CVE-2024-57975

In the Linux kernel, the following vulnerability has been resolved: btrfs: do proper folio cleanup when run_delalloc_nocow() failed [BUG]With CONFIG_DEBUG_VM set, test case generic/476 has some chance to crashwith the following VM_BUG_ON_FOLIO(): BTRFS error (device dm-3): cow_file_range failed, ...

CVE-2024-57976

In the Linux kernel, the following vulnerability has been resolved: btrfs: do proper folio cleanup when cow_file_range() failed [BUG]When testing with COW fixup marked as BUG_ON() (this is involved with thenew pin_user_pages*() change, which should not result new out-of-banddirty pages), I hit a ...

CVE-2025-38034

CVE-2025-38034 : The connected Azure Linux 3.0 Nessus entry confirms a Linux kernel issue affecting btrfs paths where btrfs__prelim_ref calls wrong order of oldref/newref, causing a NULL pointer dereference in trace_btrfs_prelim_ref_insert(). The backtrace shows the call path ending in prelim_ref...

CVE-2025-38066

CVE-2025-38066 affects the Linux kernel in the dm-cache subsystem (policy SMQ). The issue arises when a cache device fails to resume due to mapping errors and a resumed operation is retried, which can leave a partially initialized policy object and trigger a BUG_ON during mapping reload. The conn...

CVE-2025-38344

CVE-2025-38344 relates to ACPICA in the Linux kernel where ACPI cache leaks were fixed. Technical details in connected docs show memory leaks in Acpi-State, Acpi-Parse, and Acpi-parse_ext caches due to merging of slabs and use of KMEM cache flags (SLAB_NEVER_MERGE). The root cause was leaks in ea...

CVE-2025-38406

CVE-2025-38406 affects the Linux kernel wifi driver ath6kl: the vulnerability originates from an unnecessary WARN_ON() when firmware input is bad. The description clarifies that bad firmware input is unrelated to the driver stack and does not constitute an exploitable condition; the fix instead p...

CVE-2021-47083

CVE-2021-47083 affects the Linux kernel’s pinctrl Mediatek code: when the eint virtual EINT number exceeds the GPIO count, it can trigger a global-out-of-bounds write to desc[eint_n]. The issue was fixed in the mediatek pinctrl path (pinctrl: mediatek: fix global-out-of-bounds issue). No exploit ...

CVE-2021-47577

In the Linux kernel, the following vulnerability has been resolved: io-wq: check for wq exit after adding new worker task_work We check IO_WQ_BIT_EXIT before attempting to create a new worker, andwq exit cancels pending work if we have any. But it's possible to havea race between the two, where c...

CVE-2022-48734

CVE-2022-48734 affects the Linux kernel in the btrfs subsystem. The issue is a deadlock caused by quota disable interactions with the qgroup rescan worker and other transactions (e.g., block group relocation) when quota is disabled. The described sequence involves Task A starting a transaction an...

CVE-2022-48849

CVE-2022-48849 affects the Linux kernel (drm/amdgpu) where tiling flag checks were bypassed in the virtual display path. The issue arises in framebuffer initialization when VKMS virtual display is enabled and VKMS does not support FB modifiers, potentially allowing a local attacker to bypass expe...

CVE-2022-49457

CVE-2022-49457 is a Linux kernel issue in ARM versatile: missing of_node_put in dcscb_init. The of_find_compatible_node call increments the device_node refcount, but the code path did not release it, causing a refcount leak. Connected advisories from Astra/TencentUnity/Linux OSS bulletins confirm...

CVE-2022-50012

CVE-2022-50012 affects the Linux kernel on 64-bit PowerPC (powerpc/64). The root cause is that jump_label_init() is invoked in setup_feature_keys() too late, since static keys may be used by subroutines of parse_early_param(), which itself is a subroutine of early_init_devtree(). The result is th...

CVE-2023-23005

The CVE-2023-23005 issue affects the Linux kernel prior to 6.2. It occurs in mm/memory-tiers.c where alloc_memory_type is misinterpreted (treating an error pointer as NULL in the error case), potentially enabling an availability impact. The root cause is the incorrect handling of the alloc_memory...

