CVE-2026-64186

CVE-2026-64186 relates to the Linux kernel AMD IOMMU debugfs handling. The issue arises from using int-typed dbg_mmio_offset and dbg_cap_offset populated via kstrtou32_from_user(), which can wrap to a negative value for large inputs, risking out-of-bounds access in read/write paths. The patch fix...

CVE-2026-64222

CVE-2026-64222 affects the Linux kernel on OcteonTX2/CN20K: a double-free in pool->stack during AQ pool init cleanup. The otx2_pool_aq_init() path frees pool->stack on mailbox sync/retry failure but doesn’t null the pointer, causing otx2_sq_aura_pool_init() cleanup (via otx2_aura_pool_free(...

CVE-2022-50264

CVE-2022-50264 affects the Linux kernel clock subsystem, specifically the socfpga gate init path. The issue is a memory leak in the socfpga_clk/ops error path, corrected by freeing both the socfpga_clk and its ops on error. The vulnerability is categorized with a CVSS v3.1 base score of 5.5 (Medi...

CVE-2022-50426

CVE-2022-50426 affects the Linux kernel remoteproc path for imx_dsp_rproc. The issue arises from a workqueue that may run after rproc_stop_subdevices releases resources, allowing rproc_vq_interrupt to access freed rpmsg endpoints. The fix adds mutex protection in imx_dsp_rproc_vq_work to skip rpr...

CVE-2022-50428

CVE-2022-50428 affects the Linux kernel ext4 fast-commit journaling, caused by multiple off-by-one errors in filling tlv blocks. The issues constrain where tlvs start and end within a block, risking replay problems and memory leakage in last-byte handling. The fixed patch corrects block-filling o...

CVE-2022-50437

CVE-2022-50437 - Linux kernel (drm/msm/hdmi) : A memory corruption issue was fixed by adding a missing sanity check on the bridge counter to prevent writing beyond the fixed-sized bridge array when there are more than eight bridges. Affects the Linux kernel with drm/msm/hdmi; patch resolves data ...

CVE-2022-50451

CVE-2022-50451 involves a memory leak in the Linux kernel’s ntfs3 module, specifically in the ntfs_fill_super() error path. The provided documents consistently describe a bug where an unreferenced kmemleak object is leaked during mounting, traced to the error handling path of ntfs_fill_super(). T...

CVE-2022-50477

CVE-2022-50477 (Linux kernel): A memory leak in the RTC device management was fixed. During devm_rtc_allocate_device(), a rtc_device is allocated before calling dev_set_name(). If dev_set_name() fails, the rtc_device could leak. The fix reorders actions by moving devm_add_action_or_reset() in fro...

CVE-2022-50496

CVE-2022-50496 is a Linux kernel use-after-free in the dm-cache component, triggered by concurrent destroy() with dm_resume() and dm_destroy(). The fix is to cancel the timer in destroy() to prevent the UAF, as described in the advisory and the related kernel commits referenced in the sources.

CVE-2022-50498

CVE-2022-50498 : In the Linux kernel, the alx ethernet driver vulnerability stems from not taking the rtnl_lock during resume, allowing an rtnl assertion to trip in net/core/dev.c when reopening on resume. The issue is localized to the alx driver’s suspend/resume path and is triggered during devi...

CVE-2023-53451

CVE-2023-53451 concerns a NULL pointer dereference in the Linux kernel scsi: qla2xxx path (root cause: potential dereference of cur_dsd). Connected advisories list the CVE among kernel fixes and indicate a fix was applied upstream; EulerOS/SUSE Nessus entries enumerate this CVE as addressed in ke...

CVE-2023-53479

In CVE-2023-53479, the Linux kernel cxl driver had a use-after-free in cxl_parse_cfmws() during cxl_decoder_add() fail path. KASAN/KFENCE observed a slab-use-after-free where a released cxld was accessed in a later dev_err() path. The root cause was dereferencing freed memory; the fix replaces th...

