CVE-2022-50381

CVE-2022-50381 targets the Linux kernel mempool_free crash observed during mdend/mempool usage in environments such as EulerOS and Unity Linux. The root cause is a race between wake-up of pending_writes and the subsequent free of bios (bio) in mempool_free, where bio_put could race with other act...

CVE-2022-50390

The CVE-2022-50390 issue is in the Linux kernel DRM TTM code. It fixes an undefined behavior when shifting a signed 32-bit value by 31 bits in TTM_TT_FLAG_PRIV_POPULATED, by changing the operation to unsigned to avoid UBSAN/shift-out-of-bounds warnings observed during framebuffer/VM operations. T...

CVE-2022-50407

The CVE-2022-50407 entry concerns the Linux kernel crypto: hisilicon/qm component, where the code path allocates a small local buffer for a QoS value and uses sscanf without validating destination length, enabling a stack overflow. Public documents in connected sources confirm the issue and descr...

CVE-2022-50410

CVE-2022-50410 pertains to the Linux kernel NFSD component handling NFSv2 READ. The issue arises from the historical optimization that combines the RPC receive and send buffers into a single page array, shrinking the send buffer when a large RPC Call is received. A client can trigger this shrinka...

CVE-2022-50411

CVE-2022-50411 concerns the Linux kernel. A use-after-free vulnerability occurs in the ACPI sub-system: after a failed invocation of acpi_ds_call_control_method(), the thread’s next_walk_state is freed but not popped, causing acpi_ps_parse_aml() to obtain an invalid current walk state. The fix ma...

CVE-2022-50527

CVE-2022-50527 concerns the Linux kernel patch for amdgpu memory size validation. The description states that amdgpu_bo_validate_size() was fixed to verify that the TTM domain manager for the requested memory exists, preventing a kernel oops when dereferencing the manager pointer. The lineage sho...

CVE-2023-53149

CVE-2023-53149 concerns the Linux kernel ext4 filesystem. The issue arises from a filesystem-wide lock protecting ext4_writepages() that can deadlock during fs reclaim initiated by page writeback, due to a recursion scenario where ext4_writepages() attempts to acquire sbi->s_writepages_rwsem w...

CVE-2023-53196

CVE-2023-53196 affects the Linux kernel USB subsystem (dwc3 on Qualcomm platforms). The issue was a memory leak in dwc3_qcom_probe(), where allocated memory for the resource structure pointed to by parent_res was not freed. The fix replaces that dynamic allocation with stack-allocated memory to p...

CVE-2023-53198

CVE-2023-53198 affects the Linux kernel raw socket handling (net/ipv4/raw.c). The vulnerability is a NULL dereference in raw_get_next(), triggered by races where a socket in one netns is freed while another thread iterates SOCK_RAW sockets. The root cause involves using RCU-based iteration with h...

CVE-2023-53225

The connected details describe CVE-2023-53225 as a Linux kernel issue in the SPI IMX driver where the remove path could skip cleanup of DMA resources on error. The root cause is returning early from a platform driver’s remove callback, leading to a permanent resource leak because DMA resources ma...

CVE-2023-53254

CVE-2023-53254 is a Linux kernel vulnerability related to the cacheinfo shared_cpu_map. The issue occurs when the kernel checks that caches with the same index are shared, which can trigger slab-out-of-bounds access if CPUs have different cache hierarchies. A second problem is a mismatched shared...

CVE-2023-53266

The CVE-2023-53266 issue affects the Linux kernel (arm64) ACPI path involving ffh_ctxt allocation. The vulnerability arises when SMCCC version and conduit checks fail and a -EOPNOTSUPP return occurs without freeing the allocated ffh_ctxt memory, creating a memory leak. The documented fix moves th...

CVE-2023-53280

CVE-2023-53280 affects the Linux kernel’s scsi/qla2xxx path. The issue stems from removing the unused nvme_ls_waitq wait queue, which could lead to a NULL pointer dereference when qla2x00_start_sp returns an error and wake_up is invoked for an uninitialized sp->nvme_ls_waitq. The connected adv...

CVE-2023-53281

Technical details for CVE-2023-53281 (affected product, root cause, impact, or mitigation) are not provided in the connected documents. Monitor for updates from vendors or advisories.

CVE-2023-53301

CVE-2023-53301 affects the Linux kernel f2fs subsystem. The root cause is a NULL pointer dereference when io->bio is NULL inside __submit_merged_write_cond, which can cause a kernel panic during f2fs_checkpoint/write paths. A fix was implemented to return when io->bio is NULL before proceed...

CVE-2023-53313

CVE-2023-53313 concerns the Linux kernel, fixing the corrupted md/raid10 behavior where no input validation existed for echo md/max_read_errors, risking overflow and affecting availability (fixed in the kernel). Public references from Unity Linux Nessus advisories reproduce the description, confi...

CVE-2023-53326

CVE-2023-53326 affects the PowerPC Linux kernel. It stems from PF_KTHREAD/PF_IO_WORKER tasks with a NULL pt_regs, causing a NULL pointer dereference during core dump (kernel crash). The fix adds pt_regs validity checks in ppc_get/ppr_set and returns -EINVAL if pt_regs are not set. Remediation is ...

