CVE-2021-47313

The CVE-2021-47313 entry pertains to the Linux kernel cpufreq CPPC path, where a memleak could occur due to resources not being freed on policy->init() failure during cppc_cpufreq_cpu_init. The vulnerability, and its fix, are documented across multiple connected sources (kernel patch reference...

CVE-2021-47470

CVE-2021-47470 affects the Linux kernel. The issue is in the mm/slab subsystem (slab_debugfs_fops) where a use-after-free can occur if sysfs_slab_add fails, because the slab object “s” is freed soon after and then used later by slab_debugfs_fops. The connected Astra Linux advisory confirms this d...

CVE-2021-47533

CVE-2021-47533 affects the Linux kernel drm/vc4: kms path. A use-after-free could occur when duplicating state due to a stale HVS FIFO commit pointer not being cleared after waiting on the previous FIFO user. The fix sets the HVS FIFO commit pointer to NULL once the wait completes to prevent carr...

CVE-2021-47617

CVE-2021-47617 affects the Linux kernel PCIe hot-plug controller (pciehp) in the PCIe Slot Common Service, specifically the Power Fault Detected (PFD) handling. The issue caused an infinite loop in the IRQ path due to the hardirq handler clearing the PFD bit before the power_fault_detected flag c...

CVE-2022-48749

CVE-2022-48749 affects the Linux kernel (drm/msm/dpu) where dpu_setup_dspp_pcc performs a check on the ctx parameter but uses it prior to the check. The issue is a potential NULL pointer dereference, mitigated by initializing the base variable after the sanity check. The vulnerability is describe...

CVE-2022-48795

CVE-2022-48795 maps to a PA-RISC Linux kernel issue: overrunning sglist in sba_unmap_sg caused a Data TLB miss and null-pointer dereference, leading to a kernel panic. The root cause was testing sg_dma_len(sglist) before confirming remaining entries (nents), which could cross a page boundary and ...

CVE-2022-48800

CVE-2022-48800 : In the Linux kernel, a soft lockup deadlock was observed involving kcompactd when rescheduling and draining PCP lists during page migration, caused by throttling not making progress. The issue is tied to CONFIG_PREEMPT being disabled (CONFIG_PREEMPT=n) and a task migrating pages ...

CVE-2022-48877

In CVE-2022-48877, the Linux kernel f2fs subsystem introduces a fix to avoid a panic when extent_tree is not created. The described crash trace (__lookup_extent_tree+0xd8/0x760; f2fs_do_write_data_page; f2fs_write_cache_pages) occurs during writeback of data pages, potentially leading to kernel p...

CVE-2022-48927

CVE-2022-48927 refers to a Linux kernel issue in iio: adc: tsc2046 where memory corruption occurred due to an array overflow. The root cause was a mismatch: indio_dev->num_channels counted physical channels plus a timestamp channel, while the target array was allocated only for physical channe...

CVE-2022-49186

CVE-2022-49186 describes a Linux kernel vulnerability in the Visconti clock driver where a -1 sentinel used to indicate no reset function is stored in an unsigned 8-bit field. This caused the check if (clks[i].rs_id >= 0) to always be true, leading to an out-of-bounds access in visconti_clk_re...

CVE-2022-49195

The CVE-2022-49195 entry documents a Linux kernel issue in the DSA driver: during multi-chip probing, all switches must probe, but up to N-1 may bind and later shutdown since the Nth switch initializes the tree. If that Nth initialization fails, shutdown on the other switches dereferences uniniti...

CVE-2022-49364

CVE-2022-49364 : In the Linux kernel, a f2fs inode eviction bug was fixed. The root cause is that the inode node and the dnode share the same nid, causing dnode truncation to invalidate the NAT entry during f2fs_evict_inode() and leaving the inode marked dirty. The fix clears the dirty flag on th...

CVE-2022-49393

CVE-2022-49393 affects the Linux kernel code path misc: fastrpc: fix list iterator in fastrpc_req_mem_unmap_impl. The root cause is an incorrect use of the list iterator and a NULL check on the iterator value, where list_for_each_entry() guarantees a non-NULL map, causing the loop exit condition ...

