CVE-2024-50255

The CVE CVE-2024-50255 affects the Linux kernel Bluetooth stack. A null-ptr-deref in hci_read_supported_codecs can occur due to __hci_cmd_sync_sk() returning NULL for unknown opcodes and the hci_cmd_complete_evt() assuming status from skb->data[0] when an opcode is missing from hci_cc, trigger...

CVE-2025-21688

CVE-2025-21688 : In the Linux kernel, a race between the DRM v3d scheduler and the IRQ execution thread occurs when signaling a fence after a job completes. The patch that assigns the job pointer to NULL after completion can race with run_job() assigning a new job, risking a NULL pointer derefere...

CVE-2022-48938

CVE-2022-48938 affects the Linux kernel CDC-NCM path. The issue arises when a broken device provides an extreme offset (e.g., 0xFFF0) with a plausible fragment length, allowing an integer overflow in the existing sanity check. The description states that both offset and offset + len must be check...

CVE-2022-48990

CVE-2022-48990 affects the Linux kernel (drm/amdgpu) where a use-after-free could occur during GPU recovery due to fw_fence not being initialized before amdgpu_job_free_cb frees a job. The publicly provided details state the fix is in drm/amdgpu: fix use-after-free during gpu recovery, addressing...

CVE-2022-49033

CVE-2022-49033 affects the Linux kernel’s btrfs qgroup code, where a sleep was performed in an invalid context during qgroup inheritance. The advisory and connected documents describe the fix as: call qgroup_dirty() on the destination qgroup and update the limit item in btrfs_run_qgroups() later,...

CVE-2022-49109

CVE-2022-49109 concerns the Linux kernel ceph subsystem. The provided text describes a leak: when ceph_get_inode() searches for or inserts an inode into the hash for a given vino, it returns a reference to the inode and may consume that reference if new is non-NULL. If error handling does not rel...

CVE-2022-49135

CVE-2022-49135 : In the Linux kernel, the vulnerability related to a memory leak in the drm/amd/display path has been resolved. The root cause was failure to release resources on the error handling path, leading to a memory leak. The fix adds a kfree call on the error path to ensure proper resour...

CVE-2022-49268

Summary: CVE-2022-49268 affects the Linux kernel ASoC: SOF Intel path and causes a NULL pointer dereference when ENOMEM occurs during noncontiguous DMA allocations. The issue arises if snd_dma_free_pages() is called after snd_dma_alloc_pages() returns -ENOMEM, leading to a NULL dereference in dma...

CVE-2022-49296

CVE-2022-49296: Linux kernel Ceph deadlock when holding Fwb to get inline_data. The vulnerability arises during cephfs/cephmds inline data handling (inline_version logic) causing a deadlock involving Fwb/Fsr caps during the getattr sequence, potentially locking the system. Connected docs indicate...

CVE-2022-49300

CVE-2022-49300 affects the Linux kernel nbd subsystem. A race occurs when the nbd module is removed: nbd_genl_connect() may call nbd_alloc_config() concurrently, and although try_module_get() can fail, nbd_alloc_config() previously did not handle that. This can cause leakage of nbd_config and rel...

CVE-2022-49535

CVE-2022-49535 affects the Linux kernel SCSI lpfc path. The flaw can cause a use-after-free via premature node release when FLOGI/PLOGI handling fails or when non-zero ELS PLOGI status is processed if a dev-loss-evt work is pending. The described root cause is a premature decrementing of the ndlp...

CVE-2022-49697

CVE-2022-49697 concerns a leak in the Linux kernel caused by a BPF lookup path that could leak a request_sock. The issue occurs when a BPF program performs a socket lookup that takes a refcnt on the socket and, after locating the child request_socket, returns the parent LISTEN socket via sk_to_fu...

CVE-2022-49860

CVE-2022-49860 : The provided connected documents describe a Linux kernel vulnerability in the dmaengine: ti: k3-udma-glue subsystem, where a memory leak could occur if device_register() fails. The root cause is that, on failure, the code should call put_device() to release a reference, and the n...

