CVE-2022-49849

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix match incorrectly in devargsmatchdevice syzkaller found a failed assertion: assertion failed: args-devid != u64-1 || args-missing, in fs/btrfs/volumes.c:6921 This can be triggered when we set devid to u64-1 by ioctl. I...

CVE-2022-49852

In the Linux kernel, the following vulnerability has been resolved: riscv: process: fix kernel info leakage threadstruct's s12 may contain random kernel memory content, which may be finally leaked to userspace. This is a security hole. Fix it by clearing the s12 array in threadstruct when fork. A...

CVE-2022-49813

In the Linux kernel, the following vulnerability has been resolved: net: ena: Fix error handling in enainit The enainit won't destroy workqueue created by createsinglethreadworkqueue when pciregisterdriver failed. Call destroyworkqueue when pciregisterdriver failed to prevent the resource leak...

CVE-2022-49854

In the Linux kernel, the following vulnerability has been resolved: mctp: Fix an error handling path in mctpinit If mctpneighinit return error, the routes resources should be released in the error handling path. Otherwise some resources leak...

CVE-2022-49898

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix tree mod log mishandling of reallocated nodes We have been seeing the following panic in production kernel BUG at fs/btrfs/tree-mod-log.c:677! invalid opcode: 0000 1 SMP RIP: 0010:treemodlogrewind+0x1b4/0x200 RSP:...

CVE-2022-49899

In the Linux kernel, the following vulnerability has been resolved: fscrypt: stop using keyrings subsystem for fscryptmasterkey The approach of fs/crypto/ internally managing the fscryptmasterkey structs as the payloads of "struct key" objects contained in a "struct key" keyring has outlived its...

CVE-2022-49919

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: release flow rule object from commit path No need to postpone this to the commit release path, since no packets are walking over this object, this is accessed from control plane only. This helped uncovered UA...

CVE-2022-49900

In the Linux kernel, the following vulnerability has been resolved: i2c: piix4: Fix adapter not be removed in piix4remove In piix4probe, the piix4 adapter will be registered in: piix4probe piix4addadapterssb800 / piix4addadapter i2caddadapter Based on the probed device type, piix4addadapterssb800...

CVE-2022-49878

In the Linux kernel, the following vulnerability has been resolved: bpf, verifier: Fix memory leak in array reallocation for stack state If an error NULL is returned by krealloc, callers of reallocarray were setting their allocation pointers to NULL, but on error krealloc does not touch the...

CVE-2022-49788

In the Linux kernel, the following vulnerability has been resolved: misc/vmwvmci: fix an infoleak in vmcihostdoreceivedatagram struct vmcieventqp allocated by qpnotifypeer contains padding, which may carry uninitialized data to the userspace, as observed by KMSAN: BUG: KMSAN: kernel-infoleak in...

CVE-2022-49838

In the Linux kernel, the following vulnerability has been resolved: sctp: clear outcurr if all frag chunks of current msg are pruned A crash was reported by Zhen Chen: listdel corruption, ffffa035ddf01c18-next is NULL WARNING: CPU: 1 PID: 250682 at lib/listdebug.c:49 listdelentryvalid+0x59/0xe0...

CVE-2022-49820

In the Linux kernel, the following vulnerability has been resolved: mctp i2c: don't count unused / invalid keys for flow release We're currently hitting the WARNON in mctpi2cflowrelease: if midev-releasecount midev-i2clockcount WARNONCE1, "release count overflow"; This may be hit if we expire a...

CVE-2022-49857

In the Linux kernel, the following vulnerability has been resolved: net: marvell: prestera: fix memory leak in presterarxtxswitchinit When presterasdmaswitchinit failed, the memory pointed to by sw-rxtx isn't released. Fix it. Only be compiled, not be tested...

CVE-2022-49793

In the Linux kernel, the following vulnerability has been resolved: iio: trigger: sysfs: fix possible memory leak in iiosysfstriginit devsetname allocates memory for name, it need be freed when deviceadd fails, call putdevice to give up the reference that hold in deviceinitialize, so that it can ...

CVE-2022-49779

In the Linux kernel, the following vulnerability has been resolved: kprobes: Skip clearing aggrprobe's posthandler in kprobe-on-ftrace case In unregisterkprobetop, if the currently unregistered probe has posthandler but other child probes of the aggrprobe do not have posthandler, the posthandler ...

CVE-2022-49799

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix wild-memory-access in registersynthevent In registersynthevent, if setsyntheventprintfmt failed, then both traceremoveeventcall and unregistertraceevent will be called, which means the traceeventcall will call...

CVE-2022-49794

In the Linux kernel, the following vulnerability has been resolved: iio: adc: at91adc: fix possible memory leak in at91adcallocatetrigger If iiotriggerregister returns error, it should call iiotriggerfree to give up the reference that hold in iiotriggeralloc, so that it can call iiotrigrelease to...

CVE-2022-49776

In the Linux kernel, the following vulnerability has been resolved: macvlan: enforce a consistent minimal mtu macvlan should enforce a minimal mtu of 68, even at link creation. This patch avoids the current behavior which could lead to crashes in ipv6 stack if the link is brought up $ ip link add...

CVE-2022-49925

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix null-ptr-deref in ibcorecleanup KASAN reported a null-ptr-deref error: KASAN: null-ptr-deref in range 0x0000000000000118-0x000000000000011f CPU: 1 PID: 379 Hardware name: QEMU Standard PC i440FX + PIIX, 1996 RIP:...

CVE-2022-49905

In the Linux kernel, the following vulnerability has been resolved: net/smc: Fix possible leaked pernet namespace in smcinit In smcinit, registerpernetsubsys&smcnetstatops is called without any error handling. If it fails, registering of &smcnetops won't be reverted. And if smcnlinit fails,...