CVE-2026-64248

CVE-2026-64248 affects the Linux kernel on MIPS: the function smp_send_stop() offline CPUs without informing RCU, causing possible stalls due to RCU grace periods never completing. The issue can trigger reboot hangs when irq_work_sync() runs after the affected path. The vulnerability has been fix...

CVE-2026-64325

CVE-2026-64325 is a NULL pointer dereference in the Linux kernel's mt76 Wi-Fi driver , affecting mt7921 and mt7925 chipsets. When a channel-switch announcement (CSA) beacon is received, a queued work item may execute after the station has disconnected, at which point the driver's dev->new_ctx ...

CVE-2026-64349

CVE-2026-64349 affects the DesignWare USB3 (dwc3) driver in the Linux kernel . In dwc3_ulpi_setup() (drivers/usb/dwc3/core.c), the functions dwc3_readl() and dwc3_writel() are incorrectly passed dwc3->regs (a void __iomem *) instead of the expected struct dwc3 * pointer. This type mismatch acr...

CVE-2026-64351

CVE-2026-64351 affects the kalmia USB network driver in the Linux kernel. In kalmia_rx_fixup(), usb_packet_length is computed as a u16 by subtracting two header lengths from skb->len. A device delivering a short bulk-IN frame (length 6–11) or a short trailing remainder causes an underflow to ~...

CVE-2026-64359

CVE-2026-64359 affects the nilfs2 filesystem in the Linux kernel. User-supplied segment numbers passed via NILFS_IOCTL_CLEAN_SEGMENTS were not validated before processing began; out-of-range values reached deep in the call chain where per-entry warnings were emitted while still holding the ns_seg...

CVE-2026-64360

CVE-2026-64360 affects the Linux kernel's hfs and hfsplus filesystem drivers. The function hfs_bnode_read() can return early—when is_bnode_offset_valid() fails or check_and_correct_requested_length() zeroes the length—without writing to the caller's stack-allocated output buffer. Callers such as ...

CVE-2022-50063

CVE-2022-50063 is a Linux kernel issue affecting the DSA felix driver, where dsa_tree_notify handling can cause repeated tagging-protocol changes and lead to a kernel crash. The root cause is described as suppressing non-changes to the tagging protocol in felix_change_tag_protocol(), which can tr...

CVE-2022-50267

CVE-2022-50267 pertains to the Linux kernel’s MMC/SD subsystem, specifically the mmc_add_host() path in the mmc: rtsx_pci driver. Root cause: return value of mmc_add_host() was not checked; on error, memory allocated by mmc_alloc_host() could be leaked, risking a kernel crash when removing an una...

CVE-2022-50281

CVE-2022-50281 concerns a leak in the Linux kernel’s SGI-IP27 mips platform-bridge handling. The vulnerability occurs in bridge_platform_create() where, on error after calling platform_device_add()/platform_device_add_data()/platform_device_add_resources(), the failed device (pdev) must be releas...

CVE-2022-50297

CVE-2022-50297 concerns the Linux kernel driver for ath9k USB wireless devices. The issue arises when a USB device claims to be ATH9K but does not expose the endpoints the driver expects; specifically, an interrupt endpoint is presented where a bulk endpoint is anticipated. This mismatch can caus...

CVE-2022-50305

CVE-2022-50305 is a Linux kernel ASoC issue: sof_es8336_remove() could cause use-after-free because cancel_delayed_work() may not wait for the work function to finish. The fix uses cancel_delayed_work_sync() to ensure the work is cancelled, not running, and cannot be re-scheduled. Affected compon...

CVE-2022-50421

The CVE-2022-50421 entry concerns the Linux kernel rpmsg subsystem. The root cause is a double-destroy path for the default rpmsg endpoint: rpmsg_chrdev_eptdev_destroy() may destroy the default endpoint again after rpmsg_dev_remove() releases it, causing refcount underflow and use-after-free. Rep...