CVE-2023-53504

Technical details for CVE-2023-53504 are not publicly available in the provided documents; monitor for updates.

CVE-2023-53508

Technical details for CVE-2023-53508 are not provided in the supplied documents. Monitor for official updates from vendors/advisories; current sources only reiterate a kernel fix without specifics.

CVE-2023-53547

CVE-2023-53547 concerns the Linux kernel DRM/AMDGPU SDMA v4 component. The fixed issue is a sw_fini error in SDMA 4.2.2 that could trigger a general protection fault (likely address 0xd5e5a4ae79d24a32) during firmware release, as shown in the stack trace including release_firmware and amdgpu_ucod...

CVE-2023-53551

The CVE-2023-53551 issue affects the Linux kernel USB gadget, specifically the u_serial driver. The root cause was a potential null pointer dereference in gserial_resume that could occur if gserial_disconnect had already cleared gser->ioport and a wakeup interrupt fired afterward. The fix adds...

CVE-2023-53553

CVE-2023-53553 is a Linux kernel issue tied to Hyper-V HID handling. The vulnerability arises from a fortify memcpy-related codepath in HID Hyper-V (mousevsc_on_receive) where a __write_overflow_field warning could be triggered, prompting a patch to rework the code to avoid the warning. Connected...

CVE-2023-53563

CVE-2023-53563 relates to the Linux kernel amd-pstate-ut driver. The root cause is that after calling amd_pstate_ut_check_perf() and amd_pstate_ut_check_freq(), the code uses cpufreq_cpu_get() to obtain the CPU policy but fails to release it with cpufreq_policy_put, causing the policy to remain b...

CVE-2023-53633

CVE-2023-53633 pertains to the Linux kernel where the leak occurs in accel/qaic’s map_user_pages() path. If get_user_pages_fast() allocates some pages but not as many as requested, the current code fails to release the pages, causing a leak. The root cause is improper page accounting in the get_u...

CVE-2023-53649

CVE-2023-53649 concerns a memory-leak in the Linux kernel related to perf trace. The described fix corrects how the evsel->priv area is freed: previously, freeing occurred only when evsel->tp_format->system compared to 'syscalls' yielded zero, but evsel->priv could be non-zero in othe...

CVE-2023-53655

CVE-2023-53655 (Linux kernel) is a stack overflow vulnerability caused by registering a kprobe on __rcu_irq_enter_check_tick(). The issue can trigger kernel panics/stack overflow when NO_HZ_FULL is enabled and the system boots with nohz_full=, leading to a tree of stack traces and a kernel panic,...

CVE-2023-53677

CVE-2023-53677 is associated with a Linux kernel issue in the drm/i915 area. The affected component is the i915 selftests code path, where the patch fixes memory leaks on error escapes in function fake_get_pages (cherry-picked from a kernel commit). The vulnerability was resolved in the kernel, a...

CVE-2023-53678

CVE-2023-53678 concerns the Linux kernel, specifically the drm/i915 driver, where system suspend could crash on platforms without fbdev initialized. The root cause described in the documents is a suspend path involving intel_fbdev_set_suspend during device suspend, leading to a NULL pointer deref...

CVE-2023-53686

CVE-2023-53686: Linux kernel vulnerability in net/handshake/netlink.c fix null-ptr-deref in handshake_nl_done_doit(); ensures trace_handshake_cmd_done_err() is not called if socket lookup fails and is invoked before releasing the file to avoid dereferencing sock->sk. Affects kernel networking ...

CVE-2025-39900

CVE-2025-39900: Linux kernel net_sched: gen_estimator est_timer vulnerability fixed. When CONFIG_PREEMPT_RT=y, timer callbacks could be preempted, risking seqcount/seqlock integrity. A fix in net/core/gen_estimator.c updates est_timer() by adopting preempt_disable_nested()/preempt_enable_nested()...

