CVE-2023-53286

CVE-2023-53286 affects the Linux kernel’s RDMA mlx5 path. The issue is: when destroying QP/RQ, the firmware destruction result was ignored, so upper layers could proceed as if destruction succeeded, potentially triggering kernel WARNs. The description specifies that the kernel now returns the fir...

CVE-2023-53405

CVE-2023-53405 concerns the Linux kernel USB gadget gr_udc: a memory leak that occurs when debugfs_lookup() is used without proper cleanup. The vulnerability arises because the result of debugfs_lookup() must be released with dput(), else memory leaks accumulate over time. The fixed approach in t...

CVE-2023-53415

CVE-2023-53415 concerns the Linux kernel USB-DWC3 subsystem. The vulnerability arises from not freeing memory obtained via debugfs_lookup(): the returned object must be released with dput(), otherwise a memory leak occurs over time. The fixed approach consolidates the logic by using debugfs_looku...

CVE-2025-38716

CVE-2025-38716 affects the Linux kernel and relates to the hfs_find_init() code path. The vulnerability arises when the tree pointer is NULL, potentially triggering a general protection fault / null pointer dereference during HFS operations (e.g., ext_read_extent, get_block, and subsequent file m...

CVE-2025-39753

CVE-2025-39753 relates to the Linux kernel’s gfs2 code. The vulnerability is resolved by a patch that adds the .migrate_folio flag in gfs2_{rgrp,meta}_aops, addressing a warning: gfs2_meta_aops does not implement migrate_folio, triggering messages during xfstests. The described impact is the supp...

CVE-2026-31582

CVE-2026-31582 affects the Linux kernel hwmon powerz driver. A use-after-free occurs when a USB disconnect frees the URB and mutex, and a subsequent powerz_read() can dereference the freed URB in powerz_read_data(). The fix, as described across sources, is to set priv->urb to NULL in powerz_di...

CVE-2022-50258

CVE-2022-50258 – Linux kernel wifi/brcmfmac stack-out-of-bounds fix The vulnerability is in brcmfmac when handling a non‑null‑terminated firmware version string passed to strsep() via brcmf_c_preinit_dcmds(). The code path writes the firmware version into a buffer via memcpy() and previously coul...

CVE-2022-50344

CVE-2022-50344 - Linux kernel ext4 null-ptr-deref Affects: Linux kernel ext4 subsystem (ext4_write_info) in quota handling during umount/shutdown paths. Root cause: A null pointer dereference can occur in ext4_write_info when the superblock root inode is no longer valid during unmount, leading to...

CVE-2022-50346

CVE-2022-50346 is a Linux kernel ext4 issue where ext4_rename may modify old.inode’s ctime and trigger quota/extra_isize expansion, potentially allocating blocks and emitting a quota-related warning. The root cause involves ext4_xattr handling during a rename, with syzbot traces showing s_want_ex...

CVE-2023-53176

In the Linux kernel, the following vulnerability has been resolved: serial: 8250: Reinit port->pm on port specific driver unbind When we unbind a serial port hardware specific 8250 driver, the genericserial8250 driver takes over the port. After that we see an oops about 10seconds later. This c...

CVE-2023-53220

CVE-2023-53220 affects the Linux kernel, specifically the media/az6007 driver. The vulnerability arises in az6007_i2c_xfer where user-controlled msg[i].buf could be dereferenced if msg[i].buf is null and msg[i].len is zero, bypassing previous checks and potentially crashing. The root cause is mis...

CVE-2023-53222

CVE-2023-53222 pertains to the Linux kernel, specifically the JFS filesystem code (jfs_dmap). The issue is a mounting-time validation flaw in db_l2nbperpage: BLKTODMAP uses db_l2nbperpage to shift, and an unchecked large value can trigger a shift-out-of-bounds crash. The root cause is that db_l2n...

