Miaoqian Lin

13 exploits Active since Feb 2023
CVE-2023-22995 WRITEUP HIGH WRITEUP
Linux kernel <5.17 - Buffer Overflow
In the Linux kernel before 5.17, an error path in dwc3_qcom_acpi_register_core in drivers/usb/dwc3/dwc3-qcom.c lacks certain platform_device_put and kfree calls.
CVSS 7.8
CVE-2023-22996 WRITEUP MEDIUM WRITEUP
Linux Kernel < 5.17.2 - Missing Release of Resource in qcom_aoss.c
In the Linux kernel before 5.17.2, drivers/soc/qcom/qcom_aoss.c does not release an of_find_device_by_node reference after use, e.g., with put_device.
CVSS 5.5
CVE-2023-22997 WRITEUP MEDIUM WRITEUP
Linux Kernel < 6.1.2 - NULL Pointer Dereference in Module Decompression
In the Linux kernel before 6.1.2, kernel/module/decompress.c misinterprets the module_get_next_page return value (expects it to be NULL in the error case, whereas it is actually an error pointer).
CVSS 5.5
CVE-2023-22998 WRITEUP MEDIUM WRITEUP
Linux Kernel < 6.0.3 - Use-After-Free in virtgpu_object
In the Linux kernel before 6.0.3, drivers/gpu/drm/virtio/virtgpu_object.c misinterprets the drm_gem_shmem_get_sg_table return value (expects it to be NULL in the error case, whereas it is actually an error pointer).
CVSS 5.5
CVE-2023-22999 WRITEUP MEDIUM WRITEUP
Linux Kernel < 5.16.3 - NULL Pointer Dereference in dwc3_qcom_create_urs_usb_platdev
In the Linux kernel before 5.16.3, drivers/usb/dwc3/dwc3-qcom.c misinterprets the dwc3_qcom_create_urs_usb_platdev return value (expects it to be NULL in the error case, whereas it is actually an error pointer).
CVSS 5.5
CVE-2023-23000 WRITEUP MEDIUM WRITEUP
Linux Kernel < 5.17 - NULL Pointer Dereference in Tegra XUSB Port Node Handling
In the Linux kernel before 5.17, drivers/phy/tegra/xusb.c mishandles the tegra_xusb_find_port_node return value. Callers expect NULL in the error case, but an error pointer is used.
CVSS 5.5
CVE-2023-23001 WRITEUP MEDIUM WRITEUP
Linux Kernel < 5.16.3 - NULL Pointer Dereference in UFS Mediatek Driver
In the Linux kernel before 5.16.3, drivers/scsi/ufs/ufs-mediatek.c misinterprets the regulator_get return value (expects it to be NULL in the error case, whereas it is actually an error pointer).
CVSS 5.5
CVE-2023-23002 WRITEUP MEDIUM WRITEUP
Linux Kernel < 5.16.3 - NULL Pointer Dereference in Bluetooth HCI QCA Driver
In the Linux kernel before 5.16.3, drivers/bluetooth/hci_qca.c misinterprets the devm_gpiod_get_index_optional return value (expects it to be NULL in the error case, whereas it is actually an error pointer).
CVSS 5.5
CVE-2023-23003 WRITEUP MEDIUM WRITEUP
Linux kernel <5.16 - Buffer Overflow
In the Linux kernel before 5.16, tools/perf/util/expr.c lacks a check for the hashmap__new return value.
CVSS 4.0
CVE-2023-23004 WRITEUP MEDIUM WRITEUP
Linux Kernel < 5.19 - NULL Pointer Dereference in Mali-DP Planes Driver
In the Linux kernel before 5.19, drivers/gpu/drm/arm/malidp_planes.c misinterprets the get_sg_table return value (expects it to be NULL in the error case, whereas it is actually an error pointer).
CVSS 5.5
CVE-2023-23005 WRITEUP MEDIUM WRITEUP
Linux Kernel < 6.2 - NULL Pointer Dereference in Memory Tier Allocation
In the Linux kernel before 6.2, mm/memory-tiers.c misinterprets the alloc_memory_type return value (expects it to be NULL in the error case, whereas it is actually an error pointer). NOTE: this is disputed by third parties because there are no realistic cases in which a user can cause the alloc_memory_type error case to be reached.
CVSS 5.5
CVE-2023-23006 WRITEUP MEDIUM WRITEUP
Linux Kernel < 5.15.13 - NULL Pointer Dereference in mlx5_get_uars_page Error Handling
In the Linux kernel before 5.15.13, drivers/net/ethernet/mellanox/mlx5/core/steering/dr_domain.c misinterprets the mlx5_get_uars_page return value (expects it to be NULL in the error case, whereas it is actually an error pointer).
CVSS 5.5
CVE-2025-53630 WRITEUP HIGH WRITEUP
llama.cpp - Heap-based Buffer Overflow in gguf_init_from_file_impl
llama.cpp is an inference of several LLM models in C/C++. Integer Overflow in the gguf_init_from_file_impl function in ggml/src/gguf.cpp can lead to Heap Out-of-Bounds Read/Write. This vulnerability is fixed in commit 26a48ad699d50b6268900062661bd22f3e792579.