CVE-2022-50245

CVE-2022-50245 concerns a Linux kernel issue in the rapidio driver where a UAF can occur if kfifo_alloc() fails during mport_cdev_open(). The fix removes priv from the chdev->file_list before freeing it to prevent traversal from accessing a freed object (the smatch warning reference). Affected...

CVE-2022-50251

CVE-2022-50251 affects the Linux kernel mmc/vub300 driver. The vulnerability arises when mmc_add_host() returns an error but its return value is ignored, leading to a memory leak from mmc_alloc_host() and a potential kernel crash due to removing an unadded device in the remove path. The accompany...

CVE-2022-50257

The CVE-2022-50257 issue is in the Linux kernel Xen grant handling (xen/gntdev) where partial grant mapping failures could leak grants. In paravirtualized domains (use_ptemod = true), alloced was not updated for all successful map_ops or kmap_ops, risking incorrect live_grants and leaks. The fix ...

CVE-2022-50259

CVE-2022-50259 : In the Linux kernel, a race in sock_map_free() can cause use-after-free because sock_map_free() calls release_sock(sk) without owning a socket reference. This vulnerability affects BPF sockmap handling and is illustrated by the kernel call chain leading to release_sock and sock_m...

CVE-2022-50260

CVE-2022-50260 concerns the Linux kernel DRM MSM driver where .remove and .shutdown callbacks run via different code paths, creating a risk of calling drm_atomic_helper_shutdown() on an uninitialized DRM device. The initial description explains this mismatch can trigger kernel panics, especially ...

CVE-2022-50270

This CVE (CVE-2022-50270) affects the Linux kernel f2fs component. The root cause was a faulty iocb assignment in the f2fs_direct_IO_enter trace event: the code only copied the pointer of iocb and then accessed its field during trace printing, which could lead to a kernel paging fault. The fixes ...

CVE-2022-50271

CVE-2022-50271 affects the Linux kernel’s vhost/vsock code. The issue arises when copying large files over SFTP over vsock, where data sizes commonly reach 32 kB and kmalloc may allocate many 32 kB chunks, leading to a page allocation failure (example: vhost-5837). The root cause is an inefficien...

CVE-2022-50309

CVE-2022-50309 : Linux kernel vulnerability in media: xilinx: vipp, fixed in the commit that adds balance for refcount in xvip_graph_dma_init. The issue arises because of_get_child_by_name() returns a node pointer with its refcount incremented, and there was no corresponding of_node_put() when th...

CVE-2022-50312

CVE-2022-50312 affects the Linux kernel driver for serial jsm: leaks in probe due to incomplete unwind in error paths. The advisory notes that the error path must unwind instead of returning directly, and a fix was applied in the kernel source (commit referenced in the CVE description). Impact is...

CVE-2022-50326

CVE-2022-50326 relates to a memory leak in the Linux kernel’s media: airspy probe. The root cause is that a variable buf was moved from stack to heap by commit ca9dc8d06ab6, but deallocation was only present in the error path, not the success path. Consequently, buf can leak in the success path. ...

CVE-2022-50352

CVE-2022-50352 affects the Linux kernel’s net/hns driver (hnae_ae_register). If device_register() fails during probing and the kobject refcount isn’t decremented to 0, the name allocated in dev_set_name() is leaked. The fix calls put_device() so the name can be freed in kobject_cleanup(). The con...

CVE-2022-50364

The CVE-2022-50364 issue in the Linux kernel concerns i2c mux: reg: an IPv4? actually resource handling in platform_get_resource() returning NULL leading to NULL pointer dereference in resource_size(). The documented fix moves the call to resource_size() to after devm_ioremap_resource() which che...

CVE-2022-50382

CVE-2022-50382 refers to a Linux kernel fix for a deadlock involving padata parallelization when BHs are enabled during the serial path. The issue occurs in padata_do_serial where a spin_lock on reorder->lock could be taken with BHs still on, enabling a deadlock on overload. The fix ensures BH...