CVE-2025-39960

Concrete details from connected sources show CVE-2025-39960 affecting the Linux kernel gpiolib/acpi path. The root cause is uninitialized acpi_gpio_info passed to __acpi_find_gpio(), leading to info->quirks usage in acpi_populate_gpio_lookup and breaking i2c_hid_cpi HID over I2C probes. The fi...

CVE-2025-39962

The CVE-2025-39962 entry concerns the Linux kernel RXRPC path. A bug in rxgk_app.c involved an untrusted unsigned subtract (ticket_len - 10 * 4) that could affect token parsing. The fix prechecks token lengths in two places and uses sizeof() for the extracted struct. This CVE is marked as resolve...

CVE-2025-71109

CVE-2025-71109 concerns a memory corruption in the Linux kernel’s MIPS ftrace due to the UASM LA macro (used since a 2020s commit) potentially emitting more than two instructions and the ftrace code storing them in an int[2] array. When _mcount exceeds 32 bits, this can corrupt variables in the _...

CVE-2025-71126

CVE-2025-71126 concerns the Linux kernel’s MPTCP implementation. The vulnerability is a deadlock during the fallback reinjection path. Specifically, a thread (mptcp_connect/20858) may attempt to acquire msk->fallback_lock while it is already held by another path (as shown in the trace: __mptcp...

CVE-2025-71129

The CVE-2025-71129 entry documents a LoongArch kernel issue where kfunc calls did not sign-extend their arguments properly, risking kernel panic. The fix introduces a new emit_abi_ext() helper that performs in-place extension (distinct from sign_extend()) to ensure LoongArch calling conventions a...

CVE-2025-71183

CVE-2025-71183 affects the Linux kernel via the btrfs filesystem. The issue arises during rename exchanges (or multi-step renames) where two inodes, one a directory, can produce a log containing only some inodes. During replay, this can lead to deleting an inode that should not be deleted after a...

CVE-2025-71289

CVE-2025-71289 affects the Linux kernel’s ntfs3 handling of attr_set_size() when truncating files. If attr_set_size() fails during down-truncation, the error may be silently ignored, potentially leaving the inode in an inconsistent state. The connected sources corroborate this description and lis...

CVE-2025-71290

CVE-2025-71290 concerns a memory leak in the Linux kernel’s misc: ti_fpc202 probe function. The root cause is not releasing a device node reference during iteration, leading to a leak. The remedy implemented is a code change that uses for_each_child_of_node_scoped() to ensure the node reference i...

CVE-2025-71301

CVE-2025-71301 affects the Linux kernel DRM shmem test code. The root cause is that the GEM object reservation lock was not consistently held during vmap and vunmap, which led to warnings and potential instability. The published fixes acquire and release the reservation lock around vmap and vunma...

CVE-2026-23009

CVE-2026-23009 is a Linux kernel vulnerability in the xHCI sideband code where xhci_sideband_remove_endpoint() could dereference a non-existent transfer ring (ep->ring) during suspend/resume or re-enumeration, risking a crash. The fix adds a guard to only dereference ep->ring if it exists a...

CVE-2026-23285

CVE-2026-23285 is a Linux kernel vulnerability fixed in the DRBD path: in drbd_request_endio(), READ_COMPLETED_WITH_ERROR can pass a NULL peer_device to __req_mod(), leading to a null pointer dereference inside drbd_set_out_of_sync(). The mitigation described in the advisory is to obtain the peer...

CVE-2026-23304

The connected advisories confirm CVE-2026-23304 affects the Linux kernel IPv6 routing code. Root cause: l3mdev_master_dev_rcu() can return NULL when a slave device is un-slaved from a VRF, and ip6_rt_get_dev_rcu() used by ip6_rt_pcpu_alloc() did not fall back to loopback, causing a NULL pointer d...

CVE-2026-23387

The CVE-2026-23387 issue concerns the Linux kernel fix for a double-put in pinctrl/cirrus cs42l43 handling during cs42l43_pin_probe, caused by an explicit put after devm_add_action_or_reset() already performing an action on failure. Connected OSV entries (ROOT-OS-DEBIAN-13-CVE-2026-23387 and ROOT...

