CVE-2022-48968 octeontx2-pf: Fix potential memory leak in otx2_init_tc()

In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: Fix potential memory leak in otx2inittc In otx2inittc, if rhashtableinit failed, it does not free tc-tcentriesbitmap which is allocated in otx2tcallocentbitmap...

CVE-2022-48964 ravb: Fix potential use-after-free in ravb_rx_gbeth()

In the Linux kernel, the following vulnerability has been resolved: ravb: Fix potential use-after-free in ravbrxgbeth The skb is delivered to napigroreceive which may free it, after calling this, dereferencing skb may trigger use-after-free...

CVE-2022-48964 ravb: Fix potential use-after-free in ravb_rx_gbeth()

In the Linux kernel, the following vulnerability has been resolved: ravb: Fix potential use-after-free in ravbrxgbeth The skb is delivered to napigroreceive which may free it, after calling this, dereferencing skb may trigger use-after-free...

CVE-2022-48962 net: hisilicon: Fix potential use-after-free in hisi_femac_rx()

In the Linux kernel, the following vulnerability has been resolved: net: hisilicon: Fix potential use-after-free in hisifemacrx The skb is delivered to napigroreceive which may free it, after calling this, dereferencing skb may trigger use-after-free...

CVE-2022-48958 ethernet: aeroflex: fix potential skb leak in greth_init_rings()

In the Linux kernel, the following vulnerability has been resolved: ethernet: aeroflex: fix potential skb leak in grethinitrings The grethinitrings function won't free the newly allocated skb when dmamappingerror returns error, so add devkfreeskb to fix it. Compile tested only...

CVE-2022-48954 s390/qeth: fix use-after-free in hsci

In the Linux kernel, the following vulnerability has been resolved: s390/qeth: fix use-after-free in hsci KASAN found that addr was dereferenced after br2deveventwork was freed. ================================================================== BUG: KASAN: use-after-free in...

CVE-2022-48953 rtc: cmos: Fix event handler registration ordering issue

In the Linux kernel, the following vulnerability has been resolved: rtc: cmos: Fix event handler registration ordering issue Because acpiinstallfixedeventhandler enables the event automatically on success, it is incorrect to call it before the handler routine passed to it is ready to handle event...

CVE-2022-48949

In the Linux kernel, the following vulnerability has been resolved: igb: Initialize mailbox message for VF reset When a MAC address is not assigned to the VF, that portion of the message sent to the VF is not set. The memory, however, is allocated from the stack meaning that information may be...

CVE-2022-48946 udf: Fix preallocation discarding at indirect extent boundary

In the Linux kernel, the following vulnerability has been resolved: udf: Fix preallocation discarding at indirect extent boundary When preallocation extent is the first one in the extent block, the code would corrupt extent tree header instead. Fix the problem and use udfdeleteaext for deleting...

CVE-2024-50065

In the Linux kernel, the following vulnerability has been resolved: ntfs3: Change to non-blocking allocation in ntfsdhash dhash is done while under "rcu-walk" and should not sleep. getname allocates using GFPKERNEL, having the possibility to sleep when under memory pressure. Change the allocation...

CVE-2024-50060 io_uring: check if we need to reschedule during overflow flush

In the Linux kernel, the following vulnerability has been resolved: iouring: check if we need to reschedule during overflow flush In terms of normal application usage, this list will always be empty. And if an application does overflow a bit, it'll have a few entries. However, nothing obviously...

CVE-2024-50058 serial: protect uart_port_dtr_rts() in uart_shutdown() too

In the Linux kernel, the following vulnerability has been resolved: serial: protect uartportdtrrts in uartshutdown too Commit af224ca2df29 serial: core: Prevent unsafe uart port access, part 3 added few uport == NULL checks. It added one to uartshutdown, so the commit assumes, uport can be NULL i...

CVE-2024-50049 drm/amd/display: Check null pointer before dereferencing se

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check null pointer before dereferencing se WHAT & HOW se is null checked previously in the same function, indicating it might be null; therefore, it must be checked when used again. This fixes 1 FORWARDNULL issue...

CVE-2024-50047 smb: client: fix UAF in async decryption

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF in async decryption Doing an async decryption large read crashes with a slab-use-after-free way down in the crypto API. Reproducer: mount.cifs -o ...,seal,esize=1 //srv/share /mnt dd if=/mnt/largefile...

CVE-2024-50035

CVE-2024-50035 affects the Linux kernel PPP path, specifically a fault in ppp_async_encode() that can be triggered by a zero-size pppoe_sendmsg() followed by an empty skb, leading to a possible uninitialized access (KMSAN) in drivers/net/ppp/ppp_async.c. The issue was fixed in upstream Linux comm...

CVE-2024-50018

In the Linux kernel, the following vulnerability has been resolved: net: napi: Prevent overflow of napideferhardirqs In commit 6f8b12d661d0 "net: napi: add hard irqs deferral feature" napideferirqs was added to netdevice and napideferirqscount was added to napistruct, both as type int. This value...

CVE-2024-49924

In the Linux kernel, the following vulnerability has been resolved: fbdev: pxafb: Fix possible use after free in pxafbtask In the pxafbprobe function, it calls the pxafbinitfbinfo function, after which &fbi-task is associated with pxafbtask. Moreover, within this pxafbinitfbinfo function, the...

CVE-2024-49901

In the Linux kernel, the following vulnerability has been resolved: drm/msm/adreno: Assign msmgpu-pdev earlier to avoid nullptrs There are some cases, such as the one uncovered by Commit 46d4efcccc68 "drm/msm/a6xx: Avoid a nullptr dereference when speedbin setting fails" where msmgpucleanup :...

CVE-2024-49890

In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: ensure the fwinfo is not null before using it This resolves the dereference null return value warning reported by Coverity...

CVE-2024-50001 net/mlx5: Fix error path in multi-packet WQE transmit

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix error path in multi-packet WQE transmit Remove the erroneous unmap in case no DMA mapping was established The multi-packet WQE transmit code attempts to obtain a DMA mapping for the skb. This could fail, e.g. under...