Linux Kernel vulnerabilities

CVE-2021-3600 [HIGH] CWE-125 CVE-2021-3600: It was discovered that the eBPF implementation in the Linux kernel did not properly track bounds inf It was discovered that the eBPF implementation in the Linux kernel did not properly track bounds information for 32 bit registers when performing div and mod operations. A local attacker could use this to possibly execute arbitrary code.

CVE-2025-23133 [HIGH] CWE-787 CVE-2025-23133: In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: update channel li In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: update channel list in reg notifier instead reg worker Currently when ath11k gets a new channel list, it will be processed according to the following steps: 1. update new channel list to cfg80211 and queue reg_work. 2. cfg80211 handles new channel list during reg_work.

CVE-2022-49412 [HIGH] CWE-416 CVE-2022-49412: In the Linux kernel, the following vulnerability has been resolved: bfq: Avoid merging queues with In the Linux kernel, the following vulnerability has been resolved: bfq: Avoid merging queues with different parents It can happen that the parent of a bfqq changes between the moment we decide two queues are worth to merge (and set bic->stable_merge_bfqq) and the moment bfq_setup_merge() is called. This can happen e.g. because the process submitted I

CVE-2025-37861 [HIGH] CWE-416 CVE-2025-37861: In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Synchronous acces In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue When the task management thread processes reply queues while the reset thread resets them, the task management thread accesses an invalid queue ID (0xFFFF), set by the reset thread, which points to unallocated m

CVE-2022-49505 [HIGH] CWE-416 CVE-2022-49505: In the Linux kernel, the following vulnerability has been resolved: NFC: NULL out the dev->rfkill t In the Linux kernel, the following vulnerability has been resolved: NFC: NULL out the dev->rfkill to prevent UAF Commit 3e3b5dfcd16a ("NFC: reorder the logic in nfc_{un,}register_device") assumes the device_is_registered() in function nfc_dev_up() will help to check when the rfkill is unregistered. However, this check only take effect when device_del

CVE-2022-49030 [HIGH] CWE-190 CVE-2022-49030: In the Linux kernel, the following vulnerability has been resolved: libbpf: Handle size overflow fo In the Linux kernel, the following vulnerability has been resolved: libbpf: Handle size overflow for ringbuf mmap The maximum size of ringbuf is 2GB on x86-64 host, so 2 * max_entries will overflow u32 when mapping producer page and data pages. Only casting max_entries to size_t is not enough, because for 32-bits application on 64-bits kernel the siz

CVE-2024-46738 [HIGH] CWE-416 CVE-2024-46738: In the Linux kernel, the following vulnerability has been resolved: VMCI: Fix use-after-free when r In the Linux kernel, the following vulnerability has been resolved: VMCI: Fix use-after-free when removing resource in vmci_resource_remove() When removing a resource from vmci_resource_table in vmci_resource_remove(), the search is performed using the resource handle by comparing context and resource fields. It is possible though to create two reso

CVE-2025-37885 [HIGH] CWE-416 CVE-2025-37885: In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Reset IRTE to host co In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Reset IRTE to host control if *new* route isn't postable Restore an IRTE back to host control (remapped or posted MSI mode) if the *new* GSI route prevents posting the IRQ directly to a vCPU, regardless of the GSI routing type. Updating the IRTE if and only if the new GSI i

CVE-2024-41051 [HIGH] CWE-416 CVE-2024-41051: In the Linux kernel, the following vulnerability has been resolved: cachefiles: wait for ondemand_o In the Linux kernel, the following vulnerability has been resolved: cachefiles: wait for ondemand_object_worker to finish when dropping object When queuing ondemand_object_worker() to re-open the object, cachefiles_object is not pinned. The cachefiles_object may be freed when the pending read request is completed intentionally and the related erofs i

CVE-2023-52468 [HIGH] CWE-416 CVE-2023-52468: In the Linux kernel, the following vulnerability has been resolved: class: fix use-after-free in cl In the Linux kernel, the following vulnerability has been resolved: class: fix use-after-free in class_register() The lock_class_key is still registered and can be found in lock_keys_hash hlist after subsys_private is freed in error handler path.A task who iterate over the lock_keys_hash later may cause use-after-free.So fix that up and unregister th