CVE-2022-50384

CVE-2022-50384 is a Linux kernel vulnerability in staging/vme_user (tsi148_dma_list_add) where an error path could free an entry without removing it from list->entries, risking use-after-free. The connected documents confirm the root cause is the failure to remove &entry->list from list-&gt...

CVE-2022-50391

CVE-2022-50391 concerns the Linux kernel memory management path mm/mempolicy, where set_mempolicy_home_node could leak memory. The root cause is that when scanning VMA ranges, if a policy differs from MPOL_BIND or MPOL_PREFERRED_MANY, the allocated policy via mpol_dup() was not released with mpol...

CVE-2022-50401

CVE-2022-50401 is a Linux kernel vulnerability fixed in NFSv4.1 path: a double svc_xprt_put on rpc_create failure in nfsd leads to refcount underflow and use-after-free in the kernel. Public advisories (Unity Linux, EulerOS, Astra Linux, SUSE) report the issue as resolved by kernel updates; the e...

CVE-2022-50422

CVE-2022-50422 affects the Linux kernel’s SCSI LIBSAS path. When SMP task execution fails, smp_execute_task_sg() calls del_timer() to remove slow_task->timer, but if sas_task_internal_timedout() is running, the timer isn’t stopped, causing a use-after-free of task->slow_task. The fix is to ...

CVE-2022-50439

CVE-2022-50439 is a Linux kernel vulnerability in ASoC: mediatek mt8173 where IRQs could fire before pdata is ready, causing memory read errors and kernel instability. Connected advisories (SUSE, Astra Linux, OSV) indicate the issue was resolved in the kernel by enabling IRQ once pdata is ready. ...

CVE-2022-50457

CVE-2022-50457 : In the Linux kernel, the vulnerability is in mtd: core where del_mtd_device() calls of_node_put() on mtd_get_of_node(mtd) after memset(&mtd->dev, 0), clearing mtd->dev first and causing a refcount leak. The fix caches the pointer to the device_node to avoid unbalanced of_no...

CVE-2022-50492

CVE-2022-50492 affects the Linux kernel DRM MSM driver. The issue is a use-after-free during probe deferral, where the bridge counter isn’t reset on DRM device teardown, causing stale pointers to deallocated structures to be accessed on the next tear down (e.g., after a late bind deferral). With ...

CVE-2022-50527

CVE-2022-50527 concerns the Linux kernel patch for amdgpu memory size validation. The description states that amdgpu_bo_validate_size() was fixed to verify that the TTM domain manager for the requested memory exists, preventing a kernel oops when dereferencing the manager pointer. The lineage sho...

CVE-2022-50534

CVE-2022-50534 (Linux kernel, dm thin) : A vulnerability in the dm thin component can trigger an ABBA deadlock between shrinker_rwsem and pmd-root_lock when concurrent drop cache operations and dm thin worker threads run. This may lead to a broken btree with mixed fresh/stale nodes and cause a sy...

CVE-2022-50552

CVE-2022-50552 : In the Linux kernel, the blk-mq path had a race where hctx->run_work could race with the elevator switch during reinitialization of hardware queues, potentially leading to use-after-free and kernel panics. The fix switches to a quiesced elevator switch and makes the previous e...

CVE-2023-53168

In the Linux kernel, CVE-2023-53168 affects the usb: ucsi_acpi timeout handling. The root cause was an increased command completion timeout (5s -> 60s) during alternate mode discovery, which was later reduced to 1s after switching to polled mode, causing issues on Lenovo ThinkPad X1 Yoga gen7 ...

CVE-2023-53172

CVE-2023-53172 concerns the Linux kernel fsverity feature. A change to FS_IOC_ENABLE_VERITY made it read data via __kernel_read() instead of direct pagecache, which made the WARN_ON_ONCE path reachable when the FD was opened with ioctl-only mode (mode 3). The fix is to reject FS_IOC_ENABLE_VERITY...

