc_reg_address[j] and mc_data[j] when j equals SMC_NISLANDS_MC_REGISTER_ARRAY_SIZE due to missing bounds checks after the last j++. The f...

CVE-2023-32249

The CVE-2023-32249 issue concerns ksmbd in the Linux kernel where guest users are no longer allowed on multichannel connections. The underlying fix changes behavior to return STATUS_NOT_SUPPORTED when the binding session is a guest, effectively preventing certain guest-mediated multichannel negot...

CVE-2023-52785

CVE-2023-52785 affects the Linux kernel, specifically the SCSI UFS core. The issue is a race between ufshcd_mcq_abort() and the ISR: when a command timeout occurs and a CQ complete IRQ arrives concurrently, ufshcd_mcq_abort clears lprb->cmd, leading to a NULL pointer dereference in the ISR. Th...

CVE-2023-52941

CVE-2023-52941 affects the Linux kernel can:isotp subsystem. The bug arose from the tx timer handling for isotp PDUs, where the timer served two roles: sending two consecutive frames with a gap and monitoring timeouts for flow control and echo frames. This caused more complex txstate checks and e...

CVE-2023-53032

CVE-2023-53032 concerns the Linux kernel netfilter/ipset bitmap_ip_create() overflow handling. When first_ip = 0, last_ip = 0xFFFFFFFF, and netmask = 31, the expression 2 <

CVE-2023-53092

The CVE-2023-53092 entry concerns a Linux kernel interconnect driver (exynos) where a node leak could occur in the PM QoS error path during probe. The documented fix ensures that the newly allocated interconnect node is added to the provider before the PM QoS request is applied, so that the node ...

CVE-2023-53178

CVE-2023-53178 affects the Linux kernel’s memory management path, specifically the mm/zswap.c writeback logic. The vulnerability is a race condition in the zswap writeback entry handling that can lead to memory corruption: a swapped-out page can be swapped back in with data from a different page....

CVE-2024-42146

CVE-2024-42146: Linux kernel DRM/XE vulnerability fixed by adding outer runtime PM protection to xe_live_ktest@xe_dma_buf. The issue arose because kunit tests performing memory access did not use outer runtime_pm protections, leaving inner callers unprotected. Root cause: missing outer runtime PM...

CVE-2024-42300

CVE-2024-42300 concerns the Linux kernel EROFS (fs/erofs/zutil.c) race in z_erofs_get_gbuf(). The issue arises when the current task can migrate to another CPU between z_erofs_gbuf_id() and spin_lock(&gbuf->lock), which allows z_erofs_put_gbuf() to trigger a kernel crash (BUG) observed in stre...

CVE-2024-57878

CVE-2024-57878 (Linux kernel, arm64) : The vulnerability in ptrace NT_ARM_FPMR regset handling could leave the temporary fpmr uninitialized for zero-length writes, potentially leaking up to 64 bits of kernel-stack memory. The patch initializes the temporary value before copying the regset from us...

CVE-2024-58075

Technical details for CVE-2024-58075 are not publicly provided in the supplied documents. No listed affected products, versions, or remediation are specified here. Monitor for updates from vendor advisories and security feeds.

CVE-2025-21874

CVE-2025-21874 is a Linux kernel vulnerability in dm-integrity, where in Inline mode the journal is unused and journal_sectors can be zero. Calculating the journal watermark divides by journal_sectors, which can trigger an OOPS during a simple dmsetup table query. The issue was observed on some s...

CVE-2025-37847

CVE-2025-37847: In the Linux kernel, a deadlock could occur in accel/ivpu during ivpu_ms_cleanup() when runtime resume acquires file_priv->ms_lock, leading to a cold boot path that calls ivpu_ms_cleanup_all(). The issue is resolved by preventing runtime resume after ms_lock is acquired, avoidi...

