CVE-2022-50005

The CVE-2022-50005 issue concerns Linux kernel NFC code for pn533 devices. The root cause is a use-after-free caused by a timer (cmd_timeout) not being canceled during pn532_uart_remove(), allowing a concurrent use path to dereference freed memory. The fix adds del_timer_sync() in pn532_uart_remo...

CVE-2022-50005 nfc: pn533: Fix use-after-free bugs caused by pn532_cmd_timeout

In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: Fix use-after-free bugs caused by pn532cmdtimeout When the pn532 uart device is detaching, the pn532uartremove is called. But there are no functions in pn532uartremove that could delete the cmdtimeout timer, which wil...

CVE-2022-50004

CVE-2022-50004 is a Linux kernel vulnerability in the xfrm policy path. A null pointer dereference can occur when transmitting an skb with metadata_dst where dst->dev is NULL, through the xfrm interface, due to a missing null check in xfrmi_xmit/xfrm_lookup_with_ifid. The impact is kernel cras...

CVE-2022-50004 xfrm: policy: fix metadata dst->dev xmit null pointer dereference

In the Linux kernel, the following vulnerability has been resolved: xfrm: policy: fix metadata dst-dev xmit null pointer dereference When we try to transmit an skb with metadatadst attached i.e. dst-dev == NULL through xfrm interface we can hit a null pointer dereference1 in xfrmixmit2 -...

CVE-2022-50001

The CVE-2022-50001 issue affects the Linux kernel netfilter component nft_tproxy. The root cause was that TPROXY could be used from non-prerouting paths, leading to a null dereference crash. The fix restricts nft_tproxy to the prerouting hook, requiring a check that it runs only in prerouting. Th...

CVE-2022-50001 netfilter: nft_tproxy: restrict to prerouting hook

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfttproxy: restrict to prerouting hook TPROXY is only allowed from prerouting, but nfttproxy doesn't check this. This fixes a crash null dereference when using tproxy from e.g. output...

CVE-2022-50000 netfilter: flowtable: fix stuck flows on cleanup due to pending work

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: fix stuck flows on cleanup due to pending work To clear the flow table on flow table free, the following sequence normally happens in order: 1 gcstep work is stopped to disable any further stats/del requests...

CVE-2022-49999 btrfs: fix space cache corruption and potential double allocations

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix space cache corruption and potential double allocations When testing spacecache v2 on a large set of machines, we encountered a few symptoms: 1. "unable to add free space :-17" EEXIST errors. 2. Missing free space info...

CVE-2022-49999 btrfs: fix space cache corruption and potential double allocations

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix space cache corruption and potential double allocations When testing spacecache v2 on a large set of machines, we encountered a few symptoms: 1. "unable to add free space :-17" EEXIST errors. 2. Missing free space info...

CVE-2022-49997 net: lantiq_xrx200: restore buffer if memory allocation failed

In the Linux kernel, the following vulnerability has been resolved: net: lantiqxrx200: restore buffer if memory allocation failed In a situation where memory allocation fails, an invalid buffer address is stored. When this descriptor is used again, the system panics in the buildskb function when...

CVE-2022-49997

The CVE-2022-49997 issue affects the Linux kernel, specifically the net: lantiq_xrx200 driver. Root cause: when memory allocation fails, an invalid buffer address can be stored; using the descriptor again may cause a panic in build_skb(), resulting in an availability impact. Supported documents i...

CVE-2022-49996

CVE-2022-49996 is a Linux kernel issue affecting the btrfs subsystem. The vulnerability arises when btrfs_get_dev_args_from_path() calls btrfs_get_bdev_and_sb() with an invalid path, causing the function to return without freeing previously allocated memory for args->uuid and args->fsid, wh...

CVE-2022-49995 writeback: avoid use-after-free after removing device

In the Linux kernel, the following vulnerability has been resolved: writeback: avoid use-after-free after removing device When a disk is removed, bdiunregister gets called to stop further writeback and wait for associated delayed work to complete. However, wbinodewritebackend may schedule bandwid...

CVE-2022-49992 mm/mprotect: only reference swap pfn page if type match

In the Linux kernel, the following vulnerability has been resolved: mm/mprotect: only reference swap pfn page if type match Yu Zhao reported a bug after the commit "mm/swap: Add swpoffsetpfn to fetch PFN from swap entry" added a check in swpoffsetpfn for swap type 1: kernel BUG at...

CVE-2022-49991 mm/hugetlb: avoid corrupting page->mapping in hugetlb_mcopy_atomic_pte

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: avoid corrupting page-mapping in hugetlbmcopyatomicpte In MCOPYATOMICCONTINUE case with a non-shared VMA, pages in the page cache are installed in the ptes. But hugepageaddnewanonrmap is called for them mistakenly...

CVE-2022-49990 s390: fix double free of GS and RI CBs on fork() failure

In the Linux kernel, the following vulnerability has been resolved: s390: fix double free of GS and RI CBs on fork failure The pointers for guarded storage and runtime instrumentation control blocks are stored in the threadstruct of the associated task. These pointers are initially copied on fork...

CVE-2022-49989 xen/privcmd: fix error exit of privcmd_ioctl_dm_op()

In the Linux kernel, the following vulnerability has been resolved: xen/privcmd: fix error exit of privcmdioctldmop The error exit of privcmdioctldmop is calling unlockpages potentially with pages being NULL, leading to a NULL dereference. Additionally lockpages doesn't check for pinuserpagesfast...

CVE-2022-49989 xen/privcmd: fix error exit of privcmd_ioctl_dm_op()

In the Linux kernel, the following vulnerability has been resolved: xen/privcmd: fix error exit of privcmdioctldmop The error exit of privcmdioctldmop is calling unlockpages potentially with pages being NULL, leading to a NULL dereference. Additionally lockpages doesn't check for pinuserpagesfast...

CVE-2022-49989

CVE-2022-49989 concerns the Linux kernel’s xen/privcmd code. The vulnerability stems from: (1) error exit handling in privcmd_ioctl_dm_op() calling unlock_pages() with NULL pages, risking a NULL dereference, and (2) lock_pages() not verifying pin_user_pages_fast() success, potentially leaving som...

CVE-2022-49987 md: call __md_stop_writes in md_stop

In the Linux kernel, the following vulnerability has been resolved: md: call mdstopwrites in mdstop From the link 1, we can see raid1d was running even after the path raiddtr - mdstop - mdstop. Let's stop write first in destructor to align with normal md-raid to fix the KASAN issue. 1...