CVE-2022-50252

CVE-2022-50252 affects the Linux kernel igb driver. The issue arises when memory pressure triggers kzalloc() failure: q_vector is freed but not cleared from adapter->q_vector[v_idx], risking a use-after-free. The available connected advisories confirm the fix was implemented to ensure that q_v...

CVE-2023-53147

The CVE-2023-53147 entry maps to a Linux kernel vulnerability in the IPsec XFRM subsystem: a NULL pointer dereference via xfrm_new_ae that could crash the kernel. The root cause is a missing NULL check when updating AE parameters; xfrm_update_ae_params could dereference a NULL x->replay_esn/x-...

CVE-2023-53166

CVE-2023-53166 is a Linux kernel race in the bq25890 charger driver. The external_power_changed callback dereferenced bq->charger before it was guaranteed to be set during power_supply_init, creating a potential NULL pointer dereference in early boot when the extcon power is detected. The vuln...

CVE-2026-53251

CVE-2026-53251: Linux kernel Bluetooth ISO path vulnerability where hci_get_route() leaks a reference-counted hci_dev pointer (via hci_dev_hold()) on exit, without releasing it. Documented as a resource leak that can contribute to a Denial of Service. Several advisories indicate patches exist (e....

CVE-2026-53278

CVE-2026-53278 affects the Linux kernel arm_mpam component. The vulnerability arises when __destroy_component_cfg() is invoked from mpam_disable() before the configuration array has been allocated, causing a NULL pointer dereference. The function frees the configuration array and mbwu_state; sinc...

CVE-2026-53318

The CVE-2026-53318 affects the Linux kernel wifi subsystem, specifically the mt76: mt7925 driver. A NULL pointer dereference in mt7925_tx_check_aggr() is addressed by moving the NULL check for 'sta' before it is dereferenced, which prevents a possible crash (DoS). This fix is described as resolve...

CVE-2026-53321

CVE-2026-53321 affects the Linux kernel io_uring/napi busy polling, where there was no cap on the maximum polling time when no events are found. The root cause is an unbounded busy_poll loop that can cause a task to be stuck, potentially leading to DoS-like unresponsiveness. Several connected sou...

CVE-2026-64079

CVE-2026-64079 is a NULL dereference in the Linux kernel's netfilter x_tables subsystem. The arp/ip(6)t_register_table() function adds a table to the per-netns list via xt_register_table() before allocating the per-netns hook ops copy, leaving a window where the table is visible with ops=NULL. If...

CVE-2026-64096

Summary of CVE-2026-64096 (Linux kernel, batman-adv): A use-after-free in batman-adv multicast origin node release was fixed. The function batadv_mcast_purge_orig() removed entries from RCU-protected hlists without waiting for an RCU grace period, risking access to freed memory by concurrent read...

CVE-2026-64104

CVE-2026-64104 (Linux kernel) affects virt: sev-guest where set_memory_encrypted()/set_memory_decrypted() can fail leaving pages in an unknown state, potentially unencrypted and not safely returnable to the buddy allocator. The provided documentation notes that to avoid this, the pages should not...

CVE-2026-64126

The CVE-2026-64126 entry concerns the Linux kernel Bluetooth MGMT path for Add Extended Advertising Data. A vulnerability exists where MGMT_OP_ADD_EXT_ADV_DATA is a variable-length command and the fixed-header size plus advertised data lengths are not validated against cp->data, allowing an ou...

CVE-2026-64168

Technical details for CVE-2026-64168 are not provided in the supplied documents. Public information (affected products, exploit status, remediation) is not available here. Monitor for official updates.

CVE-2026-64251

CVE-2026-64251 concerns a Linux kernel bug in the pwrseq core where use-after-free occurs in the pwrseq_debugfs_seq_next() path due to incorrect reference counting. The fix standardizes reference management across seq_file callbacks to prevent prematurely dropped references: start() now returns a...

CVE-2026-64263

CVE-2026-64263 affects the Linux kernel fuse-uring component. The issue arises when cancelled entries moved to ent_in_userspace are dereferenced by ent_list_request_expired(), causing a crash. The fix updates fuse_uring_cancel() to free the cancelled entry and drop queue_refs directly, ensuring s...

CVE-2026-64295

CVE-2026-64295 affects the Linux kernel mm/page_ext API used during memory hotplug. The vulnerability arises because page_ext_iter_next may advance the iterator beyond the current valid memory region without verifying that the PFN still belongs to a valid section, which can trigger a NULL pointer...

CVE-2026-64297

Summary (CVE-2026-64297): The Linux kernel vuln arises from not checking the return value of module_extend_max_pages() inside the decompression path. When initial allocation fails, info->pages is NULL and info->max_pages is 0. Subsequent calls to module_get_next_page() may call module_exten...

CVE-2026-64306

CVE-2026-64306 affects the Linux kernel 's crypto subsystem, specifically the CTR_DRBG (Counter-mode Deterministic Random Bit Generator) implementation. The function drbg_ctr_generate() sometimes returns success when it actually fails, leaving the output buffer uninitialized. This can lead to den...

