CVE-2022-50385

CVE-2022-50385 affects the Linux kernel NFS automount path: when mounting from an NFSv4 referral, path->dentry can become a negative dentry, so the fix derives the struct nfs_server from the dentry itself. The vulnerability is an Oops (local impact) and is resolved in the kernel by this change...

CVE-2022-50402

CVE-2022-50402 concerns Linux kernel’s md-bitmap code. The vulnerability arises from not validating the return value of md_bitmap_get_counter(), which can lead to a NULL pointer dereference. The issue was resolved by updating the code to check the return value and guard against NULL dereferences;...

CVE-2022-50456

Linux kernel vulnerability CVE-2022-50456 (btrfs): when a file has an inline extent followed by a regular/prealloc extent, resolving a logical address in the non-inline region could read an invalid offset and trigger a panic (general protection fault). A fix was implemented by detecting the inlin...

CVE-2022-50510

CVE-2022-50510 affects the Linux kernel’s perf/smmuv3 component. The issue is a hotplug callback leak in arm_smmu_pmu_init(): when platform_driver_register() fails, the callback added by cpuhp_setup_state_multi() is not removed, potentially leaking a hotplug callback. The fix removes the callback...

CVE-2022-50525

The CVE-2022-50525 issue affects the Linux kernel, specifically the iommu/fsl_pamu path. The root cause was in fsl_pamu_probe(): on create_csd() failure, the function returned early, leaving IRQs and memory unreleased. The patch fixes this by jumping to an error-handling path when create_csd() fa...

CVE-2022-50538

CVE-2022-50538 pertains to the Linux kernel VME subsystem. In fake_init(), __root_device_register() may fail and the error is not handled, which can cause unregistering vme_root during exit to fail, potentially yielding a general protection fault and a null-ptr-deref (non-canonical address 0xdfff...

CVE-2022-50555

CVE-2022-50555 : Linux kernel Tipc topsrv accept crashes due to a null pointer dereference when srv->listener is null (set by tipc_topsrv_stop). Root cause: concurrent use of a potentially null listener inside tipc_topsrv_accept; protection via srv->idr_lock, and a missing check allowed der...

CVE-2023-53189

In CVE-2023-53189, the Linux kernel IPv6 addrconf subsystem has a fix for a potential refcount underflow affecting idev in addrconf_mod_rs_timer. The root cause is a timing gap where rs_timer may activate without holding idev, risking a refcount mismanagement. The fix is to hold idev when mod_tim...

CVE-2023-53229

The CVE-2023-53229 entry relates to the Linux kernel wifi/mac80211 subsystem. It fixes invalid calls to drv_sta_pre_rcu_remove for non-uploaded stations, addressing potential data corruption from uninitialized driver private data. The public description confirms the vulnerability in the mac80211 ...

CVE-2023-53230

CVE-2023-53230 concerns the Linux kernel SMB client. The publicly provided docs identify the issue as a fix to a warning in fs/smb/client/cifsfs.c:982 within cifs_smb3_do_mount(), described as a memory‑leak warning reported by the kernel test robot. The connected advisories indicate the patch was...

CVE-2023-53267

The CVE-2023-53267 issue affects the Linux kernel driver for Xilinx SoC where memory allocated for cb_data in xlnx_add_cb_for_notify_event() could leak if kfree() is not invoked on allocation failure. The connected documents confirm a fix was applied to ensure kfree() is called to prevent leaks. ...

CVE-2023-53295

CVE-2023-53295 affects the Linux kernel, specifically the UDF module. The issue occurs when writing to inline files fails (or is only partially successful); the kernel wrongly updates the file length as if the entire write had succeeded. Root cause: updating length of inline data on failed writes...

CVE-2023-53307

CVE-2023-53307: In the Linux kernel rbd subsystem, do_rbd_add() can trigger a use-after-free if rbd_dev_create() fails after transferring ownership of rbd_dev fields (rbd_client, spec, opts) to the rbd_dev. The root cause is that these structures are freed when rbd_dev_create() calls rbd_dev_free...

