CVE-2026-64146

The Linux kernel's EROFS filesystem has a memory leak in erofs_init_inode_xattrs(): after commit bb88e8da0025 converted xattr operations to on-stack erofs_buf instances, certain error paths after erofs_read_metabuf() exit through out_unlock without dropping the metabuf, leaking folio references. ...

CVE-2026-64216

CVE-2026-64216: Linux kernel netfs UAF fix. The issue occurs in netfs_unlock_abandoned_read_pages() (and netfs_unlock_read_folio()) where the code dereferenced an index after NETFS_RREQ_IN_PROGRESS was cleared, risking access to the folio protected by no_unlock_folio. The fix stores the folio poi...

CVE-2026-64243

CVE-2026-64243 (Linux kernel, ASoC codecs: simple-mux) A fix was applied to correct the bounds check in simple_mux_control_put for enum controls. Previously the code rejected values greater than e->items, but enum controls are zero-based, making 0 and 1 valid for a two-entry mux and 2 should b...

CVE-2026-64311

The CVE concerns the Linux kernel: crypto: loongson - Remove broken and unused loongson-rng. The loongson-rng rng_alg reportedly has forward-security issues and a use-after-free bug linked to wait_for_completion_interruptible(), and the rng_alg framework is largely unused in-kernel. The advisory ...

CVE-2026-64317

CVE-2026-64317 affects the Linux kernel isofs Rock Ridge SL handling. A crafted Rock Ridge SL record can declare a component length that runs past the SL record, causing an out-of-bounds read of up to 255 bytes during parsing in get_symlink_chunk() and parse_rock_ridge_inode_internal(). This can ...

CVE-2026-64337

CVE-2026-64337 affects the Linux kernel's USB MTU3 gadget driver . The function mtu3_gadget_queue() maps the request DMA before checking whether the QMU GPD ring can accept another transfer. When mtu3_prepare_transfer() fails, the request is returned with -EAGAIN but the DMA mapping is never unma...

CVE-2022-49947

CVE-2022-49947: Linux kernel binder null-ptr dereference in alloc->vma_vm_mm. Connected reports confirm a fix: initialize alloc->vma_vm_mm during open() and cache from current->mm to guarantee safe mmap_lock usage when a binder_proc has not mmap’d to set up alloc space. Descriptions deta...

CVE-2022-49976

CVE-2022-49976 relates to Linux kernel code for x86 Android tablet handling, specifically the Chuwi Hi8 touchscreen issue. The vulnerability stems from the x86_android_tablets path calling x86_acpi_irq_helper_get() which may invoke acpi_unregister_gsi(), leading to touchscreen malfunctions and ke...

CVE-2022-50013

Summary: CVE-2022-50013 relates to the f2fs (Flash-Friendly File System) code in the Linux kernel. The issue arises from a NAT/NAT bitmap inconsistency that can cause a BUG_ON() in f2fs_new_node_page() when a NAT entry’s blkaddr is not NULL_ADDR while its NAT bitmap marks it free. The vulnerabili...

CVE-2022-50239

CVE-2022-50239 refers to a Linux kernel issue in the cpufreq: qcom driver where a string literal stored in read-only memory was used as a destination for snprintf, causing an oops by writing into RO memory. The root cause was using a char *pvs_name pointing to a RO string and attempting snprintf(...

CVE-2022-50252

CVE-2022-50252 affects the Linux kernel igb driver. The issue arises when memory pressure triggers kzalloc() failure: q_vector is freed but not cleared from adapter->q_vector[v_idx], risking a use-after-free. The available connected advisories confirm the fix was implemented to ensure that q_v...

CVE-2022-50260

CVE-2022-50260 concerns the Linux kernel DRM MSM driver where .remove and .shutdown callbacks run via different code paths, creating a risk of calling drm_atomic_helper_shutdown() on an uninitialized DRM device. The initial description explains this mismatch can trigger kernel panics, especially ...

