CVE-2026-64144

CVE-2026-64144 is a memory leak in the Linux kernel's Bluetooth MediaTek (btmtk) driver . The setup_packet of a control URB is not freed when usb_submit_urb fails or the submitted URB is killed. A local attacker with low privileges can repeatedly trigger these error paths during USB Bluetooth ope...

CVE-2026-64175

CVE-2026-64175 concerns the Linux kernel’s iwlwifi/iwl_mld stack. When the Intel BE201 Wi‑Fi 7 firmware restarts after a crash, the TX path lacked a guard like the RX path, so iwl_mld_tx_from_txq() could dequeue and push frames to the transport layer while the firmware was dead. This caused iwl_t...

CVE-2026-64211

CVE-2026-64211 affects the Linux kernel SRCU: during CPU state transitions, tree SRCU could queue workqueue callbacks to CPUs that are not online or will never be online (including imaginary CPUs). The issue could cause hangs on s390 due to scheduling workqueue handlers on such CPUs. The referenc...

CVE-2026-64254

CVE-2026-64254: In the Linux kernel NTB EPF path, a teardown path could call pci_iounmap() on the same iomem with an offset when BARs for PEER_SPAD and CONFIG are shared. The result was a kernel warning about vunmap() on a nonexistent vm area. A fix exists to unmap only when the two BARs used are...

CVE-2026-64267

CVE-2026-64267 affects the Linux kernel’s FUSE (Filesystem in Userspace) path. The issue is an integer overflow in handling FUSE_NOTIFY_PRUNE messages on 32-bit architectures, where the product of outarg.count and sizeof(u64) can wrap during payload length validation, potentially causing the kern...

CVE-2026-64312

The CVE-2026-64312 vulnerability affects the Linux kernel crypto/pcrypt path. Specifically, when padata_do_parallel() returns -EBUSY and the code falls back to invoking the child AEAD directly, the padata completion callback must not be kept. Otherwise, an asynchronous completion could run pcrypt...

CVE-2026-64323

CVE-2026-64323 affects the Linux kernel UDF filesystem handling. The bug is in udf_load_vat() where the virtual partition start offset is taken from vat20->lengthHeader without validating against the VAT inode size, allowing a fully attacker-controlled 16-bit lengthHeader to underflow s_num_en...

CVE-2026-64404

CVE-2026-64404 is a NULL pointer dereference in the Linux kernel's Bluetooth ISO subsystem , specifically in the iso_conn_big_sync() function. The function drops the socket lock to call hci_get_route() and re-acquires it, but dereferences iso_pi(sk)->conn->hcon without re-validating that co...

CVE-2026-64439

CVE-2026-64439: In the Linux kernel, the krb5 AEAD path could free a buffer while an async AEAD worker still held a pointer, causing a use-after-free (KASAN). The fix filters out async AEAD implementations at allocation time in krb5_aead_encrypt()/krb5_aead_decrypt() and corresponding rfc3961_sim...

CVE-2014-9903

CVE-2014-9903 (Linux kernel) : Affects Linux kernel 3.14-rc1 to 3.14-rc3 (and earlier rc builds) where sched_read_attr in kernel/sched/core.c uses an incorrect size. This enables a local attacker to obtain sensitive information from kernel stack memory via a crafted sched_getattr system call. The...

CVE-2022-50043

CVE-2022-50043 is a Linux kernel vulnerability in ndisc_router_discovery where, on certain paths after grabbing rt and neigh, a nonzero lifetime with a metric change causes the code to delete the route and potentially reacquire rt/neigh without decrementing the previous neigh reference count, lea...

CVE-2022-50240

CVE-2022-50240 concerns the Linux kernel Android binder subsystem. The issue arises from saving a pointer to a VMA outside of the mmap_lock, which could become stale or be freed, leading to fragile behavior in various failure paths. The documented fix changes the binder_alloc structure to record ...

