CVE-2023-53607

CVE-2023-53607 involves the Linux kernel ALSA ymfpci driver. The bug is caused by snd_ymfpci_probe using snd_BUG_ON() with snd_dma_buffer.bytes that were not accounting for the aligned size, leading to a faulty check and a kernel warning in snd_ymfpci_create. The issue manifests as a local, low-p...

CVE-2023-53620

The issue CVE-2023-53620 affects the Linux kernel md (mdadm) status_resync logic. status_resync() reads curr_resync and recovery_active concurrently, which can cause an overflow in the expression curr_resync - recovery_active and lead to an extremely long loop that results in a soft lockup. The f...

CVE-2023-53622

Summary of CVE-2023-53622 (Linux kernel, gfs2): A data race can occur in gfs2_show_options() when accessing fields of gfs2_tune (eg, gt_logd_secs) without holding the gt_spin lock, allowing concurrent execution with gfs2_reconfigure() to race. The fix acquires the lock (sdp->sd_tune.gt_spin) b...

CVE-2023-53625

CVE-2023-53625 : In the Linux kernel, the vgpu debugfs cleanup path for drm/i915/gvt could dereference a null or destroyed debugfs root while destroying a virtual GPU, causing a kernel NULL pointer dereference and an oops. The issue occurs in remove paths where the drm minor’s debugfs root may al...

CVE-2023-53627

CVE-2023-53627 affects the Linux kernel SCSI driver histi_sas. The root cause is a race on sas_dev.list traversal during slot freeing in dereg_device_v3_hw() and hisi_sas_release_tasks(), which can trigger a NULL pointer dereference and kernel panic. The mitigation is to grab the sas_dev lock whi...

CVE-2023-53630

CVE-2023-53630 is a Linux kernel issue in the IOMMU driver (iommufd) where unpinning pages during unmapping could corrupt pages that were never mapped. The provided reports describe that the bug stems from an incorrect calculation of batch_last_index in iopt_area_unfill_domain, which should be dr...

CVE-2023-53642

The CVE-2023-53642 entry relates to the Linux kernel (x86) where the clear_user_rep_good() exception handling annotation was fixed. The issue stemmed from an incorrect exception-table annotation that pointed to the wrong instruction, which could turn a user-space fault into a kernel oops rather t...

CVE-2023-53650

CVE-2023-53650 : In the Linux kernel, the fbdev: omapfb lcd_mipid path fixes an error path in mipid_spi_probe. If mipid_detect() fails, the code must free the allocated md to avoid a memory leak. Affects the fbdev/omapfb mipid probe code; underlying impact is a potential memory leak on failure. T...

CVE-2023-53659

CVE-2023-53659 : Linux kernel iavf driver fix for an out-of-bounds write when setting channels during remove. The issue could cause the number of active queues to exceed allocated tx/rx_rings on iavf_remove(), leading to an OOB condition. Reproduction in the report shows a KASAN slab-out-of-bound...

CVE-2023-53661

CVE-2023-53661 affects the Linux kernel bnxt driver. The issue is an arithmetic overflow in bnxt_get_nvram_directory() caused by the use of a multiplication macro instead of casting operands to a larger type when performing arithmetic. The vulnerability could enable an overflow condition within t...

CVE-2023-53676

The CVE-2023-53676 vulnerability affects the Linux kernel’s iSCSI target (lio_target_nacl_info_show) where printf-style buffer handling in a loop could overflow a configfs buffer. Root cause: sprintf() used without bounds checking for each iSCSI connection, enabling memory corruption with many co...

CVE-2023-53685

The CVE-2023-53685 issue affects the Linux kernel tun driver when a TUN device is configured with IFF_TUN, IFF_NAPI, and IFF_MULTI_QUEUE and the queue is detached while a write happens. A memory leak can occur by enqueuing skbs into tfile->sk_write_queue after the queue is detached, due to a r...