CVE-2022-50274

CVE-2022-50274 : In the Linux kernel, a use-after-free in dvb_unregister_device() was mitigated by adding a reference counter to struct dvb_device and delaying deallocation until no pointers reference the object. The vulnerability stemmed from cleanup releasing the dvb_device while file->priva...

CVE-2022-50283

In the Linux kernel, CVE-2022-50283 is due to a missing of_node_get() in the dynamic partitions code, causing an unbalanced of_node_put() and a use-after-free in refcount handling during MTD partition parsing on gpmi-nand. The issue manifested in traces such as refcount_t: addition on 0; use-afte...

CVE-2022-50286

The CVE-2022-50286 issue affects the Linux kernel ext4 file system in scenarios where bigalloc and inline options are used simultaneously. The root cause is in ext4_clu_mapped: when converting inline-stored data to extents, the code may search the (non-existent) extent tree to decide if a block s...

CVE-2022-50309

CVE-2022-50309 : Linux kernel vulnerability in media: xilinx: vipp, fixed in the commit that adds balance for refcount in xvip_graph_dma_init. The issue arises because of_get_child_by_name() returns a node pointer with its refcount incremented, and there was no corresponding of_node_put() when th...

CVE-2022-50313

Summary: CVE-2022-50313 affects the Linux kernel (EROF S subsystem). The root cause is that the i_size field is signed; crafted negative i_size can be interpreted as a fast symlink, triggering an order = MAX_ORDER warning. The fix changes the handling to fall back to the generic path for such unu...

CVE-2022-50314

The CVE-2022-50314 issue affects the Linux kernel nbd subsystem. When a signal interrupts nbd_start_device_ioctl() while waiting for inflight I/Os to complete, a hung task could occur. The fix clears the queue (not just shutdown) on signal interruption to nbd_start_device_ioctl(), mitigating the ...

CVE-2022-50326

CVE-2022-50326 relates to a memory leak in the Linux kernel’s media: airspy probe. The root cause is that a variable buf was moved from stack to heap by commit ca9dc8d06ab6, but deallocation was only present in the error path, not the success path. Consequently, buf can leak in the success path. ...

CVE-2022-50346

CVE-2022-50346 is a Linux kernel ext4 issue where ext4_rename may modify old.inode’s ctime and trigger quota/extra_isize expansion, potentially allocating blocks and emitting a quota-related warning. The root cause involves ext4_xattr handling during a rename, with syzbot traces showing s_want_ex...

CVE-2022-50349

The connected advisories for CVE-2022-50349 describe a Linux kernel memory-leak fix in tifm: tifm_7xx1_switch_media. If device_register() fails, the kobject name allocated in dev_set_name() during device_add() is leaked. The recommended remediation is not to free @dev after device_register(), and...

CVE-2022-50384

CVE-2022-50384 is a Linux kernel vulnerability in staging/vme_user (tsi148_dma_list_add) where an error path could free an entry without removing it from list->entries, risking use-after-free. The connected documents confirm the root cause is the failure to remove &entry->list from list-&gt...

CVE-2022-50385

CVE-2022-50385 affects the Linux kernel NFS automount path: when mounting from an NFSv4 referral, path->dentry can become a negative dentry, so the fix derives the struct nfs_server from the dentry itself. The vulnerability is an Oops (local impact) and is resolved in the kernel by this change...

CVE-2022-50398

The CVE-2022-50398 entry affects the Linux kernel DRM MSM display path (drm/msm/dp). A race in commit_tail/drm_release could allow an extra frame to be pushed downstream when the display interface is down, causing dp_bridge_disable() to access the main link register with clocks disabled and trigg...

CVE-2022-50416

CVE-2022-50416 concerns the Linux kernel’s irqchip/wpcm450 module. The vulnerability is a memory leak in wpcm450_aic_of_init(): if of_iomap() fails, the allocated memory for 'aic' must be freed before return. The issue is resolved in the provided documents; the root cause is the missing free path...