CVE-2023-53334

CVE-2023-53334 affects the Linux kernel USB: chipidea subsystem. The issue was a memory leak that occurred when using debugfs_lookup(); the returned object must be paired with dput(), otherwise memory leaks over time. The fix simplifies handling by using debugfs_lookup_and_remove(), which perform...

CVE-2023-53343

CVE-2023-53343: Linux kernel vulnerability where icmp6_dev() dereferences ip6_null_entry->rt6i_idev, potentially enabling NULL pointer dereference when processing IPv6 Extension Headers (RPL/SRv6). Impact is local (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) with available mitigation by upgrading to ...

CVE-2023-53349

CVE-2023-53349 concerns the Linux kernel media driver ov2740. The vulnerability stems from a memleak in ov2740_init_controls() where resources allocated in the failure path are not fully freed, causing a kmemleak when testing media/i2c/ov2740.c with a BPF mock device. The advisory notes an unrefe...

CVE-2023-53351

CVE-2023-53351 concerns the Linux kernel drm/sched subsystem. The vulnerability arises from using the scheduler’s ready flag to decide whether to call drm_sched_fault, which could lead to GPU reset or a fault depending on timing between IRQ handling and gfx engine startup. The root cause is that ...

CVE-2023-53358

CVE-2023-53358 relates to the Linux kernel’s ksmbd component, where a race condition during concurrent smb2 tree disconnect led to a use-after-free (UAF). The issue is addressed by a patch that adds TREE_CONN_EXPIRE flags for tcon to prevent concurrent access. The connected documents confirm the ...

CVE-2023-53359

CVE-2023-53359 affects the Linux kernel and fixes a memory-leak in debugfs_lookup(). The issue occurs when the result of debugfs_lookup() is not paired with a dput(), allowing memory to leak over time. The workaround introduced in the patch is to call debugfs_lookup_and_remove(), which handles al...

CVE-2023-53360

CVE-2023-53360: Technical details are not publicly provided in the supplied documents. No explicit affected products/versions, impact, or remediation are stated here. Monitor official advisories for concrete details and fixes.

CVE-2023-53375

The CVE refers to a Linux kernel tracing issue: when a tracing instance is removed, the error logs from that instance were not freed, causing a memory leak reported by kmemleak. The problem statement and example trace are provided in the initial document, and connected advisories (EulerOS kernel ...

CVE-2023-53424

Technical details for CVE-2023-53424 are not publicly provided in the connected documents; only the fix note (mediatk clk memory leak) is echoed. Monitor upstream advisories for specifics on affected products, versions, and remediation.

CVE-2023-53454

CVE-2023-53454 - Linux kernel HID multitouch fix : The issue arises from using the input_dev name in a devm-allocated string, which can cause a use-after-free when input_dev is unregistered and a uevent referencing the name fires. The patch changes the reference to the HID device for devm allocat...

CVE-2023-53569

The CVE-2023-53569 entry refers to the Linux kernel ext2 filesystem check during mount, where the log of the block size stored in the superblock must be validated to prevent an overflow in the block size calculation. This vulnerability can cause undefined behavior if the block size value is not s...

CVE-2024-58241

CVE-2024-58241 concerns the Linux kernel Bluetooth subsystem (hci_core). The issue is described as Disable works on hci_unregister_dev, where submissions are not disarmable because hci_dev is freed, leading to potential use of disabled work. Connected OSV entries (e.g., ROOT-OS-UBUNTU-2204/2404, ...

CVE-2025-38357

CVE-2025-38357 concerns the Linux kernel fuse implementation emitting a runtime warning during truncate_folio_batch_exceptionals(). Public details indicate the WARN_ON_ONCE path was added in truncate_folio_batch_exceptionals() and that fixes were already applied to xfs and ext4 via commit 0e2f80a...

CVE-2025-38394

The CVE-2025-38394 issue is in the Linux kernel HID path (appletkd/b appletb-kbd) where an input handler is registered to input core and then, if probe fails, freed memory remains in input_handler_list. This creates a use‑after‑free condition (UAF) in input_attach_handler during subsequent device...

CVE-2025-38411

The CVE-2025-38411 issue is in the Linux kernel’s netfs handling. A netfs request finishing during the pause loop could have its IN_PROGRESS ref removed, and if it proceeded to the final wait loop, the code could incorrectly call the collector again because it sees IN_PROGRESS as cleared. The doc...

CVE-2025-38442

The CVE-2025-38442 entry concerns the Linux kernel and a fix for large folio support when THP (Transparent Huge Pages) is disabled. The vulnerability could trigger a NULL pointer dereference during boot if a block device with logical block size larger than the page size is present while THP is of...

CVE-2025-38598

CVE-2025-38598 : Affected component is the Linux kernel amdgpudriver (AMDGPU) code; the issue is a use-after-free in amdgpu_userq_suspend (addressing a slab-use-after-free). The vulnerability is reported with a read of size 8 during pci_unplug/remove flow, as part of a KASAN report. The entry ind...

