CVE-2022-49975

CVE-2022-49975 affects the Linux kernel’s BPF path, where a redirect of packets with invalid pkt_len could occur. The root cause is described as a BPF program test/run path (bpf_prog_test_run_skb) redirecting empty skbs, leading to a potential flow handling issue in fq_codel_drop(). The vulnerabi...

CVE-2022-50082

CVE-2022-50082 affects the Linux kernel ext4 subsystem. The issue arises in ext4_iomap_begin due to a race between bmap and write, which can trigger a WARN_ON_ONCE path during file writes, evidenced by a kernel warning trace through iomap_apply → iomap_bmap → ext4_bmap → bmap. The consequence is ...

CVE-2022-50275

The CVE-2022-50275 issue affects the Linux kernel Radeon driver: the radeon_acpi_vfct_bios() path failed to call acpi_put_table() after ACPI BIOS parsing, causing an ACPI memory leak. The vulnerability is addressed by adding the missing acpi_put_table() call to release ACPI memory post-init, as d...

CVE-2022-50284

CVE-2022-50284 affects the Linux kernel (init_mqueue_fs). If setup_mq_sysctls() fails, the mqueue_inode_cachep was not released, causing a memory leak. The issue was fixed by reordering the release path in init_mqueue_fs; upstream kernel patches exist to address this, with no explicit exploit det...

CVE-2022-50332

CVE-2022-50332 concerns a Linux kernel issue in video/aperture where sysfb_disable() must be called from aperture_remove_conflicting_pci_devices() before removing PCI devices to prevent simpledrm from binding to simple-framebuffer devices after the driver takes over. The vulnerability is describe...

CVE-2022-50388

CVE-2022-50388 affects the Linux kernel where a flush request initialized by blk_kick_flush can carry a NULL bio. With blktrace and multipath enabled, nvme_trace_bio_complete may dereference this NULL bio during io completion, leading to kernel NULL pointer dereference (crash) as shown by an OOPS...

CVE-2022-50422

CVE-2022-50422 affects the Linux kernel’s SCSI LIBSAS path. When SMP task execution fails, smp_execute_task_sg() calls del_timer() to remove slow_task->timer, but if sas_task_internal_timedout() is running, the timer isn’t stopped, causing a use-after-free of task->slow_task. The fix is to ...

CVE-2022-50430

CVE-2022-50430 affects the Linux kernel mmc vub300 driver. The fix prevents calling blocking operations when the current task is not TASK_RUNNING by ensuring vub300_enable_sdio_irq() uses proper mutex usage and marks the current task as TASK_RUNNING in a sleepable context. This reduces a potentia...

CVE-2022-50473

CVE-2022-50473 affects the Linux kernel cpufreq subsystem. The root cause is calling an uninitialized completion in cpufreq_sysfs_release() when kobject_init_and_add() fails, occurring in cpufreq_policy_alloc(). This can lead to a crash (page fault) on a local system via complete+0x98, with Call ...

CVE-2023-53169

CVE-2023-53169 concerns the Linux kernel resctrl path (x86/resctrl) where the rdt_domain’s staged_config[] was not cleared before/after use, allowing stale values to cause an MSR access error (WRMSR to 0xca0) when creating resource groups under CDP. The report describes resctrl_arch_update_domain...

CVE-2023-53172

CVE-2023-53172 concerns the Linux kernel fsverity feature. A change to FS_IOC_ENABLE_VERITY made it read data via __kernel_read() instead of direct pagecache, which made the WARN_ON_ONCE path reachable when the FD was opened with ioctl-only mode (mode 3). The fix is to reject FS_IOC_ENABLE_VERITY...

CVE-2023-53175

CVE-2023-53175 — Linux kernel hv_pci_restore_msi_msg() panic during hibernation (Hyper-V guest). Affected component: Linux kernel PCI Hyper-V integration. Root cause: when a VM with an assigned PCI device hibernates and MSI-X/MSI is not yet enabled, hv_pci_restore_msi_msg() panics because pdev-&g...

