CVE-2022-50526

Summary of CVE-2022-50526 : In the Linux kernel, the drm/msm/dp bridge handling was fixed to prevent memory corruption when there are more than eight bridges. The root cause was a missing sanity check on the bridge counter, which could corrupt data beyond the fixed-sized bridge array. The fix add...

CVE-2022-50540

CVE-2022-50540 affects the Linux kernel’s dmaengine qcom-adm driver. The root cause is a faulty slave_config implementation that compared peripheral_size against the size of the config pointer instead of the config struct, causing the crci value to be ignored and potentially triggering a kernel p...

CVE-2022-50542

CVE-2022-50542 affects the Linux kernel media/si470x driver. A use-after-free occurs in si470x_int_in_callback() when urb->context (holding a si470x_device) is freed if si470x_start_usb() has submitted a URB but the subsequent si470x_start() path fails. The fix ensures URBs are destroyed when ...

CVE-2022-50549

CVE-2022-50549 describes an ABBA deadlock in the Linux kernel’s dm-thin path where concurrent drop_caches and dm thin worker activity can cause a deadlock between shrink_slab (holding shrinker_rwsem) and dm_pool_abort_metadata (holding dm_block/root locks). The result is a hung task as shown by t...

CVE-2023-53163

CVE-2023-53163 affects the Linux kernel NTFS-3 driver: a deadlock occurs when ntfs_truncate() calls truncate_setsize() while holding ni_lock, due to interaction with PG_locked set by filemap_update_page() -> filemap_read_folio() after folio_trylock(). This can cause a hung task (do_user_addr_f...

CVE-2023-53170

CVE-2023-53170 : Linux kernel fix in net: dsa — Removed the unneeded of_node_put from felix_parse_ports_node to prevent double release of child nodes, which could lead to resource leaks or other issues. The change is described as a resolution in the advisory and references kernel commits (e.g., 0...

CVE-2023-53291

CVE-2023-53291 concerns a Linux kernel regression where kfree_scale_thread(s) could continue running after unloading the rcuscale module, risking a page fault. The root cause is the threads not being stopped during module removal, and the fix adds a cleanup call by invoking kfree_scale_cleanup() ...

CVE-2023-53306

CVE-2023-53306 involves the Linux kernel fsdax path used by XFS for CoW on non-shared extents. The issue arises when a previous non-shared extent is mwrited and its dax entry is left dirty, which produced a WARN at dax_insert_entry. The connected documents consistently describe this as a resolved...

CVE-2023-53312

CVE-2023-53312 : In the Linux kernel, a trace-event interaction with skb_transport_offset() in net_dev_start_xmit could lead to unsafe skb_transport_offset usage. The issue arises after a blamed commit and is fixed by the kernel remediation described in the initial document (commit references inc...

CVE-2023-53337

The CVE concerns the Linux kernel nilfs2 subsystem. After metadata corruption is detected, nilfs2 may degenerate to read-only mode and still perform log writes, causing mark_buffer_dirty() to be invoked on buffer heads lacking the uptodate flag. The vulnerability arises from writes to a read‑only...

CVE-2023-53341

CVE-2023-53341 refers to a Linux kernel memory initialization fix: the function early_init_dt_scan_memory now returns 1 when memory is found and 0 if none, allowing other memory setup paths to run. This changes the control flow after the ramips plat_mem_setup call, addressing scenarios where memo...

CVE-2023-53376

CVE-2023-53376 affects the Linux kernel scsi mpi3mr driver, where bitmap sizing used bytes instead of bits caused slab-out-of-bounds access (notably during firmware download to eHBA-9600) via find_first_zero_bit() in mpi3mr_send_event_ack(). The fix switches bitmap management to number-of-bits ar...

CVE-2023-53455

CVE-2023-53455 concerns the Linux kernel DRM vc4 deadlock: vc4_hdmi_reset_link() returning -EDEADLK may deadlock in the locking context. The accepted fix is to drop held locks and back off using drm_modeset_backoff(), per the cited kernel DRM-KMS guidance. The vulnerability entry provides example...

CVE-2023-53458

In CVE-2023-53458, Linux kernel media cx23885 driver may encounter a null pointer dereference in buffer_prepare() and buffer_finish() when dma_alloc_coherent fails during cx23885_risc_buffer() setup, causing risc->cpu to be empty. The vulnerability can be triggered when freeing or accessing th...

CVE-2023-53484

CVE-2023-53484 affects the Linux kernel’s cpu_rmap logic. The vulnerability arises in the lib: cpu_rmap path where, if irq_set_affinity_notifier() is called with a NULL notify, the glue pointer in the corresponding rmap->obj array entry is freed but the pointer remains non-null. A subsequent f...

CVE-2023-53494

CVE-2023-53494 affects the Linux kernel xts code. Root cause: EBUSY is not consistently treated like EINPROGRESS for MAY_BACKLOG callers, risking use-after-free on backlogged requests. Public advisories (EulerOS/MiracleLinux/OpenVAS/Nessus) reference this CVE; no patched version or remediation de...

