CVE-2022-49462

The CVE-2022-49462 issue affects the Linux kernel DRM MSM A6xx driver (a6xx_gpu_init). Root cause: of_parse_phandle() returns a node pointer with refcount incremented and a missing of_node_put() leads to a refcount leak. The code path in a6xx_gmu_init() passes the node to of_find_device_by_node()...

CVE-2022-49444

CVE-2022-49444: Linux kernel vulnerability in module loading (e_shstrndx).sh_size) leading to an out-of-bounds access; described as exploitable by crafting a module. The issue is resolved by a patch that was rebased onto modules-next. Affected systems require updating to a kernel version containi...

CVE-2022-49435 mfd: davinci_voicecodec: Fix possible null-ptr-deref davinci_vc_probe()

In the Linux kernel, the following vulnerability has been resolved: mfd: davincivoicecodec: Fix possible null-ptr-deref davincivcprobe It will cause null-ptr-deref when using 'res', if platformgetresource returns NULL, so move using 'res' after devmioremapresource that will check it to avoid...

CVE-2022-49426 iommu/arm-smmu-v3-sva: Fix mm use-after-free

In the Linux kernel, the following vulnerability has been resolved: iommu/arm-smmu-v3-sva: Fix mm use-after-free We currently call arm64mmcontextput without holding a reference to the mm, which can result in use-after-free. Call mmgrab/mmdrop to ensure the mm only gets freed after we unpinned the...

CVE-2022-49415

The CVE-2022-49415 description is supported by multiple connected sources indicating a Linux kernel issue: ipmi:ipmb: Fix refcount leak in ipmi_ipmb_probe. The root cause is that of_parse_phandle() returns a node pointer with its refcount incremented, and the proper cleanup requires calling of_no...

CVE-2022-49397

CVE-2022-49397 affects the Linux kernel, in the phy: qcom-qmp driver. The vulnerability is a leak of a struct clk (pipe clock reference) on probe errors, including late probe error/deferral paths. The advisory states the fix releases the held pipe clock reference on such errors, i.e., a proper cl...

CVE-2022-49390

In the Linux kernel, the following vulnerability has been resolved: macsec: fix UAF bug for realdev Create a new macsec device but not get reference to realdev. That can not ensure that realdev is freed after macsec. That will trigger the UAF bug for realdev as following:...

CVE-2022-49385

In the Linux kernel, the following vulnerability has been resolved: driver: base: fix UAF when driverattach failed When driverattachdrv; failed, the driverprivate will be freed. But it has been added to the bus, which caused a UAF. To fix it, we need to delete it from the bus when failed...

CVE-2022-49356 SUNRPC: Trap RDMA segment overflows

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Trap RDMA segment overflows Prevent svcrdmabuildwrites from walking off the end of a Write chunk's segment array. Caught with KASAN. The test that this fix replaces is invalid, and might have been left over from an earlie...

CVE-2022-49351

CVE-2022-49351 is tied to the Linux kernel fix in net: altera: Fix refcount leak in altera_tse_mdio_create. The issue arises in for_each_child_of_node() iterations where the previous node’s reference count is decremented and, on breaking out of the loop, of_node_put() was not called, leading to a...

CVE-2022-49344 af_unix: Fix a data-race in unix_dgram_peer_wake_me().

In the Linux kernel, the following vulnerability has been resolved: afunix: Fix a data-race in unixdgrampeerwakeme. unixdgrampoll calls unixdgrampeerwakeme without other's lock held and check if its receive queue is full. Here we need to use unixrecvqfulllockless instead of unixrecvqfull, otherwi...

CVE-2022-49301

CVE-2022-49301 : In the Linux kernel, the staging rtl8712 USB driver has a bug where, if r8712_usbctrl_vendorreq() returns a negative value, data in usb_read8/16/32 is not initialized, triggering KMSAN uninitialized-value reports. Connected advisories reference fixes in the kernel (e.g., commits ...

CVE-2022-49295 nbd: call genl_unregister_family() first in nbd_cleanup()

In the Linux kernel, the following vulnerability has been resolved: nbd: call genlunregisterfamily first in nbdcleanup Otherwise there may be race between module removal and the handling of netlink command, which can lead to the oops as shown below: BUG: kernel NULL pointer dereference, address:...

CVE-2022-49294 drm/amd/display: Check if modulo is 0 before dividing.

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check if modulo is 0 before dividing. How & Why If a value of 0 is read, then this will cause a divide-by-0 panic...

CVE-2022-49289

CVE-2022-49289 : The Linux kernel fixed an integer overflow in uaccess() during access_ok() checks. Three architectures could mis-handle a negative length/overflow at the end of a user access, potentially returning success when it should not. The fix replaces the overflow-prone check with the com...

CVE-2022-49231

CVE-2022-49231 concerns a Linux kernel vulnerability in the rtw88 driver where memory overrun and memory leaks occurred during hw_scan due to allocating less memory than required. The issue could overwrite buffers and trigger mm module complaints and access violations, with potential memory leaks...

CVE-2022-49223 cxl/port: Hold port reference until decoder release

In the Linux kernel, the following vulnerability has been resolved: cxl/port: Hold port reference until decoder release KASAN + DEBUGKOBJECTRELEASE reports a potential use-after-free in cxldecoderrelease where it goes to reference its parent, a cxlport, to free its id back to port-decoderida. BUG...

CVE-2022-49211 mips: cdmm: Fix refcount leak in mips_cdmm_phys_base

In the Linux kernel, the following vulnerability has been resolved: mips: cdmm: Fix refcount leak in mipscdmmphysbase The offindcompatiblenode function returns a node pointer with refcount incremented, We should use ofnodeput on it when done Add the missing ofnodeput to release the refcount...

CVE-2022-49202

CVE-2022-49202 concerns a missing NULL check in Linux kernel Bluetooth hci_uart path (h5_enqueue), where a Syzbot general protection fault occurred in __pm_runtime_resume() due to blindly passing a possibly NULL serdev pointer (hu->serdev). The issue could lead to GPF if hu->serdev is NULL....

CVE-2022-49178

In the Linux kernel, the following vulnerability has been resolved: memstick/msproblock: fix handling of read-only devices Use setdiskro to propagate the read-only state to the block layer instead of checking for it in -open and leaking a reference in case of a read-only device...