CVE-2010-1436

CVE-2010-1436 involves the Linux kernel 2.6.18 (and possibly other versions) where the gfs2_quota struct can span two pages, leading to an out-of-bounds write and a local denial of service (kernel panic) when manipulating gfs2 and ext3 file systems. The MiracleLinux AXSA-2010-377:12 advisory list...

CVE-2011-1474

CVE-2011-1474 affects pax-linux versions 2.6.32.33-test79.patch, 2.6.38-test3.patch, and 2.6.37.4-test14.patch. The root cause is a bad bounds check in arch_get_unmapped_area_topdown triggered by mmap after a MAP_GROWSDOWN mmap, which can loop indefinitely and not release the VM semaphore, potent...

CVE-2011-2942

CVE-2011-2942 is tied to a Red Hat patch affecting the Linux kernel 2.6.18-... on RHEL 5. The issue is in the bridge forward path, specifically br_forward.c __br_deliver, enabling a remote attacker on a bridged network to trigger a NULL pointer dereference and system crash (DoS) or potentially ot...

CVE-2012-6540

CVE-2012-6540 affects the Linux kernel prior to 3.6: do_ip_vs_get_ctl in net/netfilter/ipvs/ip_vs_ctl.c does not initialize a structure for IP_VS_SO_GET_TIMEOUT, enabling local users to read sensitive data from kernel stack memory via a crafted application. Advised fix is upgrading to a kernel wi...

CVE-2013-4514

CVE-2013-4514 affects the Linux kernel up to version 3.11, specifically in drivers/staging/wlags49_h2/wl_priv.c. The vulnerability is caused by multiple buffer overflows in wl_priv.c related to handling a long station-name string, with exploitation requiring CAP_NET_ADMIN. The affected functions ...

CVE-2015-0572

The CVE-2015-0572 entry concerns the ADSPRPC driver for the Linux kernel (drivers/char/adsprpc.c and drivers/char/adsprpc_compat.c) used in Qualcomm QuIC MSM Android contributions and other devices. The issue is a race condition that can be exploited via the COMPAT_FASTRPC_IOCTL_INVOKE_FD ioctl, ...

CVE-2015-2672

The CVE-2015-2672 entry concerns the Linux kernel’s xsave/xrstor implementation (arch/x86/include/asm/xsave.h). Vulnerable code paths exist in kernels before 3.19.2 where certain .altinstr_replacement pointers are created, failing to provide protection against instruction faulting. Local attacker...

CVE-2017-0525

CVE-2017-0525 is an elevation-of-privilege issue in the Qualcomm IPA driver on Android, enabling a local attacker to execute code in kernel context. Affected: Android devices using Kernel-3.10 or Kernel-3.18 with the Qualcomm IPA driver. Impact per sources: local privilege escalation requiring pr...

CVE-2021-47141

CVE-2021-47141 affects the Linux kernel gve path and is caused by missing NULL checks when freeing IRQ vectors. Specifically, when freeing notification blocks, code indexes priv->msix_vectors, and a failure to allocate priv->msix_vectors (abort_with_msix_vectors) can lead to a NULL pointer ...

CVE-2021-47198

CVE-2021-47198 affects the Linux kernel lpfc SCSI lpfc driver. The vulnerability arises when unloading the driver: NLP_REG_LOGIN_SEND is set in lpfc_reg_fab_ctrl_node() but not cleared on login completion, allowing a second call to lpfc_unreg_rpi() to operate with nlp_rpi = LPFC_RPI_ALLOW_ERROR a...

CVE-2021-47239

CVE-2021-47239 : In Linux kernel net/usb, theSmsc75xx driver has a use-after-free in smsc75xx_bind caused by not cleaning up a scheduled work in smsc75xx_reset→smsc75xx_set_multicast. The patch 46a8b29c6306 adds cancel_work_sync and NULLs the dangling pointer (dev->data[0]) to prevent use-afte...

