CVE-2009-1360

CVE-2009-1360 affects the Linux kernel prior to 2.6.29 when Network Namespace Support (NET_NS) is enabled. The vulnerability lies in __inet6_check_established in net/ipv6/inet6_hashtables.c, where crafted IPv6 traffic can trigger a NULL pointer dereference, enabling remote denial of service (syst...

CVE-2009-2846

CVE-2009-2846 affects the eisa_eeprom_read function in the parisc isa-eeprom driver (drivers/parisc/eisa_eeprom.c) of the Linux kernel prior to 2.6.31-rc6. A negative ppos argument bypasses a positive-ppos check, leading to an out-of-bounds read in readb and allowing local users to access restric...

CVE-2010-1451

CVE-2010-1451 affects the SPARC build of the Linux kernel prior to 2.6.33, where TSB I-TLB load handling in arch/sparc/kernel/tsb.S fails to correctly obtain the _PAGE_EXEC_4U bit, resulting in an incompletely implemented non-executable stack. This could allow context-dependent local attackers to...

CVE-2011-4917

CVE-2011-4917 : Information disclosure in the Linux kernel up to 3.1 via /proc/stat. Local access required; low attack complexity with LOW privileges and partial confidentiality impact (CVSS v3.1 base score 5.5). Root cause: kernel information leakage through /proc/stat. Affected product: Linux k...

CVE-2013-0290

The vulnerability CVE-2013-0290 affects the Linux kernel up to version 3.7.x (fixed in 3.8) and is due to how __skb_recv_datagram() in net/core/datagram.c handles MSG_PEEK when data length is zero. A local unprivileged user can trigger an infinite loop, causing a denial of service (system hang). ...

CVE-2013-4254

The CVE-2013-4254 issue affects the Linux kernel on ARM where the validate_event function in arch/arm/kernel/perf_event.c before 3.10.8 can be triggered by adding a hardware event to an event group led by a software event, allowing local privilege escalation or causing a NULL pointer dereference ...

CVE-2016-5343

CVE-2016-5343 affects the Linux kernel driver drivers/soc/qcom/qdsp6v2/voice_svc.c (QDSP6v2 Voice Service) used in Qualcomm MSM Android contributions. The vulnerability is a buffer overflow in voice_svc_send_req triggered by a write request, which can cause memory corruption and enable a denial o...

CVE-2017-0568

CVE-2017-0568 is a Broadcom Wi‑Fi driver elevation-of-privilege issue in Android kernels (3.10/3.18). An attacker controlling the dongle can abuse WLC_GET_VALID_CHANNELS results to inflate list->count, causing an out‑of‑bounds write when populating default_chan_list and enabling arbitrary code...

CVE-2021-47147

CVE-2021-47147 affects the Linux kernel (ptp: ocp). The issue is a resource leak in an error path after a successful pci_ioremap_bar() unless a corresponding pci_iounmap() is invoked, as implemented in the remove path. The connected documents confirm the vulnerability and its fix in the kernel, w...

CVE-2021-47175

CVE-2021-47175: Linux kernel net/sched fq_pie OOB access in the traffic path (fq_pie_qdisc_enqueue). The issue manifests as slab-out-of-bounds read during packet enqueue, demonstrated by a kasan report when using tc with fq_pie. A fix was applied to the fq_pie path to prevent selecting an out-of-...

CVE-2021-47204

CVE-2021-47204 affects the Linux kernel’s net: dpaa2-eth driver. The flaw is a use-after-free in dpaa2_eth_remove where access to a freed netdev occurs. The fix moves the debug log to occur before free_netdev(), preventing use-after-free. Public descriptions in connected advisories (AstraLinux, U...

CVE-2021-47218

CVE-2021-47218: Linux kernel SELinux hashtab allocation failure could lead to NULL dereference. Root cause: on hashtab_init() allocation failure, h->size remains non-zero while h->htable is NULL, breaking hashtab_map() and hashtab_destroy() which assume non-empty hashtab. Mitigation in the ...

