CVE-2022-50373

CVE-2022-50373: Linux kernel patch for fs/dlm lowcomms races. A race between queue_work() in _dlm_lowcomms_commit_msg() and srcu_read_unlock() could let a dlm_msg be freed with msg->idx containing garbage. A fix adds an extra reference count between dlm_lowcomms_new_msg() and dlm_lowcomms_comm...

CVE-2023-53406

The CVE-2023-53406 issue affects the Linux kernel’s USB gadget code (pxa25x_udc), where using debugfs_lookup() without balancing dput() could leak memory over time. The advisory describes the root cause as a memory-leak condition and recommends replacing the pattern with debugfs_lookup_and_remove...

CVE-2010-2653

CVE-2010-2653 concerns a race condition in the Linux kernel’s hvc_close function (drivers/char/hvc_console.c). The vulnerability affects Linux kernels before 2.6.34 and can enable a local attacker to cause a denial of service or potentially other impact by closing a Hypervisor Virtual Console dev...

CVE-2023-53285

CVE-2023-53285 : in the Linux kernel ext4, a bounds-check fix was added in get_max_inline_xattr_value_size() to prevent reading beyond allocated memory if the inode table is corrupted by block-device writes while mounted. This resolves a potential memory read issue in inline xattrs. Impact: HIGH ...

CVE-2023-53288

CVE-2023-53288 relates to a memory leak in the Linux kernel’s DRM subsystem. The issue occurs in drm/client: when a new mode is assigned to modeset->mode, the previously configured mode is not freed, leading to a kmemleak report chain (drm_mode_duplicate → drm_client_modeset_probe → __drm_fb_h...

CVE-2022-50400

The CVE-2022-50400 issue concerns the Linux kernel greybus: audio_helper code, where debugfs usage was removed due to incorrect handling that could leak memory and even erase all debugfs entries. The fix is to remove all debugfs logic from the audio_helper code; if needed later, a fix for the inc...

CVE-2026-31581

CVE-2026-31581 affects the Linux kernel ALSA 6fire USB audio driver. The issue is a use-after-free in usb6fire_chip_abort() where the chip structure is allocated as the card’s private data and, after snd_card_free_when_closed() frees the card (when no file handles are open), a later write to chip...

CVE-2026-31582

CVE-2026-31582 affects the Linux kernel hwmon powerz driver. A use-after-free occurs when a USB disconnect frees the URB and mutex, and a subsequent powerz_read() can dereference the freed URB in powerz_read_data(). The fix, as described across sources, is to set priv->urb to NULL in powerz_di...

CVE-2025-38709

CVE-2025-38709 affects the Linux kernel loop device where changing the loop block size while a filesystem is mounted can cause a block-size mismatch between the loop device and the superblock, triggering warnings such as in __getblk_slow(). The issue is remedied by obtaining an exclusive hold on ...

CVE-2021-4460

CVE-2021-4460 affects the Linux kernel drm/amdkfd path. The issue is a UBSAN shift-out-of-bounds warning when get_num_sdma_queues or get_num_xgmi_sdma_queues is 0, causing a shift by the operand’s bit width (undefined behavior). The fix changes the code to set num_sdma_queues or num_xgmi_sdma_que...

CVE-2022-50410

CVE-2022-50410 pertains to the Linux kernel NFSD component handling NFSv2 READ. The issue arises from the historical optimization that combines the RPC receive and send buffers into a single page array, shrinking the send buffer when a large RPC Call is received. A client can trigger this shrinka...

CVE-2022-50411

CVE-2022-50411 concerns the Linux kernel. A use-after-free vulnerability occurs in the ACPI sub-system: after a failed invocation of acpi_ds_call_control_method(), the thread’s next_walk_state is freed but not popped, causing acpi_ps_parse_aml() to obtain an invalid current walk state. The fix ma...

