CVE-2026-23114

Summary (CVE-2026-23114) The Linux kernel arm64 FPSIMD/SVE state management vulnerability arises when SVE is supported but SME is not: a ptrace write to the NT_ARM_SVE regset can place the tracee in an invalid state, storing non-streaming SVE data in FP_STATE_SVE format while TIF_SVE is not set. ...

CVE-2022-50310

Summary: CVE-2022-50310 affects the Linux kernel and describes a use-after-free (UAF) in ip6mr_sk_done() when addrconf_init_net() fails during net initialization. The vulnerability arises because devconf_all is freed during addrconf_init_net() failure, but ip6mr_sk_done() later accesses devconf-&...

CVE-2022-50313

Summary: CVE-2022-50313 affects the Linux kernel (EROF S subsystem). The root cause is that the i_size field is signed; crafted negative i_size can be interpreted as a fast symlink, triggering an order = MAX_ORDER warning. The fix changes the handling to fall back to the generic path for such unu...

CVE-2022-50317

CVE-2022-50317 affects the Linux kernel, specifically the DRM bridge driver for Megachips (stdp2690 and stdp4028). The issue is a null-pointer dereference that occurs when removing the module because the two bridges are not probed concurrently, causing ge_b850v3_register() not to be called for in...

CVE-2022-50326

CVE-2022-50326 relates to a memory leak in the Linux kernel’s media: airspy probe. The root cause is that a variable buf was moved from stack to heap by commit ca9dc8d06ab6, but deallocation was only present in the error path, not the success path. Consequently, buf can leak in the success path. ...

CVE-2022-50327

CVE-2022-50327 in the Linux kernel concerns ACPI: processor: idle where acpi_fetch_acpi_dev() could return NULL, causing a NULL pointer dereference in acpi_device_hid(). The connected Nessus/SUSE advisories confirm this CVE is addressed in kernel live patches for SUSE SLES15 SP5 (multiple patches...

CVE-2022-50335

Summary: CVE-2022-50335 relates to the 9p protocol in the Linux kernel. A race/initialization bug could leave a request with an uninitialized refcount when newly allocated from slab and added to idr, risking use-after-free of the request data structure (e.g., during p9_read_work/p9_client_walk fl...

CVE-2022-50344

CVE-2022-50344 - Linux kernel ext4 null-ptr-deref Affects: Linux kernel ext4 subsystem (ext4_write_info) in quota handling during umount/shutdown paths. Root cause: A null pointer dereference can occur in ext4_write_info when the superblock root inode is no longer valid during unmount, leading to...

CVE-2022-50348

CVE-2022-50348 affects the Linux kernel’s NFS server (nfsd). The vulnerability is a memory leak in an error-path: if memdup_user() fails, memory allocated earlier is not freed, causing a leak. The connected sources confirm the issue and state that it has been resolved in the kernel, but do not pr...

CVE-2022-50368

CVE-2022-50368 affects the Linux kernel component drm/msm/dsi. The issue is memory corruption that occurs if there are more than eight bridges, due to a missing sanity check on the bridge counter which can cause writes beyond the fixed-size bridge array. The vulnerability was fixed by adding the ...

CVE-2022-50371

CVE-2022-50371 concerns the Linux kernel, specifically the qcom-lpg LED driver. The issue arises because lpg_brighness_set() could sleep while the brightness_set() callback for the LED must be non-blocking, leading to sleeping in atomic context (as shown by the stack trace and in_atomic/irq state...

CVE-2022-50372

CVE-2022-50372 pertains to the Linux kernel’s CIFS/SMB client: a memory leak occurs when building the ntlmssp negotiate blob during mount of CIFS shares. The issue manifests as an unreferenced object and can lead to a session setup leak if the negotiate blob construction fails. The vulnerability ...

CVE-2022-50382

CVE-2022-50382 refers to a Linux kernel fix for a deadlock involving padata parallelization when BHs are enabled during the serial path. The issue occurs in padata_do_serial where a spin_lock on reorder->lock could be taken with BHs still on, enabling a deadlock on overload. The fix ensures BH...

