The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.
** DISPUTED ** An issue was discovered in wcd9335_codec_enable_dec in sound/soc/codecs/wcd9335.c in the Linux kernel through 5.1.5. It uses kstrndup instead of kmemdup_nul, which allows attackers to have an unspecified impact via unknown vectors. NOTE: The vendor disputes this issues as not being a vulnerability because switching to kmemdup_nul() would only fix a security issue if the source string wasn't NUL-terminated, which is not the case.
Base Score: 7.2
Impact Score: 10
Exploitability Score: 3.9
Base Score: 7.8
Impact Score: 5.9
Exploitability Score: 1.8
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions up to 5.1.5 (inclusive)