CVE-2022-50479

In the Linux kernel, the drm/amd driver had a potential memory leak in clk_src when a function hits the last return NULL. The patch fixes this leak by adjusting cleanup paths (s/free/kfree/), per the commit notes. Affected product: Linux kernel with drm/amd component; impact is memory leak (avail...

CVE-2023-53191

The CVE-2023-53191 vulnerability affects the Linux kernel code path irqchip/alpine-msi in alpine_msix_init_domains. The root cause is a refcount leak caused by not calling of_node_put() on the node returned by of_irq_find_parent() after it is no longer needed. A fix adds the missing of_node_put()...

CVE-2023-53196

CVE-2023-53196 affects the Linux kernel USB subsystem (dwc3 on Qualcomm platforms). The issue was a memory leak in dwc3_qcom_probe(), where allocated memory for the resource structure pointed to by parent_res was not freed. The fix replaces that dynamic allocation with stack-allocated memory to p...

CVE-2023-53326

CVE-2023-53326 affects the PowerPC Linux kernel. It stems from PF_KTHREAD/PF_IO_WORKER tasks with a NULL pt_regs, causing a NULL pointer dereference during core dump (kernel crash). The fix adds pt_regs validity checks in ppc_get/ppr_set and returns -EINVAL if pt_regs are not set. Remediation is ...

CVE-2023-53359

CVE-2023-53359 affects the Linux kernel and fixes a memory-leak in debugfs_lookup(). The issue occurs when the result of debugfs_lookup() is not paired with a dput(), allowing memory to leak over time. The workaround introduced in the patch is to call debugfs_lookup_and_remove(), which handles al...

CVE-2023-53452

Observation: CVE-2023-53452 concerns a race condition in the Linux kernel affecting the wifi driver path for rtW89. When a netdev is registered but NAPI isn’t initialized yet, a race can occur if user space opens the netdev and enables NAPI, causing a kernel BUG at net/core/dev.c:6423 and an inva...

CVE-2023-53552

CVE-2023-53552 affects the Linux kernel DRM i915 component, specifically marking requests for GuC virtual engines to prevent use-after-free across sync_file/dma-buf handling. The underlying issue is that i915_requests could be trapped by userspace and held across processes, creating a memory-leak...

CVE-2023-53569

The CVE-2023-53569 entry refers to the Linux kernel ext2 filesystem check during mount, where the log of the block size stored in the superblock must be validated to prevent an overflow in the block size calculation. This vulnerability can cause undefined behavior if the block size value is not s...

CVE-2025-38121

The CVE-2025-38121 entry describes a Linux kernel issue in the wifi: iwlwifi: mld path. When an error occurs during init, in_hw_restart is set but never cleared, causing the code to retry init as if in a restart while not actually in one. This can lead to a NULL pointer dereference during cancell...

CVE-2025-38379

The CVE-2025-38379 entry corresponds to a Linux kernel SMB/CIFS issue where, during smb2_reconnect_server() channel reestablishment, a dummy tcon with an uninitialized ->query_interface is passed to smb2_reconnect(), making queue_delayed_work() unsafe to call on that tcon. The result is a warn...

CVE-2025-38486

CVE-2025-38486 concerns the Linux kernel SoundWire subsystem, specifically related to reverting the commit that added set_channel_map API support for Qualcomm SoundWire. The vulnerability manifests in the soundwire_qcom path (qcom_swrm_set_channel_map) and was linked to a broken zero-th pconfig e...

CVE-2025-38599

CVE-2025-38599 : The connected records confirm a Linux kernel vulnerability in the wifi/mt76 stack for the mt7996 device family. Affected component: kernel networking stack (mt7996_tx function). Root cause: Out-of-bounds access in mt7996_tx() when link_id is set to IEEE80211_LINK_UNSPECIFIED. Imp...