CVE-2023-53223

The CVE-2023-53223 issue affects the Linux kernel component drm/msm/dsi where alloc_ordered_workqueue may return NULL. The vulnerability arises from a missing check of the return value, potentially leading to a NULL pointer dereference. A patch addressing this check has been published (Patchwork:...

CVE-2023-53279

CVE-2023-53279 concerns a Linux kernel issue in the misc: vmw_balloon path where calling debugfs_lookup() left the result undereferenced (no dput), causing a memory leak over time. The published fixes replace the single-lookup path with debugfs_lookup_and_remove(), which performs the necessary cl...

CVE-2023-53409

The CVE-2023-53409 issue concerns the Linux kernel: when using debugfs_lookup(), the returned object must be released with dput() to prevent a memory leak. The advisories state a fix by using debugfs_lookup_and_remove(), which handles the necessary logic in one step, mitigating the memory leak. A...

CVE-2023-53410

CVE-2023-53410 (Linux kernel) : The issue is a memory leak in USB ULPI related to using debugfs_lookup() without proper dput() on the result. The recommended remediation is to replace the call with debugfs_lookup_and_remove(), which handles lookup and cleanup in one step. Affected context and ref...

CVE-2023-53418

The CVE-2023-53418 issue affects the Linux kernel USB gadget driver, specifically the lpc32xx_udc in the USB subsystem. The root cause was a memory leak when using debugfs_lookup() because the returned object was not paired with a dput(), leaving memory allocated over time. The provided fixes sim...

CVE-2023-53443

CVE-2023-53443 affects the Linux kernel mfd Arizona driver. The root cause is a refcount leak in arizona_clk32k_enable() caused by using pm_runtime_get_sync(), which can increase the refcount even on error. The fix is to use pm_runtime_resume_and_get() to avoid leaking references. Impact per advi...

CVE-2022-50253

CVE-2022-50253 is a Linux kernel issue where bpf code did not ensure skb->len was non-zero when redirecting to a tunneling device, leading to a length underflow/invalid skb handling path after __skb_pull in certain redirect paths. The vulnerability is exploited via BPF/XDP filtering paths that...

CVE-2022-50314

The CVE-2022-50314 issue affects the Linux kernel nbd subsystem. When a signal interrupts nbd_start_device_ioctl() while waiting for inflight I/Os to complete, a hung task could occur. The fix clears the queue (not just shutdown) on signal interruption to nbd_start_device_ioctl(), mitigating the ...

CVE-2022-50341

In the Linux kernel, the following vulnerability has been resolved: cifs: fix oops during encryption When running xfstests against Azure the following oops occurred on anarm64 system Unable to handle kernel write to read-only memory at virtual addressffff0001221cf000Mem abort info:ESR = 0x9600004...

CVE-2023-53317

CVE-2023-53317 is a Linux kernel vulnerability in the ext4 subsystem, specifically the mb_find_extent path. The provided description shows a fix for a WARNING triggered in mb_find_extent and associated traces involving ext4_mb_complex_scan_group and ext4_ext_map_blocks, indicating a misbehavior i...

CVE-2023-53318

CVE-2023-53318 affects the Linux kernel and is associated with memory leaks in the recordmcount flow, specifically in the uwrite function. The vulnerability’s impact is listed as local access with medium base severity (CVSSv3.1: AV Local, AC Low, PR Low, UI None, S Unchanged, C None, I None, A Hi...

CVE-2023-53346

The CVE-2023-53346 entry concerns a memory-leak in the Linux kernel’s kernel/fail_function logic. The issue occurs when using debugfs_lookup(): the returned object must be released with dput(), otherwise memory leaks accrue over time. The associated advisories indicate a straightforward remediati...

CVE-2023-53412

The CVE-2023-53412 issue affects the Linux kernel USB gadget bcm63xx_udc where memory leaks occur when using debugfs_lookup() because the result is not dput()’d. The mitigated pattern is to call debugfs_lookup_and_remove() which handles the lookup and cleanup in one step, preventing leaks. Eviden...

