CVE-2022-49914

CVE-2022-49914 involves the Linux kernel btrfs backref walk leak in resolve_indirect_refs(). When an error occurs, code previously freed the parents list with ulist_free(), but attached inode lists via the aux field were not freed, causing a leak. The fix replaces ulist_free() with free_leaf_list...

CVE-2022-49946

CVE-2022-49946 affects the Linux kernel component handling Raspberry Pi clocks (clk: bcm: rpi). The vulnerability arises in raspberrypi_discover_clocks() where the loop relies on the last clock element’s id being zero, a property not guaranteed by Videocore firmware, which could lead to an out-of...

CVE-2022-50046

In CVE-2022-50046, the Linux kernel fixes a memory-leak and potential NULL-dereference in net/sunrpc rpc_sysfs_xprt_state_change(): on error paths, xprt may fail to decrement the reference count of xps and may use an invalid xps. The issue arises because the function does not always handle errors...

CVE-2022-50102

CVE-2022-50102 affects the Linux kernel’s fbdev arkfb driver. A user-controlled ioctl can cause a divide-by-zero in ark_set_pixclock, e.g. with hdiv=1, pixclock=1, hmul=2, producing (1*1)/2 = 0 and leading to division by zero later in arkfb.c when computing 1000000000 / pixclock. The vulnerabilit...

CVE-2022-50137

CVE-2022-50137 (Linux kernel) affects RDMA/irdma by a window for use-after-free during CQ destruction. An interrupt could cause CQE processing after CQ resources are freed by irdma_cq_free_rsrc(). The fix moves irdma_cq_free_rsrc() to run after irdma_sc_cleanup_ceqes() (which executes under cq_lo...

CVE-2022-50140

CVE-2022-50140 affects the Linux kernel memstick/ms_block subsystem. The root cause is a memory leak where erased_blocks_bitmap is allocated with used_blocks_bitmap but not freed; the patch adds bitmap_free() in msb_data_clear() to free erased_blocks_bitmap. The CVSS 3.1 base score is 5.5 (MEDIUM...

CVE-2022-50175

CVE-2022-50175 affects the Linux kernel media driver for tw686x. The vulnerability is a memory leak in tw686x_video_init: video_device_alloc() allocates memory for vdev, and if video_register_device() fails, the memory is not released, causing a leak. The fix is to call video_device_release() to ...

CVE-2023-52744

CVE-2023-52744 concerns the Linux kernel RDMA/irdma path. The in_dev_get() function can return NULL, and the code may dereference idev in in_dev_for_each_ifa_rtnl(), causing a crash. A patch was added to check for NULL before dereferencing idev, mitigating the NULL pointer dereference. The issue ...

CVE-2023-52776

CVE-2023-52776 affects the Linux kernel wifi driver ath12k (DFS radar and temperature event handling). The root cause was that DFS-radar and temperature event code calling ath12k_mac_get_ar_by_pdev_id() was not in an RCU read-side critical section, risking use-after-free scenarios. The fix marks ...

CVE-2023-52848

Summary (CVE-2023-52848) : The issue, reported for the Linux kernel’s f2fs file system, centers on a bug during f2fs_put_super() where the meta_inode page cache is not dropped after an IO error in f2fs_wait_on_all_pages. This can lead to a reference-count leak and a kernel panic during unmount. T...

CVE-2023-52980

The CVE-2023-52980 issue affects the Linux kernel ublk driver, specifically the SPDK ublk target when assigning very large queue depths. The root cause is that UBLK_MAX_QUEUE_DEPTH is 4096, and the calculation sizeof(struct ublk_queue) + depth * sizeof(struct ublk_io) can exceed 65535 when depth ...

CVE-2023-53143

CVE-2023-53143 is a Linux kernel ext4 off-by-one fsmap bug for 1k-block filesystems. The crash stems from insufficient range validation in ext4_getfsmap_datadev when querying GETFSMAP, due to s_first_data_block being nonzero on 1k blocks, causing an underflow and invalid group calculation. A fix ...