CVE-2023-53414

The CVE-2023-53414 entry affects the Linux kernel scsi: snic driver. The root cause is a memory leak when using debugfs_lookup() because the returned object required a dput(), which could leak over time. The advisory notes a fix by using debugfs_lookup_and_remove() instead, which handles the look...

CVE-2026-43057

CVE-2026-43057 concerns the Linux kernel networking stack. The issue arises in how IPv6 traffic with extension headers or with no inner IP protocol is processed when using IPV6_CSUM GSO fallback. The fix, described in the CVE entry and corroborated by Debian/Red Hat advisories, changes the fallba...

CVE-2026-43171

The CVE-2026-43171 described affects the Linux kernel EFI/CPER component where cper_print_fw_err() does not validate the error-record length against the given offset, allowing an underflow that can cause dumping of large memory regions. Consequences include potential data disclosure and system in...

CVE-2022-50381

CVE-2022-50381 targets the Linux kernel mempool_free crash observed during mdend/mempool usage in environments such as EulerOS and Unity Linux. The root cause is a race between wake-up of pending_writes and the subsequent free of bios (bio) in mempool_free, where bio_put could race with other act...

CVE-2023-53213

The CVE-2023-53213 issue affects the Linux kernel brcmfmac driver, causing a slab-out-of-bounds read in kmemdup called from brcmf_get_assoc_ies when assoc_info->req_len (from a USB URB) exceeds WL_EXTRA_BUF_MAX. The advisory states this was fixed by adding a size check for req_len/resp_len in ...

CVE-2023-53359

CVE-2023-53359 affects the Linux kernel and fixes a memory-leak in debugfs_lookup(). The issue occurs when the result of debugfs_lookup() is not paired with a dput(), allowing memory to leak over time. The workaround introduced in the patch is to call debugfs_lookup_and_remove(), which handles al...

CVE-2023-53429

CVE-2023-53429 concerns the Linux kernel's btrfs __extent_writepage path. The issue arises because __extent_writepage could set PageError on any error and the submission context might see that flag if the end I/O handler also touched PageError, risking leakage of error state into the submission c...

CVE-2012-0058

The CVE-2012-0058 issue affects the Linux kernel up to version 3.2.2, in the kiocb_batch_free function of fs/aio.c, caused by incorrect iocb management. It allows local attackers to cause a denial of service (OOPS). Impact is confined to local execution, with availability as the primary effect de...

CVE-2022-50408

The CVE-2022-50408 entry concerns a use-after-free in brcmfmac within the Linux kernel when handling wifi transmission in brcmf_netdev_start_xmit(). The vulnerability can allow a schedule race between brcmf_proto_tx_queue_data and updating skb stats, leading to a use-after-free observed by KASAN....

CVE-2023-53417

CVE-2023-53417 affects the Linux kernel USB sl811 path. The issue is a memory leak that occurs when debugfs_lookup() is used without releasing the result with dput(). The published fix replaces this flow with debugfs_lookup_and_remove(), which handles the required cleanup in one step. The connect...

CVE-2022-50328

CVE-2022-50328 affects the Linux kernel component jbd2. It describes a use-after-free in jbd2_fc_wait_bufs caused by using bh after releasing the buffer head reference, with the recommended fix: validate uptodate status of the buffer before putting the buffer head reference count. The incident is...

CVE-2023-53173

In CVE-2023-53173, the Linux kernel tty pcn_uart driver had a memory leak when using debugfs_lookup() because the returned object wasn’t always released with dput(). The recommended fix is to call debugfs_lookup_and_remove() to perform the lookup and cleanup in one step, mitigating the leak.

CVE-2023-53432

CVE-2023-53432 : Linux kernel vulnerability in the FireWire net path (firewire: net: fix use after free in fwnet_finish_incoming_packet()). The netif_rx() path frees the skb, so dereferencing skb->len could use freed memory. The incident is reported as resolved in the provided description; no ...