CVE-2023-53438

CVE-2023-53438 : In the Linux kernel, the AMD Zen IF poison error path could misclassify context due to non-synchronous delivery of poison by the IF unit. The issue is mitigated by adding a quirk to always save the Code Segment (CS) register when poison is consumed from the IF unit banks, ensurin...

CVE-2022-50241

CVE-2022-50241 is a Linux kernel local-use-after-free in NFSD during inter-server copy. The race occurs when a CLOSE may be sent before FREE_STATEID, leaving a freed lock/state entry on the s2s_cp_stateids/sc_cp_list and triggering a BAD_STATEID on subsequent FREE_STATEID. The referenced patches ...

CVE-2022-50296

CVE-2022-50296 affects the Linux kernel where cpu_max_bits_warn() would warn when CONFIG_CPUMASK_OFFSTACK and CONFIG_DEBUG_PER_CPU_MAPS are enabled while displaying /proc/cpuinfo. The root cause is using NR_CPUS to iterate CPUs instead of the runtime limit nr_cpu_ids, which leads to a runtime war...

CVE-2022-50358

The CVE-2022-50358 issue affects the Linux kernel driver brcmfmac. When the dongle reports an invalid max_flowrings value (greater than 256) during firmware initialization, the host may read an abnormal number and trigger a kernel panic when performing iowrite to initialize the dongle ring. The v...

CVE-2023-53295

CVE-2023-53295 affects the Linux kernel, specifically the UDF module. The issue occurs when writing to inline files fails (or is only partially successful); the kernel wrongly updates the file length as if the entire write had succeeded. Root cause: updating length of inline data on failed writes...

CVE-2023-53305

The CVE-2023-53305 entry refers to a Linux kernel vulnerability in Bluetooth L2CAP that fixes a use-after-free condition in l2cap_le_command_rej. The issue is described as a use-after-free (UAF) in Bluetooth code, leading to potential impact with a CVSSv3.1 score of 7.8 (HIGH) and a LOCAL attack ...

CVE-2023-53339

CVE-2023-53339 : In the Linux kernel’s Btrfs code, a race between pausing and balancing can cause a BUG_ON panic in btrfs_cancel_balance due to an unaccounted race. The race has no other side effects, and a fix has been applied in the upstream patch set. The vulnerability affects local attackers ...

CVE-2023-53414

The CVE-2023-53414 entry affects the Linux kernel scsi: snic driver. The root cause is a memory leak when using debugfs_lookup() because the returned object required a dput(), which could leak over time. The advisory notes a fix by using debugfs_lookup_and_remove() instead, which handles the look...

CVE-2025-39748

CVE-2025-39748 - Linux kernel BPF verifier issue (JSET) patched Root cause: A verifier range refinement bug after JSET could produce inconsistent register bounds on an unreachable path, due to not forgetting ranges after narrowing tnums post-JSET. Impact: Local access to kernel may be affected; C...

CVE-2025-39905

The CVE-2025-39905 issue affects the Linux kernel phylink path: the race arises from phylink_resolve() manipulating pl->phydev under pl->state_mutex, creating a lock-order inversion with pl->phydev->lock. The fix introduces an explicit lock to serialize concurrent writes to pl->phy...

CVE-2026-43171

The CVE-2026-43171 described affects the Linux kernel EFI/CPER component where cper_print_fw_err() does not validate the error-record length against the given offset, allowing an underflow that can cause dumping of large memory regions. Consequences include potential data disclosure and system in...

CVE-2022-50333

CVE-2022-50333 concerns the Linux kernel: fs/jfs contains a shift-out-of-bounds bug in dbDiscardAG, addressed by guarding the dbMount to mitigate URSAN-generated issues. The connected Nessus/SUSE advisories reproduce the same description and confirm a kernel-level fix, without detailing affected ...

