CVE-2026-53385

CVE-2026-53385 relates to a Linux kernel issue in vc_screen where a race in vcs_write() can yield a stale vc_data after the console_lock is dropped and re-acquired. If the vc has been deallocated in the interim, a subsequent call to vcs_scr_updated() uses a NULL vc, causing a null-pointer derefer...

CVE-2026-53374

The CVE-2026-53374 issue affects the Linux kernel’s DRM/AMDGPU path: during amdgpu_bo_create_kernel() allocation, the GART table is not zero-initialized, so writing a single PTE can cause the TLB to speculatively load other uninitialized entries from the same cacheline. This can yield stale or ga...

CVE-2026-53383

The CVE-2026-53383 issue affects the Linux kernel’s ksmbd component where a COMPOUND request could bypass validation of the session state. Specifically, smb2_check_user_session() reused work->sess for operations beyond the first in a COMPOUND, validating only SessionId and not rechecking work-...

CVE-2026-53400

CVE-2026-53400 pertains to the Linux kernel: i2c core adapter registration race. The issue arises when looking up adapters by id via i2c_get_adapter(), which uses a reference to an embedded struct device. The advisory states that the adapter (including its struct device) must be initialised befor...

CVE-2026-63801

CVE-2026-63801 is a Linux kernel vulnerability in TIPC crypto path. The issue arises when tipc_aead_decrypt() offloads to asynchronous crypto code and does not take a reference on the per-netns object before calling crypto_aead_decrypt(), unlike the encrypt path. If the bearer's netns is torn dow...

CVE-2022-49947

CVE-2022-49947: Linux kernel binder null-ptr dereference in alloc->vma_vm_mm. Connected reports confirm a fix: initialize alloc->vma_vm_mm during open() and cache from current->mm to guarantee safe mmap_lock usage when a binder_proc has not mmap’d to set up alloc space. Descriptions deta...

CVE-2022-50240

CVE-2022-50240 concerns the Linux kernel Android binder subsystem. The issue arises from saving a pointer to a VMA outside of the mmap_lock, which could become stale or be freed, leading to fragile behavior in various failure paths. The documented fix changes the binder_alloc structure to record ...

CVE-2022-50256

CVE-2022-50256 affects the Linux kernel’s DRM Meson/Meson DW HDMI components. The issue arose because bridges added by meson_encoder_hdmi_init and meson_encoder_cvbs_init were not removed at aggregate driver unload, leaving references to freed memory in the global bridge_list. On reload, drm_brid...

CVE-2022-50259

CVE-2022-50259 : In the Linux kernel, the bpf sock_map_free() path can trigger use-after-free because sock_map_free() calls release_sock(sk) without holding a socket reference. This race is evidenced by syzbot tracing and mirrors a related issue fixed in sock_hash_free() (commit referenced). The ...

CVE-2022-50260

CVE-2022-50260 concerns the Linux kernel DRM MSM driver where .remove and .shutdown callbacks run via different code paths, creating a risk of calling drm_atomic_helper_shutdown() on an uninitialized DRM device. The initial description explains this mismatch can trigger kernel panics, especially ...

CVE-2022-50275

The CVE-2022-50275 issue affects the Linux kernel Radeon driver: the radeon_acpi_vfct_bios() path failed to call acpi_put_table() after ACPI BIOS parsing, causing an ACPI memory leak. The vulnerability is addressed by adding the missing acpi_put_table() call to release ACPI memory post-init, as d...

CVE-2022-50276

CVE-2022-50276 is a Linux kernel issue: when kmalloc() fails in kasprintf(), propname becomes NULL and a strcmp() dereferences it in of_get_property(), causing a NULL pointer dereference. The fix is to return ENOMEM when kasprintf() returns NULL. The vulnerability affects the kernel's power suppl...

