CVE-2022-49127

In the Linux kernel, the following vulnerability has been resolved: reftracker: implement use-after-free detection Whenever reftrackerdirinit is called, mark the struct reftrackerdir as dead. Test the dead status from reftrackeralloc and reftrackerfree This should detect buggy devput/devhold...

CVE-2022-49160

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix crash during module load unload test During purex packet handling the driver was incorrectly freeing a pre-allocated structure. Fix this by skipping that entry. System crashed with the following stack during a...

CVE-2022-49198

In the Linux kernel, the following vulnerability has been resolved: mptcp: Fix crash due to tcptsortedanchor was initialized before release skb Got crash when doing pressure test of mptcp: =========================================================================== dstrelease: dst:ffffa06ce6e5c058...

CVE-2022-49144

In the Linux kernel, the following vulnerability has been resolved: iouring: fix memory leak of uid in files registration When there are no files for iosqefilesscm to process in the range, it'll free everything and return. However, it forgets to put uid...

CVE-2022-49168

In the Linux kernel, the following vulnerability has been resolved: btrfs: do not clean up repair bio if submit fails The submit helper will always run bioendio on the bio if it fails to submit, so cleaning up the bio just leads to a variety of use-after-free and NULL pointer dereference bugs...

CVE-2022-49102

In the Linux kernel, the following vulnerability has been resolved: habanalabs: fix possible memory leak in MMU DR fini This patch fixes what seems to be copy paste error. We will have a memory leak if the host-resident shadow is NULL which will likely happen as the DR and HR are not dependent...

CVE-2022-49142

In the Linux kernel, the following vulnerability has been resolved: net: preserve skbendoffset in skbunclonekeeptruesize syzbot found another way to trigger the infamous WARNONONCEdelta truesize value, we also need to make sure TCP wont fill new tailroom that pskbexpandhead was able to get from a...

CVE-2022-49162

In the Linux kernel, the following vulnerability has been resolved: video: fbdev: sm712fb: Fix crash in smtcfbwrite When the sm712fb driver writes three bytes to the framebuffer, the driver will crash: BUG: unable to handle page fault for address: ffffc90001ffffff RIP: 0010:smtcfbwrite+0x454/0x5b...

CVE-2021-4453

In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: fix a potential gpumetricstable memory leak Memory is allocated for gpumetricstable in renoirinitsmctables, but not freed in int smuv120finismctables. Free it!...

CVE-2021-47636

In the Linux kernel, the following vulnerability has been resolved: ubifs: Fix read out-of-bounds in ubifswbufwritenolock Function ubifswbufwritenolock may access buf out of bounds in following process: ubifswbufwritenolock: alignedlen = ALIGNlen, 8; // Assume len = 4089, alignedlen = 4096 if...

CVE-2021-47639

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Zap all roots when unmapping gfn range in TDP MMU Zap both valid and invalid roots when zapping/unmapping a gfn range, as KVM must ensure it holds no references to the freed page after returning from the unmap...

CVE-2021-47651

In the Linux kernel, the following vulnerability has been resolved: soc: qcom: rpmpd: Check for null return of devmkcalloc Because of the possible failure of the allocation, data-domains might be NULL pointer and will cause the dereference of the NULL pointer later. Therefore, it might be better ...

CVE-2022-49709 cfi: Fix __cfi_slowpath_diag RCU usage with cpuidle

In the Linux kernel, the following vulnerability has been resolved: cfi: Fix cfislowpathdiag RCU usage with cpuidle RCUNONIDLE usage during cfislowpathdiag can result in an invalid RCU state in the cpuidle code path: WARNING: CPU: 1 PID: 0 at kernel/rcu/tree.c:613 rcueqsenter+0xe4/0x138 ... Call...

CVE-2022-49684

The Connected documents confirm CVE-2022-49684 relates to the Linux kernel, specifically the iio: adc: aspeed code. The issue is a refcount leak in aspeed_adc_set_trim_data caused by of_find_node_by_name() returning a node pointer with an incremented refcount; the remediation is to call of_node_p...

CVE-2022-49677 ARM: cns3xxx: Fix refcount leak in cns3xxx_init

In the Linux kernel, the following vulnerability has been resolved: ARM: cns3xxx: Fix refcount leak in cns3xxxinit offindcompatiblenode returns a node pointer with refcount incremented, we should use ofnodeput on it when done. Add missing ofnodeput to avoid refcount leak...

CVE-2022-49613

CVE-2022-49613 affects the Linux kernel serial driver 8250 console handover. When a console is enabled, univ8250_console_setup() runs before .dev is bound to the uart_port, so pm_runtime_get_sync() is skipped. Later, during handover, serial8250_console_exit() may call pm_runtime_put_sync() with a...

CVE-2022-49601

CVE-2022-49601 is a Linux kernel vulnerability where a data race occurs in the tcp/dccp path around reading the sysctl_fwmark_accept value. The root cause is concurrent modification of the reader while sysctl_tcp_fwmark_accept is being read, leading to potential inconsistency. The documented fix ...

CVE-2022-49596 tcp: Fix data-races around sysctl_tcp_min_snd_mss.

In the Linux kernel, the following vulnerability has been resolved: tcp: Fix data-races around sysctltcpminsndmss. While reading sysctltcpminsndmss, it can be changed concurrently. Thus, we need to add READONCE to its readers...

CVE-2022-49569

CVE-2022-49569 affects the bcm2835 SPI driver in the Linux kernel. When an IRQ-based transfer times out, bcm2835_spi_handle_err() could dereference ctlr->dma_tx/ctlr->dma_rx if DMA pointers are not set, due to the removal of the dma_pending flag. A fix was implemented to check that ctlr-&gt...

CVE-2022-49570 gpio: gpio-xilinx: Fix integer overflow

In the Linux kernel, the following vulnerability has been resolved: gpio: gpio-xilinx: Fix integer overflow Current implementation is not able to configure more than 32 pins due to incorrect data type. So type casting with unsigned long to avoid it...