DEBIAN-CVE-2022-49778

In the Linux kernel, the following vulnerability has been resolved: arm64/mm: fix incorrect filemapcount for non-leaf pmd/pud The page table check trigger BUGON unexpectedly when collapse hugepage: ------------ cut here ------------ kernel BUG at mm/pagetablecheck.c:82! Internal error: Oops - BUG...

UBUNTU-CVE-2022-49820

In the Linux kernel, the following vulnerability has been resolved: mctp i2c: don't count unused / invalid keys for flow release We're currently hitting the WARNON in mctpi2cflowrelease: if midev-releasecount midev-i2clockcount WARNONCE1, "release count overflow"; This may be hit if we expire a...

UBUNTU-CVE-2022-49889

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Check for NULL cpubuffer in ringbufferwakewaiters On some machines the number of listed CPUs may be bigger than the actual CPUs that exist. The tracing subsystem allocates a percpu directory with access to the per CP...

UBUNTU-CVE-2022-49787

In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-pci: Fix possible memory leak caused by missing pcidevput pcigetdevice will increase the reference count for the returned pcidev. We need to use pcidevput to decrease the reference count before amdprobe returns. There ...

CVE-2022-49929

CVE-2022-49929 relates to the Linux kernel RDMA/rxe path. The issue is a use-after-free-like leak in MR handling: rxe_recheck_mr() increments mr ref_cnt and, during RESPST_ERR_RNR, the code must call rxe_put(mr) to drop the extra reference to avoid a warning in __rxe_cleanup. The vulnerability is...

CVE-2022-49929 RDMA/rxe: Fix mr leak in RESPST_ERR_RNR

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix mr leak in RESPSTERRRNR rxerecheckmr will increase mr's refcnt, so we should call rxeputmr to drop mr's refcnt in RESPSTERRRNR to avoid below warning: WARNING: CPU: 0 PID: 4156 at...

CVE-2022-49915 mISDN: fix possible memory leak in mISDN_register_device()

In the Linux kernel, the following vulnerability has been resolved: mISDN: fix possible memory leak in mISDNregisterdevice Afer commit 1fa5ae857bb1 "driver core: get rid of struct device's busid string array", the name of device is allocated dynamically, add putdevice to give up the reference, so...

CVE-2022-49909

The connected advisories describe CVE-2022-49909 as a Linux kernel Bluetooth L2CAP use-after-free (A2MP) in l2cap_conn_del(). When l2cap_recv_frame() processes data and creates an A2MP channel that is not held, the reference counting can reach 1, and during hci_error_reset(), l2cap_chan_unlock() ...

CVE-2022-49830 drm/drv: Fix potential memory leak in drm_dev_init()

In the Linux kernel, the following vulnerability has been resolved: drm/drv: Fix potential memory leak in drmdevinit drmdevinit will add drmdevinitrelease as a callback. When drmmaddaction failed, the release function won't be added. As the result, the ref cnt added by deviceget in drmdevinit won...

CVE-2022-49822

The CVE refers to a Linux kernel CIFS issue: when tlink setup fails, connections may not be released, causing a refcount leak in the CIFS module and leaking fscache info, which can lead to errors on subsequent mounts (e.g., CIFS: Cache volume key already in use). The vulnerability is tied to the ...

CVE-2022-49822 cifs: Fix connections leak when tlink setup failed

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix connections leak when tlink setup failed If the tlink setup failed, lost to put the connections, then the module refcnt leak since the cifsd kthread not exit. Also leak the fscache info, and for next mount with fsc, it...

CVE-2022-49820 mctp i2c: don't count unused / invalid keys for flow release

In the Linux kernel, the following vulnerability has been resolved: mctp i2c: don't count unused / invalid keys for flow release We're currently hitting the WARNON in mctpi2cflowrelease: if midev-releasecount midev-i2clockcount WARNONCE1, "release count overflow"; This may be hit if we expire a...

CVE-2022-49820

CVE-2022-49820 concerns the Linux kernel mctp i2c flow release logic. The issue arises when release_count > i2c_lock_count, triggering a WARN_ONCE due to expiring a flow before sending the first packet and not pairing the release increment with the i2c lock operation. The fix adds a guard: onl...

CVE-2022-49787

Summary (CVE-2022-49787): In the Linux kernel, the mmc: sdhci-pci fix prevents a memory leak by ensuring proper PCI device reference counting. The root cause is that pci_get_device() increases the pci_dev reference count and may not be balanced with pci_dev_put() before amd_probe() returns; the f...

CVE-2022-49778 arm64/mm: fix incorrect file_map_count for non-leaf pmd/pud

In the Linux kernel, the following vulnerability has been resolved: arm64/mm: fix incorrect filemapcount for non-leaf pmd/pud The page table check trigger BUGON unexpectedly when collapse hugepage: ------------ cut here ------------ kernel BUG at mm/pagetablecheck.c:82! Internal error: Oops - BUG...

CVE-2022-49778

CVE-2022-49778 concerns the Linux kernel on arm64 where pmd_user_accessible_page() incorrectly treated non-leaf PMDs as leaf, causing a decrease of file_map_count for non-leaf PMDs during collapse of huge pages and triggering a BUG_ON() in mm/page_table_check.c. The provided connected documents c...

CVE-2025-23157

In the Linux kernel, the following vulnerability has been resolved: media: venus: hfiparser: add check to avoid out of bound access There is a possibility that initcodecs is invoked multiple times during manipulated payload from video firmware. In such case, if codecscount can get incremented to...

DEBIAN-CVE-2025-23157

In the Linux kernel, the following vulnerability has been resolved: media: venus: hfiparser: add check to avoid out of bound access There is a possibility that initcodecs is invoked multiple times during manipulated payload from video firmware. In such case, if codecscount can get incremented to...

UBUNTU-CVE-2025-23157

In the Linux kernel, the following vulnerability has been resolved: media: venus: hfiparser: add check to avoid out of bound access There is a possibility that initcodecs is invoked multiple times during manipulated payload from video firmware. In such case, if codecscount can get incremented to...

CVE-2025-37779

CVE-2025-37779 concerns the Linux kernel’s lib/iov_iter.c and arises from an incorrect refcount fix for non-slab folio pages used in EROFS/v9fs p9 read paths. The root cause is that pages in a bvec can be coalesced across folio boundaries, and the non-slab folio refcount was not increased suffici...