CVE-2025-37868

Technical details beyond the initial Linux kernel description are not provided in the connected documents. Monitor for updates; this entry notes a fix for notifier vs folio deadlock in drm/xe/userptr in the Linux kernel, cherry-picked from a commit.

CVE-2025-37971

CVE-2025-37971 in the Linux kernel, under the staging/bcm2835-camera path, is caused by failing to initialise dev->v4l2_dev.dev, which leads to a NULL pointer dereference in mmal_init. The fix updates bcm2835_mmal_probe to initialise dev->v4l2_dev.dev (instead of relying on v4l2_device_regi...

CVE-2025-38039

CVE-2025-38039 affects the Linux kernel's net/mlx5e driver in scenarios where MQPRIO is enabled while HTB offload is already configured. The vulnerability arises when the driver previously returned -EINVAL and triggered a WARN_ON, potentially generating a call trace. A patch was applied to handle...

CVE-2025-38045

CVE-2025-38045 is a Linux kernel vulnerability affecting the wifi driver (iwlwifi). The issue arises from an incorrect order of debug actions; the fix adds a dump split and executes the FW reset in the middle of the dump rather than causing the FW to kill itself on error. This change means that s...

CVE-2025-38048

CVE-2025-38048 is a Linux kernel data-race in virtio_ring related to event_triggered. The issue, observed as a KCSAN data race between virtqueue_enable_cb_delayed() and virtqueue_disable_cb_split/packed() when the event_triggered flag is read/written, could cause an unreliable hint about interrup...

CVE-2025-38131

CVE-2025-38131 affects the Linux kernel coresight subsystem. The issue arises when enabling an active config via cscfg_csdev_enable_active_config() but the config could be deactivated via configfs/sysfs during unloading, potentially leading to use-after-free of config_desc after the module unload...

CVE-2025-38238

The CVE-2025-38238 issue affects the Linux kernel SCSI fnic driver, where a crash could occur when both FDMI RHBA and RPA requests time out and a frame is reused to send ABTS, leading to a double-free on completion. The fix allocates separate frames for RHBA and RPA and updates the ABTS handling ...

CVE-2025-38272

CVE-2025-38272 : In the Linux kernel, the bcm63xx DSA switch could attempt to enable EEE on external PHYs connected to multiple RGMII ports, causing a system hang when accessing non-existent EEE registers. The fix is to gate EEE configuration by actually checking switch support before enabling it...

CVE-2025-38291

CVE-2025-38291 concerns the Linux kernel wifi driver ath12k. The issue arises when the host erroneously sends WMI commands to the firmware during a firmware crash/recovery, which can trigger a kernel call trace. The documented fix is to set ATH12K_FLAG_CRASH_FLUSH and ATH12K_FLAG_RECOVERY when th...

CVE-2025-38310

CVE-2025-38310 refers to a Linux kernel vulnerability in seg6 where validation of nexthop addresses could read uninitialized memory if the provided length exceeded the actual data; the fix enforces that the provided length exactly matches the specified length. The connected advisories confirm the...

CVE-2025-38313

CVE-2025-38313 affects the Linux kernel in the bus: fsl-mc path. The issue is a double-free of mc_dev on error paths when the MC device is a DPRC, where mc_bus is allocated and mc_dev points to one field; only the mc_bus should be freed in that path. The description notes a fix/workaround impleme...

CVE-2025-38319

CVE-2025-38319 affects the Linux kernel’s DRM/AMD/PP path. The vulnerability arises because atomctrl_initialize_mc_reg_table() and atomctrl_initialize_mc_reg_table_v2_2() do not validate the return value of smu_atom_get_data_table(); if that call fails to obtain vram_info and returns NULL, a NULL...

CVE-2025-38355

CVE-2025-38355 involves the Linux kernel DRM/xe path where deferred GGTT node removals could be drained later than device unwinding, potentially unmapping MMIO/GSM mappings during unwinding and causing a page fault. The fixes add a managed-device action to explicitly drain the ggtt node removals ...

