Linux Kernel vulnerabilities

CVE-2022-49082 [HIGH] CWE-416 CVE-2022-49082: In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Fix use after fr In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Fix use after free in _scsih_expander_node_remove() The function mpt3sas_transport_port_remove() called in _scsih_expander_node_remove() frees the port field of the sas_expander structure, leading to the following use-after-free splat from KASAN when the ioc_info() cal

CVE-2024-56548 [HIGH] CWE-787 CVE-2024-56548: In the Linux kernel, the following vulnerability has been resolved: hfsplus: don't query the device In the Linux kernel, the following vulnerability has been resolved: hfsplus: don't query the device logical block size multiple times Devices block sizes may change. One of these cases is a loop device by using ioctl LOOP_SET_BLOCK_SIZE. While this may cause other issues like IO being rejected, in the case of hfsplus, it will allocate a block by usi

CVE-2021-47321 [HIGH] CWE-416 CVE-2021-47321: In the Linux kernel, the following vulnerability has been resolved: watchdog: Fix possible use-afte In the Linux kernel, the following vulnerability has been resolved: watchdog: Fix possible use-after-free by calling del_timer_sync() This driver's remove path calls del_timer(). However, that function does not wait until the timer handler finishes. This means that the timer handler may still be running after the driver's remove function has finished

CVE-2024-35855 [HIGH] CWE-416 CVE-2024-35855: In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix p In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update The rule activity update delayed work periodically traverses the list of configured rules and queries their activity from the device. As part of this task it accesses the entry pointed by 'ventry->entry', b

CVE-2025-37944 [HIGH] CWE-787 CVE-2025-37944: In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Fix invalid entry In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process Currently, ath12k_dp_mon_srng_process uses ath12k_hal_srng_src_get_next_entry to fetch the next entry from the destination ring. This is incorrect because ath12k_hal_srng_src_get_next_entry is intended for source rin

CVE-2023-52445 [HIGH] CWE-416 CVE-2023-52445: In the Linux kernel, the following vulnerability has been resolved: media: pvrusb2: fix use after f In the Linux kernel, the following vulnerability has been resolved: media: pvrusb2: fix use after free on context disconnection Upon module load, a kthread is created targeting the pvr2_context_thread_func function, which may call pvr2_context_destroy and thus call kfree() on the context object. However, that might happen before the usb hub_event han

CVE-2024-50221 [HIGH] CWE-787 CVE-2024-50221: In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: Vangogh: Fix kernel In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: Vangogh: Fix kernel memory out of bounds write KASAN reports that the GPU metrics table allocated in vangogh_tables_init() is not large enough for the memset done in smu_cmn_init_soft_gpu_metrics(). Condensed report follows: [ 33.861314] BUG: KASAN: slab-out-of-bounds in

CVE-2024-39291 [HIGH] CWE-120 CVE-2024-39291: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix buffer size in In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix buffer size in gfx_v9_4_3_init_ cp_compute_microcode() and rlc_microcode() The function gfx_v9_4_3_init_microcode in gfx_v9_4_3.c was generating about potential truncation of output when using the snprintf function. The issue was due to the size of the buffer 'ucode_pr

CVE-2024-26742 [HIGH] CWE-787 CVE-2024-26742: In the Linux kernel, the following vulnerability has been resolved: scsi: smartpqi: Fix disable_man In the Linux kernel, the following vulnerability has been resolved: scsi: smartpqi: Fix disable_managed_interrupts Correct blk-mq registration issue with module parameter disable_managed_interrupts enabled. When we turn off the default PCI_IRQ_AFFINITY flag, the driver needs to register with blk-mq using blk_mq_map_queues(). The driver is currently

CVE-2023-52444 [HIGH] CWE-119 CVE-2023-52444: In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid dirent corru In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid dirent corruption As Al reported in link[1]: f2fs_rename() ... if (old_dir != new_dir && !whiteout) f2fs_set_link(old_inode, old_dir_entry, old_dir_page, new_dir); else f2fs_put_page(old_dir_page, 0); You want correct inumber in the ".." link. And cross-directory

