CVE-2022-50034

CVE-2022-50034 affects the Linux kernel USB cdns3 gadget workaround 2. A use-after-free occurs in cdns3_wa2_remove_old_request when priv_req->request.buf is freed before the list node is removed with list_del_init(), leaving a dangling pointer in the list. The patch reorders the sequence, movi...

CVE-2022-50034 usb: cdns3 fix use-after-free at workaround 2

In the Linux kernel, the following vulnerability has been resolved: usb: cdns3 fix use-after-free at workaround 2 BUG: KFENCE: use-after-free read in listdelentryvalid+0x10/0xac cdns3wa2removeoldrequest ... kfreeprivreq-request.buf; cdns3gadgetepfreerequest&privep-endpoint, &privreq-request;...

CVE-2022-50034

In the Linux kernel, the following vulnerability has been resolved: usb: cdns3 fix use-after-free at workaround 2 BUG: KFENCE: use-after-free read in listdelentryvalid+0x10/0xac cdns3wa2removeoldrequest ... kfreeprivreq-request.buf; cdns3gadgetepfreerequest&privep-endpoint, &privreq-request;...

CVE-2022-50034 usb: cdns3 fix use-after-free at workaround 2

In the Linux kernel, the following vulnerability has been resolved: usb: cdns3 fix use-after-free at workaround 2 BUG: KFENCE: use-after-free read in listdelentryvalid+0x10/0xac cdns3wa2removeoldrequest ... kfreeprivreq-request.buf; cdns3gadgetepfreerequest&privep-endpoint, &privreq-request;...

CVE-2022-50033 usb: host: ohci-ppc-of: Fix refcount leak bug

In the Linux kernel, the following vulnerability has been resolved: usb: host: ohci-ppc-of: Fix refcount leak bug In ohcihcdppcofprobe, offindcompatiblenode will return a node pointer with refcount incremented. We should use ofnodeput when it is not used anymore...

CVE-2022-50033

CVE-2022-50033: In the Linux kernel USB host OHCI PPC OF driver, of_find_compatible_node() may return a node with an incremented refcount and of_node_put() must be used when not needed. The issue is a refcount leak in ohci_hcd_ppc_of_probe(). Affected: Linux kernel (ohci-ppc-of path). Impact is a...

CVE-2022-50033

In the Linux kernel, the following vulnerability has been resolved: usb: host: ohci-ppc-of: Fix refcount leak bug In ohcihcdppcofprobe, offindcompatiblenode will return a node pointer with refcount incremented. We should use ofnodeput when it is not used anymore...

CVE-2022-50032

CVE-2022-50032 concerns the Linux kernel USB Renesas driver fix for a refcount leak. The issue arises in usbhs_rza1_hardware_init() where of_find_node_by_name() returns a node pointer with an elevated refcount; the correct handling is to call of_node_put() when the node is no longer needed. The c...

CVE-2022-50032 usb: renesas: Fix refcount leak bug

In the Linux kernel, the following vulnerability has been resolved: usb: renesas: Fix refcount leak bug In usbhsrza1hardwareinit, offindnodebyname will return a node pointer with refcount incremented. We should use ofnodeput when it is not used anymore...

CVE-2022-50032

In the Linux kernel, the following vulnerability has been resolved: usb: renesas: Fix refcount leak bug In usbhsrza1hardwareinit, offindnodebyname will return a node pointer with refcount incremented. We should use ofnodeput when it is not used anymore...

CVE-2022-50032 usb: renesas: Fix refcount leak bug

In the Linux kernel, the following vulnerability has been resolved: usb: renesas: Fix refcount leak bug In usbhsrza1hardwareinit, offindnodebyname will return a node pointer with refcount incremented. We should use ofnodeput when it is not used anymore...

CVE-2022-50029

CVE-2022-50029 affects the Linux kernel “clk: qcom: ipq8074: dont disable gcc_sleep_clk_src” issue where the USB sleep clock is disabled while the clock framework tries to disable the sleep clock source, causing a failure. The connected advisories (Unity Linux / Astra Linux / SUSE entries) descri...

CVE-2022-50028 gadgetfs: ep_io - wait until IRQ finishes

In the Linux kernel, the following vulnerability has been resolved: gadgetfs: epio - wait until IRQ finishes after usbepqueue if waitforcompletioninterruptible is interrupted we need to wait until IRQ gets finished. Otherwise complete from epiocomplete can corrupt stack...

CVE-2022-50017

In the Linux kernel, the following vulnerability has been resolved: mips: cavium-octeon: Fix missing ofnodeput in octeon2usbclocksstart We should call ofnodeput for the reference 'uctlnode' returned by ofgetparent which will increase the refcount. Otherwise, there will be a refcount leak bug...

CVE-2022-49982

CVE-2022-49982 affects the Linux kernel media driver pvrusb2. The leak arises from error handling in pvr2_hdw_create: the v4l2 device is not unregistered when control flow returns to pvr2_context_create, causing pvr2_hdw_destroy to exit early. The fix adds v4l2_device_unregister to decrement the ...

CVE-2022-49982 media: pvrusb2: fix memory leak in pvr_probe

In the Linux kernel, the following vulnerability has been resolved: media: pvrusb2: fix memory leak in pvrprobe The error handling code in pvr2hdwcreate forgets to unregister the v4l2 device. When pvr2hdwcreate returns back to pvr2contextcreate, it calls pvr2contextdestroy to destroy context, but...

CVE-2022-49980

In the Linux kernel, the following vulnerability has been resolved: USB: gadget: Fix use-after-free Read in usbudcuevent The syzbot fuzzer found a race between uevent callbacks and gadget driver unregistration that can cause a use-after-free bug:...

CVE-2022-49980 USB: gadget: Fix use-after-free Read in usb_udc_uevent()

In the Linux kernel, the following vulnerability has been resolved: USB: gadget: Fix use-after-free Read in usbudcuevent The syzbot fuzzer found a race between uevent callbacks and gadget driver unregistration that can cause a use-after-free bug:...

CVE-2022-49980

CVE-2022-49980 affects the Linux kernel USB gadget subsystem (udc). A race between uevent callbacks and gadget driver unregistration can cause a use-after-free in usb_udc_uevent(), when it dereferences udc->driver without holding the udc_lock mutex. If the gadget driver is unbound concurrently...

CVE-2022-49980 USB: gadget: Fix use-after-free Read in usb_udc_uevent()

In the Linux kernel, the following vulnerability has been resolved: USB: gadget: Fix use-after-free Read in usbudcuevent The syzbot fuzzer found a race between uevent callbacks and gadget driver unregistration that can cause a use-after-free bug:...