CVE-2022-50440

The CVE-2022-50440 issue affects the Linux kernel DRM vmwgfx driver (drm/vmwgfx) where an invalid box size check for the snooped cursor allows an overflow during DMA surface copies, potentially crashing the system. The problem stems from improper validation of the copybox dimensions against the s...

CVE-2022-50480

CVE-2022-50480 pertains to the Linux kernel memory handling for pl353-smc, where a refcount leak in pl353_smc_probe() was fixed. The issue stems from the break path of for_each_available_child_of_node() not balancing a reference when the child is no longer used; the fix adds a corresponding of_no...

CVE-2022-50481

CVE-2022-50481 pertains to the Linux kernel; the issue is a potential null pointer dereference in cxl_guest_init_afu|adapter() when device_register() fails in cxl_register_afu|adapter(). The error path could dereference a removed-but-not-added device unless the reference is properly released. The...

CVE-2022-50493

CVE-2022-50493 is a Linux kernel vulnerability affecting the scsi/qla2xxx path where a crash can occur during CPU hotplug when an I/O abort times out. The issue stems from abort completion being issued without ensuring the I/O was still outstanding, potentially triggering a crash in the nvme/fabr...

CVE-2022-50520

CVE-2022-50520 affects the Linux kernel's DRM Radeon path, where radeon_atrm_get_bios() leaked a PCI device refcount due to a missing pci_dev_put() when breaking the loop. The issue arises because pci_get_class() may return a pci_device with a retained reference, and if the loop is exited with pd...

CVE-2022-50522

The CVE-2022-50522 entry corresponds to a Linux kernel issue in mcb-parse (chameleon_parse_gdd). When mcb_device_register() returns an error, the refcount for the bus and device name is leaked. The fix adds a put_device() to relinquish the reference so resources can be released during mcb_release...

CVE-2022-50526

Summary of CVE-2022-50526 : In the Linux kernel, the drm/msm/dp bridge handling was fixed to prevent memory corruption when there are more than eight bridges. The root cause was a missing sanity check on the bridge counter, which could corrupt data beyond the fixed-sized bridge array. The fix add...

CVE-2022-50542

CVE-2022-50542 affects the Linux kernel media/si470x driver. A use-after-free occurs in si470x_int_in_callback() when urb->context (holding a si470x_device) is freed if si470x_start_usb() has submitted a URB but the subsequent si470x_start() path fails. The fix ensures URBs are destroyed when ...

CVE-2022-50553

CVE-2022-50553 : In the Linux kernel tracing hist code, an out-of-bounds write occurs in action_data.var_ref_idx when synthesizing events with many params (n_params up to SYNTH_FIELDS_MAX) and a smaller TRACING_MAP_VARS_MAX caused writes beyond the array. The issue is fixed by enlarging data->...

CVE-2023-53167

CVE-2023-53167: In the Linux kernel, tracing_err_log_open() can dereference file->private_data if opened with write permissions and then lseek is used, causing a kernel panic via mutex_lock -> seq_lseek. A fix was applied to tracing: Fix null pointer dereference in tracing_err_log_open() fo...

CVE-2023-53184

The CVE-2023-53184 entry concerns a Linux kernel vulnerability in arm64 SME (SVE state handling). The root cause is that the vector length is updated after allocating the SVE state, causing allocation with the old length and potential memory corruption from an undersized buffer. The fix moves the...

CVE-2023-53260

Technical details for CVE-2023-53260 are not publicly available in the provided documents; monitor for updates.

CVE-2023-53277

CVE-2023-53277 is a Linux kernel vulnerability in the wifi iwl3945 driver. The issue arises from missing validation of the return value of create_singlethread_workqueue, which can lead to a NULL pointer dereference. Public advisories (Unity Linux UTSA-2025-992797/992386/992212; SUSE-SU-2025:03615...

CVE-2023-53291

CVE-2023-53291 concerns a Linux kernel regression where kfree_scale_thread(s) could continue running after unloading the rcuscale module, risking a page fault. The root cause is the threads not being stopped during module removal, and the fix adds a cleanup call by invoking kfree_scale_cleanup() ...

CVE-2023-53312

CVE-2023-53312 : In the Linux kernel, a trace-event interaction with skb_transport_offset() in net_dev_start_xmit could lead to unsafe skb_transport_offset usage. The issue arises after a blamed commit and is fixed by the kernel remediation described in the initial document (commit references inc...

CVE-2023-53337

The CVE concerns the Linux kernel nilfs2 subsystem. After metadata corruption is detected, nilfs2 may degenerate to read-only mode and still perform log writes, causing mark_buffer_dirty() to be invoked on buffer heads lacking the uptodate flag. The vulnerability arises from writes to a read‑only...

CVE-2023-53457

CVE-2023-53457 : In Linux kernel, JFS txBegin can NULL-deref when called on a read-only superblock; fix adds a read-only filesystem check before txBegin and returns an appropriate error code. Exploitation status and exact patch details beyond this description are not provided in the supplied docu...

