CVE-2022-49661

Affected component: Linux kernel, gs_usb driver (USB CAN adapter). Issue: memory leak in gs_usb_open/close where RX URBs allocated with usb_alloc_coherent() were not freed by usb_kill_anchored_urbs() and DMA memory leaked. Root cause: improper freeing pattern; the fix explicitly frees RX URBs and...

CVE-2022-49661

In the Linux kernel, the following vulnerability has been resolved: can: gsusb: gsusbopen/close: fix memory leak The gsusb driver appears to suffer from a malady common to many USB CAN adapter drivers in that it performs usballoccoherent to allocate a number of USB request blocks URBs for RX, and...

CVE-2022-49661 can: gs_usb: gs_usb_open/close(): fix memory leak

In the Linux kernel, the following vulnerability has been resolved: can: gsusb: gsusbopen/close: fix memory leak The gsusb driver appears to suffer from a malady common to many USB CAN adapter drivers in that it performs usballoccoherent to allocate a number of USB request blocks URBs for RX, and...

CVE-2022-49551 usb: isp1760: Fix out-of-bounds array access

In the Linux kernel, the following vulnerability has been resolved: usb: isp1760: Fix out-of-bounds array access Running the driver through kasan gives an interesting splat: BUG: KASAN: global-out-of-bounds in isp1760register+0x180/0x70c Read of size 20 at addr f1db2e64 by task swapper/0/1...

CVE-2022-49545 ALSA: usb-audio: Cancel pending work at closing a MIDI substream

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Cancel pending work at closing a MIDI substream At closing a USB MIDI output substream, there might be still a pending work, which would eventually access the rawmidi runtime object that is being released. For...

CVE-2022-49545

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Cancel pending work at closing a MIDI substream At closing a USB MIDI output substream, there might be still a pending work, which would eventually access the rawmidi runtime object that is being released. For...

CVE-2022-49545

CVE-2022-49545 concerns the Linux kernel ALSA USB audio path: a race during closing a USB MIDI output substream where a pending work could access the released rawmidi runtime object. The fix cancels the pending work on substream close to prevent the access. Documented via multiple advisories and ...

CVE-2022-49545 ALSA: usb-audio: Cancel pending work at closing a MIDI substream

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Cancel pending work at closing a MIDI substream At closing a USB MIDI output substream, there might be still a pending work, which would eventually access the rawmidi runtime object that is being released. For...

CVE-2022-49501 usbnet: Run unregister_netdev() before unbind() again

In the Linux kernel, the following vulnerability has been resolved: usbnet: Run unregisternetdev before unbind again Commit 2c9d6c2b871d "usbnet: run unbind before unregisternetdev" sought to fix a use-after-free on disconnect of USB Ethernet adapters. It turns out that a different fix is necessa...

CVE-2022-49501 usbnet: Run unregister_netdev() before unbind() again

In the Linux kernel, the following vulnerability has been resolved: usbnet: Run unregisternetdev before unbind again Commit 2c9d6c2b871d "usbnet: run unbind before unregisternetdev" sought to fix a use-after-free on disconnect of USB Ethernet adapters. It turns out that a different fix is necessa...

CVE-2022-49501

CVE-2022-49501 concerns the Linux kernel USB Ethernet (usbnet) path. The root cause is a use-after-free risk during disconnect caused by non-mirroring binding/unbinding order: usbnet_probe() binds then register_netdev(), whereas disconnect() previously unregisters before unbind(), leading to PHY ...

CVE-2022-49501

In the Linux kernel, the following vulnerability has been resolved: usbnet: Run unregisternetdev before unbind again Commit 2c9d6c2b871d "usbnet: run unbind before unregisternetdev" sought to fix a use-after-free on disconnect of USB Ethernet adapters. It turns out that a different fix is necessa...

CVE-2022-49501 usbnet: Run unregister_netdev() before unbind() again

In the Linux kernel, the following vulnerability has been resolved: usbnet: Run unregisternetdev before unbind again Commit 2c9d6c2b871d "usbnet: run unbind before unregisternetdev" sought to fix a use-after-free on disconnect of USB Ethernet adapters. It turns out that a different fix is necessa...

CVE-2022-49398

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: Replace listforeachentrysafe if using giveback The listforeachentrysafe macro saves the current item n and the item after n+1, so that n can be safely removed without corrupting the list. However, when traversi...

CVE-2022-49313 drivers: usb: host: Fix deadlock in oxu_bus_suspend()

In the Linux kernel, the following vulnerability has been resolved: drivers: usb: host: Fix deadlock in oxubussuspend There is a deadlock in oxubussuspend, which is shown below: Thread 1 | Thread 2 | timeraction oxubussuspend | modtimer spinlockirq //1 | wait a time ... | oxuwatchdog deltimersync...

CVE-2022-49313

CVE-2022-49313 : Linux kernel patch fixes a deadlock in usb host oxu_bus_suspend(). The issue arises when oxu_bus_suspend() holds oxu->lock while waiting for a timer to stop via del_timer_sync(), but the timer handler also needs the same lock, causing a potential deadlock. The patch removes de...

CVE-2022-49313

In the Linux kernel, the following vulnerability has been resolved: drivers: usb: host: Fix deadlock in oxubussuspend There is a deadlock in oxubussuspend, which is shown below: Thread 1 | Thread 2 | timeraction oxubussuspend | modtimer spinlockirq //1 | wait a time ... | oxuwatchdog deltimersync...

CVE-2022-49313 drivers: usb: host: Fix deadlock in oxu_bus_suspend()

In the Linux kernel, the following vulnerability has been resolved: drivers: usb: host: Fix deadlock in oxubussuspend There is a deadlock in oxubussuspend, which is shown below: Thread 1 | Thread 2 | timeraction oxubussuspend | modtimer spinlockirq //1 | wait a time ... | oxuwatchdog deltimersync...

CVE-2022-49306

CVE-2022-49306 affects the Linux kernel USB subsystem (usb: dwc3: host). The issue arises from stop setting the ACPI companion for the DWC3 host; the sysdev pointer is now used when assigning ACPI companions to xHCI ports and USB devices. Assigning the ACPI companion previously could replace the ...

CVE-2022-49306 usb: dwc3: host: Stop setting the ACPI companion

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: host: Stop setting the ACPI companion It is no longer needed. The sysdev pointer is now used when assigning the ACPI companions to the xHCI ports and USB devices. Assigning the ACPI companion here resulted in the...