CVE-2022-49490

CVE-2022-49490: In the Linux kernel, drm/msm/mdp5 had a NULL dereference risk in mdp5_pipe_release when mdp5_get_global_state could return an error (-EDEADLK) during modeset lock handling. The fix propagates such errors from mdp5_get_global_state to mdp5_pipe_release and returns a proper error in...

CVE-2022-49490

In the Linux kernel, the following vulnerability has been resolved: drm/msm/mdp5: Return error code in mdp5piperelease when deadlock is detected mdp5getglobalstate runs the risk of hitting a -EDEADLK when acquiring the modeset lock, but currently mdp5piperelease doesn't check for if an error is...

CVE-2022-49488 drm/msm/mdp5: Return error code in mdp5_mixer_release when deadlock is detected

In the Linux kernel, the following vulnerability has been resolved: drm/msm/mdp5: Return error code in mdp5mixerrelease when deadlock is detected There is a possibility for mdp5getglobalstate to return -EDEADLK when acquiring the modeset lock, but currently globalstate in mdp5mixerrelease doesn't...

CVE-2022-49486

In the Linux kernel, the following vulnerability has been resolved: ASoC: fsl: Fix refcount leak in imxsgtl5000probe offindi2cdevicebynode takes a reference, In error paths, we should call putdevice to drop the reference to aviod refount leak...

CVE-2022-49469

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix anondev leak in createsubvol When btrfsqgroupinherit, btrfsalloctreeblock, or btrfsinsertroot fail in createsubvol, we return without freeing anondev. Reorganize the error handling in createsubvol to fix this...

CVE-2022-49469 btrfs: fix anon_dev leak in create_subvol()

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix anondev leak in createsubvol When btrfsqgroupinherit, btrfsalloctreeblock, or btrfsinsertroot fail in createsubvol, we return without freeing anondev. Reorganize the error handling in createsubvol to fix this...

CVE-2022-49458 drm/msm: don't free the IRQ if it was not requested

In the Linux kernel, the following vulnerability has been resolved: drm/msm: don't free the IRQ if it was not requested As msmdrmuninit is called from the msmdrminit error path, additional care should be necessary as not to call the freeirq for the IRQ that was not requested before because an err...

CVE-2022-49429

CVE-2022-49429 affects the Linux kernel’s RDMA/hfi1 subsystem. When the hfi1 module is loaded with SDMA disabled (HFI1_CAP_SDMA off), a call to hfi1_write_iter() can dereference a NULL pointer, causing a kernel panic through the I/O path (sdma_select_user_engine → hfi1_user_sdma_process_request →...

CVE-2022-49422

CVE-2022-49422: Linux kernel dmaengine idxd vulnerability. Root cause: error path in idxd_cdev_register() for alloc_chrdev_region() failures leaks allocated resources. Impact is local with high availability impact as per the CVE entry. Affected context is the idxd driver in the kernel; remediatio...

CVE-2022-49422

In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Fix the error handling path in idxdcdevregister If a call to allocchrdevregion fails, the already allocated resources are leaking. Add the needed error handling path to fix the leak...

CVE-2022-49422 dmaengine: idxd: Fix the error handling path in idxd_cdev_register()

In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Fix the error handling path in idxdcdevregister If a call to allocchrdevregion fails, the already allocated resources are leaking. Add the needed error handling path to fix the leak...

CVE-2022-49410 tracing: Fix potential double free in create_var_ref()

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix potential double free in createvarref In createvarref, initvarref is called to initialize the fields of variable reffield, which is allocated in the previous function call to createhistfield. Function initvarref...

CVE-2022-49410

CVE-2022-49410: Linux kernel tracing double free in create_var_ref fixed by making init_var_ref() store NULL when freeing fields; affected components include the variable ref_field initialization path (create_hist_field -> init_var_ref -> destroy_hist_field). Remediation is to apply the ker...

CVE-2022-49410

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix potential double free in createvarref In createvarref, initvarref is called to initialize the fields of variable reffield, which is allocated in the previous function call to createhistfield. Function initvarref...

CVE-2022-49410 tracing: Fix potential double free in create_var_ref()

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix potential double free in createvarref In createvarref, initvarref is called to initialize the fields of variable reffield, which is allocated in the previous function call to createhistfield. Function initvarref...

CVE-2022-49389 usb: usbip: fix a refcount leak in stub_probe()

In the Linux kernel, the following vulnerability has been resolved: usb: usbip: fix a refcount leak in stubprobe usbgetdev is called in stubdevicealloc. When stubprobe fails after that, usbputdev needs to be called to release the reference. Fix this by moving usbputdev to sdevfree error path...

CVE-2022-49388

In the Linux kernel, the following vulnerability has been resolved: ubi: ubicreatevolume: Fix use-after-free when volume creation failed There is an use-after-free problem for 'ebatbl' in ubicreatevolume's error handling path: ubiebareplacetablevol, ebatbl vol-ebatbl = tbl outmapping:...

CVE-2022-49388 ubi: ubi_create_volume: Fix use-after-free when volume creation failed

In the Linux kernel, the following vulnerability has been resolved: ubi: ubicreatevolume: Fix use-after-free when volume creation failed There is an use-after-free problem for 'ebatbl' in ubicreatevolume's error handling path: ubiebareplacetablevol, ebatbl vol-ebatbl = tbl outmapping:...

CVE-2022-49388

CVE-2022-49388 affects the Linux kernel ubi_create_volume() in the UBI subsystem. The issue is an use-after-free involving the 'eba_tbl' in the error handling path: ubi_eba_replace_table(vol, eba_tbl) assigns vol->eba_tbl = tbl, then on error the code path leads to ubi_eba_destroy_table(eba_tb...

CVE-2022-49388 ubi: ubi_create_volume: Fix use-after-free when volume creation failed

In the Linux kernel, the following vulnerability has been resolved: ubi: ubicreatevolume: Fix use-after-free when volume creation failed There is an use-after-free problem for 'ebatbl' in ubicreatevolume's error handling path: ubiebareplacetablevol, ebatbl vol-ebatbl = tbl outmapping:...