CVE-2021-47224

CVE-2021-47224 concerns the Linux kernel ll_temac driver. A use-after-free can occur on the DMA side if the skb is freed while fragments are still in use because the skb pointer was piggy-backed on the first TX buffer descriptor (BD). The resolved description states the fix was to ensure the skb ...

CVE-2021-47370

CVE-2021-47370 affects the Linux kernel and concerns the MPTCP path: a signed/unsigned comparison in the code path that refills the TX cache can misbehave when size_goal is smaller than skb->len, causing the core TCP path to allocate an skb without the MPTCP extension. The fix rewrites the exp...

CVE-2021-47415

CVE-2021-47415 affects the Linux kernel’s iwlwifi mvm code. The vulnerability is a potential NULL pointer dereference in __iwl_mvm_remove_time_event(), mitigated by checking te_data->vif for NULL before dereferencing. The issue is resolved by the kernel patch referenced in the initial descript...

CVE-2021-47507

CVE-2021-47507 concerns the Linux kernel nfsd startup race. The issue stems from the nsfd startup order: an RPC pipefs event race against nfsd_net_id registration, which was re-opened by commit bd5ae9288d64 and fixed by commit bb7ffbf29e76. The patch sequence restores the order между register_per...

CVE-2021-47531

Mode C CVE-2021-47531: Linux kernel MSM DRM mmap handling fixed. The issue occurred when switching to the new mmap path (drm/msm: Implement mmap as GEM object function) and skipping the default mmap code. This caused missing VM_FLAGS and page-prot setup, contributing to crashes on ARC++ Chromeboo...

CVE-2021-47567

CVE-2021-47567 describes a Linux kernel vulnerability in the powerpc/32 code where a vmap stack overflow could lead to a hard lockup when the data MMU is not active. The root cause is that emergency_ctx was accessed with a virtual address during MMU inactivity; the fix uses a physical address ins...

CVE-2021-47669

In the provided materials, CVE-2021-47669 is tied to the Linux kernel, specifically a use-after-free condition in the vxcan_xmit path of can: vxcan. After calling netif_rx_ni(skb), the code may dereference skb, and the canfd_frame cfd that aliases skb memory can be accessed post-netif_rx_ni, lead...

CVE-2022-48667

The connected documents confirm CVE-2022-48667 affects the Linux kernel SMB3 insert-range path, where an affected cached region is not discarded, risking temporary file data corruption. The issue has been fixed in kernel code (see related commits and advisories from Astra Linux, SUSE, Microsoft, ...

CVE-2022-48671

CVE-2022-48671 affects the Linux kernel in the cgroup subsystem: a missing cpus_read_lock() in cgroup_attach_task_all() allowed a deadlock with threadgroup_rwsem, mitigated by adding cpus_read_lock() (aligned with cgroup_procs_write_start()). The issue was observed by syzbot at cpuset_attach() an...

CVE-2022-48675

CVE-2022-48675 is a Linux kernel issue in IB/core involving a nested deadlock between exiting mmap (exit_mmap/__mmu_notifier_release) and a mutex held during ib_umem_odp_map_dma_and_lock. The root cause is a potential deadlock when mmput() is called while umem_mutex is held, triggering a lock in ...

CVE-2022-48714

Summary of CVE-2022-48714 : The Linux kernel vulnerability arises in the ringbuffer mapping used by BPF. The root cause is a Kasan-related mislabeling where mappings created from allocated pages were treated as VM_ALLOC, triggering out-of-bounds reports after vmap() when KASAN is enabled. The fix...

CVE-2022-48783

CVE-2022-48783 affects the Linux kernel net: dsa lantiq_gswip driver. The issue is a use-after-free in gswip_remove() where of_node_put(priv->ds->slave_mii_bus->dev.of_node) must be done before mdiobus_free(priv->ds->slave_mii_bus). Connected documentation provides the exact remedi...

