CVE-2024-26643

The CVE-2024-26643 entry concerns the Linux kernel netfilter nf_tables: a race that could allow the rhashtable set GC to collect elements from anonymous sets with timeouts during release from the commit path. The issue is tied to anonymous sets with timeouts and is mitigated by setting the dead f...

CVE-2023-52486

CVE-2023-52486 - Linux kernel / DRM framebuffer use-after-unref issue . The bug occurs in the DRM mode page flip path: after a deadlock and a retry, the code forgets to reset the framebuffer reference to NULL, so if an error happens again before re-acquiring the fb lookup, it may unref the same f...

CVE-2024-26938

CVE-2024-26938 is a Linux kernel vulnerability in the drm/i915/bios path. The issue occurs when int​el_bios_encoder_supports_dp_dual_mode() encounters a NULL devdata for a DP encoder (e.g., if there is no VBT or the VBT does not declare the encoder). The kernel previously could oops or mis-handle...

CVE-2024-26811

CVE-2024-26811 concerns the Linux kernel component ksmbd. The vulnerability arises from insufficient validation of IPC payload size in responses from ksmbd.mountd to the ksmbd kernel server, potentially enabling memory overrun or slab-out-of-bounds conditions. The connected documents confirm that...

CVE-2023-52485

CVE-2023-52485 affects the Linux kernel; the issue stems from wake DMCUB before issuing DMUB commands in the AMD display path, which could deadlock if the DMCUB is not powered. The description indicates a fix to rework command submission to exit idle power optimizations and reenable them after su...

CVE-2024-35944

CVE-2024-35944: In the Linux kernel VMCI path, a run-time warning triggered by memcpy was observed when a field-spanning write occurred in vmci_datagram.c. The code copies a vmci_datagram dg into a local dg_info->msg with memcpy(&dg_info->msg, dg, dg_size), while dg_size = VMCI_DG_HEADERSIZ...

CVE-2024-26656

CVE-2024-26656 affects the Linux kernel AMDGPU DRM driver. The issue is a use-after-free in the amdgpu_hmm_unregister path triggered during amdgpu_gem_userptr_ioctl when an invalid address/size is supplied, causing a bad access during amdgpu_gem_object_free. The provided traces show a fault path ...

CVE-2023-52498

CVE-2023-52498 : Linux kernel sleep deadlock in system-wide PM code in low-memory conditions. root cause: system-wide resume core code could deadlock because async_schedule_dev() sometimes runs the argument synchronously and may contend for a mutex; this could cause ordering issues in resume call...

CVE-2024-26817

CVE-2024-26817 affects the Linux kernel amdkfd component. The vulnerability arises from using kzalloc with a multiplication that can overflow; the fix replaces kzalloc with calloc to avoid integer overflow. Descriptions in connected Nessus advisories (Unity Linux UTSA advisories) reiterate the sa...

CVE-2023-52587

CVE-2023-52587 (Linux kernel) affects IB/ipoib multicast locking. The issue arose when priv->lock was released while iterating priv->multicast_list in ipoib_mcast_join_task(), creating a window for ipoib_mcast_dev_flush() to remove items mid-iteration. If a mcast item is removed after the l...

CVE-2024-26957

CVE-2024-26957 relates to the Linux kernel’s s390/zcrypt subsystem, where reference counting on zcrypt card objects was fixed to prevent a use-after-free of the zcrypt_card during hot-plug/probe/remove cycles. The issue could allow freeing a zcrypt card object while it is still in use, as demonst...

CVE-2022-48828

CVE-2022-48828 – Linux kernel (NFSD: Fix ia_size underflow) The vulnerability stems from a signed 64-bit i/o field (ia_size) being used to store an NFS file size defined as unsigned 64-bit, allowing an underflow when large values are sent by NFS clients. The issue is fixed in the common code path...

