CVE-2022-50096 x86/kprobes: Update kcb status flag after singlestepping

In the Linux kernel, the following vulnerability has been resolved: x86/kprobes: Update kcb status flag after singlestepping Fix kprobes to update kcb kprobes control block status flag to KPROBEHITSSDONE even if the kp-posthandler is not set. This bug may cause a kernel panic if another INT3 user...

CVE-2022-50094

CVE-2022-50094 relates to Linux kernel spmi trace: trace_spmi_write_begin() and trace_spmi_read_end() use memcpy() with length len + 1, causing a potential stack-out-of-bounds read. A KASAN report demonstrates an out-of-bounds read in trace_event_raw_event_spmi_read_end. The issue affects the SPM...

CVE-2022-50093

CVE-2022-50093 affects the Linux kernel IOMMU VT-d code. The issue arises from using arch_test_bit() with a possibly invalid first argument when NUMA is disabled, causing a potential wild memory access after node_online() returns NUMA_NO_NODE. The fix adds an explicit check for node != NUMA_NO_NO...

CVE-2022-50093 iommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE)

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: avoid invalid memory access via nodeonlineNUMANONODE KASAN reports: 4.668325 T0 BUG: KASAN: wild-memory-access in dmarparseonerhsa arch/x86/include/asm/bitops.h:214 arch/x86/include/asm/bitops.h:226...

CVE-2022-50090 btrfs: replace BTRFS_MAX_EXTENT_SIZE with fs_info->max_extent_size

In the Linux kernel, the following vulnerability has been resolved: btrfs: replace BTRFSMAXEXTENTSIZE with fsinfo-maxextentsize On zoned filesystem, data write out is limited by maxzoneappendsize, and a large ordered extent is split according the size of a bio. OTOH, the number of extents to be...

CVE-2022-50090 btrfs: replace BTRFS_MAX_EXTENT_SIZE with fs_info->max_extent_size

In the Linux kernel, the following vulnerability has been resolved: btrfs: replace BTRFSMAXEXTENTSIZE with fsinfo-maxextentsize On zoned filesystem, data write out is limited by maxzoneappendsize, and a large ordered extent is split according the size of a bio. OTOH, the number of extents to be...

CVE-2022-50091 locking/csd_lock: Change csdlock_debug from early_param to __setup

In the Linux kernel, the following vulnerability has been resolved: locking/csdlock: Change csdlockdebug from earlyparam to setup The csdlockdebug kernel-boot parameter is parsed by the earlyparam function csdlockdebug. If set, csdlockdebug invokes staticbranchenable to enable csdlockwait feature...

CVE-2022-50089

CVE-2022-50089 affects the Linux kernel with the btrfs file system. The issue occurs when cow_file_range() fails mid-allocation (unlock=0) and may leave pages locked, potentially causing a hung task in zoned btrfs setups (as described in the provided reports). The included details show that the f...

CVE-2022-50089 btrfs: ensure pages are unlocked on cow_file_range() failure

In the Linux kernel, the following vulnerability has been resolved: btrfs: ensure pages are unlocked on cowfilerange failure There is a hungtask report on zoned btrfs like below. https://github.com/naota/linux/issues/59 726.328648 INFO: task rocksdb:high0:11085 blocked for more than 241 seconds...

CVE-2022-50089 btrfs: ensure pages are unlocked on cow_file_range() failure

In the Linux kernel, the following vulnerability has been resolved: btrfs: ensure pages are unlocked on cowfilerange failure There is a hungtask report on zoned btrfs like below. https://github.com/naota/linux/issues/59 726.328648 INFO: task rocksdb:high0:11085 blocked for more than 241 seconds...

CVE-2022-50085

The CVE-2022-50085 issue is present in the Linux kernel’s dm-raid path and affects the raid_resume flow. A KASAN warning is triggered when lvmetad tests exercise mddev->raid_disks vs rs->raid_disks, causing an out-of-bounds access in the raid resume loop. The connected OpenVAS/Nessus entrie...

CVE-2022-50085 dm raid: fix address sanitizer warning in raid_resume

In the Linux kernel, the following vulnerability has been resolved: dm raid: fix address sanitizer warning in raidresume There is a KASAN warning in raidresume when running the lvm test lvconvert-raid.sh. The reason for the warning is that mddev-raiddisks is greater than rs-raiddisks, so the loop...

CVE-2022-50079 drm/amd/display: Check correct bounds for stream encoder instances for DCN303

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check correct bounds for stream encoder instances for DCN303 Why & How engid for DCN303 cannot be more than 1, since we have only two instances of stream encoders. Check the correct boundary condition for engine ...

CVE-2022-50078

CVE-2022-50078 describes a resolved Linux kernel issue in the tracing subsystem (eprobes). The root cause is a NULL pointer dereference that occurs when event probes (eprobes) try to retrieve the instruction pointer (RIP) using registers, while eprobes do not use pt_regs. The fix, implemented in ...

CVE-2022-50077 apparmor: fix reference count leak in aa_pivotroot()

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix reference count leak in aapivotroot The aapivotroot function has a reference counting bug in a specific path. When aareplacecurrentlabel returns on success, the function forgets to decrement the reference count of...

CVE-2022-50077

The CVE-2022-50077 entry concerns the Linux kernel AppArmor path aa_pivotroot, where a reference-count bug leaks a previously incremented “target” when aa_replace_current_label() returns success. The fix is to decrement the refcount of target in that code path (build_pivotroot() increased it earl...

CVE-2022-50073 net: tap: NULL pointer derefence in dev_parse_header_protocol when skb->dev is null

In the Linux kernel, the following vulnerability has been resolved: net: tap: NULL pointer derefence in devparseheaderprotocol when skb-dev is null Fixes a NULL pointer derefence bug triggered from tap driver. When tapgetuser calls virtionethdrtoskb the skb-dev is null in tap.c skb-dev is set aft...

CVE-2022-50072 NFSv4/pnfs: Fix a use-after-free bug in open

In the Linux kernel, the following vulnerability has been resolved: NFSv4/pnfs: Fix a use-after-free bug in open If someone cancels the open RPC call, then we must not try to free either the open slot or the layoutget operation arguments, since they are likely still in use by the hung RPC call...

CVE-2022-50070

CVE-2022-50070 affects the Linux kernel and relates to the mptcp datapath: a transmit could race with mptcp_close(), causing a closed subflow (ssk) to be re-transmitted. The root cause is a subflow-state check performed before acquiring the socket lock, enabling re-transmission on an already clos...

CVE-2022-50071 mptcp: move subflow cleanup in mptcp_destroy_common()

In the Linux kernel, the following vulnerability has been resolved: mptcp: move subflow cleanup in mptcpdestroycommon If the mptcp socket creation fails due to a CGROUPINETSOCKCREATE eBPF program, the MPTCP protocol ends-up leaking all the subflows: the related cleanup happens in mptcpdestroysock...