CVE-2025-38705

CVE-2025-38705: In the Linux kernel, writing a string without delimiters to gpu_od/fan_ctrl or pp_power_profile_mode for the CUSTOM profile can cause a NULL pointer dereference in drm/amd/pm. SUSE/OpenSUSE advisories (e.g., SUSE-SU-2025:03600-1) list this alongside many other kernel fixes and ind...

CVE-2026-46017

CVE-2026-46017 involves a Linux kernel race in the migration path for folios. The vulnerability stems from a deferred split queue race during migrate_folio_move(): dst can become visible and then be requeued too late, allowing a concurrent rmap-removal path to mark dst partially mapped and trigge...

CVE-2023-53321

CVE-2023-53321 affects the Linux kernel wireless stack, specifically wifi: mac80211_hwsim. The issue arises when short frames are processed in ways that could forward incomplete 3-address headers, risking access to invalid memory if shorter frames slip through (even though some control frames lik...

CVE-2023-53322

CVE-2023-53322 in the Linux kernel affects the scsi qla2xxx driver. The issue arises when terminate_rport_io does not wait for all IOs to return, risking a use-after-free and potential resource leakage leading to a system crash. The connected advisories (EulerOS/RHEL) list this CVE among kernel f...

CVE-2023-53405

CVE-2023-53405 concerns the Linux kernel USB gadget gr_udc: a memory leak that occurs when debugfs_lookup() is used without proper cleanup. The vulnerability arises because the result of debugfs_lookup() must be released with dput(), else memory leaks accumulate over time. The fixed approach in t...

CVE-2023-53413

CVE-2023-53413 concerns a memory leak in the Linux kernel USB isp116x driver triggered by debugfs_lookup() usage. The issue arises because the result from debugfs_lookup() must be released with dput(), and if not, memory leaks accrue over time. The referenced fix replaces the call path with debug...

CVE-2025-39781

CVE-2025-39781 concerns the Linux kernel on the PA-RISC (parisc) architecture. The issue is described as the removal of a WARN_ON_ONCE() from flush_cache_vmap in the parisc code path, with observed warnings that could occasionally trigger. The available documents do not detail any exploit vectors...

CVE-2023-53150

CVE-2023-53150 is a Linux kernel issue reported as resolved, affecting the kernel’s SCSI qla2xxx path. The vulnerability arises when a NULL pointer rport may be dereferenced in fc_bsg_to_rport(); the fix adds a validation step to ensure rport is non-NULL before dereferencing. EulerOS security adv...

CVE-2023-53305

The CVE-2023-53305 entry refers to a Linux kernel vulnerability in Bluetooth L2CAP that fixes a use-after-free condition in l2cap_le_command_rej. The issue is described as a use-after-free (UAF) in Bluetooth code, leading to potential impact with a CVSSv3.1 score of 7.8 (HIGH) and a LOCAL attack ...

CVE-2023-53404

CVE-2023-53404 relates to the Linux kernel USBFotg210 driver where a memory leak can occur when using debugfs_lookup() without releasing the result. The memory must be released with dput(), but the patch replaces this with debugfs_lookup_and_remove(), which handles the lookup and cleanup in one s...

CVE-2025-39763

CVE-2025-39763 affects the Linux kernel and describes an ACPI: APEI path where a synchronous memory error that is not recovered can cause the kernel to queue memory_failure() and poison a page, unmap it, and send SIGBUS to the triggering process to avoid a system-wide panic. The issue arises when...

CVE-2022-49939

In CVE-2022-49939, the vulnerability is in the Linux kernel binder code where a race between closing a node reference and binder_deferred_release can cause a use-after-free: a weak_handle transaction may fail to increment a node’s reference, and if the target process is dying, the cleanup is dela...

CVE-2022-50258

CVE-2022-50258 – Linux kernel wifi/brcmfmac stack-out-of-bounds fix The vulnerability is in brcmfmac when handling a non‑null‑terminated firmware version string passed to strsep() via brcmf_c_preinit_dcmds(). The code path writes the firmware version into a buffer via memcpy() and previously coul...