CVE-2023-53463

The CVE-2023-53463 entry concerns Linux kernel ibmvnic (IBM Power NIC) handling of NON_FATAL resets. The advisory describes a bug where resetting dql stats on NON_FATAL resets could lead to a mismatch between num_queued and num_completed due to batched skb handling, causing a BUG_ON crash during ...

CVE-2023-53494

CVE-2023-53494 affects the Linux kernel xts code. Root cause: EBUSY is not consistently treated like EINPROGRESS for MAY_BACKLOG callers, risking use-after-free on backlogged requests. Public advisories (EulerOS/MiracleLinux/OpenVAS/Nessus) reference this CVE; no patched version or remediation de...

CVE-2023-53536

CVE-2023-53536 affects the Linux kernel in the blk-crypto subsystem. The issue stems from blk_crypto_evict_key() sometimes returning early without unlinking the key from the keyslot management structures, while the caller proceeds to free the blk_crypto_key. This mismatch can cause a use-after-fr...

CVE-2023-53567

CVE-2023-53567 – Linux kernel : The issue affects the kernel SPI QUP driver. The root cause is returning early from a platform driver’s remove callback, which prevents releasing DMA resources in the error path, causing a permanent resource leak. The fix ensures proper cleanup by not skipping hard...

CVE-2023-53627

CVE-2023-53627 affects the Linux kernel SCSI driver histi_sas. The root cause is a race on sas_dev.list traversal during slot freeing in dereg_device_v3_hw() and hisi_sas_release_tasks(), which can trigger a NULL pointer dereference and kernel panic. The mitigation is to grab the sas_dev lock whi...

CVE-2023-53632

Technical details for CVE-2023-53632 are not provided in the supplied documents. The connected sources reference other CVEs/advisories but do not include product/version/root-cause or fixes for this CVE. Monitor for updates.

CVE-2023-53636

CVE-2023-53636 : Linux kernel vulnerability in clk: microchip auxdev handling causes a use-after-free. If auxiliary_device_add() fails, the release callback can be invoked twice, leading to a UAF. The fix moves auxiliary_device_uninit() to the unregister callback to ensure proper teardown. Exploi...

CVE-2023-53656

The CVE-2023-53656 issue affects the Linux kernel perf path (drivers/perf: hisi) where a migration of the perf context to the CPU going to teardown can occur because cpu_online_mask() has not yet updated during cpuhp teardown. The result is a call trace (example: __switch_to, __schedule, mutex_lo...

CVE-2023-53669

The CVE-2023-53669 entry concerns the Linux kernel where skb_copy_ubufs() crashes when BIG TCP allows large skbs (up to ~512 KB) and zerocopy is used with hugepages. The root cause is skb_copy_ubufs() assuming payload could be copied using up to MAX_SKB_FRAGS order-0 pages; this breaks when BIG T...

CVE-2023-53670

The CVE-2023-53670 issue in Linux kernel nvme-core was resolved by a patch that fixes a dev_pm_qos memleak. The root cause was an unguarded latency-tolerance accounting leading to kmemleak reporting of an unreferenced object in nvme_init_ctrl during error unwind. The vulnerability has a CVSS v3.1...

CVE-2025-38433

CVE-2025-38433 concerns a Linux kernel issue on riscv nommu kernels where the function __runtime_fixup_32 fails to handle a zero-valued upper 32 bits during patching, potentially producing garbage in the pointer’s upper half and causing a kernel panic when accessed. The fixed logic adjusts the co...

CVE-2025-39774

CVE-2025-39774 affects the Linux kernel driver iio: adc: rzg2l_adc. The issue arises when a loop unbinds/binds the ADC (which may serve another device like a thermal block) and the ADC is resumed by runtime PM before drvdata is set, causing a crash in runtime PM callbacks that rely on drvdata. Th...

CVE-2025-39924

The CVE-2025-39924 entry relates to the Linux kernel EROFS code. A bug was fixed where the algorithm used to validate encoded extents was incorrect; the check is now unified with Z_EROFS_COMPRESSION(_RUNTIME)_MAX and aligned with sbi->available_compr_algs. The impact described in sources is li...

CVE-2025-39954

The CVE-2025-39954 issue concerns the Linux kernel (clk: sunxi-ng: mp) where the P divider offset was omitted in the .recalc_rate readback for dual-divider clocks, causing the reported clock rate to be bogus or zero. The COMMITs in the connected sources indicate that the problem arises specifical...

CVE-2025-68823

CVE-2025-68823: Linux kernel ublk deadlock when reading partition table. If a process (e.g., udev) opens a ublk block device to read the partition table via bdev_open(), a deadlock can occur because blkdev_release() re-acquires disk->open_mutex in the same context. The fix disables bottom halv...

CVE-2025-71115

CVE-2025-71115 pertains to the Linux kernel where cpu_tasks[] is not initialized early enough, causing a NULL current in certain init paths (notably with KCOV enabled) and potential crashes. The available connected docs confirm the vulnerability arises from initializing cpu_tasks[] in uml_finishs...