CVE-2026-64313

The CVE describes a carry overflow in the Linux kernel crypto ECC vli multiplication routine. Specifically, the carry flag calculation fails when r01.m_high saturates and a lower-bit addition overflows, because the previous check (r01.m_high

CVE-2026-64409

CVE-2026-64409 is a denial-of-service vulnerability in the Linux kernel's btmtksdio Bluetooth SDIO driver. The root cause is an incorrect time_is_before_jiffies() check in btmtksdio_txrx_work(): the timeout condition is inverted, so once the 5-second limit is exceeded the loop condition becomes a...

CVE-2026-64440

CVE-2026-64440 (Linux kernel) : The vulnerability affects the rtl8723bs HT_capabilities handling in staging. HT_caps_handler() reads pIE->length bytes and writes into a fixed 26-byte HT_cap[]; since pIE->length is from an unvalidated 802.11 AssocResponse, an AP can set it to 255, causing up...

CVE-2022-49953

CVE-2022-49953 concerns the Linux kernel’s iio: light cm3605 driver. The issue is an error-handling path in cm3605_probe() that, after a fix, introduced a new error-path which should jump to the existing error-handling path to avoid resource leaks. The connected sources consistently describe this...

CVE-2022-50075

The CVE-2022-50075 entry concerns Linux kernel tracing/eprobes. A NULL pointer dereference can occur when a symbol "@" is used with an event probe, because eprobes previously did not handle data sources beyond main registers (e.g., immediate addresses, symbols, current task name). The issue is mi...

CVE-2022-50245

CVE-2022-50245 concerns a Linux kernel issue in the rapidio driver where a UAF can occur if kfifo_alloc() fails during mport_cdev_open(). The fix removes priv from the chdev->file_list before freeing it to prevent traversal from accessing a freed object (the smatch warning reference). Affected...

CVE-2022-50249

CVE-2022-50249 : Linux kernel memory subsystem flaw in the OF (Open Firmware) tree. The bug is a refcount leak in of_get_ddr_timings() caused by missing of_node_put() when exiting for_each_child_of_node(). The description states the fix is to add of_node_put() on exit, addressing refcount mismana...

CVE-2022-50279

CVE-2022-50279 affects the Linux kernel wifi rtlwifi driver (rtl8821ae/rtl8812ae). Root cause: _rtl8812ae_eq_n_byte() compared prate_section from tail to head, causing a global-out-of-bounds read when the value is HT, per KASAN. The fix: remove _rtl8812ae_eq_n_byte() and use strcmp() instead; thi...

CVE-2022-50285

CVE-2022-50285 tracks a Linux kernel vulnerability in the hugetlb subsystem where resv_huge_pages could be decremented outside the hugetlb_lock, risking a corrupted counter. The issue arises in alloc_huge_page’s corner case, creating a local (unprivileged) attack surface with a low attack complex...

CVE-2022-50299

CVE-2022-50299 is a Linux kernel issue in the md (multiple device) module where snprintf() could wrap around when the total length of the block device names with slashes exceeds 200, leading to incorrect buffer sizing. The vulnerability arises from using snprintf; the fix is to replace snprintf w...

CVE-2022-50318

The CVE-2022-50318 issue is in the Linux kernel perf/x86/intel/uncore: hswep_has_limit_sbox reference-count leak. The root cause is that pci_get_device() increments the reference count of the dev object, and pci_read_config_dword() uses it without decrementing; the fix adds pci_dev_put() immediat...

CVE-2022-50331

CVE-2022-50331 refers to a Linux kernel vulnerability in the wwan_hwsim subsystem. The description documents a memory leak in wwan_hwsim_dev_new() that can occur when probing a module if device_register() fails and the kobject refcount is not decremented to zero, leaking the name allocated in dev...

CVE-2022-50334

CVE-2022-50334: In the Linux kernel, hugetlbfs_parse_param() dereferenced param->string when a zero-length fs parameter could yield null, due to vfs_parse_fs_string setting string to NULL. This NULL-ptr-deref was triggered when illegal parameters like size=, were parsed. The fix adds a sanity ...

CVE-2022-50355

In CVE-2022-50355, the Linux kernel issue concerns the staging vt6655 driver. In initialization functions memory is allocated with 'i' as an index increasing from 0. The cleanup on allocation failure frees memory in reverse order, with 'i' decreasing to 0, but the i=0 case is not handled, causing...

CVE-2022-50387

The CVE-2022-50387 entry concerns a Linux kernel net: hinic issue where CMDQ memory leaks occur if hinic_set_cmdq_depth() fails during hinic_init_cmdqs(); the kernel patch fixes memory not being released. Affected component is the hinic CMDQ initialization path; remediation is the applied fix in ...

CVE-2022-50395

CVE-2022-50395 is a Linux kernel vulnerability where a memory leak occurs if keyring allocation fails in the integrity subsystem. The issue is triggered in integrity_init_keyring() when a keyring allocation error path is taken and the allocated key restriction is not freed. The connected advisori...

CVE-2022-50423

CVE-2022-50423 affects the Linux kernel ACPICA code path where acpi_ut_copy_ipackage_to_ipackage() can free an acpi_operand_object and later reuse it due to a failed acpi_ut_walk_package_tree() path. The root cause is use-after-free from a memory-management sequence that repeatedly released the s...

