CVE-2021-47533

CVE-2021-47533 affects the Linux kernel drm/vc4: kms path. A use-after-free could occur when duplicating state due to a stale HVS FIFO commit pointer not being cleared after waiting on the previous FIFO user. The fix sets the HVS FIFO commit pointer to NULL once the wait completes to prevent carr...

CVE-2021-47569

CVE-2021-47569 : In the Linux kernel io_uring path, cancellation of tasks can fail for EXITING tasks when the callback runs in a fallback path. The issue is triggered during io_uring cancellation logic in fs/io_uring.c (recorded at io_try_cancel_userdata+0x3c5/0x640). The call chain shows timeout...

CVE-2021-47660

CVE-2021-47660 is addressed by a Linux kernel fix in the ntfs3 filesystem code. The patch resolves memory leaks in an error-handling path of log_replay(), ensuring that on all error paths the allocated resources are released via the existing out path instead of leaking through returns. The descri...

CVE-2022-48639

CVE-2022-48639 involves a refcount leak in Linux kernel net: sched tc_new_tfilter(). The fix requires tfilter_put to release the refcount obtained from tp->ops->get when chain->tmplt_ops is non-NULL and differs from tp->ops. Connected sources confirm the vulnerability exists in the Li...

CVE-2022-48713

The CVE-2022-48713 issue concerns the Linux kernel perf/x86/intel/pt path where a PT stop filter in single-range output mode could crash the kernel. The root cause was a missing check for buf->single before calling pt_buffer_region_size, leading to a NULL pointer dereference when ToPA is not c...

CVE-2022-48731

CVE-2022-48731 is a Linux kernel vulnerability affecting mm/kmemleak: when using devm_request_free_mem_region() and devm_memremap_pages() to add ZONE_DEVICE memory, an excessively large end_pfn (e.g., 0x400000000) can make node_end_pfn() oversized, creating a huge hole between node_start_pfn() an...

CVE-2022-48776

CVE-2022-48776 is a Linux kernel memory-leak fix in the MTD parsers for Qualcomm SMEM: the cleanup function did not free pparts, causing a leak. The vulnerability affects mtd/parsers/qcomsmempart.c (pparts) and is resolved by adding a missing free in the cleanup path. Affected context and patches...

CVE-2022-48845

CVE-2022-48845 affects the Linux kernel on MIPS SMP builds, where mis-timing of CPU topology map calculation caused smt_mask (cpu_smt_mask) to be empty during sched_core_cpu_starting(). The issue arises after enabling CONFIG_SCHED_CORE (landed around 5.14), leading to a WARN at sched_core_cpu_sta...

CVE-2022-48873

CVE-2022-48873 affects the Linux kernel in the misc: fastrpc subsystem. The root cause is improper handling of map removal on error paths during creater_process and device_release, risking a use‑after‑free. The fixed behavior is to avoid removing the map from the list on error in fastrpc_init_cre...

CVE-2022-48998

CVE-2022-48998 concerns a PowerPC-specific issue in the Linux kernel’s BPF tail-call handling (powerpc/bpf/32). The available connected documents describe a bug where tail calls to BPF programs with differing stack depths could corrupt stack state, leading to an Oops and kernel data access on wri...

CVE-2022-49393

CVE-2022-49393 affects the Linux kernel code path misc: fastrpc: fix list iterator in fastrpc_req_mem_unmap_impl. The root cause is an incorrect use of the list iterator and a NULL check on the iterator value, where list_for_each_entry() guarantees a non-NULL map, causing the loop exit condition ...

CVE-2022-49417

CVE-2022-49417 involves the Linux kernel component iwlwifi/mei. The issue is a potential NULL-ptr dereference that could occur when SKB allocation fails; the fix was to skip using the NULL pointer instead of dereferencing it. This vulnerability is described as resolved in multiple sources and is ...

