UBUNTU-CVE-2022-49678

In the Linux kernel, the following vulnerability has been resolved: soc: bcm: brcmstb: pm: pm-arm: Fix refcount leak in brcmstbpmprobe offindmatchingnode returns a node pointer with refcount incremented, we should use ofnodeput on it when not need anymore. Add missing ofnodeput to avoid refcount...

DEBIAN-CVE-2022-49229

In the Linux kernel, the following vulnerability has been resolved: ptp: unregister virtual clocks when unregistering physical clock. When unregistering a physical clock which has some virtual clocks, unregister the virtual clocks with it. This fixes the following oops, which can be triggered by...

CVE-2022-49725

CVE-2022-49725 affects the Linux kernel i40e driver (Intel Ethernet) and relates to a crash after PF reset when ethtool -t tests are run in close succession. The root cause is a race between pf reset calling i40e_vsi_close in prep_for_reset and ethtool -t calling i40e_vsi_close in diag_test, wher...

CVE-2022-49697 bpf: Fix request_sock leak in sk lookup helpers

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix requestsock leak in sk lookup helpers A customer reported a requestsocket leak in a Calico cloud environment. We found that a BPF program was doing a socket lookup with takes a refcnt on the socket and that it was findin...

CVE-2022-49696 tipc: fix use-after-free Read in tipc_named_reinit

In the Linux kernel, the following vulnerability has been resolved: tipc: fix use-after-free Read in tipcnamedreinit syzbot found the following issue on: ================================================================== BUG: KASAN: use-after-free in tipcnamedreinit+0x94f/0x9b0...

CVE-2022-49592

CVE-2022-49592 affects the Linux kernel driver net/stmmac: a left-shift overflow in MTL_RXQ_DMA_MAP1 occurs when the number of TX/RX queues exceeds four, due to a 32‑bit mask calculation. UBSAN reports show a shift-out-of-bounds during UBSAN checks, leading to a potential warning path in dwmac4_c...

CVE-2022-49592 net: stmmac: fix dma queue left shift overflow issue

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix dma queue left shift overflow issue When queue number is 4, left shift overflows due to 32 bits integer variable. Mask calculation is wrong for MTLRXQDMAMAP1. If CONFIGUBSAN is enabled, kernel dumps below warning...

CVE-2022-49583 iavf: Fix handling of dummy receive descriptors

In the Linux kernel, the following vulnerability has been resolved: iavf: Fix handling of dummy receive descriptors Fix memory leak caused by not handling dummy receive descriptor properly. iavfgetrxbuffer now sets the rxbuffer return value for dummy receive descriptors. Without this patch, when...

CVE-2022-49554 zsmalloc: fix races between asynchronous zspage free and page migration

In the Linux kernel, the following vulnerability has been resolved: zsmalloc: fix races between asynchronous zspage free and page migration The asynchronous zspage free worker tries to lock a zspage's entire page list without defending against page migration. Since pages which haven't yet been...

CVE-2022-49541

The CVE-2022-49541 issue is a Linux kernel CIFS vulnerability: a potential double free during a failed mount. It is classed as HIGH severity (LOCAL access, LOW attack complexity) with impact to confidentiality, integrity, and availability as per the CVSS metrics. Connected advisories (SUSE/RHEL-r...

CVE-2022-49522

CVE-2022-49522 concerns a Linux kernel MMC driver issue (mmc: jz4740) where DMA maps could exceed the DMA engine’s capabilities. The root cause is not a research-level flaw but an inadequate limit on the maximum segment size for DMA data transfers. The fix enforces DMA engine limits on the jz4740...

CVE-2022-49507

CVE-2022-49507 affects the Linux kernel regulator driver for the da9121 (regulator/da9121-regulator.c). The issue arises when da9121_assign_chip_model() accesses regmap without it being initialized due to an invalid chip->subvariant_id (set to -EINVAL by a malformed device tree). This leads to...

CVE-2022-49471 rtw89: cfo: check mac_id to avoid out-of-bounds

In the Linux kernel, the following vulnerability has been resolved: rtw89: cfo: check macid to avoid out-of-bounds Somehow, hardware reports incorrect macid and pollute memory. Check index before we access the array. UBSAN: array-index-out-of-bounds in rtw89/phy.c:2517:23 index 188 is out of rang...

CVE-2022-49429

CVE-2022-49429 affects the Linux kernel’s RDMA/hfi1 subsystem. When the hfi1 module is loaded with SDMA disabled (HFI1_CAP_SDMA off), a call to hfi1_write_iter() can dereference a NULL pointer, causing a kernel panic through the I/O path (sdma_select_user_engine → hfi1_user_sdma_process_request →...

CVE-2022-49418

The CVE-2022-49418 entry concerns a Linux kernel NFSv4 crash during referral lookup caused by using an uninitialized nfs4_label. The fix, as described in the provided documents, sends along the already-allocated fattr with nfs4_fs_locations and drops the memcpy of fattr, which avoids two extra al...

CVE-2022-49418 NFSv4: Fix free of uninitialized nfs4_label on referral lookup.

In the Linux kernel, the following vulnerability has been resolved: NFSv4: Fix free of uninitialized nfs4label on referral lookup. Send along the already-allocated fattr along with nfs4fslocations, and drop the memcpy of fattr. We end up growing two more allocations, but this fixes up a crash as:...

CVE-2022-49390 macsec: fix UAF bug for real_dev

In the Linux kernel, the following vulnerability has been resolved: macsec: fix UAF bug for realdev Create a new macsec device but not get reference to realdev. That can not ensure that realdev is freed after macsec. That will trigger the UAF bug for realdev as following:...

CVE-2022-49376 scsi: sd: Fix potential NULL pointer dereference

In the Linux kernel, the following vulnerability has been resolved: scsi: sd: Fix potential NULL pointer dereference If sdprobe sees an early error before sdkp-device is initialized, sdzbcreleasedisk is called. This causes a NULL pointer dereference when sdiszoned is called inside that function...

CVE-2022-49356

CVE-2022-49356 affects the Linux kernel SUNRPC RDMA path. The vulnerability arises when svc_rdma_build_writes() can walk past the end of a Write chunk’s segment array, enabling a potential out-of-bounds condition. The issue was detected with KASAN and is addressed by a fix in the write path (net/...

CVE-2022-49320 dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size data type

In the Linux kernel, the following vulnerability has been resolved: dmaengine: zynqmpdma: In struct zynqmpdmachan fix descsize data type In zynqmpdmaalloc/freechanresources functions there is a potential overflow in the below expressions. dmaalloccoherentchan-dev, 2 chan-descsize ZYNQMPDMANUMDESC...