CVE-2022-50182 media: imx-jpeg: Align upwards buffer size

In the Linux kernel, the following vulnerability has been resolved: media: imx-jpeg: Align upwards buffer size The hardware can support any image size WxH, with arbitrary W image width and H image height dimensions. Align upwards buffer size for both encoder and decoder. and leave the picture...

CVE-2022-50179 ath9k: fix use-after-free in ath9k_hif_usb_rx_cb

In the Linux kernel, the following vulnerability has been resolved: ath9k: fix use-after-free in ath9khifusbrxcb Syzbot reported use-after-free Read in ath9khifusbrxcb 0. The problem was in incorrect htchandle-drvpriv initialization. Probable call trace which can trigger use-after-free:...

CVE-2022-50177 rcutorture: Fix ksoftirqd boosting timing and iteration

In the Linux kernel, the following vulnerability has been resolved: rcutorture: Fix ksoftirqd boosting timing and iteration The RCU priority boosting can fail in two situations: 1 If nrcpus= maxcpus=, which means if the total number of CPUs is higher than those brought online at boot, then...

CVE-2022-50176

In CVE-2022-50176, the Linux kernel’s drm/mcde mcde_dsi_bind had a refcount leak: every iteration of for_each_available_child_of_node() decremented the previous node’s refcount, but a missing of_node_put() on loop exit caused leaks. The fix is to add of_node_put() to restore correct refcount hand...

CVE-2022-50173

CVE-2022-50173 affects the Linux kernel DRM/MSM MDP5 path. The vulnerability arises from not grabbing the global state lock after an early return when hwpipe is disabled, allowing contention and potentially returning 0. The public entries describe the fix as “Fix global state lock backoff” and ci...

CVE-2022-50173 drm/msm/mdp5: Fix global state lock backoff

In the Linux kernel, the following vulnerability has been resolved: drm/msm/mdp5: Fix global state lock backoff We need to grab the lock after the early return for !hwpipe case. Otherwise, we could have hit contention yet still returned 0. Fixes an issue that the new CONFIGDRMDEBUGMODESETLOCK stu...

CVE-2022-50172 mt76: mt76x02u: fix possible memory leak in __mt76x02u_mcu_send_msg

In the Linux kernel, the following vulnerability has been resolved: mt76: mt76x02u: fix possible memory leak in mt76x02umcusendmsg Free the skb if mt76ubulkmsg fails in mt76x02umcusendmsg routine...

CVE-2022-50171

CVE-2022-50171 affects the Linux kernel crypto path for Hisilicon sec2 (drivers/crypto/hisilicon/sec2/sec_crypto.c). The issue arises when the Kunpeng920 encryption driver processes packets during softirq: mutex locking is improperly used in softirq context, causing a scheduling-while-atomic scen...

CVE-2022-50171 crypto: hisilicon/sec - don't sleep when in softirq

In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/sec - don't sleep when in softirq When kunpeng920 encryption driver is used to deencrypt and decrypt packets during the softirq, it is not allowed to use mutex lock. The kernel will report the following error:...

CVE-2022-50169 wifi: wil6210: debugfs: fix info leak in wil_write_file_wmi()

In the Linux kernel, the following vulnerability has been resolved: wifi: wil6210: debugfs: fix info leak in wilwritefilewmi The simplewritetobuffer function will succeed if even a single byte is initialized. However, we need to initialize the whole buffer to prevent information leaks. Just use...

CVE-2022-50169 wifi: wil6210: debugfs: fix info leak in wil_write_file_wmi()

In the Linux kernel, the following vulnerability has been resolved: wifi: wil6210: debugfs: fix info leak in wilwritefilewmi The simplewritetobuffer function will succeed if even a single byte is initialized. However, we need to initialize the whole buffer to prevent information leaks. Just use...

CVE-2022-50166 Bluetooth: When HCI work queue is drained, only queue chained work

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: When HCI work queue is drained, only queue chained work The HCI command, event, and data packet processing workqueue is drained to avoid deadlock in commit 76727c02c1e1 "Bluetooth: Call drainworkqueue before resetting...

CVE-2022-50167 bpf: fix potential 32-bit overflow when accessing ARRAY map element

In the Linux kernel, the following vulnerability has been resolved: bpf: fix potential 32-bit overflow when accessing ARRAY map element If BPF array map is bigger than 4GB, element pointer calculation can overflow because both index and elemsize are u32. Fix this everywhere by forcing 64-bit...

CVE-2022-50165

CVE-2022-50165 affects the Linux kernel wifi/wil6210 debugfs, where a logic error in wil_write_file_wmi() stems from a commit that changed simple_write_to_buffer() to memdup_user() but did not adjust the return value, leaving rc uninitialized and returning rc. The fix is to return the length when...

CVE-2022-50165 wifi: wil6210: debugfs: fix uninitialized variable use in `wil_write_file_wmi()`

In the Linux kernel, the following vulnerability has been resolved: wifi: wil6210: debugfs: fix uninitialized variable use in wilwritefilewmi Commit 7a4836560a61 changes simplewritetobuffer with memdupuser but it forgets to change the value to be returned that came from simplewritetobuffer call. ...

CVE-2022-50164 wifi: iwlwifi: mvm: fix double list_add at iwl_mvm_mac_wake_tx_queue

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix double listadd at iwlmvmmacwaketxqueue After successfull station association, if station queues are disabled for some reason, the related lists are not emptied. So if some new element is added to the list ...

CVE-2022-50161 mtd: maps: Fix refcount leak in of_flash_probe_versatile

In the Linux kernel, the following vulnerability has been resolved: mtd: maps: Fix refcount leak in offlashprobeversatile offindmatchingnodeandmatch returns a node pointer with refcount incremented, we should use ofnodeput on it when not need anymore. Add missing ofnodeput to avoid refcount leak...

CVE-2022-50160 mtd: maps: Fix refcount leak in ap_flash_init

In the Linux kernel, the following vulnerability has been resolved: mtd: maps: Fix refcount leak in apflashinit offindmatchingnode returns a node pointer with refcount incremented, we should use ofnodeput on it when not need anymore. Add missing ofnodeput to avoid refcount leak...

CVE-2022-50158

CVE-2022-50158 relates to the Linux kernel vulnerability in mtd: partitions where of_get_child_by_name() returns a node pointer with an incremented refcount and is not put back, leading to a refcount leak. The issue is fixed by adding a missing of_node_put() when the pointer is no longer needed. ...

CVE-2022-50159

CVE-2022-50159 concerns the Linux kernel: the function that restores ima-kexec-buffer may read outside the addressable RAM if the previous kernel’s buffer lies beyond the new kernel’s memory map, risking kernel panic when booting with mem=X. A fix was implemented to validate the returned PFN rang...