CVE-2023-53506

CVE-2023-53506 : Linux kernel udf merging long extents. The merge logic that pushes as much length as possible to the first extent caused risk of extents corruption; the patch resolves the behavior by not merging overly long extents. Reported impact is high (local attack, no user interaction) wit...

CVE-2023-53540

CVE-2023-53540 affects the Linux kernel wifi cfg80211: it rejects authentication/association attempts to an AP when the AP uses our own address as MLD/BSSID to avoid later failures. The issue’s root cause is improper handling of APs that spoof our address; it is mitigated by patches in the Linux ...

CVE-2023-53559

CVE-2023-53559 affects the Linux kernel ip_vti path when an ip_vti device is using the sfb qdisc. The cb field of the skb may be modified during enqueuing, causing slab-use-after-free on IPv6 packet transmission. The root cause is that IP6CB(skb)->nhoff is not set during transmit, as described...

CVE-2023-53571

The CVE-2023-53571 entry concerns the Linux kernel DRM/I915: the fix changes intel_get_crtc_new_encoder() to fetch the dev pointer from the atomic state instead of relying on a potentially NULL encoder, avoiding a WARN that could lead to an oops when a connector for the CRTC isn’t found in the at...

CVE-2023-53576

CVE-2023-53576 affects the Linux kernel’s null_blk driver. The patch ensures queue mode is always validated from configfs by checking queue_mode in null_validate_conf() and returning an error for NULL_Q_RQ to prevent a NULL I/O path OOPs when queue_mode is set to 1. Reproduction steps are provide...

CVE-2023-53580

CVE-2023-53580 affects the Linux kernel USB gadget core, where the gadget_unbind_driver() path could deadlock with usb_gadget_deactivate() when a UVC gadget driver is removed. The root cause is that gadget_unbind_driver() held udc->connect_lock while invoking the driver’s unbind(), while usb_g...

CVE-2023-53590

CVE-2023-53590 affects the Linux kernel SCTP scheduler code. The root cause was a missing reference counter in sctp_stream_priorities, which could cause a nested loop when freeing a stream priority (potential heavy CPU usage). The advisory notes that a refcnt is now added in sctp_stream_prioritie...

CVE-2023-53591

CVE-2023-53591 affects the Linux kernel’s mlx5e offload path. The issue is a deadlock in the tc route query code when peer flows are created while holding the devcom rw semaphore. The patch refactors the code for lockless execution by making the devcom data pointer RCU-friendly, wrapping the pair...

CVE-2023-53594

CVE-2023-53594 is a Linux kernel driver-core resource leak in device_add(): if kobject_add() fails, dev->kobj.parent is set to NULL, causing a leak in resource cleanup and potentially insmod failure for mac80211_hwsim. The initial description and EulerOS/SUSE advisories confirm the vulnerabili...

CVE-2023-53610

The CVE-2023-53610 issue affects the Linux kernel and is tied to irqchip/refcount handling in platform_irqchip_probe. Specifically, of_irq_find_parent() returns a node pointer with an incremented refcount, and the advisory notes that of_node_put() must be invoked when the node is no longer needed...

CVE-2023-53615

In CVE-2023-53615, the Linux kernel vulnerability affects the scsi: qla2xxx path and centers on a race when deleting sessions. The issue allowed a session deletion to be queued twice on different CPUs, risking link-list corruption and a system crash in debug builds. The internal trace demonstrate...

CVE-2023-53638

Technical details for CVE-2023-53638 are not publicly available in the provided documents. Monitor for updates from official advisories.

CVE-2023-53650

CVE-2023-53650 : In the Linux kernel, the fbdev: omapfb lcd_mipid path fixes an error path in mipid_spi_probe. If mipid_detect() fails, the code must free the allocated md to avoid a memory leak. Affects the fbdev/omapfb mipid probe code; underlying impact is a potential memory leak on failure. T...

CVE-2023-53661

CVE-2023-53661 affects the Linux kernel bnxt driver. The issue is an arithmetic overflow in bnxt_get_nvram_directory() caused by the use of a multiplication macro instead of casting operands to a larger type when performing arithmetic. The vulnerability could enable an overflow condition within t...

CVE-2023-53662

CVE-2023-53662 affects the Linux kernel ext4 filesystem. The issue is a memory leak in ext4_fname_setup_filename() and ext4_fname_prepare_lookup() when filename casefolding fails, leaking fscrypt_name.name. The patch adds freeing of the allocated memory in the error paths of both functions. Affec...

CVE-2023-53668

CVE-2023-53668 affects the Linux kernel ring-buffer subsystem used by tracing_read_pipe/trace_pipe. The issue is a deadloop where a non-empty buffer cannot be read because rb_num_of_entries() == 0, leading to endless waiting when user-space buffers aren’t filled. Root cause: when the ringbuffer i...

CVE-2025-39696

The CVE-2025-39696 issue affects the Linux kernel’s ALSA HDA tas2781 code path. A misreference during calibration data unification caused tasdevice_priv to be assigned from h->hda_priv instead of h->priv, leading to memory corruption and potential crashes when the affected code executed. Th...