CVE-2022-50424

CVE-2022-50424 affects the Linux kernel WiFi driver for MT7921 (mt76/mt7921). The issue is a resource leak in mt7921_check_offload_capability() where a fw/allocated storage goes out of scope, leaking memory. The vulnerability is described as resolved/fixed via a Coverity-related fix (Addresses-Co...

CVE-2022-50428

CVE-2022-50428 affects the Linux kernel ext4 fast-commit journaling, caused by multiple off-by-one errors in filling tlv blocks. The issues constrain where tlvs start and end within a block, risking replay problems and memory leakage in last-byte handling. The fixed patch corrects block-filling o...

CVE-2022-50429

CVE-2022-50429 affects the Linux kernel memory/OF subtree. The issue is a refcount leak in of_lpddr3_get_ddr_timings() caused by not balancing refcounts when breaking out of for_each_child_of_node(). The fix adds of_node_put() at the exit path to balance refcounts. Connected advisories (SUSE OSVs...

CVE-2022-50435

CVE-2022-50435 : Linux kernel ext4 inline data handling bug where inline data was not cleared after direct IO creation, potentially causing a crash when an inode with both inline and block data is later truncated and rewritten. The accompanying fixes clear EXT4_STATE_MAY_INLINE_DATA during direct...

CVE-2022-50459

CVE-2022-50459 : In the Linux kernel, a NULL pointer dereference can occur in the SCSI/iscsi iscsi_tcp path when freeing a socket concurrently with access via sysfs. The root cause is a sequence where sock_hold() increments a sock refcount, sockfd_put() later releases the socket and clears sock-&...

CVE-2022-50470

The CVE-2022-50470 vulnerability is a Linux kernel issue in the xHCI host controller code. It occurs when freeing a virtual device if the xHCI host controller dies or is removed; endpoints may not be dropped from the bandwidth list due to early returns, triggering a list_del corruption and kernel...

CVE-2022-50481

CVE-2022-50481 pertains to the Linux kernel; the issue is a potential null pointer dereference in cxl_guest_init_afu|adapter() when device_register() fails in cxl_register_afu|adapter(). The error path could dereference a removed-but-not-added device unless the reference is properly released. The...

CVE-2022-50507

CVE-2022-50507 : Linux kernel ntfs3 data run offset validation bug. The issue arises from insufficient sanity checks when unpacking NTFS data runs, potentially enabling a use-after-free or out-of-bounds memory access during mount operations. The vulnerability is fixed by adding data-run offset va...

CVE-2022-50533

CVE-2022-50533 concerns a Linux kernel issue in the wifi/mac80211 mlme handling where a failed association to an AP without a link 0 could trigger a null-pointer dereference in tracing. The observed root cause was that sdata->vif.valid_links is cleared and then ap_mld_addr or link 0 BSS may be...

CVE-2023-53278

CVE-2023-53278 affects the Linux kernel in the ubifs subsystem, specifically a memory leak in ubifs_sysfs_init() that occurs when insmod ubifs.ko is loaded. The entry states the vulnerability has been resolved via a fix for the memory leak, with the observable kmemleak report and backtrace indica...

CVE-2023-53337

The CVE concerns the Linux kernel nilfs2 subsystem. After metadata corruption is detected, nilfs2 may degenerate to read-only mode and still perform log writes, causing mark_buffer_dirty() to be invoked on buffer heads lacking the uptodate flag. The vulnerability arises from writes to a read‑only...

CVE-2023-53344

In CVE-2023-53344, the Linux kernel patch addresses a KMSAN uninitialized-value issue in bcm_tx_setup triggered by uninitialized memory during aio_write handling after a memcpy_from_msg call. The vulnerability chain involves can/bcm code allocating an op frame and copying data, with a comparison ...

CVE-2023-53451

CVE-2023-53451 concerns a NULL pointer dereference in the Linux kernel scsi: qla2xxx path (root cause: potential dereference of cur_dsd). Connected advisories list the CVE among kernel fixes and indicate a fix was applied upstream; EulerOS/SUSE Nessus entries enumerate this CVE as addressed in ke...