CVE-2009-3001

Technical details about CVE-2009-3001 are not provided in the connected documents; the initial description states a kernel infoleak via getsockname on AF_LLC, but no vendor/product/version specifics or fixes are included. Monitor for updates.

CVE-2022-49108

CVE-2022-49108 concerns the Linux kernel Mediatek clock driver, where memory leaks occur on probe due to not freeing memory in error handling paths. The vulnerability is resolved by handling error branches to free allocated memory, addressing a resource leak (Coverity ID 1491825). Connected sourc...

CVE-2022-49117

The CVE-2022-49117 issue is in the Linux kernel (mips/ralink): a refcount leak in ill_acc_of_setup() that requires of_node_put(np) when pdev == NULL. The vulnerability is addressed by applying the fix that ensures proper reference counter management, preventing the leak and potential use-after-fr...

CVE-2022-49681

The CVE-2022-49681 issue in the Linux kernel concerns xtensa: xtfpga setup where of_find_compatible_node() may return a node with an incremented refcount. The fix is to call of_node_put() when the node is no longer in use to prevent a refcount leak. Public advisories (Tencent/Unity Linux integrat...

CVE-2022-50086

The CVE CVE-2022-50086 concerns a Linux kernel issue where concurrent writes to io cost qos (rq_qos) could cause the same rq_qos type to be added twice to a disk, leading to list walk corruption and potential crashes. Connected advisories (EulerOS/Nessus entries) reference the same description an...

CVE-2023-53040

CVE-2023-53040 (Linux kernel) is a local-bypass buffer-overflow vulnerability caused by the ca8210 patch: it fixes a negative mac_len array access that could overflow skb->data when ieee802154_hdr_peek_addrs() fails. Affected: Linux kernel code handling ieee802.154 headers. Impact per provided...

CVE-2024-40918

In the Linux kernel, the following vulnerability has been resolved: parisc: Try to fix random segmentation faults in package builds PA-RISC systems with PA8800 and PA8900 processors have had problemswith random segmentation faults for many years. Systems with earlierprocessors are much more stabl...

CVE-2025-38430

This CVE-2025-38430 affects the Linux kernel and is addressed by a patch that makes nfsd4_spo_must_allow() verify that the RPC procedure is NFSPROC4_COMPOUND. If the request is not a v4 compound, examining cstate could yield undefined results; the patch enforces the proper rq_procinfo for v4 comp...

CVE-2008-2729

CVE-2008-2729 affects the Linux kernel before 2.6.19 on some AMD64 systems. The issue is in arch/x86_64/lib/copy_user.S where, after a kernel memory copy exception, destination memory locations aren’t erased, potentially letting a local user read residual data. Impact: local information disclosur...

CVE-2011-2700

CVE-2011-2700 affects the Linux kernel prior to 2.6.39.4 on the N900 platform, where multiple buffer overflows in si4713_write_econtrol_string (drivers/media/radio/si4713-i2c.c) can be triggered by a crafted s_ext_ctrls operation using V4L2_CID_RDS_TX_PS_NAME or V4L2_CID_RDS_TX_RADIO_TEXT. The is...

CVE-2012-0055

CVE-2012-0055 concerns OverlayFS in the Linux kernel, affected in versions before 3.0.0-16.28 (as used in Ubuntu 10.04 LTS and 11.10). The vulnerability stems from missing inode security checks in OverlayFS, enabling an attacker to bypass security restrictions and perform unauthorized actions. Th...

CVE-2021-47340

CVE-2021-47340 is a Linux kernel vulnerability in the JFS subsystem. The issue arises when diFree() processes an inode without a valid ipimap, causing a NULL dereference via JFS_IP(ipimap) and leading to a GFP-related fault. The fix prevents passing an inode with IPIMAP == NULL to diFree, avoidin...

