CVE-2022-49928

The CVE-2022-49928 entry corresponds to a Linux kernel vulnerability (SUNRPC) where a null-ptr-deref can occur if the xps sysfs allocation fails, specifically in sysfs_do_create_link_sd during RPC client setup (gssproxy path). The concrete issue is triggered when the xprt_switch sysfs allocation ...

CVE-2022-49926 net: dsa: Fix possible memory leaks in dsa_loop_init()

In the Linux kernel, the following vulnerability has been resolved: net: dsa: Fix possible memory leaks in dsaloopinit kmemleak reported memory leaks in dsaloopinit: kmemleak: 12 new suspected memory leaks unreferenced object 0xffff8880138ce000 size 2048: comm "modprobe", pid 390, jiffies...

CVE-2022-49925

CVE-2022-49925 : In the Linux kernel, a null-pointer dereference can occur in RDMA/core during ib_core_cleanup due to an unhandled failure of roce_gid_mgmt_init() (gid_cache_wq may be allocated and then freed during cleanup when not allocated). This is reported as a KASAN null-ptr-deref and is tr...

CVE-2022-49921 net: sched: Fix use after free in red_enqueue()

In the Linux kernel, the following vulnerability has been resolved: net: sched: Fix use after free in redenqueue We can't use "skb" again after passing it to qdiscenqueue. This is basically identical to commit 2f09707d0c97 "schsfb: Also store skb len before calling child enqueue"...

CVE-2022-49920 netfilter: nf_tables: netlink notifier might race to release objects

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: netlink notifier might race to release objects commit release path is invoked via callrcu and it runs lockless to release the objects after rcu grace period. The netlink notifier handler might win race to...

CVE-2022-49920 netfilter: nf_tables: netlink notifier might race to release objects

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: netlink notifier might race to release objects commit release path is invoked via callrcu and it runs lockless to release the objects after rcu grace period. The netlink notifier handler might win race to...

CVE-2022-49919

CVE-2022-49919 : In the Linux kernel, the nf_tables flow rule object release path was fixed. The underlying issue was a use-after-free (UAF) triggered by races with the netlink notifier, observed when the flow rule object is accessed only from the control plane (no data packets traverse it). The ...

CVE-2022-49919 netfilter: nf_tables: release flow rule object from commit path

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: release flow rule object from commit path No need to postpone this to the commit release path, since no packets are walking over this object, this is accessed from control plane only. This helped uncovered UA...

CVE-2022-49917

CVE-2022-49917 affects the Linux kernel IPVS subsystem (ip_vs_app_net_cleanup and ip_vs_app_net_init). If ip_vs_app fails to be created during init, removal still proceeds, causing the ip_vs_app entry to be missing and a WARNING in fs/proc/generic.c: remove_proc_entry. The issue is demonstrated b...

CVE-2022-49916

CVE-2022-49916 covers a NULL pointer dereference in the Linux kernel’s Rose protocol path (rose_send_frame). The issue surfaces when rose_loopback_neigh's neigh->dev is NULL, causing access to neigh->dev->dev_addr and triggering a NULL dereference in rose_send_frame (rose_link.c: rose_se...

CVE-2022-49916 rose: Fix NULL pointer dereference in rose_send_frame()

In the Linux kernel, the following vulnerability has been resolved: rose: Fix NULL pointer dereference in rosesendframe The syzkaller reported an issue: KASAN: null-ptr-deref in range 0x0000000000000380-0x0000000000000387 CPU: 0 PID: 4069 Comm: kworker/0:15 Not tainted...

CVE-2022-49914 btrfs: fix inode list leak during backref walking at resolve_indirect_refs()

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix inode list leak during backref walking at resolveindirectrefs During backref walking, at resolveindirectrefs, if we get an error we jump to the 'out' label and call ulistfree on the 'parents' ulist, which frees all the...

CVE-2022-49911 netfilter: ipset: enforce documented limit to prevent allocating huge memory

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: enforce documented limit to prevent allocating huge memory Daniel Xu reported that the hash:net,iface type of the ipset subsystem does not limit adding the same network with different interfaces to a set, which...

CVE-2022-49909 Bluetooth: L2CAP: fix use-after-free in l2cap_conn_del()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix use-after-free in l2capconndel When l2caprecvframe is invoked to receive data, and the cid is L2CAPCIDA2MP, if the channel does not exist, it will create a channel. However, after a channel is created, the...

CVE-2022-49908 Bluetooth: L2CAP: Fix memory leak in vhci_write

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix memory leak in vhciwrite Syzkaller reports a memory leak as follows: ==================================== BUG: memory leak unreferenced object 0xffff88810d81ac00 size 240: ... hex dump first 32 bytes: 00 00 ...

CVE-2022-49906

The CVE-2022-49906 issue affects the Linux kernel ibmvnic driver: a path in the reset handling could leak 32 bytes by not freeing the rwi structure when the last rwi in the list is processed. A fix releases the rwi memory on reset success (kernel patch 4f408e1fa6e1 and related commits). Connected...

CVE-2022-49906 ibmvnic: Free rwi on reset success

In the Linux kernel, the following vulnerability has been resolved: ibmvnic: Free rwi on reset success Free the rwi structure in the event that the last rwi in the list processed successfully. The logic in commit 4f408e1fa6e1 "ibmvnic: retry reset if there are no other resets" introduces an issue...

CVE-2022-49905

In the Linux kernel, the net/smc subsystem has a vulnerability disclosed as CVE-2022-49905 due to a missing error path in smc_init(). register_pernet_subsys(&smc_net_stat_ops) is called without proper rollback handling; if it fails, the registration of &smc_net_ops may not be reverted, and if smc...

CVE-2022-49902

CVE-2022-49902 concerns a Linux kernel memory-leak in rq_wb on add_disk failure. kmemleak reported 3 memory-leak instances; the leak stems from memory allocated in wbt_enable_default() not being freed in device_add_disk()’s error path. Normally, del_gendisk()/rq_qos_exit() would free rq_wb memory...

CVE-2022-49900 i2c: piix4: Fix adapter not be removed in piix4_remove()

In the Linux kernel, the following vulnerability has been resolved: i2c: piix4: Fix adapter not be removed in piix4remove In piix4probe, the piix4 adapter will be registered in: piix4probe piix4addadapterssb800 / piix4addadapter i2caddadapter Based on the probed device type, piix4addadapterssb800...