CVE-2022-50225

CVE-2022-50225 concerns a Linux kernel issue on riscv where the uprobe handling incorrectly clears/sets the SR_SPIE flag around origin instruction execution. The description and connected sources state that the problematic sequence could occur when a page fault happens while the origin instructio...

CVE-2022-50243

CVE-2022-50243 – Linux kernel SCTP use-after-free (summary from connected advisories) The vulnerability arises in SCTP when an error is returned from sctp_auth_asoc_init_active_key(): the old sh_key could be freed while still in use as the active key, leading to a use-after-free during packet sen...

CVE-2022-50342

CVE-2022-50342 affects the Linux kernel floppy subsystem: memory leak in do_floppy_init() when floppy_alloc_disk() fails, leaking set->tag in the error path. The issue is resolved by freeing the current drive’s set->tag before returning. Connected advisories (SUSE OSV and Astra Linux) corro...

CVE-2022-50370

The provided documents describe a Linux kernel issue (CVE-2022-50370) in the i2c designware driver where an interrupt occurring during resume from S3 could trigger a NULL pointer dereference in i2c_dw_xfer_msg() on certain Alder Lake‑S platforms. Root cause: an interrupt from i2c_designware.0 (PC...

CVE-2022-50390

The CVE-2022-50390 issue is in the Linux kernel DRM TTM code. It fixes an undefined behavior when shifting a signed 32-bit value by 31 bits in TTM_TT_FLAG_PRIV_POPULATED, by changing the operation to unsigned to avoid UBSAN/shift-out-of-bounds warnings observed during framebuffer/VM operations. T...

CVE-2022-50407

The CVE-2022-50407 entry concerns the Linux kernel crypto: hisilicon/qm component, where the code path allocates a small local buffer for a QoS value and uses sscanf without validating destination length, enabling a stack overflow. Public documents in connected sources confirm the issue and descr...

CVE-2023-53168

In the Linux kernel, CVE-2023-53168 affects the usb: ucsi_acpi timeout handling. The root cause was an increased command completion timeout (5s -> 60s) during alternate mode discovery, which was later reduced to 1s after switching to polled mode, causing issues on Lenovo ThinkPad X1 Yoga gen7 ...

CVE-2023-53225

The connected details describe CVE-2023-53225 as a Linux kernel issue in the SPI IMX driver where the remove path could skip cleanup of DMA resources on error. The root cause is returning early from a platform driver’s remove callback, leading to a permanent resource leak because DMA resources ma...

CVE-2023-53257

CVE-2023-53257 is a Linux kernel vulnerability in wifi/mac80211: check S1G action frame size. The fix ensures the action frame exists before inspecting its code, addressing a potential improper memory handling in the frame processing path. The CVSS v3.1 base score is 7.8 (HIGH), with LOCAL attack...

CVE-2023-53290

CVE-2023-53290 affects the Linux kernel in the samples/bpf path, where fout was opened with fopen but not closed, leading to a leak in hbm's run_bpf_prog. The issue is resolved by a patch that ensures fout is closed (fclose’d) before scope exit. The provided sources confirm the fixed state and li...

CVE-2023-53296

CVE-2023-53296 affects the Linux kernel SCTP stack. The issue arises when a client’s out-stream count is temporarily higher than the server’s, allowing a thread waiting for sndbuf to send a message on a stream that may no longer exist after INIT_ACK processing, potentially triggering a crash. The...

CVE-2023-53301

CVE-2023-53301 affects the Linux kernel f2fs subsystem. The root cause is a NULL pointer dereference when io->bio is NULL inside __submit_merged_write_cond, which can cause a kernel panic during f2fs_checkpoint/write paths. A fix was implemented to return when io->bio is NULL before proceed...

CVE-2023-53322

CVE-2023-53322 in the Linux kernel affects the scsi qla2xxx driver. The issue arises when terminate_rport_io does not wait for all IOs to return, risking a use-after-free and potential resource leakage leading to a system crash. The connected advisories (EulerOS/RHEL) list this CVE among kernel f...