CVE-2022-50385

CVE-2022-50385 affects the Linux kernel NFS automount path: when mounting from an NFSv4 referral, path->dentry can become a negative dentry, so the fix derives the struct nfs_server from the dentry itself. The vulnerability is an Oops (local impact) and is resolved in the kernel by this change...

CVE-2022-50388

CVE-2022-50388 affects the Linux kernel where a flush request initialized by blk_kick_flush can carry a NULL bio. With blktrace and multipath enabled, nvme_trace_bio_complete may dereference this NULL bio during io completion, leading to kernel NULL pointer dereference (crash) as shown by an OOPS...

CVE-2022-50409

CVE-2022-50409 is a Linux kernel vulnerability affecting networking code. The issue occurs when a socket is dead but code paths access the socket’s wait queue (sk_wq) during sk_stream_wait_memory, which can lead to a NULL dereference or use-after-free scenario when the socket is released while me...

CVE-2022-50500

CVE-2022-50500 – Linux kernel (netdevsim): The vulnerability is a memory leak in nsim_drv_probe() when nsim_dev_resources_register() fails, as reported in the initial document. Unreferenced object and backtrace indicate leak of 128-byte allocation in that failure path. The issue is fixed in the L...

CVE-2023-53172

CVE-2023-53172 concerns the Linux kernel fsverity feature. A change to FS_IOC_ENABLE_VERITY made it read data via __kernel_read() instead of direct pagecache, which made the WARN_ON_ONCE path reachable when the FD was opened with ioctl-only mode (mode 3). The fix is to reject FS_IOC_ENABLE_VERITY...

CVE-2023-53176

CVE-2023-53176 concerns the Linux kernel serial driver stack. When unbinding a port-specific 8250 driver, control passes to the generic serial8250 driver while port->pm may still reference the now-destroyed driver, causing an oops roughly 10 seconds later. The connected documents confirm the r...

CVE-2023-53236

The CVE-2023-53236 entry concerns a vulnerability in the Linux kernel IOMMU driver (iommufd) where in batch carry the pfn list could be corrupted if batch->end is 0 and npfns[0] is set before pfns is updated. This ordering bug could lead to various page metadata and accounting corruptions (as ...

CVE-2023-53255

CVE-2023-53255 : Linux kernel vulnerability in firmware: stratix10-svc caused a potential resource leak in svc_create_memory_pool (invoked from stratix10_svc_drv_probe). The memremap() call was not paired with memunmap(), risking leakage. The fix switches to devm_memremap() to ensure proper resou...

CVE-2023-53379

CVE-2023-53379 affects the Linux kernel, specifically the USB PHY Tahvo driver. The issue is described as a memory leak in tahvo_usb_probe() where, after obtaining an IRQ, if probe() returns a negative value, the error path failed to free allocated memory. The root cause is stated as missing erro...

CVE-2023-53391

CVE-2023-53391 patches the Linux kernel shmem:ramfs-based tmpfs memory leak by replacing kill_sb with ramfs_kill_sb() in ramfs-based tmpfs, freeing fc->s_fs_info during init_fs_context() cleanup. Affected: Linux kernel ramfs/tmpfs shmem path; root cause: memory leak in kill_sb/init_fs_context ...

CVE-2023-53415

CVE-2023-53415 concerns the Linux kernel USB-DWC3 subsystem. The vulnerability arises from not freeing memory obtained via debugfs_lookup(): the returned object must be released with dput(), otherwise a memory leak occurs over time. The fixed approach consolidates the logic by using debugfs_looku...

CVE-2023-53434

In the Linux kernel, CVE-2023-53434 concerns remoteproc: imx_dsp_rproc. The fix adds a custom memory copy implementation (and memset) for the i.MX DSP cores because the HiFi DSP IRAM requires 32‑bit writes; violating this can trigger a Kernel panic. The vulnerability is mitigated by the patched m...

