CVE-2022-49939

In CVE-2022-49939, the vulnerability is in the Linux kernel binder code where a race between closing a node reference and binder_deferred_release can cause a use-after-free: a weak_handle transaction may fail to increment a node’s reference, and if the target process is dying, the cleanup is dela...

CVE-2022-50333

CVE-2022-50333 concerns the Linux kernel: fs/jfs contains a shift-out-of-bounds bug in dbDiscardAG, addressed by guarding the dbMount to mitigate URSAN-generated issues. The connected Nessus/SUSE advisories reproduce the same description and confirm a kernel-level fix, without detailing affected ...

CVE-2022-50341

CVE-2022-50341 affects the Linux kernel CIFS/SMB path. In ARM64 Azure xfstests, an oops occurred when a CRC/encryption flow wrote via scatterwalk_copychunks into a vmalloc buffer, crossing a page boundary and triggering a kernel Oops. The root cause is writing to a buffer allocated in vmalloc via...

CVE-2023-53400

CVE-2023-53400 : In the Linux kernel, ALSA: hda: Fix Oops by 9.1 surround channel names. The root cause is get_line_out_pfx() overflowing a static array when more than 8 channels are present (reported on MacBookPro 12,1 with Cirrus codec). The fix extends the code paths to accommodate 9.1 channel...

CVE-2025-39745

CVE-2025-39745 relates to the Linux kernel rcutorture code path in PREEMPT_RT builds. The issue manifests as a splat in rcutorture_one_extend_check() during RT testing due to an interaction with preempt_count/softirq handling; Debian/OSS and OSV/NVD records indicate the vulnerability has been res...

CVE-2022-50017

CVE-2022-50017 affects the Linux kernel’s mips cavium-octeon implementation, specifically the octeon2_usb_clocks_start path. The root cause is a missing of_node_put() on the reference returned by of_get_parent(), which increments the devicetree reference count and leads to a refcount leak. The fi...

CVE-2022-50409

CVE-2022-50409 is a Linux kernel vulnerability affecting networking code. The issue occurs when a socket is dead but code paths access the socket’s wait queue (sk_wq) during sk_stream_wait_memory, which can lead to a NULL dereference or use-after-free scenario when the socket is released while me...

CVE-2023-53209

CVE-2023-53209 : In the Linux kernel, the wifi mac80211_hwsim subsystem could dereference a NULL sta pointer in mac80211_hwsim_select_tx_link(), leading to a NULL pointer dereference. The vulnerability is fixed by explicitly checking that the sta pointer is not NULL before use. Affected component...

CVE-2023-53223

The CVE-2023-53223 issue affects the Linux kernel component drm/msm/dsi where alloc_ordered_workqueue may return NULL. The vulnerability arises from a missing check of the return value, potentially leading to a NULL pointer dereference. A patch addressing this check has been published (Patchwork:...

CVE-2023-53230

CVE-2023-53230 concerns the Linux kernel SMB client. The publicly provided docs identify the issue as a fix to a warning in fs/smb/client/cifsfs.c:982 within cifs_smb3_do_mount(), described as a memory‑leak warning reported by the kernel test robot. The connected advisories indicate the patch was...

CVE-2023-53282

CVE-2023-53282 concerns the Linux kernel, specifically the lpfc SCSI driver path used during a sysfs firmware write. The issue is a use-after-free KFENCE violation in lpfc_wr_object() where a pointer referencing mailbox memory is recycled before the memory is no longer in use, causing a potential...

CVE-2023-53286

CVE-2023-53286 affects the Linux kernel’s RDMA mlx5 path. The issue is: when destroying QP/RQ, the firmware destruction result was ignored, so upper layers could proceed as if destruction succeeded, potentially triggering kernel WARNs. The description specifies that the kernel now returns the fir...

CVE-2023-53317

CVE-2023-53317 is a Linux kernel vulnerability in the ext4 subsystem, specifically the mb_find_extent path. The provided description shows a fix for a WARNING triggered in mb_find_extent and associated traces involving ext4_mb_complex_scan_group and ext4_ext_map_blocks, indicating a misbehavior i...