CVE-2025-39768

CVE-2025-39768 relates to the Linux kernel driver net/mlx5. The issue is described as a faulty error flow when moving complex rules during rehash, which could lead to broken steering rules and risk of soft lock-ups. The fix compresses the error-handling logic across the complex rule rehash path: ...

CVE-2025-39856

CVE-2025-39856 concerns the Linux kernel network driver for TI am65 CPSW-NUSS (CPSW2G) where, in the TX completion path, the variable ndev may be accessed before initialization if no TX packets have been processed. This can cause a null pointer dereference and kernel crash. Affected component: ne...

CVE-2025-68817

CVE-2025-68817 affects the Linux kernel ksmbd component. A use-after-free on a tree-connection object (tcon) can occur under high concurrency when a disconnect path frees the tcon while another path still holds a reference and later calls *_put()/write. The issue is addressed by a kernel fix in k...

CVE-2025-71127

The CVE-2025-71127 issue concerns the Linux kernel mac80211 handling of Beacon frames. A unicast Beacon frame could bypass beacon protection when the Protected Frame bit is 1, potentially allowing targeted actions on a specific STA. The documented fix is a policy change to drop Beacon frames addr...

CVE-2025-71130

The CVE-2025-71130 issue affects the drm/i915/gem path in the Linux kernel. The fix zero-initializes the eb.vma array when setting up the eb structure in i915_gem_do_execbuffer, initializing eb->vma[i].vma to NULL and ensuring all pointers are NULL at the start of eb_lookup_vmas() to simplify ...

CVE-2025-71146

The CVE-2025-71146 entry concerns Linux kernel netfilter nf_conncount, where a ct (connection tracking) reference could be leaked on some error paths because the refcounted check was skipped. The published description states the issue and that it is resolved by ensuring the check is always perfor...

CVE-2025-71186

Technical details (affected component, root cause, impact, and patch information) for CVE-2025-71186 are not publicly provided in the supplied documents. Monitor for updates from official advisories and vendor/security bulletins.

CVE-2025-71236

CVE-2025-71236 is documented in connected sources as a Linux kernel vulnerability affecting the SCSI driver path for qla2xxx. The issue centers on a potential NULL pointer dereference when freeing memory associated with an SP (scsi request) in error paths, which can cause a system crash. The prov...

CVE-2025-71274

Summary (CVE-2025-71274): A race in the Linux kernel rpmsg driver_override_show() can cause use-after-free of the driver_override string because reading occurs without the device_lock while the store path frees/modifies it under the lock. The fix replaces rpmsg_string_attr with explicit show/stor...

CVE-2025-71314

In the Linux kernel, the drm/panthor component was updated to recover from panthor_gpu_flush_caches() failures that could block the memory subsystem. The fix introduces a reset path to recover when flush operations hang, and resets pending_reqs so new commands can be issued after a reset. If addi...

CVE-2026-23018

CVE-2026-23018 describes a Linux kernel vulnerability in the btrfs code path. In btrfs_read_locked_inode(), a path with a read-locked leaf from a subvolume tree is used while calling btrfs_init_file_extent_tree(), which may perform GFP_KERNEL allocations and trigger memory reclaim. This can creat...

CVE-2026-23118

The CVE-2026-23118 entry concerns a Linux kernel rxrpc data-race: rxrpc_peer_keepalive_worker and rxrpc_send_data_packet access peer->last_tx_at without synchronization, and the 64-bit last_tx_at risking 32-bit tearing. The fix changes last_tx_at to unsigned int and stores only the least-signi...

CVE-2026-23137

CVE-2026-23137 (Linux kernel). In unittest_data_add() a memory leak could occur if of_resolve_phandles() failed, leaving unittest_data allocated. The fix uses a scope-based cleanup helper (__free(kfree)) to automatically free unittest_data on error paths, and retain_and_null_ptr() on the success ...

CVE-2026-23156

CVE-2026-23156 affects Linux kernel efivarfs: efivar_entry_get() may return success even if __efivar_entry_get() fails, potentially enabling uninitialized heap data to be copied to userspace via efivarfs_file_read(). The root cause is error propagation being suppressed; the fix is to return the e...

CVE-2026-23186

CVE-2026-23186 pertains to the Linux kernel hwmon driver for the ACPI power meter. The issue arises when acpi_power_meter_notify() calls hwmon_device_unregister() while holding a lock also acquired by sysfs callbacks, creating potential deadlocks between sysfs access and device removal. Fixes inc...

CVE-2026-23249

Summary (CVE-2026-23249) : In Linux kernel XFS, during free-space and inode btree repair, revalidation calls xchk_allocbt for BNOBT and CNTBT can race: the first call nullifies the CNTBT cursor, causing a NULL dereference on the second revalidation. The fix changes the control flow so CNTBT curso...

CVE-2026-23253

CVE-2026-23253 affects the Linux kernel dvb-core/dvb_dvr_open path where reinitializing the shared dvr_buffer waitqueue via dvb_ringbuffer_init() could leave stale waitqueue entries. The fix uses direct data/size assignment and calls dvb_ringbuffer_reset() instead, avoiding waitqueue/spinlock tou...