CVE-2022-49067

CVE-2022-49067 is about a Linux kernel issue where virt_addr_valid() incorrectly returned true for vmalloc addresses in 64-bit Book3E (and related 32-bit behavior). Investigations across multiple advisories (NVD, Red Hat, Debian OSV, Unity/NASL/Nessus plugins) describe the root cause: __pa() can ...

CVE-2022-49993

CVE-2022-49993 affects the Linux kernel loop subsystem. The vulnerability stems from overflow when configuring a loop via ioctl: the code copies info->lo_offset (loop_info64) into lo_offset (loff_t), enabling an overflow that can trigger a warning in iomap_iter() (via iomap_iter_done). The iss...

CVE-2024-26911

In the Linux kernel, the following vulnerability has been resolved: drm/buddy: Fix alloc_range() error handling code Few users have observed display corruption when they bootthe machine to KDE Plasma or playing games. We have rootcaused the problem that whenever alloc_range() couldn'tfind the req...

CVE-2025-38204

CVE-2025-38204 affects the Linux kernel’s JFS filesystem. The issue is an array-index-out-of-bounds read in add_missing_indices, where stbl (s8) must map to offsets 0–127. A bound check was added and -EIO is returned if the check fails; jfs_readdir is also updated to propagate errors from add_mis...

CVE-2011-2898

CVE-2011-2898 concerns the Linux kernel AF_PACKET implementation. The flaw allows local users to read potentially sensitive kernel memory by exploiting inadequate restrictions on VLAN Tag Control Information data structures. The vulnerability is described as a kernel information leak in the AF_PA...

CVE-2017-18552

CVE-2017-18552 affects the Linux kernel up to version 4.10 in net/rds/af_rds.c, where rds_recv_track_latency contains an out-of-bounds write and read. The connected Nessus advisories (Unity Linux UTSA advisories) mirror this issue and reference kernel versions before 4.11, with a commit in the Li...

CVE-2022-48671

CVE-2022-48671 affects the Linux kernel in the cgroup subsystem: a missing cpus_read_lock() in cgroup_attach_task_all() allowed a deadlock with threadgroup_rwsem, mitigated by adding cpus_read_lock() (aligned with cgroup_procs_write_start()). The issue was observed by syzbot at cpuset_attach() an...

CVE-2022-48706

The CVE-2022-48706 entry concerns the Linux kernel and a memory-leak in the virtual data path (vdpa) IFCVF path. Root cause: ifcvf_mgmt_dev leaks memory if not freed on exit and the existing cleanup in ifcvf_init_hw does not handle it, so the fix adds proper cleanup at the return path to ensure m...

CVE-2022-49077

CVE-2022-49077 — Linux kernel : A vulnerability where an mremap(old_size=0) path could reach move_page_tables() and trigger unnecessary invalidate_range_start()/invalidate_range_end() on an empty range, causing a WARN in KVM mmu_notifier. The published fix is to short‑circuit with an early return...

CVE-2022-49762

CVE-2022-49762: In the Linux kernel, ntfs_attr_find() can overflow when iterating ATTR_RECORDs in MFT records, due to adding le32_to_cpu(a->length) to the current pointer and wrapping on 32‑bit systems. A patch adds bounds checks when computing the end address of the current ATTR_RECORD to pre...

CVE-2022-49937

CVE-2022-49937 affects the Linux kernel mceusb driver in the media subsystem. Automatic fuzzing reported a WARN due to an unusual read on endpoint 0 caused by using legacy usb_control_msg_() routines and not setting USB_DIR_IN in bRequestType. The fix converts the driver to usb_control_msg_recv()...

CVE-2022-50011

The CVE-2022-50011 issue affects the Linux kernel code path used by the Venus driver, where the OPP (Operating Performance Points) core warns during probe due to misordered configuration options. The root cause is that the OPP core expects all configuration options to be provided before the OPP t...

CVE-2022-50084

CVE-2022-50084 - Kernel dm-raid KASAN warning fix Context: Linux kernel vulnerability resolved in the dm-raid area, where an AddressSanitizer slab-out-of-bounds read could occur in raid_status. The fault manifested as a read of 4 bytes from conf->max_nr_stripes when mddev->private was cast ...