CVE-2022-50418

CVE-2022-50418 concerns the Linux kernel wifi path, specifically the ath11k MHI workflow. The issue: when mhi_alloc_controller() allocates mhi_ctrl and ath11k_mhi_read_addr_from_dt() fails, the code path returns without freeing the allocated controller, causing a memory leak. The documented fix a...

CVE-2022-50456

Linux kernel vulnerability CVE-2022-50456 (btrfs): when a file has an inline extent followed by a regular/prealloc extent, resolving a logical address in the non-inline region could read an invalid offset and trigger a panic (general protection fault). A fix was implemented by detecting the inlin...

CVE-2022-50458

CVE-2022-50458 : In the Linux kernel, the clk/tegra path (tegra210_clock_init) leaked a refcount. The bug was that of_find_matching_node() returned a node with a refcount that was not released with of_node_put(). The fix adds the missing of_node_put() to avoid the leak and resolve the vulnerabili...

CVE-2022-50538

CVE-2022-50538 pertains to the Linux kernel VME subsystem. In fake_init(), __root_device_register() may fail and the error is not handled, which can cause unregistering vme_root during exit to fail, potentially yielding a general protection fault and a null-ptr-deref (non-canonical address 0xdfff...

CVE-2023-53201

CVE-2023-53201: In Linux kernel RDMA/bnxt_re, the producer index for the mailbox could wrap around incorrectly; when the 0x80000000 bit (bit 31) was set after long runtimes, the FW could enter initialization and hang. The fix is to wrap the mbox producer index at u16 max instead of allowing u32 w...

CVE-2023-53207

CVE-2023-53207 applies to the Linux kernel ublk subsystem. The issue arises in ublk_ctrl_end_recovery: if wait_for_completion_interruptible() is interrupted by a signal, queues aren’t yet fully set up, so the kernel must fail UBLK_CMD_END_USER_RECOVERY to avoid a kernel oops. The CVSS 3.1 data in...

CVE-2023-53231

The CVE-2023-53231 entry concerns the Linux kernel erofs subsystem. The vulnerability stems from incorrect detection of atomic context when z_erofs_decompressqueue_endio can be invoked under an RCU/lock context (e.g., from blk_mq_flush_plug_list). The patch updates the context check to rcu_read_l...

CVE-2023-53235

CVE-2023-53235: In the Linux kernel, a use-after-free can occur in drm_dev_put() during device-managed cleanup when a driver is freed after kunit-managed resources. The root cause is dereferencing a driver that has become freed due to mismatched resource lifetimes (driver allocated as kunit-manag...

CVE-2023-53237

Summary: CVE-2023-53237 relates to the AMDGPU driver in the Linux kernel, where an improper call to amdgpu_irq_put during gmc_v11_0_hw_fini led to an unnecessary call trace. The root cause is that gmc.ecc_irq is enabled by firmware via IFWI, and the host driver isn’t privileged to enable/disable ...

CVE-2023-53238

In MODE C: The CVE-2023-53238 issue affects the Linux kernel’s Hisilicon Inno PHY code. The flaw is an out-of-bounds write in the probe path: priv->ports[] has size INNO_PHY_PORT_NUM, but the loop uses i with a comparison that allows i == INNO_PHY_PORT_NUM; this requires the check to be i >...

CVE-2023-53289

The CVE-2023-53289 issue affects the Linux kernel, specifically the media/bdisp component. The root cause is a missing check for the return value of create_workqueue, which could lead to a NULL pointer dereference. The publicly available connected documents confirm a fix that adds the necessary c...

CVE-2023-53302

CVE-2023-53302 affects the Linux kernel wifi iwl4965 driver. The vulnerability stems from a missing check of the return value of create_singlethread_workqueue(), which can lead to a NULL pointer dereference. The provided connected documents confirm the fix was applied in the kernel to add the nec...

CVE-2023-53307

CVE-2023-53307: In the Linux kernel rbd subsystem, do_rbd_add() can trigger a use-after-free if rbd_dev_create() fails after transferring ownership of rbd_dev fields (rbd_client, spec, opts) to the rbd_dev. The root cause is that these structures are freed when rbd_dev_create() calls rbd_dev_free...