CVE-2023-53151

CVE-2023-53151 affects the Linux kernel’s md/raid10 path. The vulnerability arose because there was no limit for plugged bio during flush writes in raid10 (unlike raid1 which used cond_resched), allowing writeback activity to cause a soft lockup under heavy I/O. The public advisories describe a f...

CVE-2023-53209

CVE-2023-53209 : In the Linux kernel, the wifi mac80211_hwsim subsystem could dereference a NULL sta pointer in mac80211_hwsim_select_tx_link(), leading to a NULL pointer dereference. The vulnerability is fixed by explicitly checking that the sta pointer is not NULL before use. Affected component...

CVE-2023-53318

CVE-2023-53318 affects the Linux kernel and is associated with memory leaks in the recordmcount flow, specifically in the uwrite function. The vulnerability’s impact is listed as local access with medium base severity (CVSSv3.1: AV Local, AC Low, PR Low, UI None, S Unchanged, C None, I None, A Hi...

CVE-2023-53334

CVE-2023-53334 affects the Linux kernel USB: chipidea subsystem. The issue was a memory leak that occurred when using debugfs_lookup(); the returned object must be paired with dput(), otherwise memory leaks over time. The fix simplifies handling by using debugfs_lookup_and_remove(), which perform...

CVE-2023-53416

CVE-2023-53416 affects the Linux kernel USB isp1362 driver. The issue is a memory leak caused by calling debugfs_lookup() without releasing the result with dput(), allowing leaked memory over time. The fix simplifies the handling by using debugfs_lookup_and_remove(), which performs the lookup and...

CVE-2023-53425

CVE-2023-53425 affects the Linux kernel’s Mediatek VPU driver (media: platform: mediatek: vpu). The issue is a NULL pointer dereference when pdev is NULL, which could occur during vpu firmware loading in mtk_vpu.c (vpu_load_firmware). The vulnerability is mitigated by a fix that prevents derefere...

CVE-2025-38716

CVE-2025-38716 affects the Linux kernel and relates to the hfs_find_init() code path. The vulnerability arises when the tree pointer is NULL, potentially triggering a general protection fault / null pointer dereference during HFS operations (e.g., ext_read_extent, get_block, and subsequent file m...

CVE-2025-39748

CVE-2025-39748 - Linux kernel BPF verifier issue (JSET) patched Root cause: A verifier range refinement bug after JSET could produce inconsistent register bounds on an unreachable path, due to not forgetting ranges after narrowing tnums post-JSET. Impact: Local access to kernel may be affected; C...

CVE-2022-50341

CVE-2022-50341 affects the Linux kernel CIFS/SMB path. In ARM64 Azure xfstests, an oops occurred when a CRC/encryption flow wrote via scatterwalk_copychunks into a vmalloc buffer, crossing a page boundary and triggering a kernel Oops. The root cause is writing to a buffer allocated in vmalloc via...

CVE-2022-50409

CVE-2022-50409 is a Linux kernel vulnerability affecting networking code. The issue occurs when a socket is dead but code paths access the socket’s wait queue (sk_wq) during sk_stream_wait_memory, which can lead to a NULL dereference or use-after-free scenario when the socket is released while me...

CVE-2023-53215

CVE-2023-53215 affects the Linux kernel sched/fair component. The issue occurs when the load balancer tries to migrate a task that is migration-disabled to its current CPU, triggering a warning in set_task_cpu() during balance. The root cause is how the new_dst_cpu is selected from env->dst_gr...

CVE-2023-53254

CVE-2023-53254 is a Linux kernel vulnerability related to the cacheinfo shared_cpu_map. The issue occurs when the kernel checks that caches with the same index are shared, which can trigger slab-out-of-bounds access if CPUs have different cache hierarchies. A second problem is a mismatched shared...