CVE-2022-49647

In the Linux kernel, the following vulnerability has been resolved: cgroup: Use separate src/dst nodes when preloading csssets for migration Each cset cssset is pinned by its tasks. When we're moving tasks around across csets for a migration, we need to hold the source and destination csets to...

CVE-2022-49645

In the Linux kernel, the following vulnerability has been resolved: drm/panfrost: Fix shrinker list corruption by madvise IOCTL Calling madvise IOCTL twice on BO causes memory shrinker list corruption and crashes kernel because BO is already on the list and it's added to the list again, while BO...

CVE-2022-49644 drm/i915: fix a possible refcount leak in intel_dp_add_mst_connector()

In the Linux kernel, the following vulnerability has been resolved: drm/i915: fix a possible refcount leak in inteldpaddmstconnector If drmconnectorinit fails, intelconnectorfree will be called to take care of proper free. So it is necessary to drop the refcount of port before intelconnectorfree...

CVE-2022-49609

CVE-2022-49609 affects the Linux kernel component power/reset for the arm-versatile family. Root cause: of_find_matching_node_and_match() returns a node pointer with refcount incremented and was not balanced with of_node_put() when no longer needed, causing a refcount leak in versatile_reboot_pro...

CVE-2022-49562 KVM: x86: Use __try_cmpxchg_user() to update guest PTE A/D bits

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Use trycmpxchguser to update guest PTE A/D bits Use the recently introduced trycmpxchguser to update guest PTE A/D bits instead of mapping the PTE into kernel address space. The VMPFNMAP path is broken as it assumes tha...

CVE-2022-49530

CVE-2022-49530 affects the Linux kernel DRM/AMD power management code. The vulnerability arises in si_parse_power_table() where allocations for adev->pm.dpm.ps and its elements can be followed by a second free in si_dpm_fini() if an allocation fails, causing a potential double-free of adev-&gt...

CVE-2022-49511

In the Linux kernel, the following vulnerability has been resolved: fbdev: defio: fix the pagelist corruption Easily hit the below list corruption: == listadd corruption. prev-next should be next ffffffffc0ceb090, but was ffffec604507edc8. prev=ffffec604507edc8. WARNING: CPU: 65 PID: 3959 at...

CVE-2022-49489 drm/msm/disp/dpu1: set vbif hw config to NULL to avoid use after memory free during pm runtime resume

In the Linux kernel, the following vulnerability has been resolved: drm/msm/disp/dpu1: set vbif hw config to NULL to avoid use after memory free during pm runtime resume BUG: Unable to handle kernel paging request at virtual address 006b6b6b6b6b6be3 Call trace: dpuvbifinitmemtypes+0x40/0xb8...

CVE-2022-49470 Bluetooth: btmtksdio: fix use-after-free at btmtksdio_recv_event

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtksdio: fix use-after-free at btmtksdiorecvevent We should not access skb buffer data anymore after hcirecvframe was called. 39.634809 BUG: KASAN: use-after-free in btmtksdiorecvevent+0x1b0 39.634855 Read of size 1 ...

CVE-2022-49466 regulator: scmi: Fix refcount leak in scmi_regulator_probe

In the Linux kernel, the following vulnerability has been resolved: regulator: scmi: Fix refcount leak in scmiregulatorprobe offindnodebyname returns a node pointer with refcount incremented, we should use ofnodeput on it when done. Add missing ofnodeput to avoid refcount leak...

CVE-2022-49466

CVE-2022-49466 affects the Linux kernel regulator: scmi subsystem. The root cause is a refcount leak in scmi_regulator_probe due to of_find_node_by_name() returning a node pointer with an incremented refcount; the patch adds a call to of_node_put() to release the node when done. This fix prevents...

CVE-2022-49454

CVE-2022-49454 concerns the Linux kernel Mediatek PCI subsystem: a refcount leak in mtk_pcie_subsys_powerup() caused by of_find_compatible_node() returning a node pointer with an incremented refcount. The issue is resolved by adding a missing of_node_put() to release the refcount when the node is...

CVE-2022-49437 powerpc/xive: Fix refcount leak in xive_spapr_init

In the Linux kernel, the following vulnerability has been resolved: powerpc/xive: Fix refcount leak in xivespaprinit offindcompatiblenode returns a node pointer with refcount incremented, we should use ofnodeput on it when done. Add missing ofnodeput to avoid refcount leak...

CVE-2022-49400

In the Linux kernel, the following vulnerability has been resolved: md: Don't set mddev private to NULL in raid0 pers-free In normal stop process, it does like this: domdstop | mdstop pers-free; mddev-private=NULL | mdfree free mddev mdstop sets mddev-private to NULL after pers-free. The raid...

CVE-2022-49367

Summary (CVE-2022-49367) In the Linux kernel, the mv88e6xxx DSA MDIO registration path contains a refcount leak. The function of_get_child_by_name() returns a node pointer with an incremented refcount, but of_node_put() is not called when finished, leaking references. mv88e6xxx_mdio_register() fo...

CVE-2022-49334 mm/huge_memory: Fix xarray node memory leak

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: Fix xarray node memory leak If xassplitalloc fails to allocate the necessary nodes to complete the xarray entry split, it sets the xastate to -ENOMEM, which xasnomem then interprets as "Please allocate more memory"...

CVE-2022-49257 watch_queue: Fix NULL dereference in error cleanup

In the Linux kernel, the following vulnerability has been resolved: watchqueue: Fix NULL dereference in error cleanup In watchqueuesetsize, the error cleanup code doesn't take account of the fact that freepage can't handle a NULL pointer when trying to free up buffer pages that did get allocated...

CVE-2022-49257

CVE-2022-49257 affects the Linux kernel and stems from a NULL dereference in watch_queue_set_size() during error cleanup. The code path could call __free_page() on buffers that were not allocated, causing a NULL pointer dereference (observed as a KASAN report in __free_pages). The issue is mitiga...

CVE-2022-49257

In the Linux kernel, the following vulnerability has been resolved: watchqueue: Fix NULL dereference in error cleanup In watchqueuesetsize, the error cleanup code doesn't take account of the fact that freepage can't handle a NULL pointer when trying to free up buffer pages that did get allocated...

CVE-2022-49217 scsi: pm8001: Fix abort all task initialization

In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Fix abort all task initialization In pm80xxsendabortall, the nelem field of the ccb used is not initialized to 0. This missing initialization sometimes lead to the task completion path seeing the ccb with a non-zero...