CVE-2022-48859

CVE-2022-48859 concerns the Linux kernel fix for a refcount leak in the marvell prestera path. The issue arises from a missing of_node_put() return value from of_find_compatible_node(), which increments a node’s refcount; without a corresponding of_node_put(), the reference could leak. The OSV en...

CVE-2022-48926

CVE-2022-48926 affects the Linux kernel USB gadget rndis path. The vulnerability arises from a missing spinlock protecting the rndis response list, enabling potential list corruption when two list_add operations occur concurrently. The provided traces show corruption of next->prev and a corres...

CVE-2022-48945

The CVE-2022-48945 issue is in the Linux kernel’s media/vivid path where the compose height boundary is not checked in V4L2_SEL_TGT_CROP after adjustment. The root cause is an unsafe boundary calculation that can trigger a page fault (not-present page) via a local access (memcpy_erms) during vivi...

CVE-2022-49167

CVE-2022-49167 – Linux kernel (btrfs) double bio endio in compressed reads : The vulnerability stems from btrfs_submit_compressed_read() sometimes neglecting to call bio_endio() on error when compression bios are not created, leaving a race with btrfs_submit_data_bio() that may also end the bio. ...

CVE-2022-49184

The CVE-2022-49184 issue affects the Linux kernel under net: sparx5: switchdev, where a NULL pointer dereference could occur if devm_kzalloc() returns NULL and the code dereferences the pointer. The description across connected sources indicates the vulnerability was resolved in the Linux kernel ...

CVE-2022-49192

Technical details about CVE-2022-49192 are not publicly available in the provided Connected documents. The CVE entry describes a fix in cpsw but lacks vendor/product/version specifics, exploit info, or remediation steps beyond the general change. Monitor for updates.

CVE-2022-49233

The CVE-2022-49233 issue is in the Linux kernel DRM/AMD display path where a porting error left a stream assignment for a link encoder unreleased, causing a memory leak. The documented fix reintroduces the intended dc_stream_release() call to release the stream as part of the original patch. The ...

CVE-2022-49450

CVE-2022-49450 relates to the Linux kernel AF_RXRPC listen() backlog handling. The underlying issue is that the backlog can be configured up to 32, but the preallocation ring has 32 slots and one slot is always dead due to the ring using CIRC_CNT(). This caused an oops on socket close when listen...

CVE-2022-49499

CVE-2022-49499 relates to the Linux kernel, in the drm/msm path. The issue is a null pointer dereference that occurs when the code accesses the per- process address space (aspace) without verifying it is set, which can be null on systems without an IOMMU (e.g., msm8974). The fix adds a check for ...

CVE-2022-49547

CVE-2022-49547 relates to a Linux kernel issue in btrfs where deadlocks can occur when reserving data space for direct IO writes under low free space. The deadlock involves concurrent writes to overlapping file ranges ([0,128K) and [128K,256K)) contending for the inode lock and for ordered extent...

CVE-2022-49624

Summary (CVE-2022-49624) The Linux kernel Atlantic/AQ NIC driver had a bug where aq_nic_deinit() could be invoked again during resume after suspend, causing a hang on resume from S3. The fix removes aq_nic_deinit() during resume so it is not called again. This vulnerability affects the Atlantic n...

CVE-2022-49665

CVE-2022-49665 affects the Linux kernel (platform/x86: thinkpad_acpi) and is caused by a memory leak in EFCH MMIO resource handling: release_resource() does not free the resource as release_mem_region() would, so the resource must be freed explicitly to avoid leaks. The issue is addressed by a ke...

CVE-2022-49840

CVE-2022-49840 affects the Linux kernel's BPF test_run path (bpf_prog_test_run_skb) where an odd-sized user-supplied BPF program could trigger an alignment fault on aarch64 leading to use-after-free in skb handling. The issue is caused by unaligned access to skb_shared_info when KFENCE is enabled...