CVE-2023-53368

CVE-2023-53368 – Linux kernel tracing race : A race between writing to the per-CPU tracing buffer and swapping the buffer via per_cpu/cpu0/snapshot can cause a false “committing” state in rb_end_commit(), leading to a WARN and potential commit inconsistencies. The issue manifests in the tracing r...

CVE-2023-53384

CVE-2023-53384 affects the Linux kernel wifi driver (mwifiex). The vulnerability is a possible NULL pointer dereference in mwifiex_handle_uap_rx_forward due to not verifying skb_copy() result, potentially dereferencing skb in mwifiex_uap_queue_bridged_pkt. The patch adds a check for skb_copy() re...

CVE-2023-53405

CVE-2023-53405 concerns the Linux kernel USB gadget gr_udc: a memory leak that occurs when debugfs_lookup() is used without proper cleanup. The vulnerability arises because the result of debugfs_lookup() must be released with dput(), else memory leaks accumulate over time. The fixed approach in t...

CVE-2023-53416

CVE-2023-53416 affects the Linux kernel USB isp1362 driver. The issue is a memory leak caused by calling debugfs_lookup() without releasing the result with dput(), allowing leaked memory over time. The fix simplifies the handling by using debugfs_lookup_and_remove(), which performs the lookup and...

CVE-2023-53468

Summary of CVE-2023-53468 : In the Linux kernel, the ubifs memory leak is fixed in the alloc_wbufs() path. The issue was triggered when ubifs_wbuf_init() returns an error inside the loop, causing wbuf->buf and wbuf->inodes that were already allocated to remain unfreed. The fix adds an error...

CVE-2025-38252

The CVE-2025-38252 entry concerns a Linux kernel vulnerability in the cxl/ras CPER handler device confusion. The defect stems from cxl_cper_handle_prot_err() making fragile assumptions: it may treat endpoints as CXL-Type-3 devices, assume the device is bound to the cxl_pci driver, and unnecessari...

CVE-2025-38411

The CVE-2025-38411 issue is in the Linux kernel’s netfs handling. A netfs request finishing during the pause loop could have its IN_PROGRESS ref removed, and if it proceeded to the final wait loop, the code could incorrectly call the collector again because it sees IN_PROGRESS as cleared. The doc...

CVE-2025-38570

CVE-2025-38570 is described in the initial document as a Linux kernel issue in the fbnic AF_XDP path, where a UaF occurs in xsk_bind() due to NAPI handling: NAPI is freed and the NAPI pointer is not cleared from the queue after a device open failure. The report indicates a local attack vector wit...

CVE-2025-38638

CVE-2025-38638: In the Linux kernel IPv6 stack, inet6_rt_notify() could be invoked under RCU protection, allowing concurrent route changes and rt6_fill_node() returning -EMSGSIZE. The fix adds retry logic: when this situation is detected, the skb is resized and the operation retried, and a previo...

CVE-2025-38651

Summary: CVE-2025-38651 concerns the Linux kernel landlock component. A bug in get_id_range() could receive a non-positive value because get_random_u8() may return 0, triggering an unsafe first argument. The fix clamps the value to ensure positivity. The vulnerability was discussed in kernel-land...

CVE-2025-38682

The CVE-2025-38682 entry details a Linux kernel vulnerability in i2c core: i2c_unregister_device() could double-free a fwnode when the i2c_client has a software-node as its primary fwnode. The root cause was unconditional fwnode_handle_put() on the i2c_client, which, if a software fwnode is prima...

CVE-2025-38723

CVE-2025-38723 concerns the Linux kernel, specifically LoongArch BPF tailcall handling. The issue arises in the tailcall jump offset calculation when bpf_int_jit_compile() fails to initialize the JIT context, leaving out_offset = -1. Consequently, the computed jmp_offset = (out_offset - cur_offse...