CVE-2023-53316

Technical details about CVE-2023-53316 are not publicly available in the provided documents. Monitor for updates.

CVE-2023-53320

CVE-2023-53320 (Linux kernel) relates to scsi: mpi3mr: Fix issues in mpi3mr_get_all_tgt_info(). The patch fixes four issues in mpi3mr_get_all_tgt_info(): (1) valid entry length now uses the correct header size (sizeof(u64) instead of sizeof(u32)); (2) kern_entrylen no longer subtracts one from nu...

CVE-2023-53323

CVE-2023-53323 affects the Linux kernel ext2 with DAX on pmem: ext2/dax: Fix ext2_setsize when len is page aligned. The bug arises when PAGE_ALIGN(x) returns x for already-aligned x, causing dax_zero_range() to pass length 0 to iomap_begin(), which makes ext2_get_blocks() see max_blocks = 0 and t...

CVE-2023-53327

CVE-2023-53327 concerns a Linux kernel iommufd selftest issue where an overflow of uptr and length near UINTPTR_MAX could trigger a WARN_ON in drivers/iommu/iommufd/selftest.c. The vulnerability is described as resolved, with the notable consequence being user memory range checks that must not ov...

CVE-2023-53353

The CVE concerns the Linux kernel in accel/habanalabs where the memory manager IDR destruction is postponed from the memory manager fini to hpriv_release(). The issue arises because destroying the IDR while a user context may still hold memory buffers could cause release calls to fail later, crea...

CVE-2023-53367

CVE-2023-53367 concerns a memory leak in the Linux kernel’s accel/habanalabs code path (mem mappings in user_mappings) that could occur when clearing user_mappings during rapid context reuse. The connected OSV entries indicate Rootio‑Linux patches fixing this CVE across Root:Ubuntu:22.04 and Root...

CVE-2023-53383

CVE-2023-53383: In the Linux kernel, a workaround was added for NVIDIA T241-FABRIC-4 erratum affecting inter-socket interleaving of AXI4 transactions in GICv3. The issue can cause GIC state corruption and potentially kernel panics on NVIDIA server platforms with more than two sockets, due to inte...

CVE-2023-53388

Summary of CVE-2023-53388 : In the Linux kernel, the DRM/Mediatek driver had a dangling pointer in the error path of the bind sequence. When mtk_drm_bind() fails, the code previously called drm_dev_put() to destroy the drm_device, but a private object still held a pointer to that device. If a sus...

CVE-2023-53402

CVE-2023-53402 affects the Linux kernel, specifically the printk debugfs path. The root cause is a memory leak in kernel/printk/index.c when using debugfs_lookup() without a matching dput(). The documented fix replaces the sequence with debugfs_lookup_and_remove(), handling the logic and preventi...

CVE-2023-53428

CVE-2023-53428 affects the Linux kernel powercap subsystem, specifically the arm_scmi implementation. The issue arises when powercap zones are retrieved from platforms and registered in a hierarchical tree; the current recursive walk can cause kernel stack overflow for large trees. The fix replac...

CVE-2023-53436

CVE-2023-53436 : In the Linux kernel, the scsi: snic path had a memory leak when device_add() fails because the name allocated by dev_set_name() wasn’t freed. The fix releases the reference in the error path by calling put_device(), allowing kobject_cleanp() to free the name. The vulnerability’s ...

CVE-2023-53485

CVE-2023-53485 affects the Linux kernel JFS code path. The UBSAN out-of-bounds access in fs/jfs/jfs_dmap.c:1965 was triggered when dbAllocDmapLev accessed dp->tree.stree[leafidx + LEAFIND] with a negative leafidx. The patch adds a guard in dbAllocDmapLev to return an I/O error if leafidx is ne...