CVE-2022-49924

CVE-2022-49924 : In the Linux kernel NFC fdp path, fdp_nci_send() calls fdp_nci_i2c_write() which may not free the skb, causing a memory leak when the I2C write completes. The public impact is a potential memory leak affecting kernel availability (CVSS base 5.5, HIGH for availability) with no imp...

CVE-2023-3865

CVE-2023-3865 affects the ksmbd component of the Linux kernel (smb2_write). Root cause: ksmbd_smb2_check_message does not validate hdr->NextCommand; if NextCommand > Offset+Length of smb2 write, an oversized length allows an out-of-bounds read in smb2_write. Implication: out-of-bounds read ...

CVE-2023-52586

CVE-2023-52586 : In the Linux kernel DRM MSM DPU, a race between vblank enable/disable from different threads existed due to missing synchronization. The fix adds a mutex around control vblank IRQ handling (and removes vblank_ctl_lock usage), replacing an atomic refcount with a simple int counter...

CVE-2023-53046

CVE-2023-53046 describes a race condition between hci_cmd_sync_work and hci_cmd_sync_clear in the Linux kernel Bluetooth subsystem, which can lead to a use-after-free and potentially a kernel panic. The issue arises when hci_cmd_sync_work is queued after a cancel_work_sync, allowing the cmd_sync_...

CVE-2023-53051

CVE-2023-53051 affects the Linux kernel dm-crypt write path. The vulnerability arises because the dmcrypt_write() loop could run for an unbounded amount of time, risking a soft lockup. The approved fix adds cond_resched() to dmcrypt_write() to yield CPU and prevent long uninterruptible runs. Expl...

CVE-2023-53103

CVE-2023-53103 affects the Linux kernel bonding subsystem. A bug in the enslave/error path could clear the bond’s IFF_SLAVE/IFF_MASTER flags when an enslave of a non-ethernet device fails, causing inconsistent bond state. The fix uses bond_ether_setup to restore the bond’s flags correctly, ensuri...

CVE-2024-26710

CVE-2024-26710 affects the Linux kernel on PowerPC with KASAN. The issue was that KASAN’s thread stack size increase was doubled, which could push a 32KB stack to 64KB and trigger build errors (arch/powerpc/kernel/switch.S). The resolved approach limits the stack size increase to cases where the ...

CVE-2024-26970

In the Linux kernel, the following vulnerability has been resolved: clk: qcom: gcc-ipq6018: fix terminating of frequency table arrays The frequency table arrays are supposed to be terminated with anempty element. Add such entry to the end of the arrays where itis missing in order to avoid possibl...

CVE-2024-27435

CVE-2024-27435 refers to a Linux kernel issue where NVMe over RDMA reconnection could fail forever due to an ABBA deadlock caused by reserved tag allocation in the admin queue. The root cause was a single reserved tag held by a keep-alive operation, which blocked a required tag for the connect co...

CVE-2024-35917

CVE-2024-35917 (Linux kernel, s390/bpf) details from connected Azure Linux Nessus entry show the issue arises from GCC reordering memcpy() after assignments in bpf_jit_plt(), causing NULL pointers to be written instead of the intended return/target addresses. Root cause is GCC alias-analysis misc...

CVE-2024-35955

The Linux kernel is vulnerable to a use-after-free issue during kprobe registration due to a race condition during module unloading. When a module transitions from MODULE_STATE_LIVE to MODULE_STATE_GOING and finally MODULE_STATE_UNFORMED, separate calls to is_module_text_address() and __module_te...

CVE-2024-35992

CVE-2024-35992 : Linux kernel vulnerability in marvell a3700-comphy driver exposes an out-of-bounds read of gbe_phy_init_fix[fix_idx].addr; after fix_idx reaches ARRAY_SIZE(gbe_phy_init_fix), an iteration may read beyond, unless gbe_phy_init[addr] is used when all elements of gbe_phy_init_fix are...

