CVE-2023-52456

CVE-2023-52456 affects the Linux kernel, specifically the imx serial driver used for RS-485 when the TX state machine can deadlock if the TTY is closed mid-transmission. In that scenario, imx_uart_shutdown disables the interface and the Transmission Complete interrupt, causing imx_uart_stop_tx to...

CVE-2023-52436

CVE-2023-52436 affects the Linux kernel in the f2fs file system. The issue arises when setting an extended attribute (xattr) because the xattr list was not guaranteed to be zeroed in unused space; the fix explicitly terminates the xattr list to avoid relying on zeroed unused space. The descriptio...

CVE-2024-26593

CVE-2024-26593: In the Linux kernel, i2c: i801: Fix block process call transactions. The issue was that the driver did not reset the block buffer index a second time before reading the incoming data, per Intel datasheets, causing reading the wrong portion of the block buffer. The advisory notes t...

CVE-2023-52464

CVE-2023-52464 affects the Linux kernel EDAC/thunderx driver. The issue is a potential out-of-bounds string access in thunderx_ocx_com_threaded_isr due to repeated use of strncat with an incorrect buffer size, which mimics a strlcat-like pattern but uses the wrong bound. The root cause is the mis...

CVE-2024-26597

CVE-2024-26597 affects the Linux kernel, specifically the Qualcomm RMNET netlink policy driver. The vulnerability arises from assigning a larger maxtype to rmnet_link_ops, causing a global out-of-bounds read when parsing netlink attributes. The bug is mapped to the rmnet_policy variable and is fi...

CVE-2024-26601

CVE-2024-26601 : Technical details are not publicly available in the provided connected documents. Initial description contains basic context but no affected products/versions, root cause, impact, or fix specifics. Monitor for updates from official advisories.

CVE-2023-52469

CVE-2023-52469 : The Linux kernel vulnerability resides in drivers/amd/pm where a use-after-free occurs in kv_parse_power_table. When kzalloc returns NULL, kv_parse_power_table frees adev->pm.dpm.ps and the object is then (incorrectly) used in kv_dpm_fini, causing a use-after-free. This is doc...

CVE-2024-26600

CVE-2024-26600 details (Linux kernel): A NULL pointer dereference in the TI PHY/OMAP USB2 PHY driver could be triggered when an external phy does not implement send_srp(), causing a wakeup path to call a NULL function. The issue manifests during idle Ethernet gadget wakeups and leads to a kernel ...

CVE-2023-52470

CVE-2023-52470: Linux kernel vulnerability fixed in drm/radeon driver. The issue was a potential NULL pointer dereference in radeon_crtc_init() if the alloc_workqueue call failed. The published fix adds a check for the alloc_workqueue return value to avoid dereferencing a NULL pointer. Affected c...

CVE-2023-52467

CVE-2023-52467 : Linux kernel vulnerability in mfd: syscon addressing a NULL pointer dereference in of_syscon_register() and a potential NULL return from kasprintf(). Connected advisory evidence (e.g., RHSA-2024:9315) confirms the issue and its fix in kernel code. Impact is localized (LOCAL) with...

CVE-2023-52458

CVE-2023-52458 affects the Linux kernel block subsystem where partition length must be aligned to the disk’s logical block size. The issue arises before adding or resizing partitions when length isn’t checked for LBS alignment; if LBS > 512 bytes, the partition size may not be a multiple of LB...

CVE-2023-52462

CVE-2023-52462 concerns the Linux kernel BPF spill-pointer bug. Technical details in connected docs indicate the vulnerability arises when a register is spilled onto the stack as 1/2/4-byte registers, leading to incorrect checking of spilled slots via slot_type and the need to consult slot_type[7...

CVE-2021-46904

CVE-2021-46904 affects the Linux kernel net: hso subsystem. The issue was a null pointer dereference during tty device unregistration caused by multiple ttys claiming the same minor number. The root cause was that get_free_serial_index() returned an available minor but did not assign it immediate...