CVE-2025-38640

CVE-2025-38640 concerns the Linux kernel netfilter BPF path. The issue arises when a BPF program could be executed in nf_hook_run_bpf() without properly disabling migration, which can lead to a crash (splat) in __bpf_prog_run(). The fix introduced is to call bpf_prog_run_pin_on_cpu() in nf_hook_r...

CVE-2025-38645

CVE-2025-38645 affects the Linux kernel (net/mlx5). Root cause: a NULL device memory pointer (dev->dm) can be dereferenced in mlx5_init_once() if allocation fails. Fix: add a NULL check before accessing device memory to prevent a crash. Impact in docs: LOCAL attacker could crash the system; re...

CVE-2025-38647

CVE-2025-38647 affects the Linux kernel wifi/rtw89 driver. The issue is a dropped lockdep assertion in rtw89_set_sar_from_acpi during driver startup, which could trigger under early init and is resolved by the kernel fix. The vulnerability details, call trace, and affected chain are documented in...

CVE-2025-38655

The CVE-2025-38655 issue in the Linux kernel affects pinctrl for canaan: k230 where the group parser retrieved the device-tree property "pinmux" without validating the of_get_property() return. The root cause is a missing NULL check, leading to a potential NULL pointer dereference if the property...

CVE-2025-38682

The CVE-2025-38682 entry details a Linux kernel vulnerability in i2c core: i2c_unregister_device() could double-free a fwnode when the i2c_client has a software-node as its primary fwnode. The root cause was unconditional fwnode_handle_put() on the i2c_client, which, if a software fwnode is prima...

CVE-2025-38683

CVE-2025-38683 affects hv_netvsc in the Linux kernel. The issue arises during namespace deletion when a VF NIC is moved to a new namespace and then back, causing netdev list handling to dereference NULL and trigger a kernel panic. The supplied references describe the root cause as a race in defau...

CVE-2025-38687

The CVE-2025-38687 issue affects the Linux kernel’s comedi subsystem, where a race between polling and detaching a device can lead to a use-after-free of the wait_queue_head memory. The root cause is the removal of the allocated async area while poll requests are still active on subdevice wait qu...

CVE-2025-38705

CVE-2025-38705: In the Linux kernel, writing a string without delimiters to gpu_od/fan_ctrl or pp_power_profile_mode for the CUSTOM profile can cause a NULL pointer dereference in drm/amd/pm. SUSE/OpenSUSE advisories (e.g., SUSE-SU-2025:03600-1) list this alongside many other kernel fixes and ind...

CVE-2025-39678

CVE-2025-39678 affects the Linux kernel, specifically the x86/amd/hsmp code path. The vulnerability arises when sock->metric_tbl_addr is NULL, which can cause a NULL pointer dereference when accessing metrics_bin. The provided connected SUSE advisory confirms the fix: a NULL check was added to...

CVE-2025-39704

The provided connected documents confirm CVE-2025-39704 affects LoongArch KVM in the Linux kernel, where send_ipi_data() calls kvm_io_bus_read() and may write an 8-byte signed extension into *val regardless of the given length. This can cause a buffer overflow when CONFIG_STACKPROTECTOR is enable...

CVE-2025-39786

The CVE-2025-39786 issue affects the Linux kernel IIO ADC driver for ad7173. The root cause is an index mismatch when accessing the syscalib_mode channel: the address field is 0-based (same as scan_index) used to locate entries in ad7173_channels, while the channels field may not match the addres...

CVE-2025-39822

The CVE-2025-39822 issue affects the Linux kernel io_uring/kbuf path. Root cause: buf->len is treated unsigned when importing buffers but is converted to signed int when committing, risking negative interpretation for large buffers. Mitigation: the min_t calculation is now unsigned. This is a ...

CVE-2025-39854

CVE-2025-39854 affects the ice driver in the Linux kernel. The ice_ll_ts_intr() path could dereference a NULL tracker or use-after-free if the ice_ptp_tx tracker isn’t initialized. The fix gates access on the tracker’s initialized state and ensures reset clears the init flag under lock to prevent...

