UBUNTU-CVE-2022-49819

In the Linux kernel, the following vulnerability has been resolved: octeonep: fix potential memory leak in octepdevicesetup When occur unsupporteddev and mbox init errors, it did not free oct-conf and iounmap oct-mmioi.hwaddr. That would trigger memory leak problem. Add kfree for oct-conf and...

UBUNTU-CVE-2022-49870

In the Linux kernel, the following vulnerability has been resolved: capabilities: fix undefined behavior in bit shift for CAPTOMASK Shifting signed 32-bit value by 31 bits is undefined, so changing significant bit to unsigned. The UBSAN warning calltrace like below: UBSAN: shift-out-of-bounds in...

UBUNTU-CVE-2022-49829

In the Linux kernel, the following vulnerability has been resolved: drm/scheduler: fix fence ref counting We leaked dependency fences when processes were beeing killed. Additional to that grab a reference to the last scheduled fence...

UBUNTU-CVE-2022-49788

In the Linux kernel, the following vulnerability has been resolved: misc/vmwvmci: fix an infoleak in vmcihostdoreceivedatagram struct vmcieventqp allocated by qpnotifypeer contains padding, which may carry uninitialized data to the userspace, as observed by KMSAN: BUG: KMSAN: kernel-infoleak in...

UBUNTU-CVE-2022-49901

In the Linux kernel, the following vulnerability has been resolved: blk-mq: Fix kmemleak in blkmqinitallocatedqueue There is a kmemleak caused by modprobe nullblk.ko unreferenced object 0xffff8881acb1f000 size 1024: comm "modprobe", pid 836, jiffies 4294971190 age 27.068s hex dump first 32 bytes:...

CVE-2022-49922 nfc: nfcmrvl: Fix potential memory leak in nfcmrvl_i2c_nci_send()

In the Linux kernel, the following vulnerability has been resolved: nfc: nfcmrvl: Fix potential memory leak in nfcmrvli2cncisend nfcmrvli2cncisend will be called by nfcmrvlncisend, and skb should be freed in nfcmrvli2cncisend. However, nfcmrvlncisend will only free skb when i2cmastersend return =...

CVE-2022-49916 rose: Fix NULL pointer dereference in rose_send_frame()

In the Linux kernel, the following vulnerability has been resolved: rose: Fix NULL pointer dereference in rosesendframe The syzkaller reported an issue: KASAN: null-ptr-deref in range 0x0000000000000380-0x0000000000000387 CPU: 0 PID: 4069 Comm: kworker/0:15 Not tainted...

CVE-2022-49868

CVE-2022-49868 relates to a Linux kernel quirk involving the mt7621 PCI PHY/staging driver. The issue arises when mt7621_soc_dev_attr registers the SoC as a device, causing an oops in soc_device_match_attr. The quirk was introduced in the staging driver (staging: mt7621-pci-phy) and was later re-...

CVE-2022-49855 net: wwan: iosm: fix memory leak in ipc_pcie_read_bios_cfg

In the Linux kernel, the following vulnerability has been resolved: net: wwan: iosm: fix memory leak in ipcpciereadbioscfg ipcpciereadbioscfg is using the acpievaluatedsm to obtain the wwan power state configuration from BIOS but is not freeing the acpiobject. The acpievaluatedsm returned...

CVE-2022-49851 riscv: fix reserved memory setup

In the Linux kernel, the following vulnerability has been resolved: riscv: fix reserved memory setup Currently, RISC-V sets up reserved memory using the "early" copy of the device tree. As a result, when trying to get a reserved memory region using ofreservedmemlookup, the pointer to reserved...

CVE-2022-49827 drm: Fix potential null-ptr-deref in drm_vblank_destroy_worker()

In the Linux kernel, the following vulnerability has been resolved: drm: Fix potential null-ptr-deref in drmvblankdestroyworker drmvblankinit call drmmaddactionorreset with drmvblankinitrelease as action. If drmmaddaction failed, will directly call drmvblankinitrelease with the vblank whose worke...

CVE-2022-49820 mctp i2c: don't count unused / invalid keys for flow release

In the Linux kernel, the following vulnerability has been resolved: mctp i2c: don't count unused / invalid keys for flow release We're currently hitting the WARNON in mctpi2cflowrelease: if midev-releasecount midev-i2clockcount WARNONCE1, "release count overflow"; This may be hit if we expire a...

CVE-2022-49796

The CVE-2022-49796 issue affects the Linux kernel tracing/kprobe path. It concerns a potential NULL pointer dereference in trace_array if test_gen_kprobe_cmd() fails after kprobe_event_gen_cmd_end(), where gen_kretprobe_test could reference an invalid trace_array after kprobe_event_delete(). The ...

CVE-2022-49772 ALSA: usb-audio: Drop snd_BUG_ON() from snd_usbmidi_output_open()

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Drop sndBUGON from sndusbmidioutputopen sndusbmidioutputopen has a check of the NULL port with sndBUGON. sndBUGON was used as this shouldn't have happened, but in reality, the NULL port may be seen when the devic...

DEBIAN-CVE-2025-37748

In the Linux kernel, the following vulnerability has been resolved: iommu/mediatek: Fix NULL pointer deference in mtkiommudevicegroup Currently, mtkiommu calls during probe iommudeviceregister before the hwlist from driver data is initialized. Since iommu probing issue fix, it leads to NULL point...

DEBIAN-CVE-2025-23140

In the Linux kernel, the following vulnerability has been resolved: misc: pciendpointtest: Avoid issue of interrupts remaining after requestirq error After devmrequestirq fails with error in pciendpointtestrequestirq, the pciendpointtestfreeirqvectors is called assuming that all IRQs have been...

UBUNTU-CVE-2025-37750

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF in decryption with multichannel After commit f7025d861694 "smb: client: allocate crypto only for primary server" and commit b0abcd65ec54 "smb: client: fix UAF in async decryption", the channels started reusin...

UBUNTU-CVE-2025-37740

In the Linux kernel, the following vulnerability has been resolved: jfs: add sanity check for agwidth in dbMount The width in dmapctl of the AG is zero, it trigger a divide error when calculating the control page level in dbAllocAG. To avoid this issue, add a check for agwidth in dbAllocAG...

UBUNTU-CVE-2025-37742

In the Linux kernel, the following vulnerability has been resolved: jfs: Fix uninit-value access of imap allocated in the diMount function syzbot reports that hexdumptobuffer is using uninit-value: ===================================================== BUG: KMSAN: uninit-value in...

UBUNTU-CVE-2025-23161

In the Linux kernel, the following vulnerability has been resolved: PCI: vmd: Make vmddev::cfglock a rawspinlockt type The access to the PCI config space via pciops::read and pciops::write is a low-level hardware access. The functions can be accessed with disabled interrupts even on PREEMPTRT. Th...