CVE-2022-48949

In the Linux kernel, the following vulnerability has been resolved: igb: Initialize mailbox message for VF reset When a MAC address is not assigned to the VF, that portion of the message sent to the VF is not set. The memory, however, is allocated from the stack meaning that information may be...

CVE-2022-48958

In the Linux kernel, the following vulnerability has been resolved: ethernet: aeroflex: fix potential skb leak in grethinitrings The grethinitrings function won't free the newly allocated skb when dmamappingerror returns error, so add devkfreeskb to fix it. Compile tested only...

CVE-2022-48994

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fix function prototype mismatch in sndseqexpandvarevent With clang's kernel control flow integrity kCFI, CONFIGCFICLANG, indirect call targets are validated against the expected function pointer prototype to make sure...

CVE-2022-48982

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix crash when replugging CSR fake controllers It seems fake CSR 5.0 clones can cause the suspend notifier to be registered twice causing the following kernel panic: 71.986122 Call Trace: 71.986124 71.986125...

CVE-2022-49001

In the Linux kernel, the following vulnerability has been resolved: riscv: fix race when vmap stack overflow Currently, when detecting vmap stack overflow, riscv firstly switches to the so called shadow stack, then use this shadow stack to call the getoverflowstack to get the overflow stack...

CVE-2022-48986

In the Linux kernel, the following vulnerability has been resolved: mm/gup: fix guppudrange for dax For dax pud, pudhuge returns true on x86. So the function works as long as hugetlb is configured. However, dax doesn't depend on hugetlb. Commit 414fd080d125 "mm/gup: fix guppmdrange for dax" fixed...

CVE-2024-50059

In the Linux kernel, the following vulnerability has been resolved: ntb: ntbhwswitchtec: Fix use after free vulnerability in switchtecntbremove due to race condition In the switchtecntbadd function, it can call switchtecntbinitsndev function, then &sndev-checklinkstatuswork is bound with...

CVE-2024-50048

In the Linux kernel, the following vulnerability has been resolved: fbcon: Fix a NULL pointer dereference issue in fbconputcs syzbot has found a NULL pointer dereference bug in fbcon. Here is the simplified C reproducer: struct param uint8t type; struct tioclselection ts; ; int main struct...

CVE-2022-49009

In the Linux kernel, the following vulnerability has been resolved: hwmon: asus-ec-sensors Add checks for devmkcalloc As the devmkcalloc may return NULL, the return value needs to be checked to avoid NULL poineter dereference...

CVE-2022-48953

In the Linux kernel, the following vulnerability has been resolved: rtc: cmos: Fix event handler registration ordering issue Because acpiinstallfixedeventhandler enables the event automatically on success, it is incorrect to call it before the handler routine passed to it is ready to handle event...

CVE-2022-48988

In the Linux kernel, the following vulnerability has been resolved: memcg: fix possible use-after-free in memcgwriteeventcontrol memcgwriteeventcontrol accesses the dentry-dname of the specified control fd to route the write call. As a cgroup interface file can't be renamed, it's safe to access...

CVE-2022-49017

In the Linux kernel, the following vulnerability has been resolved: tipc: re-fetch skb cb after tipcmsgvalidate As the call trace shows, the original skb was freed in tipcmsgvalidate, and dereferencing the old skb cb would cause an use-after-free crash. BUG: KASAN: use-after-free in...

CVE-2024-50065

In the Linux kernel, the following vulnerability has been resolved: ntfs3: Change to non-blocking allocation in ntfsdhash dhash is done while under "rcu-walk" and should not sleep. getname allocates using GFPKERNEL, having the possibility to sleep when under memory pressure. Change the allocation...

CVE-2022-48950

In the Linux kernel, the following vulnerability has been resolved: perf: Fix perfpendingtask UaF Per syzbot it is possible for perfpendingtask to run after the event is free'd. There are two related but distinct cases: - the taskwork was already queued before destroying the event; - destroying t...

CVE-2022-48951

In the Linux kernel, the following vulnerability has been resolved: ASoC: ops: Check bounds for second channel in sndsocputvolswsx The bounds checks in sndsocputvolswsx are only being applied to the first channel, meaning it is possible to write out of bounds values to the second channel in stere...

CVE-2022-49011

In the Linux kernel, the following vulnerability has been resolved: hwmon: coretemp fix pci device refcount leak in nv1aramnew As comment of pcigetdomainbusandslot says, it returns a pci device with refcount increment, when finish using it, the caller must decrement the reference count by calling...

CVE-2022-48956

In the Linux kernel, the following vulnerability has been resolved: ipv6: avoid use-after-free in ip6fragment Blamed commit claimed rcureadlock was held by ip6fragment callers. It seems to not be always true, at least for UDP stack. syzbot reported: BUG: KASAN: use-after-free in ip6dstidev...

CVE-2022-48999

In the Linux kernel, the following vulnerability has been resolved: ipv4: Handle attempt to delete multipath route when fibinfo contains an nh reference Gwangun Jung reported a slab-out-of-bounds access in fibnhmatch: fibnhmatch+0xf98/0x1130 linux-6.0-rc7/net/ipv4/fibsemantics.c:961...

CVE-2022-49013

In the Linux kernel, the following vulnerability has been resolved: sctp: fix memory leak in sctpstreamoutqmigrate When sctpstreamoutqmigrate is called to release stream out resources, the memory pointed to by priohead in stream out is not released. The memory leak information is as follows:...

CVE-2022-48965

In the Linux kernel, the following vulnerability has been resolved: gpio/rockchip: fix refcount leak in rockchipgpiolibregister The node returned by ofgetparent with refcount incremented, ofnodeput needs be called when finish using it. So add it in the end of ofpinctrlget...