CVE-2023-53487

CVE-2023-53487 concerns the Linux kernel under POWERPC: the powerpc/rtas_flash path allowed a user to copy memory into flash_block_cache objects when hardened usercopy is enabled (CONFIG_HARDENED_USERCOPY=y). The flaw is triggered via the /proc/powerpc/rtas/firmware_update interface, causing a ke...

CVE-2023-53492

The CVE-2023-53492 entry describes a Linux kernel nf_tables issue: when adding a rule that refers to a chain by ID, Genmask was ignored if the chain had been deleted in the same batch, causing the rule to reference a deleted chain and trigger a warning. The root cause is nf_tables_lookup_byid ign...

CVE-2023-53518

CVE-2023-53518 — Linux kernel vulnerability fixed: leak in PM / devfreq path during devfreq_dev_release() and resources allocated by srcu_init_notifier_head() must be released via srcu_cleanup_notifier_head(). Connected advisories confirm the issue in the kernel and KMEMLEAK reporting. Exploitati...

CVE-2023-53581

CVE-2023-53581 affects the Linux kernel mlx5 core (net/mlx5e). The issue is a race: NOT_READY flag is checked before acquiring the necessary lock, allowing a flow to be concurrently removed from unready_flows by a workqueue, which can cause a double removal and a crash (as shown by the crash trac...

CVE-2023-53582

Concrete details found: CVE-2023-53582 affects the Linux kernel’s brcmfmac wifi driver. The issue is a stack-out-of-bounds read that occurs when a CLM version string, filled via memcpy() in brcmf_fil_iovar_data_get(), is passed as an argument to strreplace() in brcmf_c_preinit_dcmds() without bei...

CVE-2023-53624

The CVE-2023-53624 issue affects the Linux kernel’s net/sched implementation, specifically sch_fq. It arises when the initial quantum (configured for sch_fq) exceeds INT_MAX, causing the first assignment to the credit field to overflow to a very negative value. This can trigger a CPU soft-lockup ...

CVE-2023-53626

CVE-2023-53626 : In the Linux kernel, the vulnerability is in the ext4 code and is caused by a possible double unlock when moving a directory. Affected component is ext4 within the kernel, with fixes committed in the upstream kernel (see references to stable kernel patches). The EulerOS/OSS advis...

CVE-2023-53628

CVE-2023-53628 affects the Linux kernel drm/amdgpu path. The issue arises from the gfx_v11_0_cp_ecc_error_irq_funcs being retired in gfx11; gfx_v11_0_hw_fini still called amdgpu_irq_put to disable the interrupt, which led to a call trace during suspend/reset. The patch history (v2–v5) shows separ...

CVE-2023-53648

The CVE CVE-2023-53648 fixes a NULL pointer dereference in ALSA: ac97 in snd_ac97_mixer() within the Linux kernel. The issue occurred because rac97 could be NULL; the patch removes a redundant assignment and returns an error if rac97 is NULL. The documented impact is a local denial of service due...

CVE-2023-53665

CVE-2023-53665 : Linux kernel vulnerability in md/mdadm handling where after export_rdev(), mddev may be dereferenced via rdev->kobject; if the last rdev is freed, mddev might be invalid. This is caused by mddev->kobject being referenced by rdev->kobject and using mddev after export_rdev...

CVE-2023-53666

CVE-2023-53666 relates to the Linux kernel ASoC codecs (snd_soc_wcd_mbhc, wcd938x) where MBHC initialisation could fail and lead to a NULL/error pointer dereference while configuring the jack. The patch fixes missing error handling to prevent dereferencing an error pointer, addressing an issue th...

CVE-2025-38504

Summary: CVE-2025-38504 relates to the Linux kernel, specifically the io_uring/zcrx component. The connected documents describe a code-level fix in the destruction path for page pools, where a misplaced warning could trigger during destruction and affect niovs handling. The root cause is that nio...

CVE-2025-38592

CVE-2025-38592 affects the Linux kernel Bluetooth subsystem. The issue arises in hci_devcd_dump where dev_coredumpv and skb_put_data both use hdev->dump.head, allowing a freed vmalloc buffer to be accessed and causing vmalloc-out-of-bounds access. The documented root cause is that dev_coredump...