CVE-2022-50248

CVE-2022-50248 is a Linux kernel vulnerability affecting the iwlwifi/iwl mvm TX path where a double-free of skb can occur. The issue arises when iwl_mvm_tx_skb_sta returns non-zero and the skb is freed, but a TSO skb buffer may also be freed in an error path; the fix is to return 0 in that error ...

CVE-2022-50263

CVE-2022-50263 concerns the Linux kernel component vdpasim. The vulnerability stems from a memory leak when freeing IOTLBs: after the commit that added control virtqueue support, vdpasim->iommu became an array of IOTLBs, and mappings must be cleaned for each free IOTLB rather than deleting onl...

CVE-2022-50289

CVE-2022-50289 concerns the Linux kernel OCFS2 subsystem. The provided advisories describe a memory leak in ocfs2_stack_glue_init() where ocfs2_table_header must be freed if ocfs2_sysfs_init() fails, to prevent a kmemleak-detected memleak. The root cause is the missing free path during initializa...

CVE-2022-50310

Summary: CVE-2022-50310 affects the Linux kernel and describes a use-after-free (UAF) in ip6mr_sk_done() when addrconf_init_net() fails during net initialization. The vulnerability arises because devconf_all is freed during addrconf_init_net() failure, but ip6mr_sk_done() later accesses devconf-&...

CVE-2022-50324

CVE-2022-50324 — The Linux kernel contains a fix in the mtd: maps: pxa2xx-flash subsystem to address a memory leak during probe/remapping. The issue is triggered during probe when remapping an area and could leak memory if not handled properly; the fix frees the ‘info’ structure upon remapping er...

CVE-2022-50335

Summary: CVE-2022-50335 relates to the 9p protocol in the Linux kernel. A race/initialization bug could leave a request with an uninitialized refcount when newly allocated from slab and added to idr, risking use-after-free of the request data structure (e.g., during p9_read_work/p9_client_walk fl...

CVE-2022-50344

CVE-2022-50344 - Linux kernel ext4 null-ptr-deref Affects: Linux kernel ext4 subsystem (ext4_write_info) in quota handling during umount/shutdown paths. Root cause: A null pointer dereference can occur in ext4_write_info when the superblock root inode is no longer valid during unmount, leading to...

CVE-2022-50352

CVE-2022-50352 affects the Linux kernel’s net/hns driver (hnae_ae_register). If device_register() fails during probing and the kobject refcount isn’t decremented to 0, the name allocated in dev_set_name() is leaked. The fix calls put_device() so the name can be freed in kobject_cleanup(). The con...

CVE-2022-50368

CVE-2022-50368 affects the Linux kernel component drm/msm/dsi. The issue is memory corruption that occurs if there are more than eight bridges, due to a missing sanity check on the bridge counter which can cause writes beyond the fixed-size bridge array. The vulnerability was fixed by adding the ...

CVE-2022-50372

CVE-2022-50372 pertains to the Linux kernel’s CIFS/SMB client: a memory leak occurs when building the ntlmssp negotiate blob during mount of CIFS shares. The issue manifests as an unreferenced object and can lead to a session setup leak if the negotiate blob construction fails. The vulnerability ...

CVE-2022-50382

CVE-2022-50382 refers to a Linux kernel fix for a deadlock involving padata parallelization when BHs are enabled during the serial path. The issue occurs in padata_do_serial where a spin_lock on reorder->lock could be taken with BHs still on, enabling a deadlock on overload. The fix ensures BH...

CVE-2022-50388

CVE-2022-50388 affects the Linux kernel where a flush request initialized by blk_kick_flush can carry a NULL bio. With blktrace and multipath enabled, nvme_trace_bio_complete may dereference this NULL bio during io completion, leading to kernel NULL pointer dereference (crash) as shown by an OOPS...

CVE-2022-50392

CVE-2022-50392 is a Linux kernel vulnerability affecting ASoC: mediatek mt8183. The issue is a refcount leak in the mt8183_mt6358_ts3a227_max98357_dev_probe() path caused by not calling of_node_put() on the phandle node returned by of_parse_phandle() when finishing usage. The connected advisories...