CVE-2022-49886

The CVE-2022-49886 issue affects the Linux kernel related to x86/tdx memory handling. The vulnerability stems from how private memory (TDX private memory, including kernel stacks/text) may trigger a virtualization exception (#VE) and the difficulty of handling such exceptions. The root cause desc...

CVE-2022-49889

In CVE-2022-49889, the Linux kernel ring-buffer wake path could dereference a NULL or invalid buffer when waking waiters during ring-buffer shutdown on systems where listed CPUs > online CPUs. The fix adds a NULL check for the buffer and validates the allocation against online CPUs; it also no...

CVE-2022-49898

CVE-2022-49898 concerns the Linux kernel’s BTRFS tree modification log handling. Connected sources describe a reproducible kernel panic: during replay of tree modification log entries, a REMOVE_WHILE_FREEING entry can be processed with an insufficiently checked slot count, triggering a BUG_ON whe...

CVE-2022-49942

CVE-2022-49942 affects the Linux kernel wifi/mac80211 code. The issue occurs when CSA (channel switch announcement) is finalized in IBSS mode while the device is not connected to a channel; the BSS list is empty, cfg80211_get_bss() can return NULL, triggering a WARN_ON() in ieee80211_ibss_csa_bea...

CVE-2022-49943

In CVE-2022-49943, the Linux kernel USB gadget udc_mutex scope was too large, allowing a lockdep alert/circular locking dependency when the gadget core invoked driver bind/unbind or started/stopped a UDC. The root cause is a widened udc_lock footprint that protected udc->driver among other thi...

CVE-2022-50019

CVE-2022-50019 concerns the Linux kernel tty: serial path, specifically the ucc_uart.c refcount leak. In soc_info(), of_find_node_by_type() may return a node pointer with an incremented refcount that is not released, leading to a resource leak. The documented fix is to call of_node_put() when the...

CVE-2022-50086

The CVE CVE-2022-50086 concerns a Linux kernel issue where concurrent writes to io cost qos (rq_qos) could cause the same rq_qos type to be added twice to a disk, leading to list walk corruption and potential crashes. Connected advisories (EulerOS/Nessus entries) reference the same description an...

CVE-2022-50103

CVE-2022-50103: In the Linux kernel, sched/cpuset handling with cgroup v2 can lead to a panic when cpus_allowed is empty, causing dl_cpu_busy() to crash due to an out-of-bounds percpu access. The fix uses the effective_cpus mask instead of cpus_allowed, for both v1 (where they’re the same) and v2...

CVE-2022-50157

CVE-2022-50157 affects the Linux kernel PCI subsystem (PCI: microchip: Fix refcount leak in mc_pcie_init_irq_domains). The issue arises because of_get_next_child() returns a node pointer with the refcount incremented, and mc_pcie_init_irq_domains() fails to call of_node_put() in some error paths,...

CVE-2022-50158

CVE-2022-50158 relates to the Linux kernel vulnerability in mtd: partitions where of_get_child_by_name() returns a node pointer with an incremented refcount and is not put back, leading to a refcount leak. The issue is fixed by adding a missing of_node_put() when the pointer is no longer needed. ...

CVE-2022-50159

CVE-2022-50159 concerns the Linux kernel: the function that restores ima-kexec-buffer may read outside the addressable RAM if the previous kernel’s buffer lies beyond the new kernel’s memory map, risking kernel panic when booting with mem=X. A fix was implemented to validate the returned PFN rang...

CVE-2023-52941

CVE-2023-52941 affects the Linux kernel can:isotp subsystem. The bug arose from the tx timer handling for isotp PDUs, where the timer served two roles: sending two consecutive frames with a gap and monitoring timeouts for flow control and echo frames. This caused more complex txstate checks and e...

CVE-2023-52996

CVE-2023-52996 : Linux kernel IPv4 code in fib_metrics_match() uses @type as an array index, which could enable a spectre v1 gadget. The connected advisories indicate this is resolved in the kernel, with mitigation by preventing speculative access to fi->fib_metrics->metrics[type-1]. The vu...