CVE-2021-46905

CVE-2021-46905 : Linux kernel vulnerability where a NULL-pointer dereference was introduced in net: hso during tty device unregistration after a minor was released. The issue arose because the serial device table could be accessed post-release of the minor by hso_serial_tty_unregister(), leading ...

CVE-2023-52454

CVE-2023-52454 affects the Linux kernel nvmet-tcp component; a host data command H2CData with invalid DATAL could crash nvmet_tcp_build_pdu_iovec(), risking a kernel NULL pointer dereference. The fix raises a fatal error when DATAL is not coherent with the packet size and ensures PDU length never...

CVE-2023-52463

CVE-2023-52463 affects the Linux kernel efivarfs: when SetVariable support is missing at runtime, the code remounts efivarfs RO but fails to validate remount flags, allowing a NULL or improper access leading to a crash. The issue is demonstrated by remounting /sys/firmware/efi/efivars RW and issu...

CVE-2019-25162

CVE-2019-25162: In the Linux kernel, an information-leak/UAF issue was fixed in the i2c subsystem. The patch fixes a potential use-after-free by ensuring the adap structure is freed only after it is no longer in use; specifically, put_device() is moved down to avoid freeing the adapter too early....

CVE-2024-26606

CVE-2024-26606 affects the Linux kernel binder subsystem. In (e)poll mode, a binder thread that issues a BINDER_WRITE_READ without a read buffer may later rely on epoll_wait to process responses, but if the epoll/wakeup signaling is not triggered for the thread’s own enqueued work, the thread can...

CVE-2023-52474

CVE-2023-52474: In the Linux kernel, fixes were applied for IB/hfi1 user SDMA multi-iovec handling to correct data handling across iovecs and to address related mmu_rb cache pinning issues. The description notes two root bugs: 1) user_sdma_txadd() could over-read an iovec by not honoring iov_len ...

CVE-2021-46906

CVE-2021-46906 — Linux kernel HID (usbhid) info leak fix : The vulnerability arises in hid_submit_ctrl where report->size of zero caused transfer_buffer_length to be calculated as 16384, enabling an information leak. The root cause is the calculation in hid_report_len() not handling a zero-siz...

CVE-2024-26602

CVE-2024-26602 affects the Linux kernel’s membarrier path. The fix targets the sys_membarrier interface by introducing a lock on the path to serialize accesses and prevent extremely high call frequency, which could otherwise cause global slowdowns. Affected component: sched/membarrier. Root cause...

CVE-2024-26586

CVE-2024-26586 (Linux kernel) : The issue is a stack corruption risk in mlxsw spectrum ACL TCAM handling when there are more than 16 ACLs in an ACL group. In Spectrum-2+ ASICs, firmware reports a larger ACL count than the PAGT register can hold, risking stack corruption during forwarding. The fix...

CVE-2023-52439

CVE-2023-52439 is a Linux kernel UIO subsystem use-after-free vulnerability. The issue occurs in a race between core-1 (uio_unregister_device) and core-2 (uio_open) where device_unregister frees idev, then core-2 may still access idev, leading to use-after-free and potential double free of idev v...

CVE-2021-46939

CVE-2021-46939 affects the Linux kernel where tracing changes to trace_clock_global() could deadlock due to recursive locking during tracing; the fix uses a trylock and retry semantics to avoid blocking. Public details in connected advisories (MiracleLinux UTSA, Nessus plugin) describe the same i...

CVE-2021-46941

CVE-2021-46941 concerns the Linux kernel usb dwc3 core. The description states the issue arises in the DRD mode switch sequence for the controller: missing CoreSoftReset before switching modes and missing Host/DGPU resets (GCTL.CoreSoftReset and DCTL.CSftRst) caused lockups on HiKey960 and simila...

CVE-2021-46929

CVE-2021-46929 describes a Linux kernel SCTP use-after-free related issue in endpoint destruction, resolved by delaying endpoint free with call_rcu() and moving sock_put/ep free into sctp_endpoint_destroy_rcu(). The patch ensures the endpoint (ep) remains alive under rcu_read_lock during certain ...