CVE-2023-53240

The CVE-2023-53240 issue concerns the Linux kernel’s xsk path. If a napi id is marked on an interface not brought up, xsk_sendmsg /xsk_poll can call xsk_xmit(), which may dereference a NULL pointers to xs->dev when IFF_UP is not set, causing a kernel NULL pointer dereference. The fix restructu...

CVE-2024-26780

CVE-2024-26780 | Linux kernel (af_unix) — The vulnerability centers on a task hang during purging oob_skb in GC. The root cause is that list_for_each_entry_safe() is not actually safe when a single skb has references from multiple sockets; freeing such an skb can unlink current and next sockets i...

CVE-2024-26781

CVE-2024-26781: In the Linux kernel, a deadlock could occur in Multipath TCP (mptcp) subflow diagnostic code due to a circular locking dependency reported by Syzbot/Eric. The issue involves tcp_diag and related subflow diagnostic paths (tcp_diag_put_ulp, tcp_diag_get_aux, inet_diag_dump_icsk) and...

CVE-2024-40926

CVE-2024-40926 affects the Linux kernel DRM Nouveau driver. The issue occurs when runtime PM resumes on headless cards that lack display hardware, where hpd_work and hpd_lock are left uninitialized and scheduling hpd_work triggers a BUG. The patch adds a headless flag to DRM and instructs the sys...

CVE-2024-41026

The CVE-2024-41026 issue affects the Linux kernel’s davinci_mmc driver: transmitted data size was not validated against sg_miter length, allowing a kernel panic when data exceeds sg_miter. The vulnerability is resolved by limiting the number of transmitted bytes to sg_miter->length (sgm->le...

CVE-2024-42150

CVE-2024-42150 concerns the Linux kernel networking driver for Intel Rhine (txgbe). The issue arises when using MSI or INTx interrupts: request_irq() for pdev->irq can conflict with request_threaded_irq() for txgbe->misc.irq, potentially causing a system crash. The fix removes the separate ...

CVE-2024-42256

CVE-2024-42256 affects the Linux kernel CIFS client. The issue arises when a subrequest is retried and smb2_async_writev() re-picks the SMB server, causing in_flight accounting to be updated against different servers and leading to misaccounting. The fix removes the repick in smb2_async_writev(),...

CVE-2024-43844

CVE-2024-43844 affects the Linux kernel’s wifi rt w89 GTK offload path. The issue stems from rtw89_fw_h2c_wow_gtk_ofld handling, where a sk_buff could be oversized, causing skb_panic in net/core/skbuff.c and a kernel crash (BUG at skbuff.c:192). Affected data path: wow GTK offload H2C, leading to...

CVE-2024-45024

CVE-2024-45024 relates to a Linux kernel Hugetlb PT locking issue fixed by aligning huge page table locking with core-mm PT walkers. The root cause: during GUP’s shared page-table walking, hugetlb folios spanning multiple PTEs could be locked using PTE table locks (pte_offset_map_lock) while core...

CVE-2024-53205

CVE-2024-53205 – Linux kernel realtek USB PHY (rtk_usb2phy_probe) NULL dereference. In rtk_usb2phy_probe(), devm_kzalloc() may return NULL and the code does not check this, allowing a possible NULL pointer dereference. The vulnerability is described as local, with a LOW/medium access/availability...

CVE-2024-56560

CVE-2024-56560: In the Linux kernel slab allocator, a too-strict alignment check in kmem_cache_create_args caused a kernel panic on m68k due to io_kiocb slab creation. The issue occurs because the minimum alignment of unsigned long can be 2 bytes on m68k, so assuming a fixed 4/8-byte alignment is...

CVE-2024-58084

The CVE-2024-58084 issue in the Linux kernel relates to the Qualcomm SC M firmware (qcom_scm) read barriers. The advisory notes a missing read barrier in qcom_scm_get_tzmem_pool() and that a write barrier was previously added in probe. Access from concurrent contexts could fetch a stale __scm val...