CVE-2022-49425

CVE-2022-49425 affects the Linux kernel's f2fs component. The vulnerability arises from dereferencing a stale list iterator after a loop, where cur->page could become a bogus pointer if no break is hit, risking out-of-bounds/undefined values during comparison with page. The documented fix intr...

CVE-2022-49458

CVE-2022-49458 concerns the Linux kernel MSM DRM path where, if an error occurs before a request_irq() call, msm_drm_uninit() could call free_irq() on an IRQ that was not requested. The described backtrace shows a “Trying to free already-free IRQ” in a Qualcomm SM8350 environment, indicating a us...

CVE-2022-49662

CVE-2022-49662 : Linux kernel vulnerability involving a lockdep splat in in6_dump_addrs() due to incorrect use of rcu_dereference() without rcu_read_lock() held. Affects net/ipv6/addrconf.c (illustrated at line ~5175) and is shown in the provided stack trace (in6_dump_addrs → inet6_dump_addr → ne...

CVE-2022-49972

CVE-2022-49972 concerns a Linux kernel XDP_SHARED_UMEM issue where packets could be corrupted when multiple sockets bind to the same umem (except the first). Root cause: the DMA addresses for pre-populated xsk buffer pool entries were initialized only for the first socket bound to the umem; the l...

CVE-2022-50001

The CVE-2022-50001 issue affects the Linux kernel netfilter component nft_tproxy. The root cause was that TPROXY could be used from non-prerouting paths, leading to a null dereference crash. The fix restricts nft_tproxy to the prerouting hook, requiring a check that it runs only in prerouting. Th...

CVE-2022-50005

The CVE-2022-50005 issue concerns Linux kernel NFC code for pn533 devices. The root cause is a use-after-free caused by a timer (cmd_timeout) not being canceled during pn532_uart_remove(), allowing a concurrent use path to dereference freed memory. The fix adds del_timer_sync() in pn532_uart_remo...

CVE-2022-50038

CVE-2022-50038 affects the Linux kernel in drm/meson, specifically the meson_vpu_has_available_connectors() function. The issue consists of two refcount leak bugs: (1) missing of_node_put() for the 'ep' when exiting for_each_endpoint_of_node(), and (2) missing of_node_put() for the reference from...

CVE-2022-50049

CVE-2022-50049 affects the Linux kernel ASoC DPCM path: when adding BE connections, the code could pick a BE that does not support the required stream direction, risking a NULL dereference if a BE substream is missing. The patch adds a presence check for the target BE’s substream at dpcm_add_path...

CVE-2022-50155

CVE-2022-50155 concerns the Linux kernel MTDi parsing code: a refcount leak in bcm4908_partitions_fw_offset was fixed by ensuring of_node_put() is called after of_find_node_by_path() returns a node. The vulnerability affects the kernel component responsible for partition parsing (mtd: parsers: of...

CVE-2022-50197

In CVE-2022-50197, the Linux kernel vulnerability affects the cpufreq: zynq component. The root cause is a refcount leak when retrieving a device node: of_find_compatible_node() returns a node pointer with an incremented refcount, and missing of_node_put() on cleanup leads to a leak. The fix adds...

CVE-2022-50199

Mode C: The CVE-2022-50199 issue affects the Linux kernel on ARM (OMAP2+). The root cause is a refcount leak in omapdss_init_of: omapdss_find_dss_of_node() calls of_find_compatible_node() which returns a node with a refcount incremented, but of_node_put() is not always called. The fix adds missin...

CVE-2022-50208

CVE-2022-50208 affects the Linux kernel, specifically the soc: amlogic driver code for meson-secure-pwrc.c. In meson_secure_pwrc_probe(), there is a refcount leak on one failure path, which is the root cause described in the Initial Document. The vulnerability is fixed in the same area (refcount ...