CVE-2022-50436

CVE-2022-50436 : Linux kernel ext4 had a deadlock risk when ext4_unlink() extended the jbd2 transaction scope, because ext4_find_entry() could require setting up the directory encryption key inside a transaction. The fix restores the transaction to its original scope, preventing the deadlock. The...

CVE-2022-50441

CVE-2022-50441 details (Linux kernel, net/mlx5): A bug introduced by commit 0d4e8ed139d8 removed a call to cancel_delayed_work_sync(), which could cause a queued delay to expire on an already destroyed workqueue, potentially leading to a kernel NULL pointer dereference. The fix restores cancel_de...

CVE-2022-50442

The CVE-2022-50442 entry describes a Linux kernel NTFS3 issue where indx_read did not sufficiently validate index buffer length during parsing, enabling a potential out-of-bounds memory access (observed as a slab-out-of-bounds read under KASAN). The vulnerability is tied to NTFS directory operati...

CVE-2022-50448

CVE-2022-50448 involves the Linux kernel mm/uffd path where PTE_MARKER_UFFD_WP was not guarded, allowing a reachable warning when PTE_MARKER_UFFD_WP was not configured. The fix adds CONFIG_PTE_MARKER_UFFD_WP specific ifdefs to ensure the code is not executed in builds without the option. Impact d...

CVE-2022-50472

CVE-2022-50472 is a Linux kernel issue where a call to a function that may sleep (ib_query_pkey) occurred in atomic context, potentially triggering a sleeping operation during trace buffer commits. The description notes a kernel warning and a trace of the ib_core path leading to a crash. The vuln...

CVE-2022-50478

The CVE-2022-50478 issue affects the Linux kernel nilfs2 code. When an on-disk superblock block size exponent is corrupted, nilfs_sb2_bad_offset can trigger a shift-out-of-bounds warning and a kernel panic at mount time. The fix series adds preliminary sanity checks and changes the risky computat...

CVE-2022-50483

CVE-2022-50483 concerns a Linux kernel issue in the net: enetc path where, on XDP redirects, a page reference counting race could leak pages. The root cause: enetc_flip_rx_buff() could be executed before xdp_do_redirect() completes, causing page refcounts to reach 2 (or 0 on some paths) and enabl...

CVE-2022-50514

CVE-2022-50514 concerns the Linux kernel’s usb gadget f_hid path. The vulnerability arises from a refcount leak on the error path when report_desc allocation fails: opts->refcnt has already been incremented and must be decremented to avoid leaving the options structure permanently locked. The ...

CVE-2022-50519

CVE-2022-50519 relates to the Linux kernel nilfs2 checkpoint handling. The affected code path was: checkpoint acquisition/finalization may trigger kernel WARN_ONs for anomalies in on-disk checkpoint metadata. The patch replaces WARN_ONs with nilfs_error, so a kernel booted with panic_on_warn no l...

CVE-2022-50523

The CVE-2022-50523 issue affects the Linux kernel, specifically the Rockchip clock driver (clk: rockchip). The vulnerability arises in rockchip_clk_register_pll() where, on clk_register() failure, pll->rate_table may have been allocated via kmemdup() and is not freed, causing a memory leak. Th...

CVE-2022-50540

CVE-2022-50540 affects the Linux kernel’s dmaengine qcom-adm driver. The root cause is a faulty slave_config implementation that compared peripheral_size against the size of the config pointer instead of the config struct, causing the crci value to be ignored and potentially triggering a kernel p...

CVE-2023-53184

The CVE-2023-53184 entry concerns a Linux kernel vulnerability in arm64 SME (SVE state handling). The root cause is that the vector length is updated after allocating the SVE state, causing allocation with the old length and potential memory corruption from an undersized buffer. The fix moves the...

CVE-2023-53192

The CVE-2023-53192 issue affects the Linux kernel vxlan nexthop code where a 32-bit hash returned by skb_get_hash() is used where a 31-bit hash is expected. This can cause int hash to become negative and trigger incorrect nexthop selection or out-of-bounds access in nh_buckets[], risking a kernel...

CVE-2023-53205

CVE-2023-53205 affects the Linux kernel KVM on s390, specifically the diag 9c handler where a race exists around the target CPU value (-1). The fix stores the physical target CPU in a local variable to prevent out-of-bounds accesses to CPU arrays. The CVE’s risk is described as high (CVSS v3.1: A...

CVE-2023-53215

CVE-2023-53215 affects the Linux kernel sched/fair component. The issue occurs when the load balancer tries to migrate a task that is migration-disabled to its current CPU, triggering a warning in set_task_cpu() during balance. The root cause is how the new_dst_cpu is selected from env->dst_gr...

CVE-2023-53237

Summary: CVE-2023-53237 relates to the AMDGPU driver in the Linux kernel, where an improper call to amdgpu_irq_put during gmc_v11_0_hw_fini led to an unnecessary call trace. The root cause is that gmc.ecc_irq is enabled by firmware via IFWI, and the host driver isn’t privileged to enable/disable ...