CVE-2023-53199

CVE-2023-53199 – Linux kernel, wifi: ath9k: hif_usb memory leak in rx stream . Syzkaller reported that when processing skbs in ath9k_hif_usb_rx_stream(), allocated skbs in skb_pool could be leaked if the function fails (e.g., due to an incorrect pkt_len or pkt_tag causing an input skb to be inval...

CVE-2023-53208

CVE-2023-53208 : Linux kernel KVM nested virtualization flaw where L1’s TSC multiplier is loaded based on L1 state instead of L2, causing a mismatch that userspace can trigger via MSR writes and guest CPUID changes. The fix ensures L1’s multiplier is loaded when exiting nested VM, preventing the ...

CVE-2023-53219

CVE-2023-53219 affects the Linux kernel media: netup_unidvb code, where detaching a Universal DVB card could lead to a use-after-free because del_timer() could not stop an active timer in netup_unidvb_dma_timeout() while the timer runs. The fix replaces del_timer() with del_timer_sync() to ensure...

CVE-2023-53222

CVE-2023-53222 pertains to the Linux kernel, specifically the JFS filesystem code (jfs_dmap). The issue is a mounting-time validation flaw in db_l2nbperpage: BLKTODMAP uses db_l2nbperpage to shift, and an unchecked large value can trigger a shift-out-of-bounds crash. The root cause is that db_l2n...

CVE-2023-53223

The CVE-2023-53223 issue affects the Linux kernel component drm/msm/dsi where alloc_ordered_workqueue may return NULL. The vulnerability arises from a missing check of the return value, potentially leading to a NULL pointer dereference. A patch addressing this check has been published (Patchwork:...

CVE-2023-53246

CVE-2023-53246 (Linux kernel, CIFS DFS upcall) : When CONFIG_CIFS_DFS_UPCALL is disabled, cifs_dfs_d_automount becomes NULL and the CIFS DFS referral handling can trigger a NULL pointer dereference in VFS follow_automount() while traversing a DFS referral. The fix adds an inline cifs_dfs_d_automo...

CVE-2023-53252

The CVE-2023-53252 entry applies to the Linux kernel Bluetooth stack. The vulnerability arises in hci_update_accept_list_sync where hci_conn_params/hci_sync lists are iterated while the lists can be modified (e.g., by le_scan_cleanup) without holding the device lock, risking an invalid list curso...

CVE-2023-53263

CVE-2023-53263 : In the Linux kernel, the drm/nouveau/disp path fixes a use-after-free in error handling of nouveau_connector_create. The bug arises because freeing the connector could happen before cleaning up the DRM side, potentially causing memory corruption when an error path is taken after ...

CVE-2023-53279

CVE-2023-53279 concerns a Linux kernel issue in the misc: vmw_balloon path where calling debugfs_lookup() left the result undereferenced (no dput), causing a memory leak over time. The published fixes replace the single-lookup path with debugfs_lookup_and_remove(), which performs the necessary cl...

CVE-2023-53286

CVE-2023-53286 affects the Linux kernel’s RDMA mlx5 path. The issue is: when destroying QP/RQ, the firmware destruction result was ignored, so upper layers could proceed as if destruction succeeded, potentially triggering kernel WARNs. The description specifies that the kernel now returns the fir...

CVE-2023-53366

CVE-2023-53366 (Linux kernel)修正了在轮询时未正确检查 bio->bi_bdev 是否为 NULL 的漏洞，根本原因是在两任务共用轮询队列时，任务 B 可能在任务 A 仍在轮询时将 IO 重新分配给 bio，导致崩溃（kernel oops）。影响点在块层的 bio_poll/io_do_iopoll/io_uring_enter 路径，已通过内核修复在对 NULL bdev 的检查中加强保护。CVSSv3.1 向量为 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H，基线分数 5.5（中等），局部可利用且无需用户交互，影响的为可用...

CVE-2023-53370

CVE-2023-53370 targets the Linux kernel DRM AMDGPU MES self test memory leak. The root cause is fences for the MES queue not being freed during amdgpu_ring_fini, leading to leaks. The description states a fix was applied in the kernel; connected documents reference kernel security updates address...