CVE-2021-47263

CVE-2021-47263 is a Linux kernel issue in the gpio-wcd934x driver where a shift-out-of-bounds UBSAN error occurred due to using BIT(n-1) for pins 0–4, leading to an out-of-bounds shift in gpio-wcd934x.c:34:14. The vulnerability has been resolved by a patch to correct the bit-mask handling (pins 0...

CVE-2021-47437

In CVE-2021-47437, the Linux kernel IIO ADIS16475 driver is affected by a deadlock during frequency setting. The issue arose from two deadlocks introduced by the patch: (1) adis_write_reg_16() path not fully unlocked, and (2) lock not released on the success path. A fix was applied in commit 39c0...

CVE-2021-47508

CVE-2021-47508 affects the Linux kernel’s btrfs code path. The issue is a memory leak: when qgroup/data reservation fails in btrfs_check_data_free_space() or btrfs_delalloc_reserve_space(), the allocated extent_changeset is not freed. This occurs specifically in the direct IO write path (and rela...

CVE-2021-47613

CVE-2021-47613 concerns a Linux kernel i2c virtio issue where the notify callback could run before all buffers are completed, risking incorrect I2C data or guest memory corruption. The confirmed fix is to call virtio_get_buf() from the notify handler (as in other virtio drivers) and to wait for a...

CVE-2021-47668

CVE-2021-47668 is a Linux kernel use-after-free vulnerability in the CAN restart path. The issue occurs when, after calling netif_rx_ni(skb), the code dereferences the same skb memory (specifically cf->len from the can_frame cf aliasing skb), which is unsafe and can lead to memory corruption. ...

CVE-2022-48729

CVE-2022-48729: In the Linux kernel’s InfiniBand hfi1 driver (ipoib), a panic occurs when ipoib send_queue_size is increased above the default. The root cause is a shift calculation that used the ring size instead of the txq item size, leading to a panic trace in hfi1_ipoib_drain_tx_ring and a ch...

CVE-2022-48730

CVE-2022-48730 affects the Linux kernel: dma-buf heaps vulnerability where a user-supplied index could be treated as a potential Spectre v1 gadget, risking leakage of kernel memory to userspace through speculative execution. The fixed issue is described as preventing leakage by using array_index_...

CVE-2022-48746

In CVE-2022-48746, the Linux kernel mlx5e bond netevent path incorrectly verified netdev origin: the code only checked for a VF representor and lacked a check that the VF representor was on the same physical device as the bond handling the netevent. The fix adds the missing check and optimizes th...

CVE-2022-48752

CVE-2022-48752 affects the Linux kernel on PowerPC power_pmu_disable handling. The fix (commit 2c9ac51b850d) calls clear_pmi_irq_pending only if PMI is pending to avoid clearing PMI when an overflown PMC is detected, addressing a PMI/PMC race in power_pmu_disable triggered under CONFIG_PPC_IRQ_SO...

CVE-2022-48770

CVE-2022-48770 affects the Linux kernel vulnerability in the BPF stack trace code: bpf_get_task_stack() could dereference NULL pt_regs because task_pt_regs() may return NULL for kernel threads on powerpc. The patch adds a NULL check on the return value of task_pt_regs() before inspecting the call...

CVE-2022-48774

CVE-2022-48774 affects the Linux kernel dmaengine/ptdma path. The issue is in pt_core_init() where resource freeing in the error path could leak resources or release unallocated items. The fix switches two goto targets in the error handling path to ensure proper resource cleanup, and relocates a ...

CVE-2022-48785

The CVE-2022-48785 issue in the Linux kernel concerns ipv6: mcast path where ipv6_get_lladdr() was switched to __ipv6_get_lladdr(), an RCUnsafe variant, after external locks were removed in mld updates. The description notes this is only safe when idev->lock is held for those code paths, but w...

CVE-2022-48807

CVE-2022-48807 concerns the Linux kernel ice driver and the LAG NETDEV_UNREGISTER notifier path. The issue arises because the same notifier handler was invoked for both NETDEV_BONDING_INFO LAG unlink and NETDEV_UNREGISTER events, passing a netdev_notifier_info structure that differs between event...