CVE-2023-52583

The CVE-2023-52583 entry describes a Linux kernel issue in the ceph component where dget() usage could lead to a deadlock due to incorrect lock ordering between dentry and its parent. The dead code path was never used because the parent directory is always supplied by callers, so the fix removes ...

CVE-2024-26982

CVE-2024-26982 affects the Linux kernel Squashfs code. The vulnerability arises from an OOB read path in fill_meta_index() triggered by an inode number value of zero, which is treated as unused. After a faulty read aborts, an empty metadata index is invalidated with inode=0, and a subsequent read...

CVE-2024-26931

The CVE-2024-26931 issue affects the Linux kernel’s qla2xxx SCSI driver. Under memory pressure, the driver could not allocate an SRB to perform error recovery during a cable pull, causing a flush failure and the upper layer to modify scsi_cmnd. When memory frees up, another cable-pull flush could...

CVE-2023-52476

CVE-2023-52476 refers to a Linux kernel vulnerability in the perf/x86/lbr path where a panic can occur if a vsyscall is made while LBR sampling is active. The issue arises when a vsyscall interrupt (NMI) leads to a decode path that dereferences next_byte pointing to the vsyscall address (e.g., ge...

CVE-2024-42096

CVE-2024-42096 is a Linux kernel vulnerability in the x86 profiling code (profile_pc) used for timer-based profiling. The issue stemmed from the function’s assumptions about stack layout when accounting time spent in spinlocks, which could misattribute time and trigger KASAN warnings. The advisor...

CVE-2023-52603

CVE-2023-52603 : In Linux kernel, a UBSAN array-index-out-of-bounds was reported in JFS’s dtSplitRoot (dtree) when the value of fsi drops below -1, causing an out-of-bounds access previously guarded by a check that only handled -1. A patch was added to handle values less than 0, addressing the ro...

CVE-2023-52600

CVE-2023-52600 affects the Linux kernel JFS component. Root cause: a use-after-free in jfs_evict_inode where, if diMount(ipimap) fails, the released ipimap may be accessed in diFreeSpecial() as rcu_core() asynchronously frees it via jfs_free_node(). The fix ensures sbi->ipimap is not initializ...

CVE-2023-52604

CVE-2023-52604 is a Linux kernel vulnerability affecting the JFS subsystem, specifically UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dmap.c (dbAdjTree). Public writeups note an out-of-bounds access (index 196694 in an s8[1365] buffer) encountered during Syzkaller fuzzing, leading to a kernel p...

CVE-2021-47002

CVE-2021-47002 references a SUNRPC NULL pointer dereference in the Linux kernel. Issue arises when alloc_pages_node() returns null and svc_rqst_free() dereferences a null rq_scratch_page during put_page(); the patch adds a null check in the failure path (svc_rqst_alloc()) to prevent dereferencing...

CVE-2024-26878

In CVE-2024-26878, the Linux kernel quota NULL pointer dereference is addressed: a race between dquot_free_inode (or related) and quota_off can dereference an inode quota pointer after it is nulled. The fix uses a temporary pointer to prevent the use-after-free: if inode quota pointers are access...

CVE-2023-52601

The CVE-2023-52601 entry refers to a Linux kernel flaw in the XFS-like JFS file system: a missing bound check in dbAdjTree when accessing dmt_stree can cause an array-index-out-of-bounds. The fix introduces a bool is_ctl to determine size, as described in the cited kernel commits. Affected/affect...

CVE-2023-52585

The Linux kernel contains a vulnerability in the drm/amdgpu component involving a potential NULL dereference in the amdgpu_ras_query_error_status_helper() function. The issue arises because the system incorrectly assumed the 'info' variable could be null, leading to an invalid error code -EINVAL ...

CVE-2023-52620

CVE-2023-52620 – Linux kernel nf_tables timeout handling : The vulnerability stems from nf_tables in netfilter where timeout parameters for anonymous sets were not disallowed, even though they were never used from userspace. It is a local, low–severity issue per CVSSv3.1 (base 2.5) with potential...