CVE-2023-52779

CVE-2023-52779 describes a Linux kernel issue where vfs_getattr_nosec() could end up invoking vfs_getattr() in certain filesystems (notably overlayfs and ecryptfs), which could lead to a NULL pointer dereference due to security_inode_getattr() on a process with no current->fs. The patch introd...

CVE-2023-52785

CVE-2023-52785 affects the Linux kernel, specifically the SCSI UFS core. The issue is a race between ufshcd_mcq_abort() and the ISR: when a command timeout occurs and a CQ complete IRQ arrives concurrently, ufshcd_mcq_abort clears lprb->cmd, leading to a NULL pointer dereference in the ISR. Th...

CVE-2023-52996

CVE-2023-52996 : Linux kernel IPv4 code in fib_metrics_match() uses @type as an array index, which could enable a spectre v1 gadget. The connected advisories indicate this is resolved in the kernel, with mitigation by preventing speculative access to fi->fib_metrics->metrics[type-1]. The vu...

CVE-2024-38584

In CVE-2024-38584, the Linux kernel net: ti: icssg_prueth prueth_probe() dereferenced a NULL pointer when emac_phy_connect() failed and of_phy_connect() returned NULL, leading to NULL pointer dereference in phy_attached_info(). The public fix is to check the return code of emac_phy_connect and fa...

CVE-2024-40991

The CVE-2024-40991 issue concerns the Linux kernel DMA driver: dmaengine: ti: k3-udma-glue, where the helper of_k3_udma_glue_parse_chn_by_id() calls of_node_put() on the udmax_np node without ever incrementing its reference count. The connected documents confirm this root cause and indicate the v...

CVE-2024-41003

The CVE-2024-41003 entry concerns a Linux kernel BPF verifier bug: after a prior OR, line 19 triggers a REG INVARIANTS VIOLATION due to a corrupted fake_reg when reg_set_min_max is applied to a known-constant branch. The issue arises in the BPF subsystem’s handling of register invariants during a...

CVE-2024-41029

CVE-2024-41029 — Linux kernel (nvmem/core) Affected: Linux kernel components handling non-volatile memory (nvmem). Issue: the cell sysfs attribute could expose more access to nvmem data than the main attribute, e.g., when nvme_config::root_only was set, the cell attribute still allowed reads for ...

CVE-2024-41053

The CVE-2024-41053 issue affects the Linux kernel’s SCSI/ufs path. It concerns ufshcd_abort_one racing with the completion ISR, which can cause the request’s mq_hctx pointer to be NULL at ISR completion and may lead to a kernel NULL pointer dereference (as shown in the backtrace). The description...

CVE-2024-42111

CVE-2024-42111 affects the Linux kernel BTRFS qgroup inheritance path. The root cause was a patch (commit b5357cb268c4) that skipped basic inheritance checks when qgroup was disabled, allowing an invalid btrfs_qgroup_inherit structure to pass through. The approved fix ensures btrfs_qgroup_check_i...

CVE-2024-43862

CVE-2024-43862 affects the Linux kernel’s net: wan: fsl_qmc_hdlc component. The root cause is using a spinlock (carrier_lock) to protect carrier detection while framer_get_status() may take a mutex, creating a potential deadlock. The issue is addressed by converting carrier_lock from a spinlock t...

CVE-2024-45004

CVE-2024-45004 affects the Linux kernel KEYS: trusted: dcp path. The bug leaks the blob encryption key (BEK) plaintext on export because BEK decryption occurs in-place in the key blob; subsequent reads output the BEK in plain text. The issue arises when importing a DCP-based trusted key and expor...

CVE-2024-46790

CVE-2024-46790 concerns the Linux kernel: when freeing PG_hwpoison pages they are isolated rather than released, leading to a warning: “alloc_tag was not set.” The Astra Linux bulletin confirms the issue and states the fix is to “clear the page tag reference after the page got isolated and accoun...

CVE-2024-57878

CVE-2024-57878 (Linux kernel, arm64) : The vulnerability in ptrace NT_ARM_FPMR regset handling could leave the temporary fpmr uninitialized for zero-length writes, potentially leaking up to 64 bits of kernel-stack memory. The patch initializes the temporary value before copying the regset from us...

