CVE-2022-50038

In the Linux kernel, the following vulnerability has been resolved: drm/meson: Fix refcount bugs in mesonvpuhasavailableconnectors In this function, there are two refcount leak bugs: 1 when breaking out of foreachendpointofnode, we need call the ofnodeput for the 'ep'; 2 we should call ofnodeput...

CVE-2022-50009

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix null-ptr-deref in f2fsgetdnodeofdata There is issue as follows when test f2fs atomic write: F2FS-fs loop0: Can't find valid F2FS filesystem in 2th superblock F2FS-fs loop0: invalid crcoffset: 0 F2FS-fs loop0:...

CVE-2022-50229 ALSA: bcd2000: Fix a UAF bug on the error path of probing

In the Linux kernel, the following vulnerability has been resolved: ALSA: bcd2000: Fix a UAF bug on the error path of probing When the driver fails in sndcardregister at probe time, it will free the 'bcd2k-midiouturb' before killing it, which may cause a UAF bug. The following log can reveal it:...

CVE-2022-50229

In the Linux kernel, the following vulnerability has been resolved: ALSA: bcd2000: Fix a UAF bug on the error path of probing When the driver fails in sndcardregister at probe time, it will free the 'bcd2k-midiouturb' before killing it, which may cause a UAF bug. The following log can reveal it:...

CVE-2022-50219

In CVE-2022-50219, the issue is in the Linux kernel’s BPF subsystem. Syzbot reported a use-after-free in compute_effective_progs when detaching BPF links, where a freed memory path could be dereferenced by update_effective_progs() leading to a KASAN UAF. The fix removes the pointer from the cgrou...

CVE-2022-50168

CVE-2022-50168 (Linux kernel) : A race/cleanup bug in BPF JIT on x86 allowed freeing of a not-finalized bpf_prog_pack, triggered when multiple subprogs are processed. The root cause was that jit_subprogs() could free subprograms before bpf_jit_binary_pack_finalize() had run for them, risking free...

CVE-2022-50164

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix double listadd at iwlmvmmacwaketxqueue After successfull station association, if station queues are disabled for some reason, the related lists are not emptied. So if some new element is added to the list ...

CVE-2022-50164

CVE-2022-50164 concerns the Linux kernel wifi driver (iwlwifi, mvm). The issue is a bug in iwl_mvm_mac_wake_tx_queue where a double list_add can leave related lists uncleared after a successful station association if station queues are disabled, allowing a new element to link with a stale one. Th...

CVE-2022-50139 usb: aspeed-vhub: Fix refcount leak bug in ast_vhub_init_desc()

In the Linux kernel, the following vulnerability has been resolved: usb: aspeed-vhub: Fix refcount leak bug in astvhubinitdesc We should call ofnodeput for the reference returned by ofgetchildbyname which has increased the refcount...

CVE-2022-50102 video: fbdev: arkfb: Fix a divide-by-zero bug in ark_set_pixclock()

In the Linux kernel, the following vulnerability has been resolved: video: fbdev: arkfb: Fix a divide-by-zero bug in arksetpixclock Since the user can control the arguments of the ioctl from the user space, under special arguments that may result in a divide-by-zero bug in:...

CVE-2022-50099

CVE-2022-50099 affects the Linux kernel video fbdev Arkfb component. In arkfb_set_par(), user input can set screen_size larger than info->screen_size, risking a kernel page fault (LOCAL, high impact). The mitigation described is to check screen_size before memset_io() and apply the provided pa...

CVE-2022-50084

CVE-2022-50084 - Kernel dm-raid KASAN warning fix Context: Linux kernel vulnerability resolved in the dm-raid area, where an AddressSanitizer slab-out-of-bounds read could occur in raid_status. The fault manifested as a read of 4 bytes from conf->max_nr_stripes when mddev->private was cast ...

CVE-2022-50073

CVE-2022-50073 affects the Linux kernel TAP path. Root cause: in dev_parse_header_protocol the code dereferences skb->dev which can be NULL when the tap driver calls virtio_net_hdr_to_skb, causing a NULL pointer dereference. The issue is triggered in tap_get_user/tap_sendmsg paths and can cras...

CVE-2022-50072

In the Linux kernel, the following vulnerability has been resolved: NFSv4/pnfs: Fix a use-after-free bug in open If someone cancels the open RPC call, then we must not try to free either the open slot or the layoutget operation arguments, since they are likely still in use by the hung RPC call...

CVE-2022-50067

Concretely, CVE-2022-50067 affects Linux kernel’s btrfs relocation logic: if prepare_to_relocate() triggers a failure during a transaction, the code frees the relocation control (rc) but does not clear fs_info->reloc_ctl, leading to a use-after-free when btrfs_init_reloc_root() later reads rc....

CVE-2022-50062 net: bgmac: Fix a BUG triggered by wrong bytes_compl

In the Linux kernel, the following vulnerability has been resolved: net: bgmac: Fix a BUG triggered by wrong bytescompl On one of our machines we got: kernel BUG at lib/dynamicqueuelimits.c:27! Internal error: Oops - BUG: 0 1 PREEMPT SMP ARM CPU: 0 PID: 1166 Comm: irq/41-bgmac Tainted: G W O...

CVE-2022-50013 f2fs: fix to avoid use f2fs_bug_on() in f2fs_new_node_page()

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid use f2fsbugon in f2fsnewnodepage As Dipanjan Das reported, syzkaller found a f2fs bug as below: RIP: 0010:f2fsnewnodepage+0x19ac/0x1fc0 fs/f2fs/node.c:1295 Call Trace: writeallxattrs fs/f2fs/xattr.c:487 inline...

CVE-2022-50013

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid use f2fsbugon in f2fsnewnodepage As Dipanjan Das reported, syzkaller found a f2fs bug as below: RIP: 0010:f2fsnewnodepage+0x19ac/0x1fc0 fs/f2fs/node.c:1295 Call Trace: writeallxattrs fs/f2fs/xattr.c:487 inline...

CVE-2022-50002

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: LAG, fix logic over MLX5LAGFLAGNDEVSREADY Only set MLX5LAGFLAGNDEVSREADY if both netdevices are registered. Doing so guarantees that both ldev-pfMLX5LAGP0.dev and ldev-pfMLX5LAGP1.dev have valid pointers when...

CVE-2022-49998 rxrpc: Fix locking in rxrpc's sendmsg

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix locking in rxrpc's sendmsg Fix three bugs in the rxrpc's sendmsg implementation: 1 rxrpcnewclientcall should release the socket lock when returning an error from rxrpcgetcallslot. 2 rxrpcwaitfortxwindowintr will return...