CVE-2023-53190

CVE-2023-53190 relates to a Linux kernel issue: a memory leak in the vxlan error path due to missing vxlan_vnigroup_uninit() when completion fails in vxlan_vnigroup_init(). The vulnerability affects vxlan initialization under certain error-injection/recovery scenarios, leading to memory leaks and...

CVE-2023-53193

CVE-2023-53193 – Linux kernel (amdgpu): The issue is in the drm/amdgpu driver, specifically gmc_v10_0_hw_fini calling amdgpu_irq_put. The firmware enables gmc.ecc_irq and the host driver is not privileged to enable/disable it, making amdgpu_irq_put in gmc_v10_0_hw_fini meaningless and causing a c...

CVE-2023-53200

CVE-2023-53200 (Linux kernel) : The vulnerability is in netfilter: x_tables where a percpu counter block allocated for a new netns is leaked if xt_register_table() fails during table creation. The stack path shows allocation via __alloc_percpu → xt_percpu_counter_alloc → translate_table, then fai...

CVE-2023-53203

CVE-2023-53203 concerns the Linux kernel MT7996/MT76 WiFi driver. A NULL pointer dereference in mt7996_mac_write_txwi() of the vif pointer is mitigated by exporting and reusing the mt76_connac2_mac_tx_rate_val utility, applied in the mt7996 driver. The fix is kernel-side (export utility and integ...

CVE-2023-53204

CVE-2023-53204 affects the Linux kernel af_unix subsystem. The root cause is a data race on the unix_inflight field: user->unix_inflight is modified under spin_lock(unix_gc_lock), while too_many_unix_fds() reads it locklessly, enabling a race between unix_attach_fds and the unix_inflight acces...

CVE-2023-53214

Summary (CVE-2023-53214) The issue is in the Linux kernel (F2FS) where __update_iostat_latency() can corrupt memory due to a mixup between META_FLUSH and NR_PAGE_TYPE, leading to a potential buffer/memory corruption. The connected documents indicate a fix that adds an iotype sanity check to preve...

CVE-2023-53229

CVE-2023-53229 : In the Linux kernel, the wifi/mac80211 path was fixed to address invalid drv_sta_pre_rcu_remove calls for non-uploaded stations, which could cause data corruption due to uninitialized driver private data structures. Affected component: Linux kernel wireless stack (mac80211). Root...

CVE-2023-53230

CVE-2023-53230 concerns the Linux kernel SMB client. The publicly provided docs identify the issue as a fix to a warning in fs/smb/client/cifsfs.c:982 within cifs_smb3_do_mount(), described as a memory‑leak warning reported by the kernel test robot. The connected advisories indicate the patch was...

CVE-2023-53231

The CVE-2023-53231 entry concerns the Linux kernel erofs subsystem. The vulnerability stems from incorrect detection of atomic context when z_erofs_decompressqueue_endio can be invoked under an RCU/lock context (e.g., from blk_mq_flush_plug_list). The patch updates the context check to rcu_read_l...

CVE-2023-53259

CVE-2023-53259 (Linux kernel) is a local vulnerability in VMCI where vmci_host_setup_notify() may dereference a NULL context->notify_page after get_user_pages_fast(), causing a general protection fault. The fix, as documented in the advisory, is to validate context->notify_page and return a...

CVE-2023-53269

CVE-2023-53269 is a Linux kernel vulnerability affecting the block layer in the ublk path. The issue centers on ensuring the block size is set correctly; an incorrect size could cause a kernel panic. The documented fix enforces proper block size handling and, when ublk_validate_params() fails, cl...

CVE-2023-53311

CVE-2023-53311 concerns a use-after-free in nilfs2 within the Linux kernel. The root cause is a UAF on the nilfs_root structure that can occur when inodes are freed from the “garbage_list” during unmount/dispose flows, specifically in a path triggered by iput()->mark_inode_dirty_sync() during ...

