CVE-2022-49515

The CVE-2022-49515 issue affects the Linux kernel ASoC driver for cs35l41. It is caused by an out-of-bounds access in otp_packed_element_t where CS35L41_NUM_OTP_ELEM is defined as 100 but only 99 entries exist in otp_map_1/2[CS35L41_NUM_OTP_ELEM], triggering UBSAN shift-out-of-bounds warnings in ...

CVE-2024-49911

CVE-2024-49911 : In the Linux kernel, the drm/amd/display path (dcn20_set_output_transfer_func) added a null check for the set_output_gamma function pointer to prevent a potential NULL pointer dereference. The fix ensures set_output_gamma is non-NULL before invocation (previously checked only for...

CVE-2024-50042

Technical details for CVE-2024-50042 are not publicly available in the provided documents. The connected advisories list kernel issues but do not disclose the affected product/version, root cause, impact, or a concrete fix for this CVE. Monitor for updates.

CVE-2024-50145

Summary: CVE-2024-50145 concerns the Linux kernel octeon_ep driver. The root cause is the possibility that build_skb() returns NULL on memory allocation failure during RX processing in __octep_oq_process_rx(). The documented fix handles such skb allocation failures inside __octep_oq_process_rx():...

CVE-2024-50248

CVE-2024-50248 affects the Linux kernel’s ntfs3 component. The advisory states that bounds checking was added to mi_enum_attr() to ensure attributes do not strays beyond valid memory regions, mitigating a memory-safety issue. The entry is resolved in the Linux kernel by updating to a patched vers...

CVE-2024-50274

CVE-2024-50274 affects the Linux kernel IDPF driver. The issue occurred when the device control plane is removed or the platform reboots; on driver reset, resources are freed and the code path could access a released vport pointer while monitoring tools query link settings. The fix moves link_spe...

CVE-2024-53043

CVE-2024-53043 : Linux kernel vulnerability in mctp i2c handling NULL header address. The issue arises when daddr can be NULL if there is no neighbour table entry, in which case the tx packet should be dropped; saddr may be NULL if a different protocol transmits a packet. This could affect transm...

CVE-2024-56538

Technical details for CVE-2024-56538 (Linux kernel drm: zynqmp_kms unplug before removal) are not publicly provided in the connected documents. Monitor for updates; none of the OpenVAS/USN entries include exact exploit specifics, affected versions, or fixes beyond referencing the CVE.

CVE-2024-56634

CVE-2024-56634 concerns a Linux kernel flaw in the GPIO grgpio driver: grgpio_probe can dereference a NULL after devm_kasprintf() returns NULL. The fix adds an explicit NULL check in grgpio_probe to prevent kernel NULL pointer dereference. Public advisories (e.g., Astra Linux and Debian/SEL advis...

CVE-2025-21786

CVE-2025-21786 concerns a Linux kernel workqueue use-after-free. The issue arises from a patch that reap workers via kthread_stop() and detaches the rescuer, but incorrectly does not preserve the rescuer’s reference to the pool and removes the code waiting for the rescuer in put_unbound_pool(). T...

CVE-2025-22027

CVE-2025-22027 affects the Linux kernel, specifically the media: streamzap component. The issue is a race between device disconnection and urb callback that leads to a NULL pointer dereference of dev->raw in ir_raw_event_store_with_filter, even though NULL checks exist in the function. The roo...

CVE-2025-22044

CVE-2025-22044 (Linux kernel) : The issue arises in acpi_nfit_ctl where a narrowing conversion from u64 to int can allow an invalid argument when nd_family is non-zero but its lower 32 bits are zero. Syzkaller warned that to_nfit_bus_uuid() may translate to a non-secondary bus family, and the fix...

CVE-2025-23141

CVE-2025-23141: In the Linux kernel KVM x86, acquiring the SRCU lock when retrieving MP state (KVM_GET_MP_STATE) can trigger a nested VM-Exit and potentially access guest memory in edge cases (e.g., L2 with INIT and pending TRIPLE_FAULT). The issue arises when the vCPU handling of MP state intera...

