CVE-2021-47644

In the Linux kernel, the following vulnerability has been resolved: media: staging: media: zoran: move videodev alloc Move some code out of zr36057init and create new functions for handling zr-videodev. This permit to ease code reading and fix a zr-videodev memory leak...

CVE-2021-47639

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Zap all roots when unmapping gfn range in TDP MMU Zap both valid and invalid roots when zapping/unmapping a gfn range, as KVM must ensure it holds no references to the freed page after returning from the unmap...

CVE-2022-49731 ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo()

In the Linux kernel, the following vulnerability has been resolved: ata: libata-core: fix NULL pointer deref in atahostallocpinfo In an unlikely and probably wrong? case that the 'ppi' parameter of atahostallocpinfo points to an array starting with a NULL pointer, there's going to be a kernel oop...

CVE-2022-49731

CVE-2022-49731 affects the Linux kernel’s ata_libata-core. The flaw is a NULL pointer dereference in ata_host_alloc_pinfo() if the ppi array starts with NULL, causing a kernel oops. The fix initializes the local pi variable to &ata_dummy_port_info to prevent the oops. This vulnerability is addres...

CVE-2022-49724 tty: goldfish: Fix free_irq() on remove

In the Linux kernel, the following vulnerability has been resolved: tty: goldfish: Fix freeirq on remove Pass the correct devid to freeirq to fix this splat when the driver is unbound: WARNING: CPU: 0 PID: 30 at kernel/irq/manage.c:1895 freeirq Trying to free already-free IRQ 65 Call Trace:...

CVE-2022-49724

In the Linux kernel, the following vulnerability has been resolved: tty: goldfish: Fix freeirq on remove Pass the correct devid to freeirq to fix this splat when the driver is unbound: WARNING: CPU: 0 PID: 30 at kernel/irq/manage.c:1895 freeirq Trying to free already-free IRQ 65 Call Trace:...

CVE-2022-49720 block: Fix handling of offline queues in blk_mq_alloc_request_hctx()

In the Linux kernel, the following vulnerability has been resolved: block: Fix handling of offline queues in blkmqallocrequesthctx This patch prevents that test nvme/004 triggers the following: UBSAN: array-index-out-of-bounds in block/blk-mq.h:135:9 index 512 is out of range for type 'long...

CVE-2022-49718 irqchip/apple-aic: Fix refcount leak in aic_of_ic_init

In the Linux kernel, the following vulnerability has been resolved: irqchip/apple-aic: Fix refcount leak in aicoficinit ofgetchildbyname returns a node pointer with refcount incremented, we should use ofnodeput on it when not need anymore. Add missing ofnodeput to avoid refcount leak...

CVE-2022-49716

CVE-2022-49716 affects the Linux kernel’s irqchip/gic-v3 mechanism. The vulnerability stems from incorrect refcount handling in gic_populate_ppi_partitions: of_get_child_by_name() returns a node pointer with an incremented refcount, and if not properly released, a refcount leak occurs when kcallo...

CVE-2022-49715 irqchip/gic-v3: Fix refcount leak in gic_populate_ppi_partitions

In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3: Fix refcount leak in gicpopulateppipartitions offindnodebyphandle returns a node pointer with refcount incremented, we should use ofnodeput on it when not need anymore. Add missing ofnodeput to avoid refcount leak...

CVE-2022-49711 bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove()

In the Linux kernel, the following vulnerability has been resolved: bus: fsl-mc-bus: fix KASAN use-after-free in fslmcbusremove In fslmcbusremove, mc-rootmcbusdev-mcio is passed to fsldestroymcio. However, mc-rootmcbusdev is already freed in fslmcdeviceremove. Then reference to mc-rootmcbusdev-mc...

CVE-2022-49711

The CVE-2022-49711 issue affects the Linux kernel in the bus: fsl-mc-bus path. Root cause: in fsl_mc_bus_remove(), mc->root_mc_bus_dev->mc_io is passed to fsl_destroy_mc_io() after mc->root_mc_bus_dev has already been freed in fsl_mc_device_remove(), causing a KASAN use-after-free. Mitig...

CVE-2022-49712 usb: gadget: lpc32xx_udc: Fix refcount leak in lpc32xx_udc_probe

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: lpc32xxudc: Fix refcount leak in lpc32xxudcprobe ofparsephandle returns a node pointer with refcount incremented, we should use ofnodeput on it when not need anymore. Add missing ofnodeput to avoid refcount leak...

CVE-2022-49709 cfi: Fix __cfi_slowpath_diag RCU usage with cpuidle

In the Linux kernel, the following vulnerability has been resolved: cfi: Fix cfislowpathdiag RCU usage with cpuidle RCUNONIDLE usage during cfislowpathdiag can result in an invalid RCU state in the cpuidle code path: WARNING: CPU: 1 PID: 0 at kernel/rcu/tree.c:613 rcueqsenter+0xe4/0x138 ... Call...

CVE-2022-49709 cfi: Fix __cfi_slowpath_diag RCU usage with cpuidle

In the Linux kernel, the following vulnerability has been resolved: cfi: Fix cfislowpathdiag RCU usage with cpuidle RCUNONIDLE usage during cfislowpathdiag can result in an invalid RCU state in the cpuidle code path: WARNING: CPU: 1 PID: 0 at kernel/rcu/tree.c:613 rcueqsenter+0xe4/0x138 ... Call...

CVE-2022-49706 zonefs: fix zonefs_iomap_begin() for reads

In the Linux kernel, the following vulnerability has been resolved: zonefs: fix zonefsiomapbegin for reads If a readahead is issued to a sequential zone file with an offset exactly equal to the current file size, the iomap type is set to IOMAPUNWRITTEN, which will prevent an IO, but the iomap...

CVE-2022-49705

CVE-2022-49705 - Linux kernel 9p fid refcount leak . A fix was implemented for the 9p fid refcount leak in v9fs_vfs_atomic_open_dotl, ensuring the directory fid is released if the open() sequence fails partway. This prevents fid leaks observed with xfstests generic 531. The description in the ini...

CVE-2022-49706

CVE-2022-49706—zonefs contains a read handling bug in zonefs_iomap_begin() where a readahead to a zone file with an offset equal to the current file size can set iomap type to IOMAP_UNWRITTEN with length 0, triggering a WARN_ON in iomap_iter and causing iomap_readahead() to loop. The patch fixes ...

CVE-2022-49702

Summary: CVE-2022-49702 concerns a deadlock in Linux kernel when unmounting a filesystem with an async block group reclaim task relocating data. Multiple reclaim tasks (block-group, metadata/data) can interact with a parked cleaner thread, leading to a hang during close_ctree()/unmount due to del...

CVE-2022-49699 filemap: Handle sibling entries in filemap_get_read_batch()

In the Linux kernel, the following vulnerability has been resolved: filemap: Handle sibling entries in filemapgetreadbatch If a read races with an invalidation followed by another read, it is possible for a folio to be replaced with a higher-order folio. If that happens, we'll see a sibling entry...