CVE-2023-53379

CVE-2023-53379 affects the Linux kernel, specifically the USB PHY Tahvo driver. The issue is described as a memory leak in tahvo_usb_probe() where, after obtaining an IRQ, if probe() returns a negative value, the error path failed to free allocated memory. The root cause is stated as missing erro...

CVE-2023-53449

CVE-2023-53449 affects the Linux kernel in the s390/dasd area. The root cause was a potential memory leak in dasd_eckd_init() where dasd_reserve_req was allocated before dasd_vol_info_req and could not be freed on error. The fix ensures dasd_reserve_req is freed before error returns, matching the...

CVE-2023-53473

The CVE-2023-53473 entry concerns Linux kernel ext4_dirhash() and its error handling when the hash tree feature is used with encrypted/casefolded file names. The vulnerability arises because ext4_dirhash() can fail and callers must propagate the error back up. Public documents provided do not inc...

CVE-2023-53486

CVE-2023-53486 affects the Linux kernel ntfs3 implementation. The fixed issue is a combined overflow/boundary check in attribute size validation during NTFS attribute enumeration, which could lead to slab-out-of-bounds access (KASAN) when mounting or reading NTFS volumes. The description and conn...

CVE-2023-53491

CVE-2023-53491 – Linux kernel : The advisory notes that start_kernel now uses an __no_stack_protector function attribute to selectively disable stack canaries on specific functions. The root cause is a per-function control of stack protector usage; prior to this, boot_init_stack_canary relied on ...

CVE-2023-53509

CVE-2023-53509 : In the Linux kernel qed_mcp_trace_dump() path, the code previously slept due to a 10µs-delayed loop in qed_mcp_cmd_and_union() which can spin up to 500k iterations, potentially blocking a thread for several seconds. The vulnerability description states that sleeping is permitted ...

CVE-2023-53510

CVE-2023-53510 : Linux kernel SCSI UFS core vulnerability. The issue is that ufshcd_queuecommand() could be invoked twice for a SCSI command before completion, caused by improper handling of lrbp->cmd in command submission paths. The fix, per the description, disables checking/clearing of the ...

CVE-2023-53515

CVE-2023-53515 affects the Linux kernel virtio-mmio subsystem. The issue stems from allocating vm_dev with devres, which breaks the vm_dev lifecycle tied to a struct device; when the platform_device is removed, the memory is freed before vm_dev release, causing a use-after-free when the release c...

CVE-2023-53619

Summary (CVE-2023-53619): Linux kernel netfilter conntrack may use a freed nf_ct_helper_hash when nf_conntrack_init_start() fails and nf_conntrack_helpers_register() runs later, leading to a use-after-free and potential memory corruption. The issue occurs on builds with NF_CONNTRACK enabled and c...

CVE-2023-53661

CVE-2023-53661 affects the Linux kernel bnxt driver. The issue is an arithmetic overflow in bnxt_get_nvram_directory() caused by the use of a multiplication macro instead of casting operands to a larger type when performing arithmetic. The vulnerability could enable an overflow condition within t...

CVE-2023-54285

CVE-2023-54285 : In the Linux kernel, a vulnerability in iomap_write_delalloc_scan could overflow when folio_next_index() (unsigned long) is left shifted by PAGE_SHIFT on 32-bit systems. The fix replaces the overflow-prone calculation with folio_pos(folio) + folio_size(folio), ensuring correct ov...

CVE-2025-38171

CVE-2025-38171 concerns a Linux kernel issue in the power: supply: max77705 path. The vulnerability arises because create_singlethread_workqueue() can return NULL instead of an error pointer, with missing or inadequate cleanup on error paths during probe. The remediation implemented fixes the wor...

CVE-2025-38570

CVE-2025-38570 is described in the initial document as a Linux kernel issue in the fbnic AF_XDP path, where a UaF occurs in xsk_bind() due to NAPI handling: NAPI is freed and the NAPI pointer is not cleared from the queue after a device open failure. The report indicates a local attack vector wit...