CVE-2025-38385

Summary: CVE-2025-38385 affects the Linux kernel in the LAN78xx USB Ethernet driver, where a WARN can be triggered during USB disconnect when NAPI is still enabled. Root cause (per provided data): In the disconnect path, netif_napi_del() was redundantly called even though unregister_netdev() hand...

CVE-2025-38389

CVE-2025-38389 affects the Linux kernel i915 DRM stack (drm/i915/gt). The vulnerability arises when ring submission allocation fails during VMA allocation, leaving the engine’s legacy timeline referenced and not released on driver unbind, potentially causing a left-held timeline and related insta...

CVE-2025-38419

In CVE-2025-38419, Linux kernel remoteproc core fixes a resource leak: when rproc_attach() runs with rproc->state = RPROC_DETACHED and rproc_handle_resources() fails, resources allocated by imx_rproc_prepare() were not released. The mitigation is a code change in rproc_attach() to route to cle...

CVE-2025-38451

CVE-2025-38451 affects the Linux kernel’s md/md-bitmap code. The issue caused a GPF in bitmap_get_stats() when handling external or internal bitmaps due to missing super-block validation. The fix adds a super-block existence check for both internal and external cases, preventing the non-canonical...

CVE-2025-38490

CVE-2025-38490 – Linux kernel : The vulnerability concerns the page_pool_put_full_page() call in net: libwx, where pages could be double-freed, potentially causing a kernel panic. The fix removes the duplicate page_put path so pages are reused unless freeing Rx buffers or building a skb when the ...

CVE-2025-38546

CVE-2025-38546 (Linux kernel: ATM clip memory leak) The vulnerability is in the ATM subsystem’s clip code. The ioctl ATMARPD_CTRL path assigns NULL to vcc->push(), which breaks the expected cleanup path and leaks memory for the allocated struct clip_vcc during ATMARP handling. The root cause i...

CVE-2025-39718

CVE-2025-39718 affects the Linux kernel’s vsock/virtio handling. The issue arises when receiving a vsock packet: virtio_vsock_skb_rx_put() uses the packet header length as the skb_put() length without proper validation, risking an SKB overflow if the header length is not trustworthy. The fix vali...

CVE-2026-46291

CVE-2026-46291 affects the Linux kernel crypto caam path, specifically hash_digest_key, where HMAC key bytes could be exposed via hex dumps when dynamic debugging is enabled. The reported fix changes the dumping approach to use print_hex_dump_devel() to avoid leaking sensitive HMAC key material a...

CVE-2003-0462

CVE-2003-0462 is a race condition in the Linux 2.4 kernel where env_start/env_end pointers used by the execve path (fs/proc/base.c) can lead to a local denial of service (kernel crash). Documented for several 2.4.x architectures (notably i386/alpha) and tracked in multiple advisories (e.g., Debia...

CVE-2005-0449

Technical details beyond the CVE description are not provided in the connected documents; monitor for updates.

CVE-2005-2456

CVE-2005-2456 refers to an array index overflow in the Linux kernel 2.6, in xfrm_user.c within xfrm_sk_policy_insert. A local user can trigger the overflow by supplying a p->dir value larger than XFRM_POLICY_OUT, causing writes beyond sock->sk_policy and resulting in a kernel crash (DoS) an...

CVE-2005-2490

CVE-2005-2490 describes a stack-based buffer overflow in the Linux kernel 2.6 sendmsg() path prior to 2.6.13.1. Local users could cause arbitrary code execution by calling sendmsg and altering message contents in another thread. Public sources in the connected documents corroborate the vulnerabil...

CVE-2007-0958

CVE-2007-0958 : In Linux kernel 2.6.x before 2.6.20, local users can read unreadable binaries by abusing the PT_INTERP interpreter mechanism, triggering a core dump. This is a local-privilege issue; the described impact is to read binaries via core-dump behavior. According to the changelog refere...