CVE-2023-53338

CVE-2023-53338 affects the Linux kernel’s lwt/BPF xmit path. The vulnerability arises from BPF encap/xmit return values being misinterpreted by the xmit hook, causing use-after-free and kernel crashes as freed SKBs reach the neighbor subsystem. The supplied advisories indicate a fix that discards...

CVE-2023-53385

The CVE-2023-53385 issue relates to the Linux kernel: media: mdp3: Fix resource leaks in of_find_device_by_node. The fix adds release of the object obtained via of_find_device_by_node using put_device to prevent leaks. Public references point to upstream commits implementing this change. If explo...

CVE-2023-53392

In the Linux kernel, CVE-2023-53392 describes a fix for a kernel panic in the intel-ish-hid/ISHTP path during warm resets. If a bus driver is registered after device->fw_client is set to NULL and before new firmware clients are enumerated, ishtp_cl_bus_match() dereferences device->fw_client...

CVE-2023-53403

CVE-2023-53403: Linux kernel vulnerability in time/debug causing potential memory leak when using debugfs_lookup(). The issue arises because the result of debugfs_lookup() must be dput()-ed; if not, memory leaks occur over time. The documented mitigation is to replace the call with debugfs_lookup...

CVE-2023-53423

CVE-2023-53423 is a Linux kernel vulnerability resolved by a fix in objtool. The issue is a memory leak: strdup() allocates memory for key_name and the code path handling errors does not free it, leading to leaks in create_static_call_sections(). The connected advisories (EulerOS/Nessus entries) ...

CVE-2023-53474

In CVE-2023-53474, the Linux kernel’s x86 MCE AMD code fixed an overflow in bank_map by switching from unsigned int to u64 and using BIT_ULL when manipulating bits. The MCA bank count is 64 (MAX_NR_BANKS), and the previous 32-bit bank_map could shift past 32, triggering UBSAN shift-out-of-bounds....

CVE-2023-53480

CVE-2023-53480 : In the Linux kernel, a o bject-level NULL-dereference can occur when registering a kset if its embedded kobject’s ktype is not initialized. The described scenario initializes a kset and its kobject name but omits kset.kobj.ktype, leading to a NULL pointer dereference in kobject_a...

CVE-2023-53487

CVE-2023-53487 concerns the Linux kernel under POWERPC: the powerpc/rtas_flash path allowed a user to copy memory into flash_block_cache objects when hardened usercopy is enabled (CONFIG_HARDENED_USERCOPY=y). The flaw is triggered via the /proc/powerpc/rtas/firmware_update interface, causing a ke...

CVE-2023-53529

CVE-2023-53529 : In the Linux kernel, the wifi driver stack (rtw88) had a memory leak in the USB probe path (rtw_usb_probe) that can leak memory via a kmemleak-detected allocation during USB device init. The leak is tied to a 512-byte allocation in the usb probe routine and was verified as real w...

CVE-2023-53532

CVE-2023-53532 concerns the Linux kernel/ath11k on AHB WLAN hardware. The issue arises during deinitialization of firmware resources for chipsets with non-fixed firmware memory when TrustZone is not present. The code path unmapped memory that was never mapped during initialization, leading to a k...

CVE-2023-53537

Summary: CVE-2023-53537 concerns a Linux kernel F2FS use-after-free involving a cached IPU bio. Root cause: after cp_error is set, f2fs_submit_merged_ipu_write() failed to validate the bio parameter in f2fs_write_single_data_page(), leading to submission of a random cached bio from another IO con...

CVE-2023-53604

CVE-2023-53604: In the Linux kernel, the dm_integrity component may leak journal_io_cache if dm_register_target() fails due to an error path that calls kmem_cache_destroy() in dm_integrity_init(). This root cause is documented in the initial report as a resolution for the leak in journal_io_cache...