CVE-2024-58060

CVE-2024-58060 affects the Linux kernel BPF struct_ops path. The issue occurs when a struct_ops contains a struct module *owner and CONFIG_MODULES=n, causing incorrect refcounting because the module btf_id is missing, leading to a potential use-after-free in tcp_congestion_ops. The patch disables...

CVE-2025-21803

CVE-2025-21803: In LoongArch, the Linux kernel fixed a warning during S3 suspend by removing a potential thread switch in enable_gpe_wakeup. Root cause was acpi_enable_all_wakeup_gpes() using a mutex, which could yield and leave the CPU interrupt-enabled state when enable_gpe_wakeup() returns. Th...

CVE-2025-22006

CVE-2025-22006 affects the Linux kernel net/ethernet ti am65 cpsw driver: registering TX/RX DMA interrupts before their NAPI callbacks can cause a NULL pointer dereference. The issue has been fixed in kernel commits (see kernel.org references) and Astra/Oracle advisories indicate the vulnerabilit...

CVE-2025-38025

The CVE-2025-38025 issue affects the Linux kernel IIO ADC driver for the ad7606 bus. The root cause is a NULL dereference when calling sw_mode_config() because the callback may not be defined on all buses. The vulnerability can lead to a crash via NULL-pointer dereference in vulnerable configurat...

CVE-2025-38114

CVE-2025-38114 : In the Linux kernel, a deadlock could occur in the e1000 path due to e1000_down calling cancel_work_sync for the e1000_reset_task while RTNL is held. The fix moves cancel_work_sync to happen when the device is being removed (not during normal down), and makes e1000_reset_task a n...

CVE-2025-38527

CVE-2025-38527 – Linux kernel SMB (CIFS) oplock_break UAF : A race during unmount can lead to use-after-free of cinode in cifs_oplock_break. The fix is to hold an extra reference to the superblock for the duration of the oplock-break operation, ensuring the superblock and inodes remain valid unti...

CVE-2025-71089

CVE-2025-71089 affects the Linux kernel via IOMMU Shared Virtual Addressing (SVA). In SVA, the IOMMU can cache kernel page-table entries, so freeing a kernel page-table page and reusing it could leave stale IOMMU entries, enabling use-after-free or write-after-free scenarios that could allow loca...

CVE-2026-23069

CVE-2026-23069 (Linux kernel) : In vsock/virtio, the credit calculation in virtio_transport_get_credit() can underflow when the peer’s advertised buffer (peer_buf_alloc) shrinks while data is in flight, potentially allowing more data to be queued than the peer can handle. The issue arises from un...

CVE-1999-1225

Concretely, CVE-1999-1225 affects rpc.mountd and is described in SGI IRIX advisories as allowing a remote tester to probe for the existence of files by issuing mount requests, leading to distinguishable error messages. The SGI advisory fixes this by patching/upgrading IRIX (upgrade to IRIX 6.5.23...

CVE-2004-0075

The CVE-2004-0075 issue affects the Linux kernel's Vicam USB driver prior to 2.4.25. The vulnerability arises because data copied from userspace to kernel space does not use copy_from_user, crossing security boundaries and enabling a local attacker to cause a denial of service. Public advisories ...

CVE-2004-0887

CVE-2004-0887 affects SUSE Linux Enterprise Server 9 on the S/390 platform, where the SACF privileged instruction is not handled correctly, allowing a local user to gain root privileges. Connected sources also reference Debian advisories for kernel-source-2.4.27 updates (DSA-1018-1/2) that addres...

CVE-2004-2731

CVE-2004-2731 concerns the Linux kernel Sbus PROM driver (drivers/sbus/char/openprom.c) allowing local code execution via integer overflows when a small buffer is passed to copyin_string or a negative size to copyin. It affects 2.4.x (up to 2.4.27) and 2.6.x (up to 2.6.7) and possibly later versi...