CVE-2025-37943 [HIGH] CWE-787 CVE-2025-37943: In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Fix invalid data In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Fix invalid data access in ath12k_dp_rx_h_undecap_nwifi In certain cases, hardware might provide packets with a length greater than the maximum native Wi-Fi header length. This can lead to accessing and modifying fields in the header within the ath12k_dp_rx_h_undecap_nwi

CVE-2024-49931 [HIGH] CWE-129 CVE-2024-49931: In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix array out-of- In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix array out-of-bound access in SoC stats Currently, the ath12k_soc_dp_stats::hal_reo_error array is defined with a maximum size of DP_REO_DST_RING_MAX. However, the ath12k_dp_rx_process() function access ath12k_soc_dp_stats::hal_reo_error using the REO destination SRN

CVE-2024-27396 [HIGH] CWE-416 CVE-2024-27396: In the Linux kernel, the following vulnerability has been resolved: net: gtp: Fix Use-After-Free in In the Linux kernel, the following vulnerability has been resolved: net: gtp: Fix Use-After-Free in gtp_dellink Since call_rcu, which is called in the hlist_for_each_entry_rcu traversal of gtp_dellink, is not part of the RCU read critical section, it is possible that the RCU grace period will pass during the traversal and the key will be free. To pr

CVE-2024-56642 [HIGH] CWE-416 CVE-2024-56642: In the Linux kernel, the following vulnerability has been resolved: tipc: Fix use-after-free of ker In the Linux kernel, the following vulnerability has been resolved: tipc: Fix use-after-free of kernel socket in cleanup_bearer(). syzkaller reported a use-after-free of UDP kernel socket in cleanup_bearer() without repro. [0][1] When bearer_disable() calls tipc_udp_disable(), cleanup of the UDP kernel socket is deferred by work calling cleanup_bear

CVE-2024-45026 [HIGH] CWE-787 CVE-2024-45026: In the Linux kernel, the following vulnerability has been resolved: s390/dasd: fix error recovery l In the Linux kernel, the following vulnerability has been resolved: s390/dasd: fix error recovery leading to data corruption on ESE devices Extent Space Efficient (ESE) or thin provisioned volumes need to be formatted on demand during usual IO processing. The dasd_ese_needs_format function checks for error codes that signal the non existence of a pr

CVE-2025-21969 [HIGH] CWE-416 CVE-2025-21969: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix slab-use- In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd After the hci sync command releases l2cap_conn, the hci receive data work queue references the released l2cap_conn when sending to the upper layer. Add hci dev lock to the hci receive data work queue to synchronize the

CVE-2022-48787 [HIGH] CWE-416 CVE-2022-48787: In the Linux kernel, the following vulnerability has been resolved: iwlwifi: fix use-after-free If In the Linux kernel, the following vulnerability has been resolved: iwlwifi: fix use-after-free If no firmware was present at all (or, presumably, all of the firmware files failed to parse), we end up unbinding by calling device_release_driver(), which calls remove(), which then in iwlwifi calls iwl_drv_stop(), freeing the 'drv' struct. However the ne

CVE-2023-52854 [HIGH] CWE-416 CVE-2023-52854: In the Linux kernel, the following vulnerability has been resolved: padata: Fix refcnt handling in In the Linux kernel, the following vulnerability has been resolved: padata: Fix refcnt handling in padata_free_shell() In a high-load arm64 environment, the pcrypt_aead01 test in LTP can lead to system UAF (Use-After-Free) issues. Due to the lengthy analysis of the pcrypt_aead01 function call, I'll describe the problem scenario using a simplified mode

CVE-2021-47358 [HIGH] CWE-416 CVE-2021-47358: In the Linux kernel, the following vulnerability has been resolved: staging: greybus: uart: fix tty In the Linux kernel, the following vulnerability has been resolved: staging: greybus: uart: fix tty use after free User space can hold a tty open indefinitely and tty drivers must not release the underlying structures until the last user is gone. Switch to using the tty-port reference counter to manage the life time of the greybus tty state to avoid

CVE-2022-48878 [HIGH] CWE-416 CVE-2022-48878: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_qca: Fix driver In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_qca: Fix driver shutdown on closed serdev The driver shutdown callback (which sends EDL_SOC_RESET to the device over serdev) should not be invoked when HCI device is not open (e.g. if hci_dev_open_sync() failed), because the serdev and its TTY are not open either. Also