CVE-2025-38607

CVE-2025-38607 refers to a Linux kernel issue in the BPF verifier where BPF_JSET (conditional jump) was not handled correctly in CFG/live register/SCC computation. The described flaw could cause incorrect live-register tracking and SCC analysis due to can_jump() not accounting for jset, potential...

CVE-2025-38625

The CVE-2025-38625 issue concerns the Linux kernel vfio/pds driver. When CONFIG_IOMMUFD is enabled and a device is bound to the pds_vfio_pci driver, probe fails with a WARN_ON trace because vfio_device_ops.detach_ioas isn’t set. The vuln is resolved by applying a fix that uses the generic vfio_io...

CVE-2025-38638

CVE-2025-38638: In the Linux kernel IPv6 stack, inet6_rt_notify() could be invoked under RCU protection, allowing concurrent route changes and rt6_fill_node() returning -EMSGSIZE. The fix adds retry logic: when this situation is detected, the skb is resized and the operation retried, and a previo...

CVE-2025-38649

In the Linux kernel fix for CVE-2025-38649 (arm64, qcom, qcs615), an infinite loop in Coresight tracing caused a stack overflow and system crash when only a source device was enabled. The root cause is a recursive invocation of coresight_find_activated_sysfs_sink while locating an active sink, le...

CVE-2025-38667

CVE-2025-38667 relates to the Linux kernel iio path, where a potential out-of-bounds write occurred when writing to a 20-character buffer. The fix adds a size check to ensure input fits the buffer and appends a zero terminator after copying the data, preventing OoB access. Impact is described as ...

CVE-2025-38673

CVE-2025-38673 impacts the Linux kernel. The issue arises from the stability of the dma_buf field in struct drm_gem_object across a GEM object’s lifetime, which can become NULL after the final GEM handle is released, leading to a NULL-pointer dereference. Public documents indicate that prior work...

CVE-2025-38720

The CVE-2025-38720 entry describes a Linux kernel issue in hibmcge where two devices could sequentially acquire rtnl_lock during PCI reset, risking deadlock. The provided description explains that the hibmcge netdev previously acquired rtnl_lock in reset_prepare() and released it in reset_done(),...

CVE-2025-39709

CVE-2025-39709 : In the Linux kernel, the Venus media driver risked a NULL dereference if an IRQ fired before the interrupt handler was fully initialized. The fix ensures the interrupt handler is initialized before the IRQ is registered, preventing spurious interrupts during probe (noted on Rb3Ge...

CVE-2025-39749

The CVE-2025-39749 issue is in the Linux kernel’s RCU read-side handling: when IRQ work is used (CONFIG_IRQ_WORK=y) and rcu_read_unlock() runs in an interrupts-disabled region, irq-work can interrupt rcu_read_unlock_special(), creating a data race on the per-CPU defer_qs_iw_pending field. The fix...

CVE-2025-39759

CVE-2025-39759 affects the Linux kernel’s btrfs quota subsystem. A race between disabling quotas and running btrfs_ioctl_quota_rescan() can lead to a use-after-free of qgroup records in fs_info->qgroup_tree due to Task B freeing qgroups without holding fs_info->qgroup_lock while Task A iter...

CVE-2025-39891

CVE-2025-39891 (Linux kernel) affects the wifi: mwifiex driver. The chan_stats[] memory is allocated with vmalloc() and not zeroed, and the array is only partially initialized in mwifiex_update_chan_statistics(). This can allow an information leak if data hasn’t been filled before a user query vi...

CVE-2025-39905

The CVE-2025-39905 issue affects the Linux kernel phylink path: the race arises from phylink_resolve() manipulating pl->phydev under pl->state_mutex, creating a lock-order inversion with pl->phydev->lock. The fix introduces an explicit lock to serialize concurrent writes to pl->phy...

CVE-2025-39928

CVE-2025-39928 concerns the Linux kernel rtl9300 I2C driver. The issue arises in rtl9300_i2c_config_xfer where transfer length validation was missing, allowing a data length of 0 to be processed. The hardware supports data lengths 1–16 (N+1 with 4 DATA_WIDTH bits), so a zero length can underflow ...