UBUNTU-CVE-2022-49651

In the Linux kernel, the following vulnerability has been resolved: srcu: Tighten cleanupsrcustruct GP checks Currently, cleanupsrcustruct checks for a grace period in progress, but it does not check for a grace period that has not yet started but which might start at any time. Such a situation...

CVE-2022-49149

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix call timer start racing with call destruction The rxrpccall struct has a timer used to handle various timed events relating to a call. This timer can get started from the packet input routines that are run in softirq...

DEBIAN-CVE-2022-49119

In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Fix memory leak in pm8001chipfwflashupdatereq In pm8001chipfwflashupdatebuild, if pm8001chipfwflashupdatebuild fails, the struct fwcontrolex allocated must be freed...

CVE-2022-49651

CVE-2022-49651 affects the Linux kernel. The advisory states that cleanup_srcu_struct() now checks for a grace period that is started but not yet started, addressing a potential use-after-free (UAF). It is resolved by a commit tightening GP checks in cleanup_srcu_struct(), with references to kern...

CVE-2022-49651

In the Linux kernel, the following vulnerability has been resolved: srcu: Tighten cleanupsrcustruct GP checks Currently, cleanupsrcustruct checks for a grace period in progress, but it does not check for a grace period that has not yet started but which might start at any time. Such a situation...

CVE-2022-49622 netfilter: nf_tables: avoid skb access on nf_stolen

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: avoid skb access on nfstolen When verdict is NFSTOLEN, the skb might have been freed. When tracing is enabled, this can result in a use-after-free: 1. access to skb-nftrace 2. access to skb-mark 3. computatio...

CVE-2022-49614

This CVE entry documents a Linux kernel vulnerability in the nvme subsystem (CVE-2022-49614) where the root cause involves using a struct group for generic command dwords. The consequence described is that this could let a trace event know the full size of data intended to be copied and could sil...

CVE-2022-49407 dlm: fix plock invalid read

In the Linux kernel, the following vulnerability has been resolved: dlm: fix plock invalid read This patch fixes an invalid read showed by KASAN. A unlock will allocate a "struct plockop" and a followed sendop will append it to a global sendlist data structure. In some cases a followed devread...

CVE-2022-49407

CVE-2022-49407 : Linux kernel dlm plock invalid read, fixed in the patch that moves the callback field into struct plock_op and adjusts handling for plock_xop. The issue arose when a sequence (unlock -> send_op -> append to send_list) could lead to a dev_write() path treating a plock_op as ...

CVE-2022-49407

In the Linux kernel, the following vulnerability has been resolved: dlm: fix plock invalid read This patch fixes an invalid read showed by KASAN. A unlock will allocate a "struct plockop" and a followed sendop will append it to a global sendlist data structure. In some cases a followed devread...

CVE-2022-49397

In the Linux kernel, the following vulnerability has been resolved: phy: qcom-qmp: fix struct clk leak on probe errors Make sure to release the pipe clock reference in case of a late probe error e.g. probe deferral...

CVE-2022-49397 phy: qcom-qmp: fix struct clk leak on probe errors

In the Linux kernel, the following vulnerability has been resolved: phy: qcom-qmp: fix struct clk leak on probe errors Make sure to release the pipe clock reference in case of a late probe error e.g. probe deferral...

CVE-2022-49320

The CVE-2022-49320 entry concerns the Linux kernel dmaengine for ZynqMP DMA. The root cause is an overflow risk in zynqmp_dma_alloc/free_chan_resources where 32-bit operands are used in size calculations (2 * chan->desc_size * ZYNQMP_DMA_NUM_DESCS). The fix changes the desc_size data type to s...

CVE-2022-49221

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dp: populate connector of struct dppanel DP CTS test case 4.2.2.6 has valid edid with bad checksum on purpose and expect DP source return correct checksum. During drm edid read, correct edid checksum is calculated and...

CVE-2022-49076 RDMA/hfi1: Fix use-after-free bug for mm struct

In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Fix use-after-free bug for mm struct Under certain conditions, such as MPIAbort, the hfi1 cleanup code may represent the last reference held on the task mm. hfi1mmurbunregister then drops the last reference and the mm ...

CVE-2022-49076 RDMA/hfi1: Fix use-after-free bug for mm struct

In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Fix use-after-free bug for mm struct Under certain conditions, such as MPIAbort, the hfi1 cleanup code may represent the last reference held on the task mm. hfi1mmurbunregister then drops the last reference and the mm ...

CVE-2022-49076

In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Fix use-after-free bug for mm struct Under certain conditions, such as MPIAbort, the hfi1 cleanup code may represent the last reference held on the task mm. hfi1mmurbunregister then drops the last reference and the mm ...

CVE-2022-49076

CVE-2022-49076 concerns the Linux kernel RDMA/hfi1 subsystem. The issue is a use-after-free in the mm struct lifecycle: under certain conditions (e.g., MPI_Abort), hfi1_mmu_rb_unregister() may drop the last reference to a task mm, freeing it before its final use in hfi1_release_user_pages. This c...

Linux io_uring Use-After-Free

The Linux kernel suffers from a use-after-free of struct ioevfd because ioeventfddosignal frees an object when the refcount reaches zero without waiting for the required grace period. Summary UAF of struct ioevfd because ioeventfddosignal frees an object when the refcount reaches zero without...

CVE-2025-24904

libsignal-service-rs is a Rust version of the libsignal-service-java library which implements the core functionality to communicate with Signal servers. Prior to commit 82d70f6720e762898f34ae76b0894b0297d9b2f8, plaintext content envelopes could be injected by a server or a malicious client, and m...