CVE-2021-46940

CVE-2021-46940 is a Linux kernel vulnerability in the perf/turbostat timer path. The bug stems from index conversion in tools/power turbostat where idx_to_offset() returns a 32-bit int while MSR_PKG_ENERGY_STAT is a 32-bit unsigned value, causing negative interpretation and triggering a guard in ...

CVE-2021-46915

The CVE-2021-46915 issue is in the Linux kernel’s netfilter nft_limit code. nft_limit_init attempted to divide a 64-bit value by a 64-bit expectation but used div_u64 (dividing 64-bit by 32-bit), risking a divide error. The fix changes nft_limit_init to use the correct 64-bit division function (d...

CVE-2021-46909

Mode C (normal, concrete details available) CVE-2021-46909 affects the Linux kernel PCI subsystem (ARM) and is resolved by a PCI interrupt/mapping fix in ARM: footbridge. The root cause was that after commit 30fdfb929e82, the kernel started mapping PCI IRQs whenever a PCI driver is probed via pci...

CVE-2020-36777

CVE-2020-36777 is a Linux kernel issue where media: dvbdev had a memory leak in dvb_media_device_free(), documented as freeing dvbdev->adapter->conn before NULL-ing it. The connected MiracleLinux advisory (AXSA-2024-8481:17) lists this CVE among others and confirms a fix/vendor advisory. Th...

CVE-2021-46936

CVE-2021-46936 affects the Linux kernel (net: fix use-after-free in tw_timer_handler). The flaw allowed use-after-free on net->mib.net_statistics when destroying a net namespace if inflight time-wait timers exist; it is triggered during path of timer handling and ip/mib teardown. The fix reloc...

CVE-2020-36776

In the Linux kernel, CVE-2020-36776 concerns the slab OOB issue in thermal/cpufreq_cooling. The vulnerability is triggered in cpu_power_to_freq() when the EM table does not contain a suitable power entry (power below OPP0), leading to a negative index read. The documented fix returns the lowest a...

CVE-2021-46948

CVE-2021-46948 relates to the Linux kernel: the sfc: farch patch fixes TX queue lookup in TX event handling. The issue occurred because TXQ label was used as the basis for queue lookup, which could cause efx_channel_get_tx_queue() to return NULL and trigger panics. The vulnerability has been reso...

CVE-2021-46925

CVE-2021-46925 affects the Linux kernel in the net/smc path. The issue is a race between smc_cdc_tx_handler() and smc_release() that can lead to a kernel panic or use-after-free when smc_cdc_tx_handler() accesses an smc_sock that has already been freed. The provided description documents a crash ...

CVE-2021-46912

The CVE-2021-46912 entry describes a Linux kernel vulnerability where tcp_allowed_congestion_control is global and writable, allowing cross-namespace leakage. A fix was applied to make tcp_allowed_congestion_control readonly in non-init netns, addressing the per-net IPv4 congestion control sysctl...

CVE-2021-46910

CVE-2021-46910 relates to the Linux kernel’s kmap_local(): when CONFIG_DEBUG_KMAP_LOCAL=y, per-CPU fixmap slots are doubled, causing the fixmap region to grow downwards and potentially collide with the virtual DT mapping. The documented impact is a local exploit path leading to kernel instability...

CVE-2021-46931

CVE-2021-46931 involves the Linux kernel mlx5e path (net/mlx5e, mlx5_core) where a TX-timeout-recovery flow calls mlx5e_tx_reporter_dump_sq() with a void* that is actually a mlx5e_tx_timeout_ctx*. The mismatch corrupts stack state and can trigger a kernel panic/stack overflow. The fix adds a wrap...