CVE-2022-50296

CVE-2022-50296 affects the Linux kernel where cpu_max_bits_warn() would warn when CONFIG_CPUMASK_OFFSTACK and CONFIG_DEBUG_PER_CPU_MAPS are enabled while displaying /proc/cpuinfo. The root cause is using NR_CPUS to iterate CPUs instead of the runtime limit nr_cpu_ids, which leads to a runtime war...

CVE-2022-50298

CVE-2022-50298 refers to a Linux kernel issue in the slimbus: qcom-ngd driver where probe error handling failed to clean up resources, leading to a warning path and potential resource leakage. The fix adds proper cleanup in probe() to unwind resources acquired during probe, as documented in the i...

CVE-2022-50300

CVE-2022-50300 affects the Linux kernel's btrfs code, where an extent_map use-after-free can occur in read_one_chunk when handling a missing device and the degraded mount option is absent. The root cause is freeing the extent_map before storing the error code, despite the structure being referenc...

CVE-2022-50317

CVE-2022-50317 affects the Linux kernel, specifically the DRM bridge driver for Megachips (stdp2690 and stdp4028). The issue is a null-pointer dereference that occurs when removing the module because the two bridges are not probed concurrently, causing ge_b850v3_register() not to be called for in...

CVE-2022-50371

CVE-2022-50371 concerns the Linux kernel, specifically the qcom-lpg LED driver. The issue arises because lpg_brighness_set() could sleep while the brightness_set() callback for the LED must be non-blocking, leading to sleeping in atomic context (as shown by the stack trace and in_atomic/irq state...

CVE-2022-50387

The CVE-2022-50387 entry concerns a Linux kernel net: hinic issue where CMDQ memory leaks occur if hinic_set_cmdq_depth() fails during hinic_init_cmdqs(); the kernel patch fixes memory not being released. Affected component is the hinic CMDQ initialization path; remediation is the applied fix in ...

CVE-2022-50401

Technical details for CVE-2022-50401 are not publicly available in the provided documents. Monitor for updates.

CVE-2022-50443

CVE-2022-50443 concerns the Linux kernel, specifically the drm/rockchip: lvds path. The root cause is a usage-counter imbalance: pm_runtime_get_sync increments the PM usage counter even if the operation fails, creating a reference leak. The fix replaces the faulty path with pm_runtime_resume_and_...

CVE-2022-50465

The CVE-2022-50465 issue is a Linux kernel ext4 fast-commit journal memory-leak: when the end of fast-commit journal blocks is unfinished, the unused tail space could leak uninitialized memory to disk. The published description states the fix is to zero out that unused space to prevent leakage. T...

CVE-2022-50490

Summary: CVE-2022-50490 affects the Linux kernel bpf path in __htab_map_lookup_and_delete_batch, where a failed htab_lock_bucket() returning -EBUSY could cause silent bucket-skips, out-of-bounds memory access, or kernel memory exposure to userspace. Root cause: error from htab_lock_bucket() not p...

CVE-2022-50539

In the Linux kernel, CVE-2022-50539 concerns the ARM OMAP2+ platform, specifically omap4-common. The issue arises in omap4_sram_init() where of_find_compatible_node() can return a node pointer with its refcount already incremented. The underlying root cause is a refcount leak related to node hand...

CVE-2022-50552

CVE-2022-50552 : In the Linux kernel, the blk-mq path had a race where hctx->run_work could race with the elevator switch during reinitialization of hardware queues, potentially leading to use-after-free and kernel panics. The fix switches to a quiesced elevator switch and makes the previous e...

CVE-2023-53190

CVE-2023-53190 relates to a Linux kernel issue: a memory leak in the vxlan error path due to missing vxlan_vnigroup_uninit() when completion fails in vxlan_vnigroup_init(). The vulnerability affects vxlan initialization under certain error-injection/recovery scenarios, leading to memory leaks and...

CVE-2023-53204

CVE-2023-53204 affects the Linux kernel af_unix subsystem. The root cause is a data race on the unix_inflight field: user->unix_inflight is modified under spin_lock(unix_gc_lock), while too_many_unix_fds() reads it locklessly, enabling a race between unix_attach_fds and the unix_inflight acces...