CVE-2023-54207

CVE-2023-54207 affects the Linux kernel HID: uclogic driver. The root cause is using the input_dev name’s devm allocation instead of referencing the HID device, which could lead to a use-after-free when the input_dev is unregistered and a uevent depending on its name fires. The fix switches to re...

CVE-2025-38017

CVE-2025-38017 affects the Linux kernel, specifically the fs/eventpoll path used by epoll_pwait2. After the fix in the commit described as setting epoll timeout when in the future, a non-zero timeout (e.g., 1 ns) could cause an endless busy loop if the timeout expires before ep_poll() is entered,...

CVE-2025-38327

The CVE-2025-38327 issue concerns the Linux kernel function graph tracing (fgraph) when the funcgraph-args option is used. The root cause described across provided documents is that if function_graph tracing is enabled while funcgraph-args is set, it may be incorrectly re-enabled and then unregis...

CVE-2025-38432

CVE-2025-38432 relates to the Linux kernel netpoll path, where the UDP checksum field (udph->check) was not initialized before checksumming. This followed a commit (f1fce08e63fe) that eliminated a redundant initialization, which inadvertently broke IPv6 netpoll transmission due to incorrect ch...

CVE-2025-39740

The CVE-2025-39740 entry concerns a Linux kernel vulnerability in the DRM XE migration path. It describes a potential use-after-free (UAF) scenario if a fence_wait is performed after the previous fence has already been put(), on the error path. The fix changes the control flow so that the put() i...

CVE-2025-39784

CVE-2025-39784 is a Linux kernel PCIe issue resolved by masking non-speed bits in PCIE_LNKCTL2_TLS2SPEED() (and PCIE_LNKCAP_SLS2SPEED()) when retraining a PCIe link. The bug caused incorrect speed values to be interpreted from the Link Control 2 register, producing PCI_SPEED_UNKNOWN (0xff) and tr...

CVE-2025-39894

The CVE-2025-39894 issue is in the Linux kernel netfilter br_netfilter path: br_nf_local_in() confirms conntrack during handling of a broadcast to a tap device added to a bridge. If another conntrack with the same hash is added, a warning can be emitted. The root cause is br_nf_local_in() using t...

CVE-2025-39939

The CVE-2025-39939 issue affects the Linux kernel (iommu/s390) where zpci_get_iommu_ctrs() could read a bad address for identity-domain devices, causing memory corruption. The root cause is that identity domains are not backed by an s390_domain, leading to an invalid to_s390_domain() result and o...

CVE-2025-39940

CVE-2025-39940 concerns the Linux kernel’s dm-stripe component. A potential integer overflow can occur in stripe_io_hints when the chunk size is too large. The fix tests for an overflow and, if detected, avoids setting limits->io_min and limits->io_opt. This mitigates a local-privilege vect...

CVE-2025-68358

CVE-2025-68358 (Linux kernel, btrfs) : A race condition was fixed in btrfs_clear_space_info_full() that updated bitfield members (full, chunk_alloc, flush) without holding the space_info lock, risking corruption of adjacent fields due to non-atomic read-modify-write sequences on bitfields. The fi...

CVE-2025-71079

CVE-2025-71079 concerns a Linux kernel deadlock between nfc_unregister_device() and rfkill_fop_write() caused by lock-order inversion (device_lock vs rfkill_global_mutex). The fix moves rfkill_unregister() and rfkill_destroy() outside the device_lock section, storing the rfkill pointer in a local...

CVE-2025-71108

CVE-2025-71108 refers to a Linux kernel vulnerability in the USB Type-C UCSI handling. The underlying issue is that the 8th bit of the num_connectors field is reserved and should be zero, but some buggy firmware sets it, which can cause a system to fail to boot. The description notes that the ker...

CVE-2025-71117

CVE-2025-71117 corresponds to a Linux kernel fix that removes queue freezing from several sysfs store callbacks to prevent deadlocks (notably with dm-multipath and the queue_if_no_path option). Affected sysfs attributes include io_poll_delay, io_timeout, nomerges, read_ahead_kb, and rq_affinity. ...