CVE-2023-53323

CVE-2023-53323 affects the Linux kernel ext2 with DAX on pmem: ext2/dax: Fix ext2_setsize when len is page aligned. The bug arises when PAGE_ALIGN(x) returns x for already-aligned x, causing dax_zero_range() to pass length 0 to iomap_begin(), which makes ext2_get_blocks() see max_blocks = 0 and t...

CVE-2023-53330

CVE-2023-53330 : In the Linux kernel, memory leak in cfctrl_linkup_request() can occur when linktype is unknown or kzalloc() fails, as pkt is not released on error. The resolution adds a release path to the error flow, mitigating a potential memory leak in affected code paths. Connected advisorie...

CVE-2023-53346

The CVE-2023-53346 entry concerns a memory-leak in the Linux kernel’s kernel/fail_function logic. The issue occurs when using debugfs_lookup(): the returned object must be released with dput(), otherwise memory leaks accrue over time. The associated advisories indicate a straightforward remediati...

CVE-2023-53358

CVE-2023-53358 relates to the Linux kernel’s ksmbd component, where a race condition during concurrent smb2 tree disconnect led to a use-after-free (UAF). The issue is addressed by a patch that adds TREE_CONN_EXPIRE flags for tcon to prevent concurrent access. The connected documents confirm the ...

CVE-2023-53367

CVE-2023-53367 concerns a memory leak in the Linux kernel’s accel/habanalabs code path (mem mappings in user_mappings) that could occur when clearing user_mappings during rapid context reuse. The connected OSV entries indicate Rootio‑Linux patches fixing this CVE across Root:Ubuntu:22.04 and Root...

CVE-2023-53380

CVE-2023-53380 affects the Linux kernel md/raid10 code. A null pointer dereference could occur in raid10_sync_request when a faulty mreplace is set between two checks. The fix merges the two checks into one and replaces the two variables with a single mreplace determination, preventing the race c...

CVE-2023-53387

The CVE-2023-53387 issue affects the Linux kernel SCSI/UFS stack. In the UFS error handling flow, when a device management NOP OUT times out and doorbell clearing also fails, the dev_cmd.complete pointer is not NULL, causing __ufshcd_transfer_req_compl() to call complete() on a stack-allocated st...

CVE-2023-53408

CVE-2023-53408 affects the Linux kernel’s trace/blktrace path. The issue is a memory leak when using debugfs_lookup(); the returned object must be dput()’d, otherwise memory leaks accumulate. The documented fix simplifies handling by replacing the call with debugfs_lookup_and_remove(), which perf...

CVE-2023-53424

Technical details for CVE-2023-53424 are not publicly provided in the connected documents; only the fix note (mediatk clk memory leak) is echoed. Monitor upstream advisories for specifics on affected products, versions, and remediation.

CVE-2023-53426

Technical details for CVE-2023-53426 are not provided in the connected documents. No affected product/version or remediation details are disclosed here. Monitor official advisories from vendors/sources for updates.

CVE-2023-53447

CVE-2023-53447 affects the Linux kernel's f2fs: remount() may reset the READ_EXTENT_CACHE mount option, creating a race with fallocate() that can trigger a NULL pointer dereference under extent_cache locks. Root cause is a race between remount and fallocate due to default_options panel updating o...

CVE-2023-53449

CVE-2023-53449 affects the Linux kernel in the s390/dasd area. The root cause was a potential memory leak in dasd_eckd_init() where dasd_reserve_req was allocated before dasd_vol_info_req and could not be freed on error. The fix ensures dasd_reserve_req is freed before error returns, matching the...

CVE-2023-53487

CVE-2023-53487 concerns the Linux kernel under POWERPC: the powerpc/rtas_flash path allowed a user to copy memory into flash_block_cache objects when hardened usercopy is enabled (CONFIG_HARDENED_USERCOPY=y). The flaw is triggered via the /proc/powerpc/rtas/firmware_update interface, causing a ke...