CVE-2022-49636

CVE-2022-49636 affects the Linux kernel VLAN code, specifically a memory leak in vlan_newlink/vlan_changelink paths. The issue arises when a memory allocation fails in vlan_changelink() after prior allocations succeed; memory allocated for egress priority/vlan_dev structures may remain referenced...

CVE-2022-49628

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix leaks in probe These two error paths should clean up before returning...

CVE-2022-49568

CVE-2022-49568 affects the Linux kernel KVM code path, where a NULL dereference can occur during cleanup if destroy() is assumed non-NULL but is not (notably for some Book3s KVM devices that use release() instead). The root cause is an assumption in kvm_ioctl_create_device() that destroy() is alw...

CVE-2022-49568 KVM: Don't null dereference ops->destroy

In the Linux kernel, the following vulnerability has been resolved: KVM: Don't null dereference ops-destroy A KVM device cleanup happens in either of two callbacks: 1 destroy which is called when the VM is being destroyed; 2 release which is called when a device fd is closed. Most KVM devices use...

CVE-2022-49568 KVM: Don't null dereference ops->destroy

In the Linux kernel, the following vulnerability has been resolved: KVM: Don't null dereference ops-destroy A KVM device cleanup happens in either of two callbacks: 1 destroy which is called when the VM is being destroyed; 2 release which is called when a device fd is closed. Most KVM devices use...

CVE-2022-49568

In the Linux kernel, the following vulnerability has been resolved: KVM: Don't null dereference ops-destroy A KVM device cleanup happens in either of two callbacks: 1 destroy which is called when the VM is being destroyed; 2 release which is called when a device fd is closed. Most KVM devices use...

CVE-2022-49558 netfilter: nf_tables: double hook unregistration in netns path

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: double hook unregistration in netns path nftreleasehooks is called from prenetns exit path which unregisters the hooks, then the NETDEVUNREGISTER event is triggered which unregisters the hooks again. 565.2214...

CVE-2022-49549 x86/MCE/AMD: Fix memory leak when threshold_create_bank() fails

In the Linux kernel, the following vulnerability has been resolved: x86/MCE/AMD: Fix memory leak when thresholdcreatebank fails In mcethresholdcreatedevice, if thresholdcreatebank fails, the previously allocated threshold banks array @bp will be leaked because the call to mcethresholdremovedevice...

CVE-2022-49502 media: rga: fix possible memory leak in rga_probe

In the Linux kernel, the following vulnerability has been resolved: media: rga: fix possible memory leak in rgaprobe rga-m2mdev needs to be freed when rgaprobe fails...

CVE-2022-49493 ASoC: rt5645: Fix errorenous cleanup order

In the Linux kernel, the following vulnerability has been resolved: ASoC: rt5645: Fix errorenous cleanup order There is a logic error when removing rt5645 device as the function rt5645i2cremove first cancel the &rt5645-jackdetectwork and delete the &rt5645-btnchecktimer latter. However, since the...

CVE-2022-49493 ASoC: rt5645: Fix errorenous cleanup order

In the Linux kernel, the following vulnerability has been resolved: ASoC: rt5645: Fix errorenous cleanup order There is a logic error when removing rt5645 device as the function rt5645i2cremove first cancel the &rt5645-jackdetectwork and delete the &rt5645-btnchecktimer latter. However, since the...

CVE-2022-49493

CVE-2022-49493: Linux kernel ASoC rt5645 cleanup order bug can cause use-after-free due to rt5645_i2c_remove() cancelling jack_detect_work before del_timer_sync, which may race with rt5645_btn_check_callback(). The fix moves del_timer_sync before cancel_delayed_work_sync, addressing the race. Con...

CVE-2022-49493 ASoC: rt5645: Fix errorenous cleanup order

In the Linux kernel, the following vulnerability has been resolved: ASoC: rt5645: Fix errorenous cleanup order There is a logic error when removing rt5645 device as the function rt5645i2cremove first cancel the &rt5645-jackdetectwork and delete the &rt5645-btnchecktimer latter. However, since the...

CVE-2022-49493

In the Linux kernel, the following vulnerability has been resolved: ASoC: rt5645: Fix errorenous cleanup order There is a logic error when removing rt5645 device as the function rt5645i2cremove first cancel the &rt5645-jackdetectwork and delete the &rt5645-btnchecktimer latter. However, since the...

CVE-2022-49419 video: fbdev: vesafb: Fix a use-after-free due early fb_info cleanup

In the Linux kernel, the following vulnerability has been resolved: video: fbdev: vesafb: Fix a use-after-free due early fbinfo cleanup Commit b3c9a924aab6 "fbdev: vesafb: Cleanup fbinfo in .fbdestroy rather than .remove" fixed a use-after-free error due the vesafb driver freeing the fbinfo in th...

CVE-2022-49419 video: fbdev: vesafb: Fix a use-after-free due early fb_info cleanup

In the Linux kernel, the following vulnerability has been resolved: video: fbdev: vesafb: Fix a use-after-free due early fbinfo cleanup Commit b3c9a924aab6 "fbdev: vesafb: Cleanup fbinfo in .fbdestroy rather than .remove" fixed a use-after-free error due the vesafb driver freeing the fbinfo in th...

CVE-2022-49419

The CVE-2022-49419 issue affects the Linux kernel vesafb (video: fbdev) where use-after-free can occur if the fb_info is freed in the .remove path before or after .fb_destroy. The underlying cause is an ordering bug: the code previously freed fb_info in .remove, which could reference freed memory...

CVE-2022-49419 video: fbdev: vesafb: Fix a use-after-free due early fb_info cleanup

In the Linux kernel, the following vulnerability has been resolved: video: fbdev: vesafb: Fix a use-after-free due early fbinfo cleanup Commit b3c9a924aab6 "fbdev: vesafb: Cleanup fbinfo in .fbdestroy rather than .remove" fixed a use-after-free error due the vesafb driver freeing the fbinfo in th...

CVE-2022-49402

CVE-2022-49402 concerns the Linux kernel ftrace hashing of direct_functions. The issue triggers a general protection fault when register_ftrace_direct fails, due to the entry not being removed from direct_functions. The available connected docs confirm the root cause and the fix: remove the entry...

CVE-2022-49398

CVE-2022-49398 relates to the Linux kernel’s USB DWC3 gadget path. The vulnerability arises when traversing the cancelled_list during dwc3_gadget_ep_cleanup_cancelled_requests() while a pull-up disable sequence runs in parallel, causing a window where removing an item (n) and then the next item (...