CVE-2025-39966

CVE-2025-39966 (Linux kernel, iommufd) : A race during abort for file descriptors could cause a use-after-free when the object is freed while a file’s private_data references it. The bug arises because fput() defers release() to a workqueue; ifAbort allocation fails before installing the file, th...

CVE-2025-40039

The CVE-2025-40039 issue is a Linux kernel ksmbd race condition in RPC handle list access. The underlying bug was that ksmbd_session_rpc_open() used only a read lock before xa_store()/xa_erase() (modifications require a write lock), and ksmbd_session_rpc_method() read the list with xa_load() with...

CVE-2025-40149

CVE-2025-40149 affects the Linux kernel TLS path: get_netdev_for_sock() could trigger a use-after-free if sk_dst_get(sk)->dev is used during setsockopt(). The fix replaces sk_dst_get() with __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(), and notes that the only user of ->ndo_sk_g...

CVE-2025-71161

The connected advisory describes CVE-2025-71161 affecting Linux kernel dm-verity. It centers on the verity_fec_decode() path in drivers/md/dm-verity-fec.c, where recursive forward error correction can be triggered. Root cause: the recursive correction logic may loop deeply (253 iterations per lev...

CVE-2025-71185

CVE-2025-71185 concerns the Linux kernel DMA engine TI dma-crossbar, specifically a leak of a crossbar device reference during am335x route allocation. The description states the fix is to drop the reference taken when looking up the crossbar platform device during am335x route allocation, addres...

CVE-2025-71188

CVE-2025-71188 affects the Linux kernel DMA engine path for the lpc18xx-dmamux component, where a reference leak to the platform device during route allocation could occur. The fix drops the reference after looking up the DMA mux platform device, mitigating the leak. OSV entries show Root:Ubuntu ...

CVE-2025-71311

CVE-2025-71311 concerns the Linux kernel’s fs/ntfs3 path, where new folios could be left partially filled and memory uninitialized. This stems from a KMSAN-detected uninitialized value in longest_match_std(), invoked by ntfs_compress_write(), occurring when new folios aren’t marked uptodate and n...

CVE-2026-22977

CVE-2026-22977 affects the Linux kernel net: sock: fix hardened usercopy panic in sock_recv_errqueue. The issue arises when using skbuff_fclone_cache where no usercopy whitelist exists for skb.cb, causing a usercopy BUG() during put_cmsg() when copying serr->ee from skb->cb via sock_recv_er...

CVE-2026-22986

CVE-2026-22986 concerns a race in Linux kernel gpiolib where two drivers calling gpiochip_add_data_with_key() can concurrently traverse gpio_name_to_desc() while another adds gdev to the list, creating a window where gdev->srcu is dereferenced before it is initialized. The result is a crash (k...

CVE-2026-23020

CVE-2026-23020 is a Linux kernel issue affecting the 3com 3c59x driver. The vulnerability stems from a potential NULL dereference in vortex_probe1(), where a null pdev could lead to a NULL dereference and later calls to free_ring. The vulnerability was fixed in the upstream kernel as part of the ...

CVE-2026-23023

CVE-2026-23023 concerns the Linux kernel, where a memory leak was fixed in the idpf driver. The vulnerability arises from not freeing vport->rx_ptype_lkup in idpf_vport_rel(), leading to leaked memory during a reset. The fix frees the memory as part of idpf_vport_rel(), preventing the unrefere...

CVE-2026-23088

CVE-2026-23088 affects the Linux kernel tracing subsystem. The issue arises when a synthetic event reuses an existing synthetic event’s stacktrace field, leading to a kernel crash (crash/NULL pointer dereference) when enabling linked synthetic events. The root cause is how the stacktrace field is...

CVE-2026-23096

CVE-2026-23096 affects the Linux kernel UACCE accelerator framework (uacce). The issue is in the cleanup path: if cdev_device_add fails, the kernel releases the cdev memory, and later a cdev_device_del could hang. The fix adds a check on the return value of cdev_device_add and clears uacce->cd...