CVE-2025-71123

CVE-2025-71123 affects the Linux kernel Ext4 mount option parsing. The vulnerability stems from improper string copying in parse_apply_sb_mount_options(), where strscpy_pad() could copy a non-NUL-terminated string into a fixed-size destination, triggering fortify warnings (strnlen: detected buffe...

CVE-2025-71125

CVE-2025-71125 affects the Linux kernel tracing subsystem. Synthetic events lack a function to register perf events, causing a NULL function pointer to be passed to tracepoint register logic and triggering a kernel warning in tracepoint_add_func. The patch replaces this path with a -ENODEV return...

CVE-2025-71127

The CVE-2025-71127 issue concerns the Linux kernel mac80211 handling of Beacon frames. A unicast Beacon frame could bypass beacon protection when the Protected Frame bit is 1, potentially allowing targeted actions on a specific STA. The documented fix is a policy change to drop Beacon frames addr...

CVE-2025-71136

CVE-2025-71136 affects the Linux kernel’s media: adv7842 path. The vulnerability arises when cp_read() or hdmi_read() return -EIO and these values are used as indexes in arrays within adv7842_cp_log_status(), causing possible out-of-bounds accesses. The issue is resolved by adding checks on retur...

CVE-2025-71146

The CVE-2025-71146 entry concerns Linux kernel netfilter nf_conncount, where a ct (connection tracking) reference could be leaked on some error paths because the refcounted check was skipped. The published description states the issue and that it is resolved by ensuring the check is always perfor...

CVE-2025-71153

Technical details for CVE-2025-71153 are not publicly available in the provided connected documents. Monitor for updates from security advisories and vendor PSNs to obtain affected products, impact, and remediation.

CVE-2025-71201

CVE-2025-71201 concerns the Linux kernel netfs subsystem, specifically a race/logic issue in buffered reads where read results could be collected beyond the intended EOF due to an end-check that used the file end rather than the folio end. The vulnerability manifests during asynchronous subreques...

CVE-2025-71236

CVE-2025-71236 is documented in connected sources as a Linux kernel vulnerability affecting the SCSI driver path for qla2xxx. The issue centers on a potential NULL pointer dereference when freeing memory associated with an SP (scsi request) in error paths, which can cause a system crash. The prov...

CVE-2025-71269

CVE-2025-71269: The Linux kernel Btrfs fallback path for inline extents could free reserved qgroup data incorrectly when ENOSPC occurred. The fix ensures that reserved qgroup data is freed in __cow_file_range_inline() only if the fallback path is not taken (ret > 0). This change prevents freei...

CVE-2025-71273

The CVE-2025-71273 entry concerns the Linux kernel’s rtw88 Wi‑Fi driver. The issue arises from a memory leak in rtw_register_hw(), where memory allocated for supported bands was not freed on error paths. The patch standardizes memory allocation using device-managed memory (devm_kmemdup()) in rtw_...

CVE-2025-71314

In the Linux kernel, the drm/panthor component was updated to recover from panthor_gpu_flush_caches() failures that could block the memory subsystem. The fix introduces a reset path to recover when flush operations hang, and resets pending_reqs so new commands can be issued after a reset. If addi...

CVE-2026-22995

The CVE concerns a Linux kernel race in ublk_partition_scan_work that can cause a use-after-free of ub->ub_disk due to a race between async partition scanning and device teardown. The vulnerability occurs when ublk_ctrl_start_dev() schedules partition_scan_work after add_disk(), and ublk_stop_...

CVE-2026-23148

CVE-2026-23148 describes a race in the Linux kernel’s nvmet path where a completed bio can be re-submitted and dereferenced after bio_uninit() clears bio->bi_blkg, leading to a NULL pointer dereference in blk_cgroup_bio_start(). The race occurs when nvmet_bio_done() and nvmet_req_complete() in...