CVE-2025-39908

CVE-2025-39908 concerns a Linux kernel issue in the hwtstamp path under netdev lock during ioctl handling (net: dev_ioctl: take ops lock in hwtstamp lower paths). The vulnerability stems fromndo hwtstamp callbacks not consistently running under the per-device ops lock in lower get/set paths, with...

CVE-2025-39917

Summary (CVE-2025-39917) : Linux kernel bug in bpf_crypto_crypt allowed an out-of-bounds write when the destination dynptr size was smaller than the source, due to missing validation before crypto backend calls with len = src_len. The issue arises in the bpf_dynptr_data usage for src and the writ...

CVE-2025-39922

CVE-2025-39922 : In the Linux kernel, the ixgbe driver fixed an incorrect map used in EEE linkmode population. The code previously used ixgbe_lp_map in loops that should populate the supported and advertised EEE linkmodes based on ixgbe_ls_map, causing incorrect bit settings and potential out-of-...

CVE-2025-39932

CVE-2025-39932 concerns the Linux kernel SMB client path where in smbd_destroy() a memory may be destroyed while post_send_credits_work could still be pending, potentially causing a use-after-free scenario illustrated by rdma_rxe/ib_drain_qp flows. The issue arises when put_receive_buffer() trigg...

CVE-2025-39934

CVE-2025-39934: Linux kernel drm: bridge: anx7625 fixes a NULL pointer dereference when an IRQ fires before resource initialization, potentially accessing uninitialized I2C tcpc_client data. The NVD entry notes a MEDIUM base score (5.5) with LOCAL attack vector and LOW PR, HIGH impact on availabi...

CVE-2025-71071

In CVE-2025-71071, the Linux kernel iommu/mediatek driver had a use-after-free risk during probe deferral when larb devices were not yet bound. The issue arose from dropping references to larb devices taken during probe on success and on errors, potentially allowing a use-after-free if probe is d...

CVE-2025-71080

CVE-2025-71080 concerns a race in Linux kernel IPv6 PREEMPT_RT code. On PREEMPT_RT kernels, after rt6_get_pcpu_route() returns NULL, a preemption can allow another task on the same CPU to install a pcpu_rt entry; when the first task resumes, the cmpxchg() in rt6_make_pcpu_route() may fail and tri...

CVE-2025-71235

CVE-2025-71235 : Linux kernel, scsi: qla2xxx driver. The issue arises when a module unload is issued while a fabric scan is in progress, causing a crash due to freeing memory in interrupt context (dma_free_attrs) after the UNLOADING flag is set and a scheduled work item cannot be allocated. Root ...

CVE-2025-71302

CVE-2025-71302 relates to the Linux kernel drm/panthor: a race in dma-fence safe access rules, potentially between drm_sched_fence_get_timeline_name and group_free_queue. The fix is implemented in commit 506aa8b02a8d6 (“dma-fence: Add safe access helpers and document the rules”). Public advisorie...

CVE-2026-23061

Summary (CVE-2026-23061) : The Linux kernel CAN subsystem can: kvaser_usb_read_bulk_callback() leak URBs in kvaser_usb, leading to a memory leak. Root cause: the URBs for USB-in transfers are anchored to dev->rx_submitted when created and submitted, but the USB framework unanchors URBs before ...

CVE-2026-23075

CVE-2026-23075 affects the Linux kernel CAN networking support. The issue arises from the esd_usb_read_bulk_callback() path where URBs for USB-in transfers are unanchored by the USB core after completion, leading to a memory leak if esd_usb_close() frees URBs that are no longer anchored. The fix ...

CVE-2026-23090

The CVE-2026-23090 entry concerns a Slimbus core device reference leak in the Linux kernel. The root cause is improper handling of device references when processing report-present messages, allowing dynamic Slimbus device allocations without correctly dropping references for previously registered...