CVE-2025-21770

The CVE-2025-21770 entry notes a memory leak in the Linux kernel’s iommu path: iopf_queue_remove_device() fails to release the per-iommu iopf group after responding to hardware, which can leak the group structure for pending iopf objects. The fix is to call iopf_free_group() after the iopf group ...

CVE-2025-23153

The CVE-2025-23153 entry is confirmed with concrete details in connected sources: Linux kernel affected area is arm/crc-t10dif, where a bug caused an out-of-scope array access in crc_t10dif_arch(). The issue is fixed by the patch(es) referenced from kernel stable commits, addressing the use-after...

CVE-2025-37962

CVE-2025-37962 affects the Linux kernel’s ksmbd code path, specifically a memory leak in parse_lease_state. The root cause: when the created lease context bounds check fails, the function returns NULL without freeing the previously allocated lease_ctx_info, causing a memory leak. The patch fixes ...

CVE-2025-38132

CVE-2025-38132 : Linux kernel coresight race condition when removing cscfg from csdev. The issue occurs if a module load and config deactivate path races with iterating/removing config_csdev_list entries while holding csdev->cscfg_csdev_lock, allowing an entry delete to race with an active con...

CVE-2025-38170

CVE-2025-38170 concerns the Linux kernel (arm64) FPSIMD/SVE/SME state handling. A race during SME trap handling can cause a preemption race where a task ends up with TIF_SME set and TIF_FOREIGN_FPSTATE cleared while the live hardware state is stale. The provided code path shows a trap handler and...

CVE-2025-38282

CVE-2025-38282 affects the Linux kernel kernfs draining guard. The issue stems from a too-sensitive WARN in kernfs_should_drain_open_files() due to the active reference break/unbreak lifecycle, which can transiently misclassify legitimate callers as a condition requiring drain. Upstream fixes ind...

CVE-2025-38299

CVE-2025-38299 affects the Linux kernel ASoC Mediatek mt8195 driver. Root cause: ETDM1/2 IN/OUT were set to COMP_DUMMY/COMP_EMPTY when codec dai_name is null, leading to a NULL pointer dereference and kernel crash during probe. The fix initializes or guards these links to safe dummy/empty compone...

CVE-2025-38356

CVE-2025-38356 (Linux kernel) . The issue affects the DRM frontend (drm/xe/guc) where during driver probe the code may briefly run in CT safe mode (driven by a delayed work). If probe aborts early, unwind can destroy a pending delayed work that would restart itself, triggering a WARN in the workq...

CVE-2025-38489

CVE-2025-38489: In the Linux kernel (s390/BPF), the on-disk description notes that bpf_arch_text_poke() with new_addr == NULL caused intermittent panics; the fix re‑instates the previously removed correction from commit c730fce7c70c, restoring the intended behavior and adding a clarifying comment...

CVE-2025-38516

CVE-2025-38516 is a Linux kernel vulnerability in the pinctrl/qcom/msm subsystem. The issue arises when certain pins are registered as IRQ-capable on platforms where intr_detection_width is not 1 or 2, enabling a user-space trigger that can cause a BUG() in msm_gpio_irq_set_type() and potentially...

CVE-2025-38561

CVE-2025-38561 concerns the ksmbd component of the Linux kernel. A race condition on Preauh_HashValue may occur when a client sends multiple session setup requests to ksmbd, due to how sess->Preauh_HashValue was previously freed during session setup. The fix moves freeing of sess->Preauh_Ha...

CVE-2025-38595

CVE-2025-38595 concerns a use-after-free in the Linux kernel’s Xen hypervisor path related to DMA buffer handling. The issue arises when a file descriptor for a dma_buf is inserted into a descriptor table and another thread closes it, with a race that can lead to dereferencing objects (e.g., the ...

CVE-2025-39698

CVE-2025-39698 concerns the Linux kernel io_uring/futex cleanup: io_futex_data is allocated upfront and wired into io_kiocb.async_data, but the request flag REQ_F_ASYNC_DATA may not be set at that time. On failure, the futex handler frees the data but may not clear async_data, so the data and fla...

