CVE-2022-49674 dm raid: fix accesses beyond end of raid member array

In the Linux kernel, the following vulnerability has been resolved: dm raid: fix accesses beyond end of raid member array On dm-raid table load using raidctr, dm-raid allocates an array rs-devsrs-raiddisks for the raid device members. rs-raiddisks is defined by the number of raid metadata and ima...

CVE-2022-49674

The CVE-2022-49674 issue is a Linux kernel vulnerability in dm-raid where an array (rs->devs) could be accessed beyond its end when the raid_disks-derived count differed from metadata-driven counts during RAID layout changes. The root cause is using rs->raid_disks for iteration instead of t...

CVE-2022-49674

In the Linux kernel, the following vulnerability has been resolved: dm raid: fix accesses beyond end of raid member array On dm-raid table load using raidctr, dm-raid allocates an array rs-devsrs-raiddisks for the raid device members. rs-raiddisks is defined by the number of raid metadata and ima...

CVE-2022-49671 RDMA/cm: Fix memory leak in ib_cm_insert_listen

In the Linux kernel, the following vulnerability has been resolved: RDMA/cm: Fix memory leak in ibcminsertlisten cmallocidpriv allocates resource for the cmidpriv. When cminitlisten fails it doesn't free it, leading to memory leak. Add the missing error unwind...

SUSE CVE-2025-26598

An out-of-bounds write flaw was found in X.Org and Xwayland. The function GetBarrierDevice searches for the pointer device based on its device ID and returns the matching value, or supposedly NULL, if no match was found. However, the code will return the last element of the list if no matching...

CVE-2022-49562

CVE-2022-49562 concerns the Linux kernel KVM/x86 path, where guest PTE A/D bits were updated using a risky mapping approach. The fix switches to __try_cmpxchg_user() to update guest PTE A/D bits instead of mapping the PTE into kernel space, and highlights VM_PFNMAP addressing being conceptually w...

CVE-2022-49509

CVE-2022-49509 : In the Linux kernel, the vulnerability arises when removing the max9286 I2C driver, causing a kernel oops due to the I2C client data potentially pointing to a freed v4l2_subdev instead of max9286_priv. The fix updates max9286_remove/max9286_probe/max9286_init so that the driver n...

CVE-2022-49471

In the Linux kernel, the following vulnerability has been resolved: rtw89: cfo: check macid to avoid out-of-bounds Somehow, hardware reports incorrect macid and pollute memory. Check index before we access the array. UBSAN: array-index-out-of-bounds in rtw89/phy.c:2517:23 index 188 is out of rang...

CVE-2022-49404 RDMA/hfi1: Fix potential integer multiplication overflow errors

In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Fix potential integer multiplication overflow errors When multiplying of different types, an overflow is possible even when storing the result in a larger type. This is because the conversion is done after the...

CVE-2022-49393

CVE-2022-49393 affects the Linux kernel code path misc: fastrpc: fix list iterator in fastrpc_req_mem_unmap_impl. The root cause is an incorrect use of the list iterator and a NULL check on the iterator value, where list_for_each_entry() guarantees a non-NULL map, causing the loop exit condition ...

CVE-2022-49393 misc: fastrpc: fix list iterator in fastrpc_req_mem_unmap_impl

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: fix list iterator in fastrpcreqmemunmapimpl This is another instance of incorrect use of list iterator and checking it for NULL. The list iterator value 'map' will always be set and non-NULL by listforeachentry, so...

CVE-2022-49270

CVE-2022-49270 : In the Linux kernel, a use-after-free can occur in dm_cleanup_zoned_dev() if it is not called before blk_cleanup_disk() proceeds through its cleanup path (blk_cleanup_disk->blk_cleanup_queue()->kobject_put()->blk_release_queue()->…->blk_free_queue_rcu()). This raci...

CVE-2022-49270 dm: fix use-after-free in dm_cleanup_zoned_dev()

In the Linux kernel, the following vulnerability has been resolved: dm: fix use-after-free in dmcleanupzoneddev dmcleanupzoneddev uses queue, so it must be called before blkcleanupdisk starts its killing: blkcleanupdisk-blkcleanupqueue-kobjectput-blkreleasequeue-...

CVE-2022-49270 dm: fix use-after-free in dm_cleanup_zoned_dev()

In the Linux kernel, the following vulnerability has been resolved: dm: fix use-after-free in dmcleanupzoneddev dmcleanupzoneddev uses queue, so it must be called before blkcleanupdisk starts its killing: blkcleanupdisk-blkcleanupqueue-kobjectput-blkreleasequeue-...

CVE-2022-49261

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: add missing boundary check in vmaccess A missing bounds check in vmaccess can lead to an out-of-bounds read or write in the adjacent memory area, since the len attribute is not validated before the memcpy later in t...

CVE-2022-49235

In the Linux kernel, the following vulnerability has been resolved: ath9khtc: fix uninit value bugs Syzbot reported 2 KMSAN bugs in ath9k. All of them are caused by missing field initialization. In htcconnectservice svcmetalen and pad are not initialized. Based on code it looks like in current sk...

CVE-2022-49212 mtd: rawnand: atmel: fix refcount issue in atmel_nand_controller_init

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: atmel: fix refcount issue in atmelnandcontrollerinit The reference counting issue happens in several error handling paths on a refcounted object "nc-dmac". In these paths, the function simply returns the error code,...

CVE-2022-49174

In the Linux kernel, the following vulnerability has been resolved: ext4: fix ext4mbmarkbb with flexbg with fastcommit In case of flexbg feature which is by default enabled, extents for any given inode might span across blocks from two different block group. ext4mbmarkbb only reads the bufferhead...

CVE-2022-49174

CVE-2022-49174 affects the Linux kernel ext4 filesystem, specifically the ext4_mb_mark_bb() logic when flex_bg (default enabled) and fast_commit are used. The issue occurs when an inode’s extents span block groups and ext4_mb_mark_bb() reads the starting block group’s bitmap only once; it does no...

CVE-2021-47636

In the Linux kernel, the following vulnerability has been resolved: ubifs: Fix read out-of-bounds in ubifswbufwritenolock Function ubifswbufwritenolock may access buf out of bounds in following process: ubifswbufwritenolock: alignedlen = ALIGNlen, 8; // Assume len = 4089, alignedlen = 4096 if...