CVE-2026-23186

CVE-2026-23186 pertains to the Linux kernel hwmon driver for the ACPI power meter. The issue arises when acpi_power_meter_notify() calls hwmon_device_unregister() while holding a lock also acquired by sysfs callbacks, creating potential deadlocks between sysfs access and device removal. Fixes inc...

CVE-2026-23298

CVE-2026-23298 affects the Linux kernel can: ucan subsystem. A zero-length message on a broken ucan device causes an infinite loop in ucan_read_bulk_callback(), hanging the system. The issue is linked to a historical fix in the kvaser_usb driver (commit 0c73772cd2b8) addressing a similar infinite...

CVE-2026-23332

The CVE-2026-23332 issue affects the Linux kernel cpufreq/ intel_pstate driver. When booted with nosmt or maxcpus and attempting to disable turbo via /sys/devices/system/cpu/intel_pstate/no_turbo, a NULL pointer dereference can occur because for_each_possible_cpu() may consider offline CPUs and a...

CVE-2026-23360

CVE-2026-23360 relates to the Linux kernel nvme subsystem where, during a controller reset, nvme_alloc_admin_tag_set() could leave a previous admin queue alive, risking an orphaned queue. The issue is fixed by releasing the old queue before allocating a new one, mitigating the leak. Multiple conn...

CVE-2026-23379

CVE-2026-23379 affects the Linux kernel net/sched ETS offload path. The root cause was an overflow in WRR weight computation (q_sum, q_psum) due to using 32-bit unsigned integers, which could lead to division by zero. The documented fix is to switch q_sum and q_psum to 64-bit integers, preventing...

CVE-2026-23429

The CVE-2026-23429 issue affects the Linux kernel IOMMU/SVA subsystem. The root cause is that after iommu_domain_free() returns, code may dereference domain->mm->iommu_mm, which can lead to a crash. The published fix moves the access to domain->mm->iommu_mm to before the call to iommu...

CVE-2026-23430

The CVE-2026-23430 issue affects the Linux kernel DRM/vmwgfx component, where the KMS surface dirty tracker was being overwritten, leading to a memory leak. The vulnerability has been resolved in the kernel by correcting this behavior. Connected sources confirm the root cause and the fix are impl...

CVE-2026-23439

The CVE-2026-23439 entry describes a Linux kernel issue in udp_tunnel where, if CONFIG_IPV6 is disabled, udp_sock_create6() can return success without creating a socket. This leads to a NULL pointer dereference when callers like fou_create() dereference the uninitialized socket pointer, causing a...

CVE-2026-31409

CVE-2026-31409 affects the Linux kernel ksmbd component. A multichannel SMB2_SESSION_SETUP with SMB2_SESSION_REQ_FLAG_BINDING could fail, but ksmbd did not clear conn->binding on the error path, leaving the connection in a binding state. This caused ksmbd_session_lookup_all() to fall back to t...

CVE-2026-31417

The CVE-2026-31417 issue affects the Linux kernel’s net/x25 implementation. Affected component: x25_sock.fraglen can overflow during packet accumulation, with the root cause involving missing overflow checks and an incorrect fraglen reset when fragment_queue is purged in x25_clear_queues(). The p...

CVE-2026-31423

The CVE-2026-31423 issue affects the Linux kernel’s net/sched sch_hfsc; rtsc_min() can divide by a value derived from the difference of large u64 slopes, risking a divide-by-zero when the difference equals 2^32. The fix widens the internal counter to u64 and replaces do_div() with div64_u64() to ...

CVE-2026-31434

CVE-2026-31434 affects the Linux kernel's btrfs subsystem. The root cause is a leak of kobject names for sub-group space_info entries: during removal, kobject_init_and_add is paired with allocations, but the corresponding btrfs_sysfs_remove_space_info() is not called on freed elements, causing le...