CVE-2025-38733

CVE-2025-38733 affects the Linux kernel’s s390/mm subsystem: the identity mapping pins lowcore to address zero, causing lowcore to map at zero regardless of relocate_lowcore. If relocate_lowcore is used, the lowcore is mapped twice. This enables NULL pointer accesses that would not trigger an exc...

CVE-2025-39693

CVE-2025-39693: In the Linux kernel, the vuln affects the DRM AMD display path (drm/amd/display) where NULL pointers could be dereferenced via drm_atomic_get_new_connector_state() or drm_atomic_get_old_connector_state(). The description states the root cause is that these functions can return NUL...

CVE-2025-39699

CVE-2025-39699 affects the Linux kernel (iommu/riscv) with a fix to prevent NULL dereference in iova_to_phys. The issue arises because riscv_iommu_pte_fetch() may return NULL for unmapped/never-mapped IO virtual addresses, and riscv_iommu_iova_to_phys() did not handle NULL, leading to a potential...

CVE-2025-39721

CVE-2025-39721 (Linux kernel, crypto: qat) : Repeated loading/unloading of a device-specific QAT driver (e.g., qat_4xxx) can trigger a use-after-free when a power-management interrupt fires just before the core intel_qat.ko remains loaded. The shared workqueue qat_misc_wq may still host a deferre...

CVE-2025-39727

The CVE-2025-39727 entry concerns a Linux kernel vulnerability in memory management swap code. The issue is a potential buffer overflow in setup_clusters() triggered when setup_swap_map() validates badpages only up to (0, last_page], and maxpages may be less than last_page, causing setup_clusters...

CVE-2025-39732

Public technical details for CVE-2025-39732 are not present in the provided Connected documents. The initial description notes the ath11k/mac fix, but no vendor/product/version specifics or exploit information are disclosed here. Monitor for updates.

CVE-2025-39738

CVE-2025-39738 affects the Linux kernel (btrfs) and is triggered during relocation of partially dropped subvolumes. The root cause is a missing orphan item for a subvolume, causing a delayed-ref transaction abort when relocating, with an offender inside a dropped subvolume. Upstream fixes exist (...

CVE-2025-39748

CVE-2025-39748 - Linux kernel BPF verifier issue (JSET) patched Root cause: A verifier range refinement bug after JSET could produce inconsistent register bounds on an unreachable path, due to not forgetting ranges after narrowing tnums post-JSET. Impact: Local access to kernel may be affected; C...

CVE-2025-39753

CVE-2025-39753 relates to the Linux kernel’s gfs2 code. The vulnerability is resolved by a patch that adds the .migrate_folio flag in gfs2_{rgrp,meta}_aops, addressing a warning: gfs2_meta_aops does not implement migrate_folio, triggering messages during xfstests. The described impact is the supp...

CVE-2025-39754

CVE-2025-39754: Linux kernel race in mm/smaps between smaps_hugetlb_range and migration. The vulnerability arises when smaps_hugetlb_range() handles the page table without holding the ptl, racing with migration and potentially triggering a BUG_ON in pfn_swap_entry_to_page(). The fix is to hold th...

CVE-2025-39794

CVE-2025-39794 affects the Linux kernel on ARM Tegra platforms. The root cause is an incorrect use of memcpy when writing to IRAM, causing Kasan to crash due to boundary checks failing under normal memcpy. The vulnerability is local with a high impact on availability, and the description notes th...

CVE-2025-39804

CVE-2025-39804 pertains to the Linux kernel (arm64) where lib/crypto/poly1305 could corrupt SIMD/general-purpose registers in no-SIMD contexts, potentially producing incorrect MACs. The fix restores a safety check to ensure Poly1305 calls do not rely on unusable SIMD state, using may_use_simd() i...

CVE-2025-39811

In CVE-2025-39811, the Linux kernel fixes a local-denial of-service risk in the DRM subsystem (xe) by clearing the scratch_pt error pointer in xe_vm_free_scratch() to prevent dereferencing an error pointer during cleanup. Root cause: potential dereference of an error pointer on error cleanup. Aff...