CVE-2024-36009

CVE-2024-36009 affects the Linux kernel ax25 subsystem where the netdev refcount issue was caused by using the wrong tracker during device detachment. The technical details show that a dev_tracker was attached to ax25_cb in ax25_bind(), and upon detachment the tracker for ax25_cb must be dealloca...

CVE-2024-38659

The CVE-2024-38659 issue affects the Linux kernel enic driver: enic_set_vf_port assumes fixed lengths for nl attributes (IFLA_PORT_PROFILE, IFLA_PORT_INSTANCE_UUID, IFLA_PORT_HOST_UUID) and validates them via nla_policy. The policy uses IFLA_PORT_PROFILE as NLA_STRING, IFLA_PORT_INSTANCE_UUID as ...

CVE-2024-42263

CVE-2024-42263 (Linux kernel) : The drm/v3d component had a memory-leak in the timestamp extension when userspace memory fetch failed in the main loop, leaking drm_syncobjs up to that point due to missing drm_syncobj_put. A fix exports and uses a common cleanup helper to correctly release resourc...

CVE-2024-43859

CVE-2024-43859 affects the Linux kernel with the f2fs filesystem. The root cause is an uninitialized inode.i_crypt_info during mount paths that involve f2fs_gc/truncate, leading to a NULL pointer dereference in fscrypt-related code when handling preallocated blocks. The documented mitigation is t...

CVE-2024-44998

CVE-2024-44998 (Linux kernel) is confirmed in multiple sources. Affects the Linux kernel’s ATM stack (idt77252) where a use-after-free could occur in dequeue_rx after skb is released post vcc->push. Connected advisories note the issue across several distributions and provide concrete fixes: De...

CVE-2024-46737

CVE-2024-46737: Linux kernel nvmet-tcp vulnerability fixed. If nvmet_tcp_alloc_cmds() fails, a NULL pointer dereference could crash the kernel in nvmet_tcp_release_queue_work(). The fix sets queue->nr_cmds to zero when allocation of commands fails; affected component is nvmet-tcp in the Linux ...

CVE-2024-46744

The CVE-2024-46744 issue in the Linux kernel affects Squashfs by failing to sanity-check the symbolic link size read from disk. This causes the size (i_size) to be corrupted, which is later used to derive a length value that overflows a signed int in squashfs_symlink_read_folio(), leading to a po...

CVE-2024-46772

CVE-2024-46772 affects the Linux kernel (drm/amd/display). The vulnerability arises from not guarding the denominator crb_pipes before use, risking a divide-by-zero. The patch fixes two divide-by-zero issues by ensuring the denominator is checked prior to its use, and is noted as resolved in down...

CVE-2024-46861

CVE-2024-46861 - Linux kernel USB net driver (usbnet/ipheth) : The issue arises when RX callbacks fail in usbnet ipheth; causes could be payload too short, incorrect payload framing (e.g., bad NCM framing), or memory pressure. These failures previously could cause the driver to seize up. The docu...

CVE-2024-47666

CVE-2024-47666 is a Linux kernel vulnerability in the SCSI pm80xx driver. The bug arises when pm8001_phy_control() stores enable_completion on a stack address, sends resets, waits 300 ms, then returns; if a late PHY control response arrives after the 300 ms, a dangling enable_completion pointer i...

CVE-2024-47690

The CVE-2024-47690 entry concerns the Linux kernel f2fs component. The vulnerability arises from the online repair mechanism for corrupted directories in f2fs_lookup(), which can generate dirty data/meta during races with readonly remount. This can leave dirty inodes after the filesystem becomes ...

CVE-2024-47741

In CVE-2024-47741, the Linux kernel’s btrfs code had a race when multiple threads perform lseek (SEEK_DATA/SEEK_HOLE) on the same file descriptor. The bug stems from find_desired_extent() grabbing the file’s private_data while it may be NULL, allowing two threads to allocate separate file private...

CVE-2024-49905

CVE-2024-49905 refers to a fix in the Linux kernel’s AMD GPU driver code, specifically for the DRM/AMD display path. The vulnerability arose from using the variable afb in amdgpu_dm_plane_handle_cursor_update without a null check; the commit added a null check to prevent potential null pointer de...