CVE-2025-38599

CVE-2025-38599 : The connected records confirm a Linux kernel vulnerability in the wifi/mt76 stack for the mt7996 device family. Affected component: kernel networking stack (mt7996_tx function). Root cause: Out-of-bounds access in mt7996_tx() when link_id is set to IEEE80211_LINK_UNSPECIFIED. Imp...

CVE-2025-38625

The CVE-2025-38625 issue concerns the Linux kernel vfio/pds driver. When CONFIG_IOMMUFD is enabled and a device is bound to the pds_vfio_pci driver, probe fails with a WARN_ON trace because vfio_device_ops.detach_ioas isn’t set. The vuln is resolved by applying a fix that uses the generic vfio_io...

CVE-2025-38628

CVE-2025-38628 affects the Linux kernel mlx5 vdpa path. The issue was a resource cleanup bug where cleanup paths could operate on uninitialized resources, triggering a splat when adding a vdpa device without a MAC address. The fixes ensure mlx5_vdpa_free() is the single entrypoint for removing vd...

CVE-2025-38696

CVE-2025-38696 (Linux kernel, MIPS) : The issue occurs in stack_top() for tasks without an ABI or vDSO mapping (e.g., kthreads). If such a task calls stack_top(), it can dereference a NULL ABI pointer and crash. Affected area is the MIPS support in the Linux kernel; the advisory notes the crash c...

CVE-2025-38714

CVE-2025-38714 affects the Linux kernel’s HFS+ subsystem. The issue is a slab-out-of-bounds in hfsplus_bnode_read(), leading to potential memory corruption during operations that touch HFS+ bnodes. The connected advisories indicate a fix has been applied in upstream kernel code (hfsplus_bnode_rea...

CVE-2025-38736

Technical details about CVE-2025-38736 are not provided in the connected documents. The initial description notes a Linux kernel MDIO PHY address masking fix (mask with 0x1f) in net: usb: asix_devices to prevent OOB/invalid MDIO addresses. Connected advisories reference the CVE, but do not supply...

CVE-2025-39692

CVE-2025-39692 is a Linux kernel vulnerability related to the SMB ksmbd path where ksmbd_rdma_stop_listening() must be called before stop_sessions() to avoid using the smb_direct_wq pointer after destroy. The issue arises when the order is not respected, allowing existing connections to reference...

CVE-2025-39705

The CVE-2025-39705 entry concerns a NULL pointer dereference in the AMD display driver (DC module) for the Linux kernel. Root cause: during cleanup in dc_destruct(), if dc->ctx construction failed, dc->ctx is NULL but code dereferenced dc->ctx->perf_trace. The fix added a NULL check f...

CVE-2025-39710

CVE-2025-39710: In the Linux kernel, the Venus media driver adds a packet-size validation after reading the header from shared memory to ensure the reported size cannot exceed the number of available words. This fixes potential out-of-bounds memory accesses by firmware-provided sizes. The fix tar...

CVE-2025-39715

CVE-2025-39715 affects the Linux kernel on Parisc where a read-access check was not triggered for certain user-access memory references, allowing a local attacker to execute a LWS compare-and-swap at an address that is read-protected at PRIV_USER. The issue is fixed by probing read access rights ...

CVE-2025-39721

CVE-2025-39721 (Linux kernel, crypto: qat) : Repeated loading/unloading of a device-specific QAT driver (e.g., qat_4xxx) can trigger a use-after-free when a power-management interrupt fires just before the core intel_qat.ko remains loaded. The shared workqueue qat_misc_wq may still host a deferre...

CVE-2025-39723

CVE-2025-39723 affects the Linux kernel netfs unbuffered write path. When all subrequests in an unbuffered write stream fail, stream->transferred could remain LONG_MAX, and wreq->transferred could be updated to that value, causing write_iter() to report an erroneous non‑zero transfer and tr...

CVE-2025-39742

CVE-2025-39742 - RDMA: hfi1 divide-by-zero in find_hw_thread_mask() (Linux kernel) Affects: Linux kernel RDMA hfi1 path; vulnerability arises from dividing the number of online CPUs by num_core_siblings, followed by a zero-division check. Root cause: division performed before validating the divis...

CVE-2025-39752

CVE-2025-39752: In the Linux kernel (ARM/rockchip), the SMP initialization hang bug was fixed by moving SRAM initialization to after all secondary CPUs are powered down. The root cause involved the trampoline code being written to SRAM while secondary CPUs were powered on, causing potential kerne...

CVE-2025-39918

CVE-2025-39918 is a Linux kernel flaw in the wifi mt76 driver (linked list corruption) caused by not clearing a temporary on-stack list of wcid entries. A fix was applied to address the linked list corruption. The provided documents confirm the vulnerability and the patch but do not disclose affe...

CVE-2025-39945

The CVE-2025-39945 entry concerns a race in the Linux kernel cnic subsystem where a use-after-free can occur if a delayed work item (delete_task) remains active during cnic_dev deallocation. The root cause is that cancel_delayed_work() does not guarantee the delayed work item has finished if it i...