CVE-2025-39832

CVE-2025-39832 concerns the Linux kernel’s mlx5 driver. The issue is a lockdep assertion triggered during the sync reset unload path, specifically when a sync reset flow is started via the devlink reload fw_activate option. The PF holds the devlink lock while handling the unload event, and the fi...

CVE-2025-39896

CVE-2025-39896 (Linux kernel, open-source) The vulnerability affects the ivpu driver in the kernel’s accel path. It arises from recovery work being queued during device removal, potentially allowing use-after-free if recovery code accesses freed resources. The fix replaces cancel_work_sync() with...

CVE-2025-39909

CVE-2025-39909 concerns the Linux kernel’s DAMON module (mm/damon/lru_sort). The issue arises during the calculation of hot_thres and cold_thres when either sample_interval or aggr_interval is used as a divisor, risking division-by-zero. The fix adds validation and directly returns -EINVAL in suc...

CVE-2025-39952

CVE-2025-39952: In the Linux kernel, the wifi wilc1000 driver had a buffer overflow in WID string configuration (wlan_cfg.c:184) due to __memcpy() with 512 vs 65537. The patch adds length checks before memory access, basing limits on the WID data type from firmware (struct wilc_cfg_str_vals/struc...

CVE-2025-39965

The CVE-2025-39965 vulnerability affects the Linux kernel XFRM stack: xfrm_alloc_spi may create states with SPI set to 0 (meaning “no SPI assigned”) due to the behavior change from commit 94f39804d891, and __xfrm_state_delete fails to remove those states from the byspi list. This leads to a use-a...

CVE-2025-40149

CVE-2025-40149 affects the Linux kernel TLS path: get_netdev_for_sock() could trigger a use-after-free if sk_dst_get(sk)->dev is used during setsockopt(). The fix replaces sk_dst_get() with __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(), and notes that the only user of ->ndo_sk_g...

CVE-2025-71084

CVE-2025-71084 (Linux kernel) fixes a leak in the multicast GID table reference within RDMA/cm. If the CM ID is destroyed while the multicast creation event is queued, cancel_work_sync() can prevent the work from running and destroy ah_attr, causing a refcount leak and a WARN in kernel logs. Affe...

CVE-2025-71122

CVE-2025-71122 concerns Linux kernel iommufd/selftest: overflow in IOMMU_TEST_OP_ADD_RESERVED, discovered by syzkaller and fixed by validating the user input length in the test ioctl. Affects test kernels with CONFIG_IOMMUFD_TEST; no exploitation details provided in the available documents.

CVE-2025-71145

CVE-2025-71145 (Linux kernel) fixes a use-after-free-like race by correcting usb: phy: isp1301 to increment the I2C device reference count for non-OF (Open Firmware) paths as well as OF paths. The bug was a device reference imbalance in isp1301_get_client() where non-OF callers could not reliably...

CVE-2025-71148

CVE-2025-71148 affects the Linux kernel networking code (net/handshake). The issue: handshake_req_submit() overwrites sk->sk_destruct on submission, but does not restore it if an error occurs before hashing, causing handshake_sk_destruct() to return early and leak the socket. The fix is to res...

CVE-2025-71157

CVE-2025-71157 affects the Linux kernel: RDMA/core path ib_del_sub_device_and_put() bug where a device reference grabbed by nldev_deldev() (via ib_device_get_by_index()) wasn’t dropped before returning -EOPNOTSUPP. The fix is to always drop the device refcount before returning, effectively solvin...

CVE-2025-71202

CVE-2025-71202 affects the Linux kernel IOMMU/SVA path (invalidating stale IOTLB entries in CPU kernel address space) and is mitigated by a patch that flushes IOTLB paging cache before freeing kernel page tables. Connected advisories confirm Debian RootOS patches (ROOT-OS-DEBIAN-13/12) with multi...