CVE-2025-37803

CVE-2025-37803 : Linux kernel vulnerability in udmabuf where a buffer size overflow can occur during udmabuf creation. The root cause is improper size calculation, mitigated by casting size_limit_mb to u64 when computing pglimit. Connected advisories corroborate a kernel fix; patches are deployed...

CVE-2025-37820

CVE-2025-37820 (Linux kernel – xen-netfront) has a concrete issue: the function xdp_convert_buff_to_frame() may return NULL when failing to convert an XDP buffer to an XDP frame due to memory constraints, internal errors, or invalid data. If the caller does not check for NULL, a NULL pointer dere...

CVE-2025-37928

CVE-2025-37928 refers to a Linux kernel vulnerability in the dm-bufio path where scheduling in atomic context can occur when try_verify_in_tasklet is enabled and CONFIG_DEBUG_ATOMIC_SLEEP is set. The bug arises from sleeping in an invalid context, potentially enabling local privilege escalation o...

CVE-2010-5313

CVE-2010-5313 is demonstrated in the Linux kernel’s arch/x86/kvm/x86.c, where a race condition allows L2 guest OS users to trigger an L2 emulation failure report and cause a denial of service on the L1 guest (as described in the CVE entry). The affected lineage is the Linux kernel before 2.6.38. ...

CVE-2014-0100

CVE-2014-0100 refers to a race condition in the Linux kernel’s inet_frag_intern function (net/ipv4/inet_fragment.c) that affects kernel versions up to 3.13.6. The vulnerability can be triggered by a large sequence of fragmented ICMP Echo Request packets under heavy CPU load, leading to a use-afte...

CVE-2014-4653

Summary (CVE-2014-4653) : The ALSA control implementation in the Linux kernel has a race/lock handling issue in sound/core/control.c. It does not ensure possession of a read/write lock, enabling a local attacker to trigger a denial of service (use-after-free) and to potentially read kernel memory...

CVE-2014-5471

CVE-2014-5471 affects the Linux kernel up to 3.16.1, specifically the parse_rock_ridge_inode_internal function in fs/isofs/rock.c. A crafted iso9660 image with a CL entry referencing a directory entry that has a CL entry can cause uncontrolled recursion, leading to a local denial of service, syst...

CVE-2016-3689

CVE-2016-3689 affects the Linux kernel: the ims_pcu_parse_cdc_data function in drivers/input/misc/ims-pcu.c is exploitable via a USB device with no master/slave interfaces, allowing a physically proximate attacker to trigger a denial of service (system crash). A patch is available in kernel 4.5.1...

CVE-2021-47063

CVE-2021-47063 concerns the Linux kernel DRM: bridge/panel code. The vulnerability arises because a devm-allocated drm_connector can outlive drm_mode_config_cleanup(), so the connector must be cleaned up when the bridge is detached to avoid use-after-free. The fix adds cleanup in panel_bridge_det...

CVE-2021-47311

CVE-2021-47311 is a Linux kernel memory use-after-free (UAF) vulnerability in net: qcom/emac, caused by private data (adpt) being used after free_netdev() is called. The fix moves free_netdev() to the end of emac_remove to ensure adpt is not accessed after the netdev is freed. Public advisories (...

CVE-2021-47356

The Linux kernel is vulnerable to a use-after-free flaw within the mISDN hardware support driver, specifically in the HFC_cleanup() function located in drivers/isdn/hardware/mISDN/hfcpci.c. The issue arises because the module's remove path calls del_timer() , which does not wait for the timer han...

CVE-2022-2590

Astra Linux bulletin confirms CVE-2022-2590 was addressed in Linux kernel MM/GUP logic by fixing FOLL_FORCE COW security issue and removing FOLL_COW. The patch targets races where a read-only shared page could become writable via FOLL_FORCE during COW, enabling unprivileged local writes to read‑o...