CVE-2023-53488

CVE-2023-53488 (Linux kernel) : The vulnerability affects the IB/hfi1 InfiniBand driver. During hotplug removal, a pending update-counters work could run after memory is freed, causing a possible kernel panic. The fix cancels the update-counters work before freeing memory. Evidence in the securit...

CVE-2023-53509

CVE-2023-53509 : In the Linux kernel qed_mcp_trace_dump() path, the code previously slept due to a 10µs-delayed loop in qed_mcp_cmd_and_union() which can spin up to 500k iterations, potentially blocking a thread for several seconds. The vulnerability description states that sleeping is permitted ...

CVE-2023-53621

CVE-2023-53621: Linux kernel memcg/memcontrol bug could cause a NULL pointer dereference during eviction if the memcg retrieved by the stored id is not the original one. Impact is local, with a high base score (7.8) and local access required. The issue stems from eviction recency checks in mem_cg...

CVE-2023-53631

CVE-2023-53631 — In Linux kernel, platform/x86 dell-sysman reference leak: if kset_find_obj() finds a duplicate attribute, a reference to that attribute can be returned and may not be disposed, potentially leaking references. Patch note: use kobject_put() to dispose the duplicate attribute. Affec...

CVE-2025-38564

CVE-2025-38564 involves the Linux kernel perf subsystem. The issue occurs in perf_mmap() when mapping a buffer read‑only into the page table after the buffer is allocated or attached. If map_range() fails, the kernel currently zaps the page table entries but does not invoke perf_mmap_close(), lea...

CVE-2025-38620

The CVE-2025-38620 vulnerability affects the Linux kernel’s zloop (zoned loop) device. It arises from a use-after-free in blk_mq_free_tag_set() during zloop removal: zloop_ctl_remove() frees zlo memory (via zloop_free_disk()) and then accesses zlo->tag_set, which now points to freed memory. Th...

CVE-2025-39722

The CVE-2025-39722 issue is in the Linux kernel crypto/caam suspend path for iMX8QM/iMX8ULP SoCs. Root cause: CAAM register access during suspend is reserved by SECO/OPTEE, causing suspend-time crashes unless page 0 is protected; a new state variable no_page0 tracks external reservations, and sus...

CVE-2025-39827

CVE-2025-39827 affects the Linux kernel’s rose networking path. The issue arises from two separate reference counting paths for rose_neigh: a numeric count from rose_node structures and a use/refcount_t from rose_sock. The patch merges these into a single lifecycle by incrementing/decrementing ro...

CVE-2025-39839

CVE-2025-39839 (Linux kernel) : In batman-adv network-coding decode, batman-adv NC code decodes skb data by XORing with coded_len without verifying the source skb length, only checking payload against destination skb length. This can produce a local out-of-bounds read and a small out-of-bounds wr...

CVE-2025-39846

CVE-2025-39846 : In the Linux kernel, a NULL pointer dereference could occur in PCMCIΑ code during resource allocation. Specifically, __iodyn_find_io_region() assigns pcmcia_make_resource() to res and uses it in pci_bus_alloc_resource(); if pcmcia_make_resource() fails, a dereference of res could...

CVE-2025-39858

The CVE-2025-39858 entry concerns a Linux kernel issue in mlx4_en_create_rx_ring where a NULL check after page_pool_create() could dereference an invalid pointer, since page_pool_create() returns ERR_PTR values. The fix replaces the NULL check with an IS_ERR() check to properly handle error point...

CVE-2025-39916

CVE-2025-39916 affects the Linux kernel DAMON subsystem (mm/damon/reclaim). The issue is a divide-by-zero in the calculation of min_age_region when creating a new DAMON_RECLAIM scheme, where aggr_interval is used as the divisor. The documented fix directly returns -EINVAL in this case, preventing...