CVE-2022-48831

CVE-2022-48831 : In the Linux kernel, the IMA path (asymmetric_verify) fixes a reference-leak vulnerability. The patch ensures that a reference to the key is not leaked if the key’s algorithm is unknown. The description currently notes only that this resolves the leak and does not provide additio...

CVE-2022-48833

CVE-2022-48833 involves the btrfs code in the Linux kernel. After patches addressing: (1) btrfs: clear extent buffer uptodate when we fail to write it and (2) btrfs: check WRITE_ERR when reading an extent buffer, unmounts could leave space reservations in block groups/log tree extents uncleared i...

CVE-2022-48908

CVE-2022-48908 is a Linux kernel issue affecting the arcnet com20020 PCI driver. The root cause is a null pointer dereference during com20020pci_probe() because the com20020pci_id_table may leave the card-info field empty for some devices, causing a null dereference on initialization. The provide...

CVE-2022-49231

CVE-2022-49231 concerns a Linux kernel vulnerability in the rtw88 driver where memory overrun and memory leaks occurred during hw_scan due to allocating less memory than required. The issue could overwrite buffers and trigger mm module complaints and access violations, with potential memory leaks...

CVE-2022-49237

CVE-2022-49237 is resolved in the Linux kernel’s ath11k driver. The vulnerability stems from a missing of_node_put() after obtaining a device tree node via of_find_node_by_type() or of_parse_phandle(), where the node’s refcount is incremented but not decremented, causing a refcount leak. The impa...

CVE-2022-49510

CVE-2022-49510 concerns a Linux kernel issue in the DRM/OMAP driver where a NULL pointer (r_ovl) dereference occurs when accessing ovl->idx, triggering a NULL-deref in omap_overlay.c. The vulnerability stems from a coccicheck warning that was fixed by correcting r_ovl->idx to ovl->idx. T...

CVE-2022-49702

Summary: CVE-2022-49702 concerns a deadlock in Linux kernel when unmounting a filesystem with an async block group reclaim task relocating data. Multiple reclaim tasks (block-group, metadata/data) can interact with a parked cleaner thread, leading to a hang during close_ctree()/unmount due to del...

CVE-2022-49781

CVE-2022-49781 corresponds to a Linux kernel vulnerability in perf/x86/amd where a race between amd_pmu_enable_all and perf NMI/throttling could lead to a NULL event dereference and kernel crash. The issue arises when perf NMI disables/enables all events while amd_pmu_enable_all is in progress, p...

CVE-2022-49944

CVE-2022-49944 : Linux kernel USB Type-C UCSI code regression caused NULL dereference when reading the power supply sysfs due to a change in error handling after the commit that added ucsi_unregister_connectors(); the stale sysfs entry remained with NULL ops. The fix is a straight revert of that ...

CVE-2022-50011

The CVE-2022-50011 issue affects the Linux kernel code path used by the Venus driver, where the OPP (Operating Performance Points) core warns during probe due to misordered configuration options. The root cause is that the OPP core expects all configuration options to be provided before the OPP t...

CVE-2022-50110

The CVE-2022-50110 issue affects the Linux kernel watchdog sp5100_tco path, where a memory leak of EFCH MMIO resource occurred because release_resource() was not freeing the resource as release_mem_region() does; the leak is fixed by explicitly freeing the resource. The vulnerability details and ...

CVE-2022-50202

CVE-2022-50202 maps to a Linux kernel vulnerability in the PM: hibernate flow where resuming from hibernation defers device probing. The described race involves probe_count, with wait_for_device_probe() potentially sleeping indefinitely while misc_mtx is held, due to three conditions (a device no...

CVE-2023-20838

CVE-2023-20838 concerns the imgsys component. Multiple connected sources confirm a race-condition–driven out-of-bounds read that can leak local information and, in some scenarios, enable system-level execution with user interaction required for exploitation. Affected references consistently descr...