CVE-2022-49176 [HIGH] CWE-416 CVE-2022-49176: In the Linux kernel, the following vulnerability has been resolved: bfq: fix use-after-free in bfq_ In the Linux kernel, the following vulnerability has been resolved: bfq: fix use-after-free in bfq_dispatch_request KASAN reports a use-after-free report when doing normal scsi-mq test [69832.239032] ================================================================== [69832.241810] BUG: KASAN: use-after-free in bfq_dispatch_request+0x1045/0x44b0 [698

CVE-2024-50282 [HIGH] CWE-120 CVE-2024-50282: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: add missing size ch In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read() Avoid a possible buffer overflow if size is larger than 4K. (cherry picked from commit f5d873f5825b40d886d03bd2aede91d4cf002434)

CVE-2022-2938 [HIGH] CWE-416 CVE-2022-2938: A flaw was found in the Linux kernel's implementation of Pressure Stall Information. While the featu A flaw was found in the Linux kernel's implementation of Pressure Stall Information. While the feature is disabled by default, it could allow an attacker to crash the system or have other memory-corruption side effects.

CVE-2024-49895 [HIGH] CWE-129 CVE-2024-49895: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix index out In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix index out of bounds in DCN30 degamma hardware format translation This commit addresses a potential index out of bounds issue in the `cm3_helper_translate_curve_to_degamma_hw_format` function in the DCN30 color management module. The issue could occur when the inde

CVE-2024-49969 [HIGH] CWE-129 CVE-2024-49969: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix index out In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix index out of bounds in DCN30 color transformation This commit addresses a potential index out of bounds issue in the `cm3_helper_translate_curve_to_hw_format` function in the DCN30 color management module. The issue could occur when the index 'i' exceeds the numbe

CVE-2022-49685 [HIGH] CWE-416 CVE-2022-49685: In the Linux kernel, the following vulnerability has been resolved: iio: trigger: sysfs: fix use-af In the Linux kernel, the following vulnerability has been resolved: iio: trigger: sysfs: fix use-after-free on remove Ensure that the irq_work has completed before the trigger is freed. BUG: KASAN: use-after-free in irq_work_run_list Read of size 8 at addr 0000000064702248 by task python3/25 Call Trace: irq_work_run_list irq_work_tick update_proces

CVE-2022-49063 [HIGH] CWE-416 CVE-2022-49063: In the Linux kernel, the following vulnerability has been resolved: ice: arfs: fix use-after-free w In the Linux kernel, the following vulnerability has been resolved: ice: arfs: fix use-after-free when freeing @rx_cpu_rmap The CI testing bots triggered the following splat: [ 718.203054] BUG: KASAN: use-after-free in free_irq_cpu_rmap+0x53/0x80 [ 718.206349] Read of size 4 at addr ffff8881bd127e00 by task sh/20834 [ 718.212852] CPU: 28 PID: 20834

CVE-2022-49626 [HIGH] CWE-416 CVE-2022-49626: In the Linux kernel, the following vulnerability has been resolved: sfc: fix use after free when di In the Linux kernel, the following vulnerability has been resolved: sfc: fix use after free when disabling sriov Use after free is detected by kfence when disabling sriov. What was read after being freed was vf->pci_dev: it was freed from pci_disable_sriov and later read in efx_ef10_sriov_free_vf_vports, called from efx_ef10_sriov_free_vf_vswitching.

CVE-2022-49073 [HIGH] CWE-787 CVE-2022-49073: In the Linux kernel, the following vulnerability has been resolved: ata: sata_dwc_460ex: Fix crash In the Linux kernel, the following vulnerability has been resolved: ata: sata_dwc_460ex: Fix crash due to OOB write the driver uses libata's "tag" values from in various arrays. Since the mentioned patch bumped the ATA_TAG_INTERNAL to 32, the value of the SATA_DWC_QCMD_MAX needs to account for that. Otherwise ATA_TAG_INTERNAL usage cause similar cras

CVE-2022-48821 [HIGH] CWE-416 CVE-2022-48821: In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: avoid double fpu In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: avoid double fput() on failed usercopy If the copy back to userland fails for the FASTRPC_IOCTL_ALLOC_DMA_BUFF ioctl(), we shouldn't assume that 'buf->dmabuf' is still valid. In fact, dma_buf_fd() called fd_install() before, i.e. "consumed" one reference, leaving us wi