CVE-2024-26958

CVE-2024-26958 is a Linux kernel vulnerability in the NFS direct write path that could cause use-after-free (refcount underflow) when completing nfs_direct_request twice in a row. A patch fixes the double-completion scenario; the CVSS 3.1 base score is 7.8 (High) with Local attack and High impact...

CVE-2024-35933

CVE-2024-35933 affects the Linux kernel Bluetooth btintel path. The root cause is a NULL pointer dereference in btintel_read_version when hci_cmd_sync_complete() is triggered and skb is NULL, leading to hdev->req_skb being NULL. The issue can enable local exploitation scenarios as described in...

CVE-2024-26962

CVE-2024-26962 — Linux kernel (dm-raid/raid456 deadlock during reshape) Root cause: when a RAID-456 reshape is in progress, IO across the reshape position may wait for reshape progress. In the dm-raid path, certain states (read-only array, MD_RECOVERY_WAIT, MD_RECOVERY_FROZEN) caused reshape to f...

CVE-2024-26996

Summary: CVE-2024-26996 relates to a use-after-free in the Linux kernel USB gadget NCM implementation. When the NCM function is active and the usb0 interface is brought down, an error in usb_ep_enable() may cause in_ep/out_ep to remain disabled. During ncm_disable(), gether_disconnect() is not ca...

CVE-2024-53241

CVE-2024-53241 affects the Linux kernel when running with Xen PV guests. The root cause is an unsafe PV iret hypercall path via the Xen hypercall page. The fix replaces the hypercall-page jump with an inlined sequence in xen-asm.S to stop using the hypercall page, preparing for its removal due to...

CVE-2024-56570

CVE-2024-56570 – Linux kernel ovl (overlayfs) : The vulnerability arises in the ovl module where directory inodes that lack the lookup function could be processed, potentially triggering errors in overlayfs when passed to the lowerstack. The fix adds a check in ovl_dentry_weird() to filter/skip i...

CVE-2024-53164

In modes: NORMAL, this CVE (CVE-2024-53164) concerns the Linux kernel net/sched subsystem. The technical detail provided across connected advisories confirms the vulnerability lies in the ordering of qlen adjustments: sch->q.qlen changes around qdisc_tree_reduce_backlog() must occur before cal...

CVE-2024-53183

CVE-2024-53183 concerns a Linux kernel vulnerability: in uml/net handling, the code previously used drvdata during device release, but drvdata may not exist at release time. The fix is to retrieve the uml_net instance with container_of() instead of drvdata, preventing a crash when removing a netw...

CVE-2024-56616

CVE-2024-56616 (Linux kernel) affects drm_dp_mst sideband handling. The MST sideband message body length check was fixed to require at least 1 byte (accounting for the message CRC). Without this, a header with a valid header CRC but body length 0 could trigger memory corruption in drm_dp_sideband...

CVE-2024-56597

CVE-2024-56597 is a confirmed Linux kernel vulnerability affecting the JFS filesystem logic. The issue is a shift-out-of-bounds in jfs/dbSplit, triggered when dmt_budmin is less than zero, leading to errors in later stages. The fix adds a pre-check in dbAllocCtl to return an error earlier, preven...

CVE-2024-56590

The CVE-2024-56590 entry concerns the Linux kernel Bluetooth stack (hci_core) and a fix for not checking whether skb actually contains an ACL header in hci_acldata_packet. The issue could cause access to uninitialized/invalid memory beyond skb->data when an ACL header is absent. The fix is a k...

CVE-2024-53181

CVE-2024-53181 refers to a Linux kernel vulnerability where vector_device_release could crash due to using drvdata after release. The fix removes drvdata access in release and uses container_of() to obtain the vector_device instance, preventing a crash and kernel panic from a segfault. The issue ...