CVE-2023-53443

CVE-2023-53443 affects the Linux kernel mfd Arizona driver. The root cause is a refcount leak in arizona_clk32k_enable() caused by using pm_runtime_get_sync(), which can increase the refcount even on error. The fix is to use pm_runtime_resume_and_get() to avoid leaking references. Impact per advi...

CVE-2022-50205

The CVE-2022-50205 entry corresponds to a Linux kernel vulnerability in ext2 that adds validity checks for inode counts. The root cause is that inodes stored in the superblock must match the computed value from inodes-per-group, and there must be at least one block worth of inodes per group; thes...

CVE-2022-50241

CVE-2022-50241 is a Linux kernel local-use-after-free in NFSD during inter-server copy. The race occurs when a CLOSE may be sent before FREE_STATEID, leaving a freed lock/state entry on the s2s_cp_stateids/sc_cp_list and triggering a BAD_STATEID on subsequent FREE_STATEID. The referenced patches ...

CVE-2022-50253

CVE-2022-50253 is a Linux kernel issue where bpf code did not ensure skb->len was non-zero when redirecting to a tunneling device, leading to a length underflow/invalid skb handling path after __skb_pull in certain redirect paths. The vulnerability is exploited via BPF/XDP filtering paths that...

CVE-2022-50344

CVE-2022-50344 - Linux kernel ext4 null-ptr-deref Affects: Linux kernel ext4 subsystem (ext4_write_info) in quota handling during umount/shutdown paths. Root cause: A null pointer dereference can occur in ext4_write_info when the superblock root inode is no longer valid during unmount, leading to...

CVE-2023-53176

CVE-2023-53176 concerns the Linux kernel serial driver stack. When unbinding a port-specific 8250 driver, control passes to the generic serial8250 driver while port->pm may still reference the now-destroyed driver, causing an oops roughly 10 seconds later. The connected documents confirm the r...

CVE-2023-53222

CVE-2023-53222 pertains to the Linux kernel, specifically the JFS filesystem code (jfs_dmap). The issue is a mounting-time validation flaw in db_l2nbperpage: BLKTODMAP uses db_l2nbperpage to shift, and an unchecked large value can trigger a shift-out-of-bounds crash. The root cause is that db_l2n...

CVE-2023-53246

CVE-2023-53246 (Linux kernel, CIFS DFS upcall) : When CONFIG_CIFS_DFS_UPCALL is disabled, cifs_dfs_d_automount becomes NULL and the CIFS DFS referral handling can trigger a NULL pointer dereference in VFS follow_automount() while traversing a DFS referral. The fix adds an inline cifs_dfs_d_automo...

CVE-2023-53276

In CVE-2023-53276, the Linux kernel ubifs code leaks memory: fscrypt_setup_filename allocates memory for the tmpfile name, but this memory is not freed after the name is copied into the directory entry inode (ubifs_tmpfile → vfs_tmpfile → path_openat). The kmemleak report shows an unreferenced ob...

CVE-2023-53279

CVE-2023-53279 concerns a Linux kernel issue in the misc: vmw_balloon path where calling debugfs_lookup() left the result undereferenced (no dput), causing a memory leak over time. The published fixes replace the single-lookup path with debugfs_lookup_and_remove(), which performs the necessary cl...

CVE-2023-53295

CVE-2023-53295 affects the Linux kernel, specifically the UDF module. The issue occurs when writing to inline files fails (or is only partially successful); the kernel wrongly updates the file length as if the entire write had succeeded. Root cause: updating length of inline data on failed writes...

CVE-2023-53297

CVE-2023-53297 affects the Linux kernel Bluetooth L2CAP path, where conn->chan_lock was not held before l2cap_get_chan_by_scid; if that call returns NULL, a “bad unlock balance” condition is triggered. Multiple connected advisories (Astra Linux, MiracleLinux, RHEL kernels) document the fix as ...