CVE-2022-50393

The CVE-2022-50393 issue affects the Linux kernel DRM/AMDGPU SDMA path where dma_resv_iter_next may be invoked from an unlocked context during SDMA page-table updates, leading to a potential misuse warning and race conditions. Affected component: amdgpu driver within the kernel's DMA-BUF handling...

CVE-2022-50409

CVE-2022-50409 is a Linux kernel vulnerability affecting networking code. The issue occurs when a socket is dead but code paths access the socket’s wait queue (sk_wq) during sk_stream_wait_memory, which can lead to a NULL dereference or use-after-free scenario when the socket is released while me...

CVE-2022-50412

CVE-2022-50412 affects the Linux kernel code paths for drm: bridge: adv7511 and CEC i2c device unregistration. The issue arises when cec_unregister_adapter() calls adapter ops that may become invalid during unregistration, which can invalidate the CEC address and trigger a kernel oops (example tr...

CVE-2022-50414

CVE-2022-50414 concerns the Linux kernel: during SCSI over FCoE, fcoe_init() calls fcoe_transport_attach(&fcoe_sw_transport). If fcoe_if_init() fails, the transport is not detached, leaving a freed fcoe_sw_transport on the fcoe_transports list. This causes a kernel panic when the module is reinse...

CVE-2022-50436

CVE-2022-50436 : Linux kernel ext4 had a deadlock risk when ext4_unlink() extended the jbd2 transaction scope, because ext4_find_entry() could require setting up the directory encryption key inside a transaction. The fix restores the transaction to its original scope, preventing the deadlock. The...

CVE-2022-50490

Summary: CVE-2022-50490 affects the Linux kernel bpf path in __htab_map_lookup_and_delete_batch, where a failed htab_lock_bucket() returning -EBUSY could cause silent bucket-skips, out-of-bounds memory access, or kernel memory exposure to userspace. Root cause: error from htab_lock_bucket() not p...

CVE-2022-50531

The CVE-2022-50531 issue is in the Linux kernel Tipc subsystem where an 4-byte portion of sub.usr_handle remained uninitialized when handling setsockopt for SOL_TIPC, causing a kernel infoleak detected by KMSAN. The fixed version initializes sub.usr_handle with an 8-byte write in tipc_topsrv_kern...

CVE-2023-53203

CVE-2023-53203 concerns the Linux kernel MT7996/MT76 WiFi driver. A NULL pointer dereference in mt7996_mac_write_txwi() of the vif pointer is mitigated by exporting and reusing the mt76_connac2_mac_tx_rate_val utility, applied in the mt7996 driver. The fix is kernel-side (export utility and integ...

CVE-2023-53204

CVE-2023-53204 affects the Linux kernel af_unix subsystem. The root cause is a data race on the unix_inflight field: user->unix_inflight is modified under spin_lock(unix_gc_lock), while too_many_unix_fds() reads it locklessly, enabling a race between unix_attach_fds and the unix_inflight acces...

CVE-2023-53215

CVE-2023-53215 affects the Linux kernel sched/fair component. The issue occurs when the load balancer tries to migrate a task that is migration-disabled to its current CPU, triggering a warning in set_task_cpu() during balance. The root cause is how the new_dst_cpu is selected from env->dst_gr...

CVE-2023-53241

The CVE-2023-53241 entry describes a Linux kernel NFSD flaw where op_release was skipped for some replies, causing a potential memory leak in layoutget when an error occurs. The fix ensures op_release is called even if op_func returns an error and, on error, nfsd4_block_get_device_info_scsi must ...

CVE-2023-53269

CVE-2023-53269 is a Linux kernel vulnerability affecting the block layer in the ublk path. The issue centers on ensuring the block size is set correctly; an incorrect size could cause a kernel panic. The documented fix enforces proper block size handling and, when ublk_validate_params() fails, cl...

