CVE-2022-49227

In the Linux kernel, the following vulnerability has been resolved: igc: avoid kernel warning when changing RX ring parameters Calling ethtool changing the RX ring parameters like this: $ ethtool -G eth0 rx 1024 on igc triggers kernel warnings like this: 225.198467 ------------ cut here...

CVE-2022-49228

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix a btf decltag bug when tagging a function syzbot reported a btf decltag bug with stack trace below: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 1 PREEMPT SMP KASAN KASAN:...

CVE-2022-49225 mt76: mt7921s: fix a possible memory leak in mt7921_load_patch

In the Linux kernel, the following vulnerability has been resolved: mt76: mt7921s: fix a possible memory leak in mt7921loadpatch Always release fw data at the end of mt7921loadpatch routine...

CVE-2022-49221 drm/msm/dp: populate connector of struct dp_panel

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dp: populate connector of struct dppanel DP CTS test case 4.2.2.6 has valid edid with bad checksum on purpose and expect DP source return correct checksum. During drm edid read, correct edid checksum is calculated and...

CVE-2022-49217

In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Fix abort all task initialization In pm80xxsendabortall, the nelem field of the ccb used is not initialized to 0. This missing initialization sometimes lead to the task completion path seeing the ccb with a non-zero...

CVE-2022-49218

In the Linux kernel, the following vulnerability has been resolved: drm/dp: Fix OOB read when handling Post Cursor2 register The linkstatus array was not large enough to read the Adjust Request Post Cursor2 register, so remove the common helper function to avoid an OOB read, found with a...

CVE-2022-49216 drm/tegra: Fix reference leak in tegra_dsi_ganged_probe

In the Linux kernel, the following vulnerability has been resolved: drm/tegra: Fix reference leak in tegradsigangedprobe The reference taken by 'offinddevicebynode' must be released when not needed anymore. Add putdevice call to fix this...

CVE-2022-49213 ath10k: Fix error handling in ath10k_setup_msa_resources

In the Linux kernel, the following vulnerability has been resolved: ath10k: Fix error handling in ath10ksetupmsaresources The devicenode pointer is returned by ofparsephandle with refcount incremented. We should use ofnodeput on it when done. This function only calls ofnodeput in the regular path...

CVE-2022-49210

In the Linux kernel, the following vulnerability has been resolved: MIPS: pgalloc: fix memory leak caused by pgdfree pgd page is freed by generic implementation pgdfree since commit f9cb654cb550 "asm-generic: pgalloc: provide generic pgdfree", however, there are scenarios that the system uses mor...

CVE-2022-49210

The CVE-2022-49210 issue is a Linux-kernel memory-leak in the MIPS pgalloc path. The generic pgd_free() freed only one pgd page, but on 64‑bit systems with PAGE_SIZE_4KB and without MIPS_VA_BITS_48 the PGD_TABLE spans two pages; this mismatch leaks memory. MemFree behavior can reveal the leak. Ro...

CVE-2022-49207 bpf, sockmap: Fix memleak in sk_psock_queue_msg

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix memleak in skpsockqueuemsg If tcpbpfsendmsg is running during a tear down operation we may enqueue data on the ingress msg queue while tear down is trying to free it. sk1 redirect sk2 sk2 -------------------...

CVE-2022-49204

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix more uncharged while msg has moredata In tcpbpfsendverdict, if msg has more data after tcpbpfsendmsgredir: tcpbpfsendverdict tosend = msg-sg.size //msg-sg.size = 22220 case SKREDIRECT: skmsgreturn //uncharged...

CVE-2022-49199 RDMA/nldev: Prevent underflow in nldev_stat_set_counter_dynamic_doit()

In the Linux kernel, the following vulnerability has been resolved: RDMA/nldev: Prevent underflow in nldevstatsetcounterdynamicdoit This code checks "index" for an upper bound but it does not check for negatives. Change the type to unsigned to prevent underflows...

CVE-2022-49199 RDMA/nldev: Prevent underflow in nldev_stat_set_counter_dynamic_doit()

In the Linux kernel, the following vulnerability has been resolved: RDMA/nldev: Prevent underflow in nldevstatsetcounterdynamicdoit This code checks "index" for an upper bound but it does not check for negatives. Change the type to unsigned to prevent underflows...

CVE-2022-49199

CVE-2022-49199 affects the Linux kernel RDMA/nldev path. The vulnerability comes from underflow in nldev_stat_set_counter_dynamic_doit() where an “index” is checked for an upper bound but not for negatives. The fix changes the index type to unsigned to prevent underflows. Affected component: RDMA...

CVE-2022-49200 Bluetooth: btmtksdio: Fix kernel oops in btmtksdio_interrupt

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtksdio: Fix kernel oops in btmtksdiointerrupt Fix the following kernel oops in btmtksdiointerrrupt 14.339134 btmtksdiointerrupt+0x28/0x54 14.339139 processsdiopendingirqs+0x68/0x1a0 14.339144 sdioirqwork+0x40/0x70...

CVE-2022-49198 mptcp: Fix crash due to tcp_tsorted_anchor was initialized before release skb

In the Linux kernel, the following vulnerability has been resolved: mptcp: Fix crash due to tcptsortedanchor was initialized before release skb Got crash when doing pressure test of mptcp: =========================================================================== dstrelease: dst:ffffa06ce6e5c058...

CVE-2022-49198

In the Linux kernel, the following vulnerability has been resolved: mptcp: Fix crash due to tcptsortedanchor was initialized before release skb Got crash when doing pressure test of mptcp: =========================================================================== dstrelease: dst:ffffa06ce6e5c058...

CVE-2022-49197

In the Linux kernel, the following vulnerability has been resolved: afnetlink: Fix shift out of bounds in group mask calculation When a netlink message is received, netlinkrecvmsg fills in the address of the sender. One of the fields is the 32-bit bitfield nlgroups, which carries the multicast...

CVE-2022-49197 af_netlink: Fix shift out of bounds in group mask calculation

In the Linux kernel, the following vulnerability has been resolved: afnetlink: Fix shift out of bounds in group mask calculation When a netlink message is received, netlinkrecvmsg fills in the address of the sender. One of the fields is the 32-bit bitfield nlgroups, which carries the multicast...