CVE-2023-53346

The CVE-2023-53346 entry concerns a memory-leak in the Linux kernel’s kernel/fail_function logic. The issue occurs when using debugfs_lookup(): the returned object must be released with dput(), otherwise memory leaks accrue over time. The associated advisories indicate a straightforward remediati...

CVE-2023-53412

The CVE-2023-53412 issue affects the Linux kernel USB gadget bcm63xx_udc where memory leaks occur when using debugfs_lookup() because the result is not dput()’d. The mitigated pattern is to call debugfs_lookup_and_remove() which handles the lookup and cleanup in one step, preventing leaks. Eviden...

CVE-2025-39905

The CVE-2025-39905 issue affects the Linux kernel phylink path: the race arises from phylink_resolve() manipulating pl->phydev under pl->state_mutex, creating a lock-order inversion with pl->phydev->lock. The fix introduces an explicit lock to serialize concurrent writes to pl->phy...

CVE-2026-31578

CVE-2026-31578: Linux kernel as102_usb driver race leads to use-after-free/double-free when a device is deregistered while an open FD remains. The crash arises from freeing as102_dev_t after usb_register_dev() and before the final FD is closed; the fix defers freeing to the .release() path, ensur...

CVE-2022-50296

CVE-2022-50296 affects the Linux kernel where cpu_max_bits_warn() would warn when CONFIG_CPUMASK_OFFSTACK and CONFIG_DEBUG_PER_CPU_MAPS are enabled while displaying /proc/cpuinfo. The root cause is using NR_CPUS to iterate CPUs instead of the runtime limit nr_cpu_ids, which leads to a runtime war...

CVE-2022-50346

CVE-2022-50346 is a Linux kernel ext4 issue where ext4_rename may modify old.inode’s ctime and trigger quota/extra_isize expansion, potentially allocating blocks and emitting a quota-related warning. The root cause involves ext4_xattr handling during a rename, with syzbot traces showing s_want_ex...

CVE-2023-53339

CVE-2023-53339 : In the Linux kernel’s Btrfs code, a race between pausing and balancing can cause a BUG_ON panic in btrfs_cancel_balance due to an unaccounted race. The race has no other side effects, and a fix has been applied in the upstream patch set. The vulnerability affects local attackers ...

CVE-2023-53387

CVE-2023-53387 affects the Linux kernel in the SCSI UFS path (ufshcd). In the UFS error handling flow, a device management command (NOP OUT) timeout can leave hba->dev_cmd.complete not NULL; if the device later completes the command, complete() is invoked for a stack-allocated structure, causi...

CVE-2023-53409

The CVE-2023-53409 issue concerns the Linux kernel: when using debugfs_lookup(), the returned object must be released with dput() to prevent a memory leak. The advisories state a fix by using debugfs_lookup_and_remove(), which handles the necessary logic in one step, mitigating the memory leak. A...

CVE-2023-53415

CVE-2023-53415 concerns the Linux kernel USB-DWC3 subsystem. The vulnerability arises from not freeing memory obtained via debugfs_lookup(): the returned object must be released with dput(), otherwise a memory leak occurs over time. The fixed approach consolidates the logic by using debugfs_looku...

CVE-2022-50314

The CVE-2022-50314 issue affects the Linux kernel nbd subsystem. When a signal interrupts nbd_start_device_ioctl() while waiting for inflight I/Os to complete, a hung task could occur. The fix clears the queue (not just shutdown) on signal interruption to nbd_start_device_ioctl(), mitigating the ...

CVE-2022-50328

CVE-2022-50328 affects the Linux kernel component jbd2. It describes a use-after-free in jbd2_fc_wait_bufs caused by using bh after releasing the buffer head reference, with the recommended fix: validate uptodate status of the buffer before putting the buffer head reference count. The incident is...