CVE-2021-46908

CVE-2021-46908 is a Linux kernel issue where the bpf permission flag for mixed signed bounds arithmetic was incorrect, enabling a vulnerability path that was mitigated by bypass_spec_v1 handling instead of allow_ptr_leaks. Connected advisories (e.g., SUSE-SU-2024:1465-1 / SUSE-SU-2024:1489-1) des...

CVE-2023-52435

CVE-2023-52435 affects the Linux kernel’s net/ skb_segment() and can overflow MSS when computing mss = mss * partial_segs, risking a crash (e.g., GSO_BY_FRAGS) and triggering NULL pointer dereferences in some traces. The fix adds a guard to ensure the new MSS is smaller than GSO_BY_FRAGS, prevent...

CVE-2021-46952

Summary (CVE-2021-46952): In the Linux kernel, NFS with UDP transport was vulnerable to a shift-out-of-bounds due to a garbage UDP retrans timeout being passed to xprt_calc_majortimeo. If retrans is >= 64, the mount fails with an error, preventing exploitation. The fix is a patch to validate U...

CVE-2021-46949

CVE-2021-46949 concerns the Linux kernel sfc (Solarflare) network driver path: farch TX queue lookup during TX flush done handling. The root cause is starting TXQ processing from a TXQ instance number (qid) rather than a TXQ type, which could cause efx_get_tx_queue() to return NULL and trigger pa...

CVE-2021-46945

CVE-2021-46945 concerns the Linux kernel ext4 filesystem. The vulnerability causes a kernel panic when the filesystem is mounted with errors=panic, prior to a specific commit. After the patch 014c9caa29d3, remounting a filesystem with abort no longer panics, and the behavior is restored to what i...

CVE-2021-46935

CVE-2021-46935 : Linux kernel binder vulnerability where async_free_space accounting for empty parcels leaked up to 8 bytes per 8-byte-or-smaller async transaction. Root cause: after a patch fixing visibility (Android binder buffer moved out of user space), the free operation didn’t add back size...

CVE-2021-46953

The CVE-2021-46953 issue affects the Linux kernel ACPI GTDT driver. If a probe fails due to invalid firmware properties, the driver may unmap an interrupt it mapped earlier without verifying that the mapping succeeded, and if the firmware reports an interrupt number overlapping the GIC SGI range,...

CVE-2021-46918

CVE-2021-46918 is a Linux kernel vulnerability in the IDXDMA/DMAR DMA engine where MSIX permission entries were not cleared on device shutdown. The issue arose because MSIX entries were left enabled and pasid entries remained programmed when the device shut down, potentially enabling persistence ...

CVE-2021-46938

CVE-2021-46938 affects the Linux kernel in the device-mapper (dm-mq) path for request-based mapped devices. When loading a device-mapper table, if the allocation/initialization of blk_mq_tag_set for the device fails, a subsequent dev_remove can trigger a double free during cleanup because the poi...

CVE-2021-46917

CVE-2021-46917 is a Linux kernel vulnerability tied to the dmaengine: idxd subsystem. The issue stems from a pre-release silicon erratum workaround where a wq reset did not clear WQCFG registers, leaking into upstream code and risking clobbering registers on future devices. The documented fix rep...

CVE-2021-46919

CVE-2021-46919 is a Linux kernel vulnerability in dmaengine/idxd where WQ size could be changed while the device was enabled. The fix changes the state check to ensure the WQ size is only modifiable when the device is disabled, addressing a race between device state and WQ configuration. Connecte...

CVE-2021-46954

CVE-2021-46954 affects the Linux kernel net/sched IPv4 path. When act_mirred attempts to fragment IPv4 packets that were previously reassembled by act_ct, sch_frag used a temporary dst_entry, which was later treated as an rtable pointer in the fragment/MTU flow. This caused a stack out-of-bounds ...

CVE-2021-46921

CVE-2021-46921 affects the Linux kernel’s locking/qrwlock code. The vulnerability arises in queued_write_lock_slowpath while the wait_lock is held: a reader can observe values before the writer has truly acquired the lock, due to an ordering gap between atomic_cond_read_acquire() and the subseque...