CVE-2022-49999

CVE-2022-49999 : In the Linux kernel, a race between caching free space for a block group and returning free space to the in‑memory space cache for pinned extents can cause double‑adding free space, corrupting the Btrfs free space tree and space cache. Symptoms include EEXIST when re‑adding freed...

CVE-2022-50030

CVE-2022-50030 is a vulnerability in the Linux kernel’s lpfc driver affecting debugfs input handling. According to the provided documents, malformed user input to debugfs can cause buffer overflow crashes due to input strings not fitting internal buffers (space for NULL terminators added). The CV...

CVE-2022-50040

CVE-2022-50040 affects the Linux kernel internal DSA path for sja1105 (net: dsa: sja1105). The vulnerability is a buffer overflow caused when an error occurs in dsa_devlink_region_create(), leading to a negative index (-1) access of priv->regions. The issue has been fixed in the cited commits,...

CVE-2022-50062

CVE-2022-50062 affects the Linux kernel net/bgmac path. The issue is a BUG_ON triggered by a race where, if an RX interrupt occurs between setting ring->end and netdev_sent_queue(), bgmac_dma_tx_free() can miscalculate the queue size when called from bgmac_poll(), causing a kernel BUG at lib/d...

CVE-2022-50145

CVE-2022-50145 affects the Linux kernel’s dmaengine sf-pdma: multithreaded use of a DMA channel can trigger OOPS/hang due to a data race where threads reread and reuse a descriptor after device_prep_dma_memcpy() is called. The root cause is that descriptors could be freed or substituted, causing ...

CVE-2022-50173

CVE-2022-50173 affects the Linux kernel DRM/MSM MDP5 path. The vulnerability arises from not grabbing the global state lock after an early return when hwpipe is disabled, allowing contention and potentially returning 0. The public entries describe the fix as “Fix global state lock backoff” and ci...

CVE-2022-50218

The CVE-2022-50218 entry describes a Linux kernel vulnerability in the iio: light: isl29028 driver where isl29028_remove() used a non-managed register function, breaking the release order relative to probe and causing a fault trace (null pointer dereference and a general protection fault) during ...

CVE-2022-50222

CVE-2022-50222 affects the Linux kernel in the VT/TTY subsystem, specifically the Unicode screen buffer initialization. According to the provided description, a kernel infoleak could occur in vcs_read() when the screen buffer is read immediately after a resize. The remediation implemented is to i...

CVE-2023-3359

CVE-2023-3359 concerns the Linux kernel’s brcm_nvram_parse in drivers/nvmem/brcm_nvram.c, where the return value of kzalloc() is not checked, potentially causing a NULL pointer dereference. The issue is listed with a local attack vector and a high availability impact (CVSS v3.1: AV:L/AC:L/PR:L/UI...

CVE-2023-52526

The CVE-2023-52526 issue affects the Linux kernel’s erofs memory handling during global compressed deduplication. The vulnerability is a memory leak related to LZMA global deduplication under stress (enabled with -Ededupe) that could cause transient pages not to be released, potentially leading t...

CVE-2023-53003

CVE-2023-53003 concerns a use-after-free in the Linux kernel’s EDAC/qcom path. The LLCC driver allocates llcc_driv_data, which was previously passed as private info to the EDAC core (edac_device_ctl_info). On driver release this data could be freed, and a subsequent probe would use the freed memo...

CVE-2023-53009

The CVE-2023-53009 entry pertains to the Linux kernel DRM/AMDKFD path. A vulnerability was resolved by adding a synchronization step after creating a VRAM buffer object (vram bo) to wait for initialization completion. Without this sync, data corruption could occur in VRAM allocated by svm if an a...

CVE-2024-27406

CVE-2024-27406 refers to a Linux kernel issue where the iov_iter unit test (TEST_IOV_ITER) incorrectly depended on MMU, causing a crash on nommu systems (e.g., qemu kc705-nommu) when vmap() is invoked. The root cause is that vmap() is not supported on nommu, leading to a kernel panic. The vulnera...