CVE-2024-49907

CVE-2024-49907 : Linux kernel DRM/AMD display vulnerability where a NULL dereference can occur by dereferencing dc->clk_mgr in the idle-power path if it is NULL. The fix adds a NULL check before calling dc->hwss.apply_idle_power_optimizations (which may call dcn35_apply_idle_power_optimizat...

CVE-2024-49921

CVE-2024-49921 concerns the Linux kernel DRM display driver (drm/amd/display) specifically around null-pointer usage; fixes were applied to ensure pointers such as dc->clk_mgr are checked before use, addressing 10 FORWARD_NULL issues reported by Coverity. The connected OSV entries confirm patc...

CVE-2024-50012

The CVE-2024-50012 issue is in the Linux kernel cpufreq code. In parse_perf_domain, if of_parse_phandle_with_args returns an error, the initial reference to the CPU device node would not be decremented, potentially leaving a reference handling bug. The fix declares the CPU node variable with a cl...

CVE-2024-50223

CVE-2024-50223: In Linux kernel sched/numa, a potential null pointer dereference in task_numa_work() could occur when a stress scenario unmapped a child address space, causing vma_next() to return NULL. The backtrace shows dereferencing a NULL vma in vma_migratable, leading to a crash. Root cause...

CVE-2024-50242

CVE-2024-50242 affects the Linux kernel ntfs3 implementation. The issue is described as an “Additional check in ntfs_file_release” in the ntfs_file_release path, with CVSSv3.1: LOCAL, Low attack complexity, Low privileges required, UI: None, S:U, and metrics indicating high confidentiality, integ...

CVE-2024-50249

Mode C: Concrete details found. The CVE-2024-50249 issue in the Linux kernel arises from a lock-ordering problem in the CPPC/ACPI code: sugov_update_shared acquires a raw_spinlock while cpc_write holds a regular spinlock on cpc_ptr->rmw_lock, potentially causing a deadlock. The remediation is ...

CVE-2024-53067

The CVE-2024-53067 entry relates to the Linux kernel SCSI/UFS subsystem. A fix prevents RTC update work from starting before runtime PM in the UFS driver is fully initialized, addressing a crash (Oops) observed in the ufshcd_rtc_work path. The core issue is a race/ordering problem that could trig...

CVE-2024-53106

CVE-2024-53106 concerns the Linux kernel ima subsystem: a buffer overrun in ima_eventdigest_init_common triggered by HASH_ALGO__LAST indexing hash_digest_size[]. Root cause is inadequate handling of HASH_ALGO__LAST; a conditional prevents the overread. A fix is included in kernel updates (commit ...

CVE-2024-54456

CVE-2024-54456 : Linux kernel NFS path vulnerability in nfs_sysfs_link_rpc_client() leading to potential buffer overflow due to strcat on cl_program->name; fix replaces with strscpy() and strncat() (kernel-side patch). Affected: Linux kernel NFS subsystem; root cause: unbounded name field size...

CVE-2024-56588

CVE-2024-56588 (Linux kernel) affects the hisi_sas driver. The issue arises when dump files are created on the fly during debugfs dump, which leads to a NULL pointer dereference and kernel hang if the driver is unbound while dumping. The root cause is allocating memory and creating debugfs entrie...

CVE-2024-56766

The CVE-2024-56766 issue affects the Linux kernel’s MTD/NAND path (mtd: rawnand) with a double-free in atmel_pmecc_create_user(). The root cause is allocating the user object with kzalloc() and then freeing it with kfree() after converting the allocation to devm_kzalloc(), leading to a use-after-...

CVE-2025-21707

CVE-2025-21707 affects the Linux kernel MPTCP implementation. The issue stems from how MPTCP maintains received suboption status as a bitmask and per-suboption info. Zeroing the status bitmask on parse isn’t sufficient; some per-suboption bitfields aren’t cleared/initialized for certain parsed su...