CVE-2026-23412

The CVE-2026-23412 issue affects the Linux kernel’s netfilter/BPF path. It describes a use-after-free (UaF) in nfnetlink_hooks where a concurrent process dumps hooks, triggering a KASAN slab-use-after-free in nfnl_hook_dump_one. The root cause is deferring the release of hook memory until RCU rea...

CVE-2026-23445

Summary of CVE-2026-23445 (Linux kernel igc driver) Affected component: igc network driver in the Linux kernel, specifically the XDP TX timestamping path. Root cause: during shutdown of the TX ring, the code leaves behind stale xsk_meta pointers, causing the IRQ handler to touch invalid pointers ...

CVE-2026-31425

The CVE-2026-31425 issue concerns a Linux kernel RDS path (rds_ib_get_mr/rds_ib_post_reg_frmr) where FRWR/memory registration could dereference a NULL i_cm_id/qp on outgoing connections before rdma_cm_id is established. Connected docs confirm the vulnerability is addressed by patches in several d...

CVE-2026-31439

The CVE-2026-31439 entry refers to a Linux kernel issue in dmaengine: xilinx: xdma, where devm_regmap_init_mmio could return an ERR_PTR and the error handling/ messaging were incorrect. The description and connected advisories confirm this is a kernel regression/fix in the regmap init path, with ...

CVE-2026-31522

CVE-2026-31522 affects the Linux kernel HID magicmouse driver. The root cause is in magicmouse_report_fixup(), which allocated a new buffer via kmemdup and failed to free it, while the caller does not own the returned pointer. This memory leak can enable local resource exhaustion, with the CVSS i...

CVE-2026-31541

CVE-2026-31541: In the Linux kernel tracing subsystem, when copy_trace_marker is enabled, deleting a tracing instance could bypass synchronization and leave a Use-After-Free (UAF) due to incorrect ordering of flag clearing and marker list updates. The fix moves clearing of all flags below the upd...

CVE-2026-31553

CVE-2026-31553 affects the Linux kernel KVM on arm64. The issue stems from computing descriptor addresses in __kvm_at_swap_desc() using (u64 __user )hva + offset, which miscomputes when offset ≠ 0, effectively performing offset 8. The correction is to use hva + offset to obtain the correct S1/S2 ...

CVE-2026-31572

CVE-2026-31572 involves the Linux kernel driver for the i2c: designware: amdisp. A race exists between probe and runtime PM resume: when the ISP is powered on via runtime PM before probe completes, the amdisp I2C resume can occur early, causing a NULL dereference in kernel v7.0. The fix uses genp...

CVE-2026-31585

CVE-2026-31585 affects the Linux kernel vidtv media driver. When vidtv_start_streaming() fails inside vidtv_start_feed(), the nfeeds counter is not decremented, leaving the number of active feeds inconsistent with actual starts. This state corruption can cause subsequent start_feed calls to skip ...

CVE-2026-31602

The CVE-2026-31602 issue affects the Linux kernel ALSA ctxfi driver, where ct_vm_map() may access memory beyond allocated space when CT_PTP_NUM exceeds 1 (AMD64), causing a page fault and potential system crash. The root cause is that ct_vm_map() always uses PTEs in vm->ptp[0].area regardless ...

CVE-2026-31722

In the Linux kernel, CVE-2026-31722 affects the USB gadget RNDIS function (f_rndis). The issue arises when the net_device is allocated during function instance creation and registered under the gadget device as its sysfs parent; during unbind, the parent is destroyed but the net_device can persis...

CVE-2026-31734

CVE-2026-31734 (Linux kernel sched_ext) has been fixed. The issue was a false negative where is_bpf_migration_disabled() could be incorrect on systems without CONFIG_PREEMPT_RCU, causing migration_disabled == 1 to be treated as truly migration-disabled even for the current task. The BPF prolog no...