CVE-2025-71129

The CVE-2025-71129 entry documents a LoongArch kernel issue where kfunc calls did not sign-extend their arguments properly, risking kernel panic. The fix introduces a new emit_abi_ext() helper that performs in-place extension (distinct from sign_extend()) to ensure LoongArch calling conventions a...

CVE-2025-71155

CVE-2025-71155 concerns the Linux kernel KVM on s390 where gmap_helper_zap_one_page() had missing checks that could lead to memory corruption in a guest under specific circumstances. The connected documents confirm the vulnerability and describe the root cause as incomplete validation within that...

CVE-2025-71158

Summary of CVE-2025-71158 : In the Linux kernel GPIO subsystem, the mpsse driver could crash when an IRQ worker was running if the hardware was unplugged (sealevel hardware not hotpluggable). The fix adds protection by tearing down the worker list with a spinlock when disconnecting, preventing a ...

CVE-2025-71183

CVE-2025-71183 affects the Linux kernel via the btrfs filesystem. The issue arises during rename exchanges (or multi-step renames) where two inodes, one a directory, can produce a log containing only some inodes. During replay, this can lead to deleting an inode that should not be deleted after a...

CVE-2025-71186

Technical details (affected component, root cause, impact, and patch information) for CVE-2025-71186 are not publicly provided in the supplied documents. Monitor for updates from official advisories and vendor/security bulletins.

CVE-2025-71236

CVE-2025-71236 is documented in connected sources as a Linux kernel vulnerability affecting the SCSI driver path for qla2xxx. The issue centers on a potential NULL pointer dereference when freeing memory associated with an SP (scsi request) in error paths, which can cause a system crash. The prov...

CVE-2025-71266

The CVE-2025-71266 entry concerns the Linux kernel ntfs3 filesystem. A malformed directory entry in NTFS3 could trigger an infinite loop in indx_find during lookups, repeatedly reading the same block and allocating 4 KB per iteration, causing memory exhaustion and potential DoS. The vulnerability...

CVE-2026-23246

CVE-2026-23246 affects the Linux kernel wifi mac80211 bounds-check in the ML Reconfiguration path. The issue arises from linking link_id (0-15) to the link_removal_timeout array (size 15), allowing an out-of-bounds write when link_id equals 15. The advisories state to skip subelements with link_i...

CVE-2026-23306

The CVE-2026-23306 issue affects Linux kernel SCSI pm8001 code. A refactor of pm8001_queue_command() to return -ENODEV in phy-down/device-gone states could inadvertently free the SAS task twice: pm8001_queue_command() would free the underlying SAS task, then libsas sas_ata_qc_issue() would attemp...

CVE-2026-23328

CVE-2026-23328 – Linux kernel (accel/amdxdna): The vulnerability is a NULL pointer dereference in mgmt_chann when the firmware returns an unexpected error in aie2_send_mgmt_msg_wait(), which may set mgmt_chann to NULL and cause a later NULL dereference in aie2_hw_stop(). The fixed patch introduce...

CVE-2026-23341

CVE-2026-23341 affects the Linux kernel accel/amdxdna path. The issue occurs when userspace issues an ioctl to destroy a hardware context that has already been automatically suspended, which may crash due to a NULL mailbox channel pointer accessed in aie2_destroy_context(). The fix adds a mailbox...

CVE-2026-31412

The CVE-2026-31412 vulnerability exists in the Linux kernel USB gadget f_mass_storage implementation, where an unchecked left shift of data_size_from_cmnd by blkbits could overflow, truncating data size and enabling memory corruption or out-of-bounds access. The root cause is lack of overflow val...

CVE-2026-31428

CVE-2026-31428 — In the Linux kernel, nfnetlink_log’s __build_packet_message() previously built NFULA_PAYLOAD attributes manually via skb_put()/skb_copy_bits(), bypassing nla_reserve()/nla_put(). This caused trailing padding to remain uninitialized, leaking stale heap data to userspace over NFLOG...

CVE-2026-31434

CVE-2026-31434 affects the Linux kernel's btrfs subsystem. The root cause is a leak of kobject names for sub-group space_info entries: during removal, kobject_init_and_add is paired with allocations, but the corresponding btrfs_sysfs_remove_space_info() is not called on freed elements, causing le...

CVE-2026-31453

The CVE-2026-31453 issue affects the Linux kernel XFS path. The root cause is use-after-free-like behavior: after xfsaild_push_item() calls iop_push(), the log item could be freed if the AIL lock is dropped, allowing a freed log item to be dereferenced by tracepoints in the switch that follow. Th...

CVE-2026-31467

CVE-2026-31467 concerns the Linux kernel vulnerability where the bio completion path in certain process contexts (e.g., dm-verity) could call into decompression and then into vm_map_ram() with GFP_KERNEL, risking memory pressure and a potential deadlock in submit_bio_wait. The issue is tied to th...

CVE-2026-31483

CVE-2026-31483 affects the s390 architecture in the Linux kernel. The root cause is a missing array_index_nospec() boundary in the syscall dispatch table, allowing a user-controlled syscall number to exceed the function pointer table and potentially read kernel memory via speculative execution (S...