CVE-2023-53305

The CVE-2023-53305 entry refers to a Linux kernel vulnerability in Bluetooth L2CAP that fixes a use-after-free condition in l2cap_le_command_rej. The issue is described as a use-after-free (UAF) in Bluetooth code, leading to potential impact with a CVSSv3.1 score of 7.8 (HIGH) and a LOCAL attack ...

CVE-2023-53408

CVE-2023-53408 affects the Linux kernel’s trace/blktrace path. The issue is a memory leak when using debugfs_lookup(); the returned object must be dput()’d, otherwise memory leaks accumulate. The documented fix simplifies handling by replacing the call with debugfs_lookup_and_remove(), which perf...

CVE-2023-53410

CVE-2023-53410 (Linux kernel) : The issue is a memory leak in USB ULPI related to using debugfs_lookup() without proper dput() on the result. The recommended remediation is to replace the call with debugfs_lookup_and_remove(), which handles lookup and cleanup in one step. Affected context and ref...

CVE-2023-53418

The CVE-2023-53418 issue affects the Linux kernel USB gadget driver, specifically the lpc32xx_udc in the USB subsystem. The root cause was a memory leak when using debugfs_lookup() because the returned object was not paired with a dput(), leaving memory allocated over time. The provided fixes sim...

CVE-2023-53438

CVE-2023-53438 : In the Linux kernel, the AMD Zen IF poison error path could misclassify context due to non-synchronous delivery of poison by the IF unit. The issue is mitigated by adding a quirk to always save the Code Segment (CS) register when poison is consumed from the IF unit banks, ensurin...

CVE-2026-31609

CVE-2026-31609 affects the Linux kernel SMB client; the double-free occurs in smbd_free_send_io() after smbd_send_batch_flush() because smbd_send_batch_flush() already frees via smbd_free_send_io() and has been moved to the batch list. The issue has been addressed in multiple advisories and patch...

CVE-2022-50286

The CVE-2022-50286 issue affects the Linux kernel ext4 file system in scenarios where bigalloc and inline options are used simultaneously. The root cause is in ext4_clu_mapped: when converting inline-stored data to extents, the code may search the (non-existent) extent tree to decide if a block s...

CVE-2022-50315

CVE-2022-50315: Linux kernel ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS. The issue arises when sata_pmp_init_links() initializes link->pmp up to SATA_PMP_MAX_PORTS while em_priv is an 8-element array, causing a UBSAN array-index-out-of-bounds in libahci.c. The patch aligns EM_MAX_SL...

CVE-2022-50358

The CVE-2022-50358 issue affects the Linux kernel driver brcmfmac. When the dongle reports an invalid max_flowrings value (greater than 256) during firmware initialization, the host may read an abnormal number and trigger a kernel panic when performing iowrite to initialize the dongle ring. The v...

CVE-2022-50359

CVE-2022-50359 affects Linux kernel media driver cx88: null-ptr-deref in buffer_prepare() when cx88_risc_buffer() fails, leading to empty buffer and null-ptr-deref in buffer_queue(). The issue is fixed by validating the return value of cx88_risc_buffer() before use. Affected reports in connected ...

CVE-2023-53220

CVE-2023-53220 affects the Linux kernel, specifically the media/az6007 driver. The vulnerability arises in az6007_i2c_xfer where user-controlled msg[i].buf could be dereferenced if msg[i].buf is null and msg[i].len is zero, bypassing previous checks and potentially crashing. The root cause is mis...

CVE-2023-53403

CVE-2023-53403: Linux kernel vulnerability in time/debug causing potential memory leak when using debugfs_lookup(). The issue arises because the result of debugfs_lookup() must be dput()-ed; if not, memory leaks occur over time. The documented mitigation is to replace the call with debugfs_lookup...

CVE-2026-31579

The CVE-2026-31579 issue affects the Linux kernel’s WireGuard integration where wg_netns_pre_exit() manually acquired rtnl_lock(), risking a hung task when another thread holds the RTNL mutex. The vulnerability is mitigated by moving the cleanup to the .exit_rtnl hook (which the framework already...