CVE-2022-49455

CVE-2022-49455 (Linux kernel) fixes a double-free bug in ocxl_file_register_afu: info_release() could be invoked during device_unregister() when info->dev’s refcount was 0, making an extra ocxl_afu_put()/kfree() unnecessary. The patch adds free_minor() and returns to the err_unregister path to...

CVE-2022-49410

CVE-2022-49410: Linux kernel tracing double free in create_var_ref fixed by making init_var_ref() store NULL when freeing fields; affected components include the variable ref_field initialization path (create_hist_field -> init_var_ref -> destroy_hist_field). Remediation is to apply the ker...

CVE-2022-49388

In the Linux kernel, the following vulnerability has been resolved: ubi: ubicreatevolume: Fix use-after-free when volume creation failed There is an use-after-free problem for 'ebatbl' in ubicreatevolume's error handling path: ubiebareplacetablevol, ebatbl vol-ebatbl = tbl outmapping:...

CVE-2022-49388

CVE-2022-49388 affects the Linux kernel ubi_create_volume() in the UBI subsystem. The issue is an use-after-free involving the 'eba_tbl' in the error handling path: ubi_eba_replace_table(vol, eba_tbl) assigns vol->eba_tbl = tbl, then on error the code path leads to ubi_eba_destroy_table(eba_tb...

CVE-2022-49388 ubi: ubi_create_volume: Fix use-after-free when volume creation failed

In the Linux kernel, the following vulnerability has been resolved: ubi: ubicreatevolume: Fix use-after-free when volume creation failed There is an use-after-free problem for 'ebatbl' in ubicreatevolume's error handling path: ubiebareplacetablevol, ebatbl vol-ebatbl = tbl outmapping:...

CVE-2022-49362

CVE-2022-49362 is a Linux kernel vulnerability affecting NFSD. The issue is a use-after-free in nfsd_file_put, where nfsd_file_put_noref() can free @nf, so the kernel must not dereference @nf immediately after returning from nfsd_file_put_noref(). The CVE is rated critical (CVSS v3.1 base score 9...

CVE-2022-49328 mt76: fix use-after-free by removing a non-RCU wcid pointer

In the Linux kernel, the following vulnerability has been resolved: mt76: fix use-after-free by removing a non-RCU wcid pointer Fixes an issue caught by KASAN about use-after-free in mt76txqschedule by protecting mtxq-wcid with rculock between mt76txqschedule and stainfoalloc, free. 18853.876689...

CVE-2022-49328 mt76: fix use-after-free by removing a non-RCU wcid pointer

In the Linux kernel, the following vulnerability has been resolved: mt76: fix use-after-free by removing a non-RCU wcid pointer Fixes an issue caught by KASAN about use-after-free in mt76txqschedule by protecting mtxq-wcid with rculock between mt76txqschedule and stainfoalloc, free. 18853.876689...

CVE-2022-49270

CVE-2022-49270 : In the Linux kernel, a use-after-free can occur in dm_cleanup_zoned_dev() if it is not called before blk_cleanup_disk() proceeds through its cleanup path (blk_cleanup_disk->blk_cleanup_queue()->kobject_put()->blk_release_queue()->…->blk_free_queue_rcu()). This raci...

CVE-2022-49258 crypto: ccree - Fix use after free in cc_cipher_exit()

In the Linux kernel, the following vulnerability has been resolved: crypto: ccree - Fix use after free in cccipherexit kfreesensitivectxp-user.key will free the ctxp-user.key. But ctxp-user.key is still used in the next line, which will lead to a use after free. We can call kfreesensitive after...

CVE-2022-49179

CVE-2022-49179 is a Linux kernel UAF in the block I/O BFQ scheduler (block, bfq: don’t move oom_bfqq). The issue manifests as a use-after-free in bfq_put_async_bfqq() during module removal (rmmod) and BFQ/blk-mq teardown, with 1024-byte slab allocations implicated. Unity Linux advisories UTSA-202...

CVE-2022-49179 block, bfq: don't move oom_bfqq

In the Linux kernel, the following vulnerability has been resolved: block, bfq: don't move oombfqq Our test report a UAF: 2073.019181 ================================================================== 2073.019188 BUG: KASAN: use-after-free in bfqputasyncbfqq+0xa0/0x168 2073.019191 Write of size 8...

CVE-2022-49176 bfq: fix use-after-free in bfq_dispatch_request

In the Linux kernel, the following vulnerability has been resolved: bfq: fix use-after-free in bfqdispatchrequest KASAN reports a use-after-free report when doing normal scsi-mq test 69832.239032 ================================================================== 69832.241810 BUG: KASAN:...

CVE-2022-49176

In the Linux kernel, the following vulnerability has been resolved: bfq: fix use-after-free in bfqdispatchrequest KASAN reports a use-after-free report when doing normal scsi-mq test 69832.239032 ================================================================== 69832.241810 BUG: KASAN:...

CVE-2022-49087 rxrpc: fix a race in rxrpc_exit_net()

In the Linux kernel, the following vulnerability has been resolved: rxrpc: fix a race in rxrpcexitnet Current code can lead to the following race: CPU0 CPU1 rxrpcexitnet rxrpcpeerkeepaliveworker if rxnet-live rxnet-live = false; deltimersync&rxnet-peerkeepalivetimer;...

CVE-2022-49082

CVE-2022-49082 in the Linux kernel: a use-after-free in mpt3sas during _scsih_expander_node_remove() was caused by freeing the port field via mpt3sas_transport_port_remove(), leading to a use-after-free when ioc_info() runs (e.g., during rmmod). The fix adds a local variable port_id to capture th...

CVE-2022-49082

In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Fix use after free in scsihexpandernoderemove The function mpt3sastransportportremove called in scsihexpandernoderemove frees the port field of the sasexpander structure, leading to the following use-after-free spl...

CVE-2022-49053

CVE-2022-49053 affects the Linux kernel scsi: target: tcmu component. The vulnerability arises from tcmu_try_get_data_page() returning a data page pointer without properly holding a reference under the cmdr_lock, which can allow the page to be freed by tcmu_blocks_release(), creating a use-after-...

CVE-2022-49047 ep93xx: clock: Fix UAF in ep93xx_clk_register_gate()

In the Linux kernel, the following vulnerability has been resolved: ep93xx: clock: Fix UAF in ep93xxclkregistergate arch/arm/mach-ep93xx/clock.c:154:2: warning: Use of memory after it is freed clang-analyzer-unix.Malloc arch/arm/mach-ep93xx/clock.c:151:2: note: Taking true branch if ISERRclk ^...

CVE-2022-49047 ep93xx: clock: Fix UAF in ep93xx_clk_register_gate()

In the Linux kernel, the following vulnerability has been resolved: ep93xx: clock: Fix UAF in ep93xxclkregistergate arch/arm/mach-ep93xx/clock.c:154:2: warning: Use of memory after it is freed clang-analyzer-unix.Malloc arch/arm/mach-ep93xx/clock.c:151:2: note: Taking true branch if ISERRclk ^...