CVE-2024-40933

The CVE-2024-40933 entry concerns a Linux kernel IIO temperature driver mlx90635 issue. The vulnerability arises in mlx90635_probe() where a failure of devm_regmap_init_i2c() could yield regmap_ee as an error pointer rather than being checked with IS_ERR(regmap_ee), effectively a copy-paste error...

CVE-2024-40991

The CVE-2024-40991 issue concerns the Linux kernel DMA driver: dmaengine: ti: k3-udma-glue, where the helper of_k3_udma_glue_parse_chn_by_id() calls of_node_put() on the udmax_np node without ever incrementing its reference count. The connected documents confirm this root cause and indicate the v...

CVE-2024-41033

The CVE-2024-41033 issue affects the Linux kernel cachestat component. The root cause is that cachestat() flushed stats while in an RCU read section, which can sleep during workingset_test_recent(). The fix moves the stat-flushing step to occur before the RCU read section and skips stat flushing ...

CVE-2024-41053

The CVE-2024-41053 issue affects the Linux kernel’s SCSI/ufs path. It concerns ufshcd_abort_one racing with the completion ISR, which can cause the request’s mq_hctx pointer to be NULL at ISR completion and may lead to a kernel NULL pointer dereference (as shown in the backtrace). The description...

CVE-2024-41083

CVE-2024-41083 affects the Linux kernel netfs code path. The flaw in netfs_page_mkwrite() could dereference a NULL folio->mapping when the folio lock is held, causing kernel oopses during mmap/write scenarios. The fix ensures folio->mapping is valid after taking the folio lock (consistent w...

CVE-2024-42111

CVE-2024-42111 affects the Linux kernel BTRFS qgroup inheritance path. The root cause was a patch (commit b5357cb268c4) that skipped basic inheritance checks when qgroup was disabled, allowing an invalid btrfs_qgroup_inherit structure to pass through. The approved fix ensures btrfs_qgroup_check_i...

CVE-2024-42266

CVE-2024-42266 affects the Linux kernel’s btrfs module, specifically the cow_file_range_inline path. The issue stems from improper handling of return values in __extent_writepage()/extent_writepage paths, where a folio could be unlocked on error, triggering a kernel panic (folio_test_locked) duri...

CVE-2024-43896

CVE-2024-43896 affects the Linux kernel ASoC cs-amp-lib. Root cause: a NULL pointer crash when efi.get_variable is NULL due to calling it without checking existence. The fix calls efi_rt_services_supported() to verify that efi.get_variable exists before use. CVSS: 5.5 (LOCAL, LOW attack complexit...

CVE-2024-44976

MODE C: CVE-2024-44976 involves the Linux kernel pata_macio driver (ata/pata_macio) where a change to max_segment_size to 64KB caused DMA table overflow on large SG lists, leading to kernel BUGs on 32-bit PowerMacs. The issue arises when oversized requests trigger the split logic, overflowing the...

CVE-2024-45023

CVE-2024-45023 affects the Linux kernel’s MD raid1 path. Root cause: the recovery status was not checked in raid1’s choose_bb_rdev() (and similarly in choose_slow_rdev()), allowing unrecovered data to be read when a degraded array lands valid data on slow disks while a normal disk is still recove...

CVE-2024-56743

CVE-2024-56743 affects the Linux kernel NFS path. The issue arises from holding RCU while calling nfsd_file_put_local; the RCU hold is moved from nfs_to_nfsd_file_put_local to nfs_to_nfsd_net_put, with the rcu-protective call nfsd_serv_put being the one that requires RCU. This change addresses a ...

CVE-2025-38500

CVE-2025-38500 : In the Linux kernel, a use-after-free could occur when changing xfrm interface collect_md state via xfrmi_changelink(), because the collect_md interface could be placed in both xfrmi_net and collect_md_xfrmi structures. The fix uses the xi from netdev_priv earlier in the path to ...