CVE-2023-53272

CVE-2023-53272 relates to the Linux kernel ENA driver (net: ena) where a UBSAN shift-out-of-bounds in the exponential backoff was observed during device reset. The issue stems from exponent calculations that could overflow 32-bit types, causing UBSAN panics when backoff delays grow large. The adv...

CVE-2023-53276

In CVE-2023-53276, the Linux kernel ubifs code leaks memory: fscrypt_setup_filename allocates memory for the tmpfile name, but this memory is not freed after the name is copied into the directory entry inode (ubifs_tmpfile → vfs_tmpfile → path_openat). The kmemleak report shows an unreferenced ob...

CVE-2023-53295

CVE-2023-53295 affects the Linux kernel, specifically the UDF module. The issue occurs when writing to inline files fails (or is only partially successful); the kernel wrongly updates the file length as if the entire write had succeeded. Root cause: updating length of inline data on failed writes...

CVE-2023-53297

CVE-2023-53297 affects the Linux kernel Bluetooth L2CAP path, where conn->chan_lock was not held before l2cap_get_chan_by_scid; if that call returns NULL, a “bad unlock balance” condition is triggered. Multiple connected advisories (Astra Linux, MiracleLinux, RHEL kernels) document the fix as ...

CVE-2023-53323

CVE-2023-53323 affects the Linux kernel ext2 with DAX on pmem: ext2/dax: Fix ext2_setsize when len is page aligned. The bug arises when PAGE_ALIGN(x) returns x for already-aligned x, causing dax_zero_range() to pass length 0 to iomap_begin(), which makes ext2_get_blocks() see max_blocks = 0 and t...

CVE-2023-53340

Linux kernel: net/mlx5 vulnerability where DEVX can issue a general, unknown command; if such a command fails, mlx5 may collect failure data without a storage for it, causing an array-index-out-of-bounds error. The fix adds a check to verify the command is known before collecting failure data. Af...

CVE-2023-53353

The CVE concerns the Linux kernel in accel/habanalabs where the memory manager IDR destruction is postponed from the memory manager fini to hpriv_release(). The issue arises because destroying the IDR while a user context may still hold memory buffers could cause release calls to fail later, crea...

CVE-2023-53365

CVE-2023-53365 is documented across multiple advisories as a Linux kernel vulnerability affecting IPv6 multicast report handling. The issue arises in the ip6mr_cache_report path, where skb_push may move data backwards by a signed length (skb_network_offset(pkt) equals 4), leading to an invalid sk...

CVE-2023-53383

CVE-2023-53383: In the Linux kernel, a workaround was added for NVIDIA T241-FABRIC-4 erratum affecting inter-socket interleaving of AXI4 transactions in GICv3. The issue can cause GIC state corruption and potentially kernel panics on NVIDIA server platforms with more than two sockets, due to inte...

CVE-2023-53393

CVE-2023-53393 affects the Linux kernel RDMA mlx5 subsystem. The root cause is incorrect port_num handling in mlx5_ib_get_hw_stats() for device (port_num = 0), with downstream code assuming port_num >= 1, which can trigger a page fault (oops) as shown in the provided trace. The fix sets port_n...

CVE-2023-53396

The CVE-2023-53396 issue affects the Linux kernel ubifs: memory leak in do_rename when renaming a file in an encrypted directory. The leak stems from fscrypt_setup_filename allocating memory for the file name, which is never used and is not freed before returning. kmemleak shows the unreferenced ...

CVE-2023-53418

The CVE-2023-53418 issue affects the Linux kernel USB gadget driver, specifically the lpc32xx_udc in the USB subsystem. The root cause was a memory leak when using debugfs_lookup() because the returned object was not paired with a dput(), leaving memory allocated over time. The provided fixes sim...

CVE-2023-53420

CVE-2023-53420 affects the Linux kernel NTFS code path. The issue arises in ntfs_listxattr() (fs/ntfs3/xattr.c) where slab-out-of-bounds access could occur due to incorrect handling in the ea_all iteration when aea->name_len is 0, potentially reading invalid memory during listxattr(). The vend...