CVE-2023-53465

CVE-2023-53465 : Linux kernel vulnerability in the SoundWire qcom driver where qcom_swrm_ctrl->pconfig (14 entries) can be written past bounds because indexing starts at 1 instead of 0, corrupting the next struct member. Exploitation is local (per CVSS: 7.1, HIGH impact on availability/Confide...

CVE-2023-53498

In the provided documents, CVE-2023-53498 is described as a Linux kernel vulnerability in the AMD display driver (drm/amd/display). The issue arises when amdgpu_dm_fini() may dereference adev->dm.dc if the pointer is NULL, allowing a NULL pointer dereference. The remediation is a code fix that...

CVE-2023-53503

In the Linux kernel, the vulnerability CVE-2023-53503 affects ext4: ext4_get_group_info() could underflow when computing a block group if s_first_data_block is set to an extremely large value due to a malicious attacker with write access to the block device while the filesystem is mounted. This c...

CVE-2023-53511

The CVE-2023-53511 entry corresponds to a Linux kernel issue in the io_uring flow where fget() leaked when a filesystem (ocfs2) does not support nowait buffered reads. Root cause: during io_issue_sqe, the path io_assign_file → io_read → io_iter_do_read → ocfs2_file_read_iter can lead to a leak wh...

CVE-2023-53512

CVE-2023-53512 : Linux kernel scsi/mpt3sas memory leak fixed by adding a forgotten kfree() in the affected path. The vulnerability is resolved in kernel updates; the connected advisories (Unity Linux/EulerOS NASL entries) reference the same fix and confirm remediation via patch version. Cards emp...

CVE-2023-53536

CVE-2023-53536 affects the Linux kernel in the blk-crypto subsystem. The issue stems from blk_crypto_evict_key() sometimes returning early without unlinking the key from the keyslot management structures, while the caller proceeds to free the blk_crypto_key. This mismatch can cause a use-after-fr...

CVE-2023-53540

CVE-2023-53540 affects the Linux kernel wifi cfg80211: it rejects authentication/association attempts to an AP when the AP uses our own address as MLD/BSSID to avoid later failures. The issue’s root cause is improper handling of APs that spoof our address; it is mitigated by patches in the Linux ...

CVE-2023-53554

CVE-2023-53554 affects the Linux kernel staging/ ks7010 driver: ks_wlan_set_encode_ext() uses exc->key_len (u16) from user, and if it exceeds IW_ENCODING_TOKEN_MAX (64) this can cause memory corruption. The connected advisories (SUSE/OpenVAS/Nessus blocks) confirm kernel remediation but do not...

CVE-2023-53583

CVE-2023-53583 concerns the Linux kernel RISC‑V PMU driver. The issue arises from the perf subsystem: after perf_event_overflow(), the RISC‑V PMU driver did not update PERF_HES_STOPPED, and the unthrottle path could trigger riscv_pmu_start(), emitting a WARN_ON_ONCE. The fixed change removes the ...

CVE-2023-53601

CVE-2023-53601 is a Linux kernel vulnerability in the bonding driver where code could assume skb_mac_header is set in ndo_start_xmit, risking invalid skb handling. The fixed description states that skb->data is sufficient and bonding must not rely on mac_header. Concrete details appear in conn...

CVE-2023-53617

CVE-2023-53617 affects the Linux kernel in the Aspeed SoC information path. The issue arises in the error handling path of soc:aspeed:socinfo, where memory allocated for kstrdup could leak. The fix adds a kfree() in the error handling to prevent memory leaks. Connected advisories reference kernel...

CVE-2023-53643

CVE-2023-53643 affects the Linux kernel nvme-tcp driver. During error recovery the nvme-tcp socket is released and a new one is created; accessing the released socket leads to a kernel NULL pointer dereference (e.g., when executing getsockname() during a sequence that triggers error recovery, suc...

CVE-2023-53650

CVE-2023-53650 : In the Linux kernel, the fbdev: omapfb lcd_mipid path fixes an error path in mipid_spi_probe. If mipid_detect() fails, the code must free the allocated md to avoid a memory leak. Affects the fbdev/omapfb mipid probe code; underlying impact is a potential memory leak on failure. T...