CVE-2025-71097

Technical details for CVE-2025-71097 are not provided in the connected documents. The sources confirm the CVE exists and is tracked in various advisories, but no further product/version/impact/fix specifics are included here. Monitor vendor advisories for updates.

CVE-2026-22997

The CVE-2026-22997 issue affects the Linux kernel CAN/J1939 subsystem. The root cause is that j1939_session_deactivate_activate_next() is only invoked in j1939_tp_rxtimer() when the timer is enabled, allowing a refcount leak if the timer is cancelled without calling the function. This can lead to...

CVE-2026-23416

The CVE-2026-23416 issue affects the Linux kernel (mm/mseal) where vm_area_struct end handling could become stale during VMA merges. The root cause is curr_end not staying in sync when a VMA is updated via vma_modify_flags(), leading to an incorrect curr_start on the next iteration. The fix uncon...

CVE-2026-43383

CVE-2026-43383 affects the Linux kernel’s TCP MD5 signature handling. The root cause is a non-constant-time MAC comparison, enabling potential timing attacks. The vulnerability is addressed by changing the MAC comparison to a constant-time implementation using the appropriate helper function. The...

CVE-2026-46119

CVE-2026-46119 affects the Linux kernel libceph component. The flaw is a slab-out-of-bounds access in auth message processing: if CEPH_MSG_AUTH_REPLY carries a positive result, it is misinterpreted as an error code and later as the size of the front segment, causing out-of-bounds reads. The fix t...

CVE-1999-0381

CVE-1999-0381 affects the syslog utility in super 3.11.6 and other versions, where a buffer overflow allows a local user to gain root privileges. The issue originates from the syslog component, with the impact described as local privilege escalation (root). Available connected documents confirm t...

CVE-2004-1071

The CVE-2004-1071 issue affects the Linux kernel’s binfmt_elf loader (binfmt_elf.c) in kernels 2.4.x up to 2.4.27 and 2.6.x up to 2.6.8. A failed mmap is not handled correctly, leading to an incorrectly mapped image and potential local code execution by unauthorized users. The connected SUSE advi...

CVE-2005-2800

CVE-2005-2800 is a memory leak in the Linux kernel's SCSI procfs sg(devices) interface (for Linux 2.6.13 and earlier). Exploitation arises from repeated reads of /proc/scsi/sg/devices, leading to memory consumption and potential Denial of Service. Publicly documented references describe the issue...

CVE-2005-3180

The CVE-2005-3180 issue concerns the Linux kernel Orinoco wireless driver (orinoco.c). In kernels up to 2.6.13 and earlier, memory from a previously used packet is not cleared when the packet length is increased, which can allow a remote attacker to observe sensitive information (information leak...

CVE-2005-3806

CVE-2005-3806 affects Linux kernels 2.4 (up to 2.4.32) and 2.6 (before 2.6.14); IPv6 flow label handling in ip6_flowlabel.c may modify the wrong variable, enabling local attackers to corrupt kernel memory or trigger a crash by freeing non-allocated memory. Connected advisories (Debian DSA-1018-1/...

CVE-2006-6056

CVE-2006-6056 affects Linux kernel 2.6.x up to 2.6.18 with SELinux hooks enabled. It causes a local denial of service (crash) via a malformed file stream that triggers a NULL pointer dereference in superblock_doinit when using an HFS filesystem image. Connected advisories (e.g., RHSA/CESA) indica...

CVE-2007-1000

The CVE-2007-1000 issue affects the Linux kernel up to version 2.6.20.2, where the ipv6_getsockopt_sticky function in net/ipv6/ipv6_sockglue.c can trigger a NULL dereference through certain getsockopt calls, allowing local users to read arbitrary kernel memory. The vulnerability stems from a NULL...

CVE-2007-6733

CVE-2007-6733 affects the Linux kernel 2.6.9, where the nfs_lock function in fs/nfs/file.c fails to properly remove POSIX locks on files that are setgid without group-execute permission. This can allow local users to cause a denial of service (BUG and system crash) by locking a file on an NFS fil...