CVE-2022-34494

CVE-2022-34494 : This vulnerability is a double free in rpmsg_virtio_add_ctrl_dev (drivers/rpmsg/virtio_rpmsg_bus.c) of the Linux kernel, before version 5.18.4. Affected: Linux kernel releases prior to 5.18.4. Root cause: double free in the RPMSG virtio control device handling. Impact: described ...

CVE-2022-48686

Summary (CVE-2022-48686) Affected software: Linux kernel (nvme-tcp) as described in initial document; Astra Linux advisories corroborate the Linux kernel fix. Root cause: Use-after-free (UAF) in nvme-tcp when detecting digest errors; also a control flow issue requiring exiting the io_work loop af...

CVE-2022-49070

CVE-2022-49070 affects the Linux kernel framebuffer (fbdev) unregister path. The issue arises when unregistering framebuffers without an underlying device, risking a NULL dereference. The patch changes the flow to perform a regular unregister instead of hot-unplugging a non-existent device, corre...

CVE-2022-49156

The CVE-2022-49156 entry corresponds to a Linux kernel vulnerability in scsi: qla2xxx where a call into midlayer (fc_remote_port_delete) could sleep in interrupt context, causing a crash via scheduling while atomic. The fix schedules the call in non-interrupt context to avoid sleeping while atomi...

CVE-2022-49179

CVE-2022-49179 is a Linux kernel UAF in the block I/O BFQ scheduler (block, bfq: don’t move oom_bfqq). The issue manifests as a use-after-free in bfq_put_async_bfqq() during module removal (rmmod) and BFQ/blk-mq teardown, with 1024-byte slab allocations implicated. Unity Linux advisories UTSA-202...

CVE-2022-49226

CVE-2022-49226 affects the Linux kernel's asix USB Ethernet driver. The root cause is that asix_read_cmd() can read fewer bytes than requested, potentially leaving callers with uninitialized data. The fix adds a sanity check to ensure the number of bytes read matches the request and propagates er...

CVE-2022-49257

CVE-2022-49257 affects the Linux kernel and stems from a NULL dereference in watch_queue_set_size() during error cleanup. The code path could call __free_page() on buffers that were not allocated, causing a NULL pointer dereference (observed as a KASAN report in __free_pages). The issue is mitiga...

CVE-2022-49302

CVE-2022-49302 affects the Linux kernel USB host isp116x driver. The vulnerability arises when code fails to check the return value of platform_get_resource(), which can lead to a null pointer dereference if the call returns NULL. The connected documents confirm the issue and state that the fix i...

CVE-2022-49716

CVE-2022-49716 affects the Linux kernel’s irqchip/gic-v3 mechanism. The vulnerability stems from incorrect refcount handling in gic_populate_ppi_partitions: of_get_child_by_name() returns a node pointer with an incremented refcount, and if not properly released, a refcount leak occurs when kcallo...

CVE-2022-49927

CVE-2022-49927: Linux kernel NFSv4 kmemleak when allocating a slot failed. If a slot allocation fails, previously allocated slots must be cleaned up; otherwise, the allocated slots leak (example: unreferenced object 0xffff8881115aa100, size 64). The fix ensures cleanup of all allocated slots on f...

CVE-2023-26605

CVE-2023-26605 affects Linux kernel 6.0.8: a use-after-free in inode_cgwb_move_to_attached (fs/fs-writeback.c) related to __list_del_entry_valid. Documentation indicates CVSS v3.1 base score 7.8 ( HIGH ) with local attack vector, low complexity, and no user interaction. The vulnerability is a loc...

CVE-2023-52781

CVE-2023-52781 concerns the Linux kernel USB config BOS descriptor handling. In usb_get_bos_descriptor(), an iteration issue occurs when skipping USB_DT_DEVICE_CAPABILITY, causing the same descriptor to be read repeatedly. The fix introduces a goto to advance the pointer and bytes read so the fun...