CVE-2023-52785

CVE-2023-52785 affects the Linux kernel, specifically the SCSI UFS core. The issue is a race between ufshcd_mcq_abort() and the ISR: when a command timeout occurs and a CQ complete IRQ arrives concurrently, ufshcd_mcq_abort clears lprb->cmd, leading to a NULL pointer dereference in the ISR. Th...

CVE-2023-52907

CVE-2023-52907 affects the Linux kernel NFC pn533 driver. A use-after-free occurs in the host controller driver (hcd) when in_urb completes before out_urb, freeing skb data used as the transfer buffer for out_urb. The fix delays sending in_urb until the out_urb callback has run, and splits the co...

CVE-2024-40962

CVE-2024-40962 affects the Linux kernel btrfs zoning code. The issue is a NULL pointer dereference in btrfs_zone_finish_endio() when handling zoned NODATASUM writes under zoned emulation for conventional zones. The fix, as described in the disclosure, is to allocate dummy checksums for zoned NODA...

CVE-2024-40986

Summary (concrete details from connected documents): The Linux kernel DMA engine Xilinx XDMA driver (xdma.c) had a synchronization flaw in xdma_channel_isr() where the vchan lock was not acquired before using xdma->stop_request. Affected component: dmaengine: xilinx: xdma. Root cause: lack of ...

CVE-2024-42150

CVE-2024-42150 concerns the Linux kernel networking driver for Intel Rhine (txgbe). The issue arises when using MSI or INTx interrupts: request_irq() for pdev->irq can conflict with request_threaded_irq() for txgbe->misc.irq, potentially causing a system crash. The fix removes the separate ...

CVE-2024-42256

CVE-2024-42256 affects the Linux kernel CIFS client. The issue arises when a subrequest is retried and smb2_async_writev() re-picks the SMB server, causing in_flight accounting to be updated against different servers and leading to misaccounting. The fix removes the repick in smb2_async_writev(),...

CVE-2024-50241

CVE-2024-50241 affects the Linux kernel NFSD/NFSv4 path. The vulnerability stems from not initializing struct nfsd4_copy’s refcount and async_copies early enough, so cleanup_async_copy() may reference uninitialized fields if nfsd4_copy() errors, risking a refcount underflow. The connected documen...

CVE-2024-57919

CVE-2024-57919: In the Linux kernel, the drm/amd/display path (dm_get_plane_scale) diverts a divide-by-zero when the destination plane size is zero, leading to a kernel oops. The fix sets out-scale size to zero when dst size is zero (consistent with drm_calc_scale), addressing cursor overlay logi...

CVE-2024-58060

CVE-2024-58060 affects the Linux kernel BPF struct_ops path. The issue occurs when a struct_ops contains a struct module *owner and CONFIG_MODULES=n, causing incorrect refcounting because the module btf_id is missing, leading to a potential use-after-free in tcp_congestion_ops. The patch disables...

CVE-2025-21874

CVE-2025-21874 is a Linux kernel vulnerability in dm-integrity, where in Inline mode the journal is unused and journal_sectors can be zero. Calculating the journal watermark divides by journal_sectors, which can trigger an OOPS during a simple dmsetup table query. The issue was observed on some s...

CVE-2025-38047

CVE-2025-38047 : Linux kernel x86/FRED: The system can hang on S4 resume when FRED is enabled. The issue arises because, after loading a hibernation image, the image kernel reuses original page frames while the FRED MSRs may still hold values set by the restore kernel. The image kernel must ensur...

CVE-2025-38356

CVE-2025-38356 (Linux kernel) . The issue affects the DRM frontend (drm/xe/guc) where during driver probe the code may briefly run in CT safe mode (driven by a delayed work). If probe aborts early, unwind can destroy a pending delayed work that would restart itself, triggering a WARN in the workq...

CVE-2025-38385

Summary: CVE-2025-38385 affects the Linux kernel in the LAN78xx USB Ethernet driver, where a WARN can be triggered during USB disconnect when NAPI is still enabled. Root cause (per provided data): In the disconnect path, netif_napi_del() was redundantly called even though unregister_netdev() hand...