CVE-2023-53675

CVE-2023-53675 affects the Linux kernel’s SCSI SES path. The vulnerability arises from potential out-of-bounds accesses to desc_ptr in ses_enclosure_data_process(), and the fix sanitizes these accesses. The accompanying metrics indicate a high-severity, local-privilege context with impact on conf...

CVE-2025-38690

The CVE-2025-38690 entry applies to the Linux kernel code path drm/xe/migrate. The vulnerability concerns incorrect handling of alignment for a bounce buffer when buf+offset is not aligned to XE_CACHELINE_BYTES, which could lead to recursive retries and a stack/recursion risk. The root cause desc...

CVE-2025-39887

CVE-2025-39887 concerns a Linux kernel issue in tracing/osnoise where bitmap_parselist() could dereference a NULL pointer when handling a cpulist input in osnoise_cpus_write() (e.g., writing "0-2" to /sys/kernel/debug/tracing/osnoise/cpus with count=0). The vulnerability affected the kernel path ...

CVE-2025-39936

The CVE-2025-39936 issue affects the Linux kernel crypto: ccp code path used during SEV/SNP shutdown. Root cause: __sev_firmware_shutdown() could call __sev_platform_shutdown_locked() with a NULL argument after the error-messages refactor, causing a NULL pointer dereference on the shutdown path d...

CVE-2025-71105

CVE-2025-71105 documents a Linux kernel issue in f2fs where two slab caches (f2fs_xattr_entry-7:3 and f2fs_xattr_entry-7:7) with identical slab sizes cause kmem_cache_sanity_check warnings during mount operations. The root cause is using per-sb slab caches instead of a single global slab, leading...

CVE-2025-71126

CVE-2025-71126 concerns the Linux kernel’s MPTCP implementation. The vulnerability is a deadlock during the fallback reinjection path. Specifically, a thread (mptcp_connect/20858) may attempt to acquire msk->fallback_lock while it is already held by another path (as shown in the trace: __mptcp...

CVE-2025-71291

The CVE-2025-71291 issue affects the Linux kernel bcm_vk_read() function, where a NULL entry dereference could occur if entry is NULL and rc is -EMSGSIZE, potentially causing system instability or DoS. The fix copies fields (to_h_msg, usr_msg_id, to_h_blks) from the iterator into temporary variab...

CVE-2025-71293

CVE-2025-71293 concerns the Linux kernel amdgpu ras issue where, if eeprom contained only invalid addresses, allocation could be skipped and lead to a NULL pointer dereference when reading bad pages. The fix moves the ras data allocation before the bad-page check, resolving a NULL pointer derefer...

CVE-2026-23155

CVE-2026-23155 affects the Linux kernel; it fixes a gs_usb_receive_bulk_callback path in can: gs_usb by correcting error messaging and resubmission handling. The patch adds null initialization for netdev when reads are short and未assigned, and reports the failed resubmit error value. This is a loc...

CVE-2026-23297

CVE-2026-23297 affects the Linux kernel’s NFS daemon (nfsd). The issue is a memory leak of struct cred caused by how nfsd_nl_threads_set_doit() passes current credentials to nfsd_svc() and later to _svc_xprt_create() without transferring ownership, leaving a refcount leak. SYZBOT identified a lea...

CVE-2026-23323

CVE-2026-23323 concerns the Linux kernel macsmc-hwmon driver on Apple Silicon. The issue stems from two concrete bugs: (1) sensor population logic using the wrong prefix (volt- vs voltage-) and mis-assigning sensors from the voltage array to the temperature array, risking out-of-bounds access or ...

CVE-2026-23335

CVE-2026-23335: Linux kernel RDMA/irdma create_user_ah() leak resolved. Root cause: the irdma_create_ah_resp struct contained 4 bytes (rsvd) that were never zeroed, leaking stack memory prior to ib_respond_udata(). Affected code paths thus exposed uninitialized stack content (4 bytes) in the resp...