CVE-2022-49997 net: lantiq_xrx200: restore buffer if memory allocation failed

In the Linux kernel, the following vulnerability has been resolved: net: lantiqxrx200: restore buffer if memory allocation failed In a situation where memory allocation fails, an invalid buffer address is stored. When this descriptor is used again, the system panics in the buildskb function when...

CVE-2022-49997

The CVE-2022-49997 issue affects the Linux kernel, specifically the net: lantiq_xrx200 driver. Root cause: when memory allocation fails, an invalid buffer address can be stored; using the descriptor again may cause a panic in build_skb(), resulting in an availability impact. Supported documents i...

CVE-2022-49996

CVE-2022-49996 is a Linux kernel issue affecting the btrfs subsystem. The vulnerability arises when btrfs_get_dev_args_from_path() calls btrfs_get_bdev_and_sb() with an invalid path, causing the function to return without freeing previously allocated memory for args->uuid and args->fsid, wh...

CVE-2022-49995 writeback: avoid use-after-free after removing device

In the Linux kernel, the following vulnerability has been resolved: writeback: avoid use-after-free after removing device When a disk is removed, bdiunregister gets called to stop further writeback and wait for associated delayed work to complete. However, wbinodewritebackend may schedule bandwid...

CVE-2022-49992 mm/mprotect: only reference swap pfn page if type match

In the Linux kernel, the following vulnerability has been resolved: mm/mprotect: only reference swap pfn page if type match Yu Zhao reported a bug after the commit "mm/swap: Add swpoffsetpfn to fetch PFN from swap entry" added a check in swpoffsetpfn for swap type 1: kernel BUG at...

CVE-2022-49991 mm/hugetlb: avoid corrupting page->mapping in hugetlb_mcopy_atomic_pte

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: avoid corrupting page-mapping in hugetlbmcopyatomicpte In MCOPYATOMICCONTINUE case with a non-shared VMA, pages in the page cache are installed in the ptes. But hugepageaddnewanonrmap is called for them mistakenly...

CVE-2022-49990 s390: fix double free of GS and RI CBs on fork() failure

In the Linux kernel, the following vulnerability has been resolved: s390: fix double free of GS and RI CBs on fork failure The pointers for guarded storage and runtime instrumentation control blocks are stored in the threadstruct of the associated task. These pointers are initially copied on fork...

CVE-2022-49989 xen/privcmd: fix error exit of privcmd_ioctl_dm_op()

In the Linux kernel, the following vulnerability has been resolved: xen/privcmd: fix error exit of privcmdioctldmop The error exit of privcmdioctldmop is calling unlockpages potentially with pages being NULL, leading to a NULL dereference. Additionally lockpages doesn't check for pinuserpagesfast...

CVE-2022-49989 xen/privcmd: fix error exit of privcmd_ioctl_dm_op()

In the Linux kernel, the following vulnerability has been resolved: xen/privcmd: fix error exit of privcmdioctldmop The error exit of privcmdioctldmop is calling unlockpages potentially with pages being NULL, leading to a NULL dereference. Additionally lockpages doesn't check for pinuserpagesfast...

CVE-2022-49989

CVE-2022-49989 concerns the Linux kernel’s xen/privcmd code. The vulnerability stems from: (1) error exit handling in privcmd_ioctl_dm_op() calling unlock_pages() with NULL pages, risking a NULL dereference, and (2) lock_pages() not verifying pin_user_pages_fast() success, potentially leaving som...

CVE-2022-49987 md: call __md_stop_writes in md_stop

In the Linux kernel, the following vulnerability has been resolved: md: call mdstopwrites in mdstop From the link 1, we can see raid1d was running even after the path raiddtr - mdstop - mdstop. Let's stop write first in destructor to align with normal md-raid to fix the KASAN issue. 1...

CVE-2022-49986 scsi: storvsc: Remove WQ_MEM_RECLAIM from storvsc_error_wq

In the Linux kernel, the following vulnerability has been resolved: scsi: storvsc: Remove WQMEMRECLAIM from storvscerrorwq storvscerrorwq workqueue should not be marked as WQMEMRECLAIM as it doesn't need to make forward progress under memory pressure. Marking this workqueue as WQMEMRECLAIM may...

CVE-2022-49984

CVE-2022-49984 is a Linux kernel vulnerability in the HID Steam driver: the code dereferences a HID report pointer without validating it, enabling a local attacker with a malicious HID device to trigger a NULL pointer dereference in steam_recv/steam_send_report. The issue has been fixed in the ke...

CVE-2022-49984 HID: steam: Prevent NULL pointer dereference in steam_{recv,send}_report

In the Linux kernel, the following vulnerability has been resolved: HID: steam: Prevent NULL pointer dereference in steamrecv,sendreport It is possible for a malicious device to forgo submitting a Feature Report. The HID Steam driver presently makes no prevision for this and de-references the...

CVE-2022-49982 media: pvrusb2: fix memory leak in pvr_probe

In the Linux kernel, the following vulnerability has been resolved: media: pvrusb2: fix memory leak in pvrprobe The error handling code in pvr2hdwcreate forgets to unregister the v4l2 device. When pvr2hdwcreate returns back to pvr2contextcreate, it calls pvr2contextdestroy to destroy context, but...

CVE-2022-49980

CVE-2022-49980 affects the Linux kernel USB gadget subsystem (udc). A race between uevent callbacks and gadget driver unregistration can cause a use-after-free in usb_udc_uevent(), when it dereferences udc->driver without holding the udc_lock mutex. If the gadget driver is unbound concurrently...

CVE-2022-49980 USB: gadget: Fix use-after-free Read in usb_udc_uevent()

In the Linux kernel, the following vulnerability has been resolved: USB: gadget: Fix use-after-free Read in usbudcuevent The syzbot fuzzer found a race between uevent callbacks and gadget driver unregistration that can cause a use-after-free bug:...

CVE-2022-49979 net: fix refcount bug in sk_psock_get (2)

In the Linux kernel, the following vulnerability has been resolved: net: fix refcount bug in skpsockget 2 Syzkaller reports refcount bug as follows: ------------ cut here ------------ refcountt: saturated; leaking memory. WARNING: CPU: 1 PID: 3605 at lib/refcount.c:19...

CVE-2022-49979

CVE-2022-49979 concerns a Linux kernel refcount bug in sk_psock_get triggered during an SMC fallback in the connect path, due to a mismatch in the sk_user_data field used by both smc and psock. The root cause is the shared use of sk_user_data by two subsystems; the patch adds a new bit (SK_USER_D...

CVE-2022-49978 fbdev: fb_pm2fb: Avoid potential divide by zero error

In the Linux kernel, the following vulnerability has been resolved: fbdev: fbpm2fb: Avoid potential divide by zero error In dofbioctl of fbmem.c, if cmd is FBIOPUTVSCREENINFO, var will be copied from user, then go through fbsetvar and info-fbops-fbcheckvar which could may be pm2fbcheckvar. Along...