CVE-2025-39961

CVE-2025-39961 (AMD IOMMU race in page tables) The Linux kernel AMD IOMMU host page table implementation could race when increasing page table levels. In iommu_v1_unmap_pages(), fetch_pte() could read pgtable->[root/mode] without a lock while increase_address_space() updates pgtable->[root/...

CVE-2025-68817

CVE-2025-68817 affects the Linux kernel ksmbd component. A use-after-free on a tree-connection object (tcon) can occur under high concurrency when a disconnect path frees the tcon while another path still holds a reference and later calls *_put()/write. The issue is addressed by a kernel fix in k...

CVE-2025-71071

In CVE-2025-71071, the Linux kernel iommu/mediatek driver had a use-after-free risk during probe deferral when larb devices were not yet bound. The issue arose from dropping references to larb devices taken during probe on success and on errors, potentially allowing a use-after-free if probe is d...

CVE-2025-71078

CVE-2025-71078 describes a Linux kernel fix for a SLB multihit issue on hash MMU POWERPC 64s. The root cause is a mismatch between the hardware SLB and the software preload cache when the kernel optimizes switch_mm_irqs_off by not calling switch_mmu_context() if prev and next mm_struct are the sa...

CVE-2025-71201

CVE-2025-71201 concerns the Linux kernel netfs subsystem, specifically a race/logic issue in buffered reads where read results could be collected beyond the intended EOF due to an end-check that used the file end rather than the folio end. The vulnerability manifests during asynchronous subreques...

CVE-2025-71269

CVE-2025-71269: The Linux kernel Btrfs fallback path for inline extents could free reserved qgroup data incorrectly when ENOSPC occurred. The fix ensures that reserved qgroup data is freed in __cow_file_range_inline() only if the fallback path is not taken (ret > 0). This change prevents freei...

CVE-2026-23091

CVE-2026-23091 concerns the Linux kernel intel_th subsystem, where a device-leak was reported during output open(). The description states to drop the reference taken when looking up the th device on errors and on close(). It notes that a recent commit fixed the leak in some open() error paths bu...

CVE-2026-23120

Technical details for CVE-2026-23120 are not provided in the connected documents. The Initial Description summarizes the race but does not specify affected products or fixes. Monitor vendor advisories for concrete remediation guidance.

CVE-2026-23137

CVE-2026-23137 (Linux kernel). In unittest_data_add() a memory leak could occur if of_resolve_phandles() failed, leaving unittest_data allocated. The fix uses a scope-based cleanup helper (__free(kfree)) to automatically free unittest_data on error paths, and retain_and_null_ptr() on the success ...

CVE-2026-23277

CVE-2026-23277 (TEQL NULL pointer dereference in iptunnel_xmit) is fixed in Linux kernel TEQL transmit path. When a GRE Gretap tunnel is TEQL slave, teql_master_xmit() transmits via netdev_start_xmit() without updating skb->dev to the slave. iptunnel_xmit then uses the original dev from skb-&g...

CVE-2026-23298

CVE-2026-23298 affects the Linux kernel can: ucan subsystem. A zero-length message on a broken ucan device causes an infinite loop in ucan_read_bulk_callback(), hanging the system. The issue is linked to a historical fix in the kvaser_usb driver (commit 0c73772cd2b8) addressing a similar infinite...

CVE-2026-23379

CVE-2026-23379 affects the Linux kernel net/sched ETS offload path. The root cause was an overflow in WRR weight computation (q_sum, q_psum) due to using 32-bit unsigned integers, which could lead to division by zero. The documented fix is to switch q_sum and q_psum to 64-bit integers, preventing...

CVE-2026-23393

CVE-2026-23393 – Linux kernel (bridge/cfm) race fix : A race during peer MEP deletion could occur because br_cfm_frame_rx() could re-schedule ccm_rx_dwork while peer_mep is freed under RCU, risking use-after-free. The fix replaces cancel_delayed_work_sync() with disable_delayed_work_sync() in bot...