CVE-2022-50359

CVE-2022-50359 affects Linux kernel media driver cx88: null-ptr-deref in buffer_prepare() when cx88_risc_buffer() fails, leading to empty buffer and null-ptr-deref in buffer_queue(). The issue is fixed by validating the return value of cx88_risc_buffer() before use. Affected reports in connected ...

CVE-2023-53230

CVE-2023-53230 concerns the Linux kernel SMB client. The publicly provided docs identify the issue as a fix to a warning in fs/smb/client/cifsfs.c:982 within cifs_smb3_do_mount(), described as a memory‑leak warning reported by the kernel test robot. The connected advisories indicate the patch was...

CVE-2023-53282

CVE-2023-53282 concerns the Linux kernel, specifically the lpfc SCSI driver path used during a sysfs firmware write. The issue is a use-after-free KFENCE violation in lpfc_wr_object() where a pointer referencing mailbox memory is recycled before the memory is no longer in use, causing a potential...

CVE-2023-53395

The CVE-2023-53395 entry refers to ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer. The issue arises from ASL Timer instructions that require no argument; without AML_NO_OPERAND_RESOLVE, interpreting the Timer instruction could produce an error, and the fix adds AML_NO_OPERAND_RESOLVE to the Tim...

CVE-2023-53402

CVE-2023-53402 affects the Linux kernel, specifically the printk debugfs path. The root cause is a memory leak in kernel/printk/index.c when using debugfs_lookup() without a matching dput(). The documented fix replaces the sequence with debugfs_lookup_and_remove(), handling the logic and preventi...

CVE-2025-39745

CVE-2025-39745 relates to the Linux kernel rcutorture code path in PREEMPT_RT builds. The issue manifests as a splat in rcutorture_one_extend_check() during RT testing due to an interaction with preempt_count/softirq handling; Debian/OSS and OSV/NVD records indicate the vulnerability has been res...

CVE-2026-31579

The CVE-2026-31579 issue affects the Linux kernel’s WireGuard integration where wg_netns_pre_exit() manually acquired rtnl_lock(), risking a hung task when another thread holds the RTNL mutex. The vulnerability is mitigated by moving the cleanup to the .exit_rtnl hook (which the framework already...

CVE-2026-46017

CVE-2026-46017 involves a Linux kernel race in the migration path for folios. The vulnerability stems from a deferred split queue race during migrate_folio_move(): dst can become visible and then be requeued too late, allowing a concurrent rmap-removal path to mark dst partially mapped and trigge...

CVE-2021-4460

CVE-2021-4460 affects the Linux kernel drm/amdkfd path. The issue is a UBSAN shift-out-of-bounds warning when get_num_sdma_queues or get_num_xgmi_sdma_queues is 0, causing a shift by the operand’s bit width (undefined behavior). The fix changes the code to set num_sdma_queues or num_xgmi_sdma_que...

CVE-2022-50252

CVE-2022-50252 affects the Linux kernel igb driver. The issue arises when memory pressure triggers kzalloc() failure: q_vector is freed but not cleared from adapter->q_vector[v_idx], risking a use-after-free. The available connected advisories confirm the fix was implemented to ensure that q_v...

CVE-2022-50315

CVE-2022-50315: Linux kernel ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS. The issue arises when sata_pmp_init_links() initializes link->pmp up to SATA_PMP_MAX_PORTS while em_priv is an 8-element array, causing a UBSAN array-index-out-of-bounds in libahci.c. The patch aligns EM_MAX_SL...

CVE-2022-50366

CVE-2022-50366 affects the Linux kernel powercap subsystem (intel_rapl). Root cause: UBSAN shift-out-of-bounds when ilog2() is computed with a value

CVE-2022-50409

CVE-2022-50409 is a Linux kernel vulnerability affecting networking code. The issue occurs when a socket is dead but code paths access the socket’s wait queue (sk_wq) during sk_stream_wait_memory, which can lead to a NULL dereference or use-after-free scenario when the socket is released while me...