CVE-2026-23153

CVE-2026-23153 concerns the Linux kernel regarding a race condition in the FireWire core when enumerating the transaction list without a lock during AR response processing, potentially impacting AT request completion handling. The issue is resolved by moving the timer start for split-transaction ...

CVE-2026-23161

CVE-2026-23161 affects the Linux kernel's mm/shmem, swap handling. The bug stems from a race between truncate and swap entry split: the code uses xa_get_order without lock protection to determine the swap entry order and then calls xa_cmpxchg_irq, which can use an outdated order if the entry was ...

CVE-2026-23190

Mode C: CVE-2026-23190 affects the Linux kernel ASoC/amd driver; the issue is a memory leak in acp3x PDM DMA ops. Public advisories (Mageia, SUSE/OpenSUSE, Oracle Linux, Debian) confirm upstream fix in kernel. Remediation is applying the upstream patch (memory leak in acp3x pdm dma ops) or upgrad...

CVE-2026-23281

In CVE-2026-23281, the Linux kernel Libertus wifi driver (lbs_free_adapter) uses non‑synchronous timer_delete() for command_timer and tx_lockup_timer, risking use‑after‑free if a timer callback runs during free. The callbacks (lbs_cmd_timeout_handler, lbs_tx_lockup_handler) access freed fields, c...

CVE-2026-23361

CVE-2026-23361 affects the Linux kernel PCIe design (dwc: ep) where a posted MSI-X write may race with ATU unmapping, potentially corrupting host memory or triggering IOMMU errors. The mitigation described in the public description is to flush the write by performing a readl() on the same address...

CVE-2026-23419

CVE-2026-23419 affects the Linux kernel’ s RDS implementation. The issue is a circular locking dependency in net/rds: a memory allocation performed inside the socket lock during the call to sk_net_refcnt_upgrade() creates a deadlock with fs_reclaim. The root cause is that sk_net_refcnt_upgrade() ...

CVE-2026-23461

CVE-2026-23461: In the Linux kernel Bluetooth L2CAP, l2cap_register_user() and l2cap_unregister_user() did not consistently acquire conn->lock, creating a race with l2cap_conn_del() that can access conn->users and conn->hchan concurrently. This caused use-after-free and list corruption. ...

CVE-2026-31449

The CVE-2026-31449 entry concerns the Linux kernel ext4 extent code. A vulnerability was fixed in ext4_ext_correct_indexes where path[k].p_idx could point outside the valid index range if the on-disk eh_entries were corrupted, causing a slab-out-of-bounds read. The fix validates path[k].p_idx aga...

CVE-2026-31506

The CVE-2026-31506 issue concerns the Linux kernel bcmasp component where the Wake-on-LAN (WoL) IRQ handler could be double-freed. The problem stems from handling of the WoL irq; the patch indicates wol_irq does not need explicit freeing because it is allocated with devm_request_irq, and devres h...

CVE-2026-31712

CVE-2026-31712 affects ksmbd in the Linux kernel. A crafted DACL with an undersized ACE can bypass validation in smb_check_perm_dacl(), causing an out-of-bounds read during a subsequent file CREATE. The issue arises when ace->size and the ACE layout permit reading access_req (offset 4) and sid...

CVE-2026-31758

The CVE-2026-31758 entry affects the Linux kernel usbtmc implementation. The vulnerability arises when releasing USB Test & Measurement Channels: pending anchored URBs are not flushed or killed during usbtmc_release, allowing use-after-free conditions (notably in the Host Controller Driver giveba...

CVE-2026-43121

CVE-2026-43121 involves the Linux kernel io_uring/zcrx race between scrub and refill paths. The non-atomic read-then-decrement of the user_refs can race with io_zcrx_scrub() using atomic_xchg, causing a double-free of a niov and an out-of-bounds write past the freelist array. The fix replaces the...