CVE-2023-53206

CVE-2023-53206 : In the Linux kernel, a NULL pointer dereference in hwmon: (pmbus_core) was fixed by removing the assumption that a regulator device is passed. The fix involves passing the i2c_client to _pmbus_is_enabled to avoid dereferencing a NULL regulator during _pmbus_get_flags, addressing ...

CVE-2023-53219

CVE-2023-53219 affects the Linux kernel media: netup_unidvb code, where detaching a Universal DVB card could lead to a use-after-free because del_timer() could not stop an active timer in netup_unidvb_dma_timeout() while the timer runs. The fix replaces del_timer() with del_timer_sync() to ensure...

CVE-2023-53251

The CVE-2023-53251 issue affects the Linux kernel (wicwifi/iwlwifi PCIe path) where a NULL pointer dereference could occur in iwl_pcie_irq_rx_msix_handler due to rxq becoming NULL when trans_pcie->rxq is NULL and entry->entry is zero; the patch adds a proper check for trans_pcie->rxq. Re...

CVE-2023-53252

The CVE-2023-53252 entry applies to the Linux kernel Bluetooth stack. The vulnerability arises in hci_update_accept_list_sync where hci_conn_params/hci_sync lists are iterated while the lists can be modified (e.g., by le_scan_cleanup) without holding the device lock, risking an invalid list curso...

CVE-2023-53269

CVE-2023-53269 is a Linux kernel vulnerability affecting the block layer in the ublk path. The issue centers on ensuring the block size is set correctly; an incorrect size could cause a kernel panic. The documented fix enforces proper block size handling and, when ublk_validate_params() fails, cl...

CVE-2023-53271

CVE-2023-53271 concerns the Linux kernel UBI layer. The issue arises from a mismatch between create and destroy interfaces where the object created by ubi_eba_create_table() is freed via kfree(), leaving ubi_eba_table->entries potentially not freed, leading to a kmemleak-reported unreferenced ...

CVE-2023-53272

CVE-2023-53272 relates to the Linux kernel ENA driver (net: ena) where a UBSAN shift-out-of-bounds in the exponential backoff was observed during device reset. The issue stems from exponent calculations that could overflow 32-bit types, causing UBSAN panics when backoff delays grow large. The adv...

CVE-2023-53289

The CVE-2023-53289 issue affects the Linux kernel, specifically the media/bdisp component. The root cause is a missing check for the return value of create_workqueue, which could lead to a NULL pointer dereference. The publicly available connected documents confirm a fix that adds the necessary c...

CVE-2023-53300

The CVE-2023-53300 issue is in the Linux kernel media hi846 driver: hi846_init_controls allocated a ctrl_hdlr but failed to free it on error, causing a memory leak. The fix adds v4l2_ctrl_handler_free to properly release the allocated resources when initialization fails. Affected area: kernel med...

CVE-2023-53332

CVE-2023-53332: In the Linux kernel, a missing NULL pointer check in ipi_send_verify() can allow NULL dereference in irq_data_get_affinity_mask() when ipi_send_{mask|single}() is called with an invalid interrupt number, causing a kernel oops. The fix adds the NULL pointer check in ipi_send_verify...

CVE-2023-53340

Linux kernel: net/mlx5 vulnerability where DEVX can issue a general, unknown command; if such a command fails, mlx5 may collect failure data without a storage for it, causing an array-index-out-of-bounds error. The fix adds a check to verify the command is known before collecting failure data. Af...

CVE-2023-53369

CVE-2023-53369 affects the Linux kernel’s DCB BCN parsing (net: dcb) where dcbnl_bcn_setcfg erroneously parsed tb[DCB_ATTR_BCN] attributes using the dcbnl_pfc_up_nest policy. This mismatch could cause parsing to overflow the intended policy bounds and read attributes (DCB_BCN_ATTR_BCNA_0..DCB_BCN...