CVE-2026-22997

The CVE-2026-22997 issue affects the Linux kernel CAN/J1939 subsystem. The root cause is that j1939_session_deactivate_activate_next() is only invoked in j1939_tp_rxtimer() when the timer is enabled, allowing a refcount leak if the timer is cancelled without calling the function. This can lead to...

CVE-2026-23069

CVE-2026-23069 (Linux kernel) : In vsock/virtio, the credit calculation in virtio_transport_get_credit() can underflow when the peer’s advertised buffer (peer_buf_alloc) shrinks while data is in flight, potentially allowing more data to be queued than the peer can handle. The issue arises from un...

CVE-2026-31716

The CVE-2026-31716 entry covers a Linux kernel NTFS3 flaw in journal replay. Description from multiple sources states that check_file_record() validates rec->total against the record size but not rec->used. The journal-replay handlers read rec->used from disk and use it to compute memmov...

CVE-2026-52911

The CVE-2026-52911 vulnerability affects the Linux kernel ksmbd code path. When a SESSION_SETUP binds a connection (conn->binding = true), a global session lookup could incorrectly resolve sessions not actually added to the connection’s session list. The fix tightens the global lookup so that ...

CVE-2026-64102

CVE-2026-64102 affects the Linux kernel RDMA/siw path. A malicious siw peer can send an iWARP FPDU whose MPA length (mpa_len) is smaller than the fixed DDP/RDMAP header for the announced opcode, triggering an underflow in fpdu_part_rem during siw_tcp_rx_data and leading to a potential out-of-boun...

CVE-2026-64386

CVE-2026-64386 : In the Linux kernel SMB client, a replayable error could free the prior response buffer when SMB2_query_info_init() fails before the next send, causing a double-free. The fix resets response bookkeeping before each attempt to prevent stale frees. Affected component is the SMB cli...

CVE-2004-1137

CVE-2004-1137 affects the Linux kernel 2.4.x (2.4.22–2.4.28) and 2.6.x (up to 2.6.9). The flaws are in IGMP handling (ip_mc_source decrements a counter to -1; igmp_marksources may perform an out-of-bounds read), allowing local or remote attackers to cause denial of service or potentially execute ...

CVE-2005-1768

The CVE-2005-1768 issue is a race condition in the Linux kernel’s IA32 (x86) compatibility execve() handling, affecting amd64/Intel EM64T and Itanium platforms. A concurrent thread can increment a pointer count after nargs has counted pointers but before copying from user space to kernel space, l...

CVE-2006-3741

CVE-2006-3741 concerns the perfmonctl (sys_perfmonctl) system call in Linux kernels 2.4.x and 2.6.x prior to 2.6.18 on Itanium. The issue is an improper reference-count accounting for file descriptors, which can allow local users to exhaust file descriptors and cause a denial of service. The desc...

CVE-2008-0001

CVE-2008-0001 affects the Linux kernel: VFS in kernels before 2.6.22.16 and 2.6.23.x before 2.6.23.14 tests access permissions using the flag variable instead of the acc_mode flag, potentially allowing a local, unprivileged user to bypass file-write permissions and remove directories. The issue i...

CVE-2008-2358

The CVE-2008-2358 entry concerns the Linux kernel DCCP module: an integer overflow in dccp_feat_change within net/dccp/feat.c on kernels 2.6.17–2.6.20 and 2.6.18, enabling a local attacker to trigger a heap-based buffer overflow and gain privileges. Connected advisories reference this issue as pa...

CVE-2009-0747

The CVE-2009-0747 issue affects the Linux kernel’s ext4_isize helper in fs/ext4/ext4.h, exposing a denial-of-service risk when a local user mounts a crafted ext4 filesystem. The vulnerability arises from using the i_size_high structure member during operations on arbitrary file types, potentially...

CVE-2009-0748

CVE-2009-0748 affects the Linux kernel: ext4_fill_super in fs/ext4/super.c fails to validate the superblock configuration, enabling a local attacker to trigger a NULL pointer dereference/OOPS when mounting a crafted ext4 filesystem. Impact is local denial of service. Affected ranges: Linux kernel...