CVE-2023-52988

CVE-2023-52988 — Linux kernel ALSA: hda/via : The issue arises in the HDA VIA path where snd_hda_get_connections() may return a negative error code, allowing an array access with a negative index in add_secret_dac_path(). This can lead to out-of-bounds access of the conn array, with potential imp...

CVE-2024-25740

CVE-2024-25740 describes a memory leak in the Linux kernel UBI driver (drivers/mtd/ubi/attach.c) up to version 6.7.4 for UBI_IOCATT, where kobj->name is not released. The issue affects the kernel code path used to attach UBI devices and is documented with an impact of high on availability. Con...

CVE-2024-26858

CVE-2024-26858 : The issue is in the Linux kernel, specifically the mlx5e/PTP code. A memory-barrier-based fix was applied to ensure that PTP WQ xmit submission tracking occurs after populating the metadata_map. Merely reordering mlx5e_ptp_metadata_map_put and mlx5e_ptpsq_track_metadata in mlx5e_...

CVE-2024-35949

CVE-2024-35949 affects the Linux kernel's btrfs subsystem. The root cause was that WRITTEN was not ensured on all metadata blocks, allowing potential corruption if extended leaf checks were skipped for blocks without WRITTEN. The fix adds checks to ensure WRITTEN is set and guarantees that __btrf...

CVE-2024-41030

The CVE-2024-41030 vulnerability affects the Linux kernel’s ksmbd server: when opening a directory, write access could be inappropriately granted due to flags from the client, causing ksmbd to become incompatible with FUSE filesystems. The fix discards write access during directory opens, address...

CVE-2024-46777

CVE-2024-46777 concerns the Linux kernel udf component where the vulnerability arises from handling partition lengths that could overflow 32-bit block numbers and unsafe indexing of the block bitmap. The connected sources confirm the issue is fixed in kernel code by rejecting mounting filesystems...

CVE-2024-47675

The connected Nessus advisories confirm CVE-2024-47675 affects the Linux kernel and describes the root cause as a use-after-free in bpf_uprobe_multi_link_attach(). If bpf_link_prime() fails, the error_free path frees the array of bpf_uprobe objects without unregistering them, leaking bpf_uprobe-&...

CVE-2024-49900

CVE-2024-49900 (Linux kernel) : Fixes an uninitialized access in jfs/xattr.c where ea_buf->new_ea was not initialized, causing an uninit-value path observed by KMSAN in lzo1x_1_do_compress. The patch initializes the buffer by applying memset at the start of ea_get(), preventing uninitialized w...

CVE-2024-49909

The CVE-2024-49909 vulnerability affects the Linux kernel DRM AMD display path (drm/amd/display) specifically in dcn32_set_output_transfer_func, where a null pointer dereference could occur if set_output_gamma is NULL. The issue arises from dereferencing set_output_gamma after a prior NULL check ...

CVE-2024-50010

CVE-2024-50010 affects the Linux kernel’s exec path checks. The issue is a race in the path_noexec (and i_mode) checks that led to spurious WARN_ON warnings when noexec is toggled, rather than a real permission failure. The fix removes the redundant path_noexec WARN and updates commentary; no exp...

CVE-2024-50112

In CVE-2024-50112, the Linux kernel fixes a weakness in Linear Address Masking (LAM) on x86 by disabling LAM in most cases. The vulnerability stems from transient execution risk related to LAM unless Linear Address Space Separation (LASS) is active. Until LASS support lands, LAM should only be al...

CVE-2024-50118

CVE-2024-50118 relates to the Linux kernel Btrfs remount/RW reconfiguration path. The issue arises during mounting different subvolumes with conflicting RO/RW flags: an initial read-only mount (ro) followed by an attempt to remount a subvolume as read/write, with options/feature checks being skip...

CVE-2024-53151

The CVE-2024-53151 entry concerns Linux kernel svcrdma: an integer overflow in xdr_check_write_chunk() that uses an untrusted segcount to compute a buffer-parse size, potentially triggering a buffer overflow in 32-bit environments. The calculation segcount * rpcrdma_segment_maxsz * sizeof(*p) cre...