CVE-2023-53378

CVE-2023-53378 (Linux kernel, DRM/i915) : The vulnerability stems from i915_gem_object_is_framebuffer() not treating the DPT BO (display plane table backing object) as a framebuffer. As a result, the shrinker can evict the DPT BO while the FB BO remains bound, if the DPT came from regular shmem. ...

CVE-2023-53391

CVE-2023-53391 patches the Linux kernel shmem:ramfs-based tmpfs memory leak by replacing kill_sb with ramfs_kill_sb() in ramfs-based tmpfs, freeing fc->s_fs_info during init_fs_context() cleanup. Affected: Linux kernel ramfs/tmpfs shmem path; root cause: memory leak in kill_sb/init_fs_context ...

CVE-2023-53423

CVE-2023-53423 is a Linux kernel vulnerability resolved by a fix in objtool. The issue is a memory leak: strdup() allocates memory for key_name and the code path handling errors does not free it, leading to leaks in create_static_call_sections(). The connected advisories (EulerOS/Nessus entries) ...

CVE-2023-53438

CVE-2023-53438 : In the Linux kernel, the AMD Zen IF poison error path could misclassify context due to non-synchronous delivery of poison by the IF unit. The issue is mitigated by adding a quirk to always save the Code Segment (CS) register when poison is consumed from the IF unit banks, ensurin...

CVE-2023-53460

CVE-2023-53460 describes a memory-leak in the Linux kernel wifi driver rt w88 (rtw_usb_probe) in drivers/net/wireless/realtek/rtw88/usb.c:876, where an allocated hw structure may not be released on a path, reported as the line 811 release issue. The root cause is a leak in the USB probe path (rtw...

CVE-2023-53486

CVE-2023-53486 affects the Linux kernel ntfs3 implementation. The fixed issue is a combined overflow/boundary check in attribute size validation during NTFS attribute enumeration, which could lead to slab-out-of-bounds access (KASAN) when mounting or reading NTFS volumes. The description and conn...

CVE-2023-53526

CVE-2023-53526 affects the Linux kernel’s journaling subsystem (jbd2) and can lead to ext4 image corruption if a journal checkpoint is removed during a power outage. The described attack path involves a sequence where a transaction is inserted into the checkpoint list, buffers are manipulated, an...

CVE-2023-53566

CVE-2023-53566 affects the Linux kernel’s netfilter nft_set_rbtree code. The issue is a null dereference on element insertion in nft_set_rbtree, where rb_prev() may return NULL, leading to a general protection fault (address 0xdffffc0000000003) and an accompanying KASAN null-pointer dereference. ...

CVE-2023-53647

The CVE-2023-53647 issue in the Linux kernel arises from an ACPI namespace traversal in the Hyper-V VMBus driver (hv_vmbus). If Hyper-V MMIO ranges cannot be found, the code may dereference the ACPI namespace root object (which has an all-ones handle), causing a NULL pointer dereference and an oo...

CVE-2025-38271

CVE-2025-38271 affects the Linux kernel where a NULL dereference could occur in rtnl_create_link() when dev->netdev_ops is NULL. The fix removes usage of netdev_lock_ops() and replaces dev_set_group() with netif_set_group() to avoid the dereference during rtnl_create_link() execution. The issu...

CVE-2025-39722

The CVE-2025-39722 issue is in the Linux kernel crypto/caam suspend path for iMX8QM/iMX8ULP SoCs. Root cause: CAAM register access during suspend is reserved by SECO/OPTEE, causing suspend-time crashes unless page 0 is protected; a new state variable no_page0 tracks external reservations, and sus...

CVE-2025-39780

CVE-2025-39780 – Linux kernel sched/ext class-switch issue. The vulnerability arises when enabling the sched_ext scheduler, which may trigger invalid task state transitions and produce warnings such as “Invalid task state transition 0 -> 3 for fish[770]” in kernel/sched/ext.c. The root cause, ...