CVE-2011-1169

CVE-2011-1169 affects the Linux kernel before 2.6.38.1 via an array index error in the AudioScience HPI driver (sound/pci/asihpi/hpioctl.c) that can memory-corrupt local kernel data and may allow local privilege escalation. Connected advisories (SUSE/Ubuntu) confirm the root cause and impact, wit...

CVE-2011-4594

The CVE-2011-4594 entry documents a local kernel vulnerability in the Linux kernel (__sys_sendmsg in net/socket.c) where crafted usage of sendmmsg can trigger an incorrect pointer dereference and crash the system. It affects kernel versions before 3.1, with the described impact being a denial of ...

CVE-2014-5045

CVE-2014-5045 – Linux kernel mountpoint_last bug (pre-3.15.8) Affected: Linux kernel versions prior to 3.15.8.Root cause: The mountpoint_last function in fs/namei.c does not properly maintain a reference count when unmount is used in conjunction with a symlink.Impact: Local users could cause deni...

CVE-2021-47233

Summary of CVE-2021-47233 (Linux kernel): The issue is a NULL pointer dereference in regulator rt4801 when priv->enable_gpios is NULL, with devm_gpiod_get_array_optional possibly returning NULL if no GPIO is assigned. The vulnerability has been resolved in the Linux kernel; multiple advisories...

CVE-2022-48769

In CVE-2022-48769, the Linux kernel vulnerability concerns Apple x86 EFI runtime services. The issue stems from a call to QueryVariableInfo() (added with EFI 2.00) used at runtime, which could crash firmware on certain Apple machines when managing NVRAM variables. The mitigation described is to a...

CVE-2022-49496

The CVE-2022-49496 entry concerns the Linux kernel Mediatek vcodec driver (mtk_vcodec_dec). If the driver runs in subdev mode, dev->pm.dev can be NULL during mtk_vcodec_dec_remove, causing a kernel crash on rmmod mtk-vcodec-dec.ko. All connected documents describe the crash scenario and indica...

CVE-2022-49738

Summary (CVE-2022-49738) : In the Linux kernel’s f2fs subsystem, a sanity check missing for .i_extra_isize in is_alive() leads to a potential slab-out-of-bounds access in data_blkaddr during garbage collection, as observed in the f2fs_gc path (gc_data_segment -> is_alive -> data_blkaddr -&g...

CVE-2022-49834

CVE-2022-49834 concerns a use-after-free in nilfs2 when downgrading to read-only and remounting read/write, risking access to a freed nilfs_writer. The issue arises during a race between log-writer detachment and remount/downgrade, potentially allowing a Task1 thread to dereference a freed pointe...

CVE-2023-3359

CVE-2023-3359 concerns the Linux kernel’s brcm_nvram_parse in drivers/nvmem/brcm_nvram.c, where the return value of kzalloc() is not checked, potentially causing a NULL pointer dereference. The issue is listed with a local attack vector and a high availability impact (CVSS v3.1: AV:L/AC:L/PR:L/UI...

CVE-2023-52900

CVE-2023-52900: Linux kernel nilfs2 vulnerability in nilfs_btree_insert() can cause a general protection fault when a corrupted disk image leads __nilfs_btree_get_block() to return -ENOENT. The patch changes this to -EINVAL, causing subsequent b-tree operations to report corruption and return -EI...

CVE-2023-52936

CVE-2023-52936 affects the Linux kernel, specifically the irqdomain.c path where debugfs_lookup() results were not being released with dput(), causing a memory leak over time. The advisory notes the fix is to replace the call with debugfs_lookup_and_remove(), which handles the necessary cleanup i...

CVE-2024-42071

In the Linux kernel, the following vulnerability has been resolved: ionic: use dev_consume_skb_any outside of napi If we're not in a NAPI softirq context, we need to be carefulabout how we call napi_consume_skb(), specifically we need tocall it with budget==0 to signal to it that we're not in asa...