CVE-2024-53195

CVE-2024-53195 : In the Linux kernel (arm64 KVM), a flawed use of userspace_irqchip_in_use can trigger a WARN_ON in kvm_timer_update_irq() during VM/vCPU interactions when a PMU (KVM_ARM_VCPU_PMU_V3) is requested but not fully initialized. The described scenario: a VM is created, vCPU initialized...

CVE-2024-53184

CVE-2024-53184 affects the Linux kernel ubd subsystem, where release-time drvdata access could cause crashes during device removal. The fix replaces drvdata usage with container_of() to locate the ubd instance, preventing a NULL-deref crash when removing a ubd device. The advisories (Unity Linux ...

CVE-2023-52602

CVE-2023-52602: In the Linux kernel, the JFS slab-out-of-bounds Read vulnerability occurs while searching the current page in the sorted entry table during dtSearch, leading to an out-of-bounds access. The issue was fixed by adding a bound check. The advisory notes that the return code was set to...

CVE-2023-52436

CVE-2023-52436 affects the Linux kernel in the f2fs file system. The issue arises when setting an extended attribute (xattr) because the xattr list was not guaranteed to be zeroed in unused space; the fix explicitly terminates the xattr list to avoid relying on zeroed unused space. The descriptio...

CVE-2024-26601

CVE-2024-26601 is a Linux kernel vulnerability in the ext4 block allocator. The issue arises when a fast commit replay causes mb_free_blocks() to mark blocks as free that are already free, corrupting the buddy bitmap. The fix reintroduces mb_regenerate_buddy() and regenerates the buddy after a bl...

CVE-2023-52458

CVE-2023-52458 affects the Linux kernel block subsystem where partition length must be aligned to the disk’s logical block size. The issue arises before adding or resizing partitions when length isn’t checked for LBS alignment; if LBS > 512 bytes, the partition size may not be a multiple of LB...

CVE-2023-52462

CVE-2023-52462 concerns the Linux kernel BPF spill-pointer bug. Technical details in connected docs indicate the vulnerability arises when a register is spilled onto the stack as 1/2/4-byte registers, leading to incorrect checking of spilled slots via slot_type and the need to consult slot_type[7...

CVE-2024-26594

In Astra Linux advisories for ksmbd, the Linux kernel vulnerability CVE-2024-26594 is described as: ksmbd validates the mechanism token during session setup and reports an error when the token is invalid. The bulletin confirms the issue is resolved, but it does not specify a patch version or affe...

CVE-2021-46905

CVE-2021-46905 : Linux kernel vulnerability where a NULL-pointer dereference was introduced in net: hso during tty device unregistration after a minor was released. The issue arose because the serial device table could be accessed post-release of the minor by hso_serial_tty_unregister(), leading ...

CVE-2020-36775

CVE-2020-36775 affects the Linux kernel’s f2fs subsystem. The vulnerability was tied to a potential deadlock in the f2fs_write_compressed_pages() path, mitigated by using f2fs_trylock_op() (consistent with the approach used in f2fs_write_single_data_page()) to avoid deadlocks. The concrete fix is...

CVE-2021-46906

CVE-2021-46906 — Linux kernel HID (usbhid) info leak fix : The vulnerability arises in hid_submit_ctrl where report->size of zero caused transfer_buffer_length to be calculated as 16384, enabling an information leak. The root cause is the calculation in hid_report_len() not handling a zero-siz...

CVE-2023-52439

CVE-2023-52439 is a Linux kernel UIO subsystem use-after-free vulnerability. The issue occurs in a race between core-1 (uio_unregister_device) and core-2 (uio_open) where device_unregister frees idev, then core-2 may still access idev, leading to use-after-free and potential double free of idev v...

CVE-2023-52435

CVE-2023-52435 affects the Linux kernel’s net/ skb_segment() and can overflow MSS when computing mss = mss * partial_segs, risking a crash (e.g., GSO_BY_FRAGS) and triggering NULL pointer dereferences in some traces. The fix adds a guard to ensure the new MSS is smaller than GSO_BY_FRAGS, prevent...