CVE-2022-49564 crypto: qat - add param check for DH

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - add param check for DH Reject requests with a source buffer that is bigger than the size of the key. This is to prevent a possible integer underflow that might happen when copying the source scatterlist into a linea...

CVE-2022-49562

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Use trycmpxchguser to update guest PTE A/D bits Use the recently introduced trycmpxchguser to update guest PTE A/D bits instead of mapping the PTE into kernel address space. The VMPFNMAP path is broken as it assumes tha...

CVE-2022-49559

CVE-2022-49559 (Linux kernel, KVM/x86) is resolved. The issue involved dropping WARNs that incorrectly assumed KVM cannot let a triple fault (KVM_REQ_TRIPLE_FAULT) escape from L2 to L1. The vulnerability could be triggered when userspace injects a machine check while L2 is active with CR4.MCE=0, ...

CVE-2022-49540 rcu-tasks: Fix race in schedule and flush work

In the Linux kernel, the following vulnerability has been resolved: rcu-tasks: Fix race in schedule and flush work While booting secondary CPUs, cpusreadlock/unlock is not keeping online cpumask stable. The transient online mask results in below calltrace. 0.324121 CPU1: Booted secondary processo...

CVE-2022-49538 ALSA: jack: Access input_dev under mutex

In the Linux kernel, the following vulnerability has been resolved: ALSA: jack: Access inputdev under mutex It is possible when using ASoC that inputdev is unregistered while calling sndjackreport, which causes NULL pointer dereference. In order to prevent this serialize access to inputdev using...

CVE-2022-49536

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix SCSI I/O completion and abort handler deadlock During stress I/O tests with 500+ vports, hard LOCKUP call traces are observed. CPU A: nativequeuedspinlockslowpath+0x192 rawspinlockirqsave+0x32 lpfchandlefcperr+0x4...

CVE-2022-49536

The CVE-2022-49536 entry concerns the Linux kernel SCSI LPFC deadlock in I/O completion and abort handling under heavy stress (500+ vports). Affected component is the lpfc driver within the SCSI subsystem. The root cause is a deadlock between the lpfc_cmd->buf_lock and phba->hbalock during ...

CVE-2022-49536 scsi: lpfc: Fix SCSI I/O completion and abort handler deadlock

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix SCSI I/O completion and abort handler deadlock During stress I/O tests with 500+ vports, hard LOCKUP call traces are observed. CPU A: nativequeuedspinlockslowpath+0x192 rawspinlockirqsave+0x32 lpfchandlefcperr+0x4...

CVE-2022-49531 loop: implement ->free_disk

In the Linux kernel, the following vulnerability has been resolved: loop: implement -freedisk Ensure that the lodevice which is stored in the gendisk private data is valid until the gendisk is freed. Currently the loop driver uses a lot of effort to make sure a device is not freed when it is stil...

CVE-2022-49522 mmc: jz4740: Apply DMA engine limits to maximum segment size

In the Linux kernel, the following vulnerability has been resolved: mmc: jz4740: Apply DMA engine limits to maximum segment size Do what is done in other DMA-enabled MMC host drivers cf. host/mmci.c and limit the maximum segment size based on the DMA engine's capabilities. This is needed to avoid...

CVE-2022-49523 ath11k: disable spectral scan during spectral deinit

In the Linux kernel, the following vulnerability has been resolved: ath11k: disable spectral scan during spectral deinit When ath11k modules are removed using rmmod with spectral scan enabled, crash is observed. Different crash trace is observed for each crash. Send spectral scan disable WMI...

CVE-2022-49516 ice: always check VF VSI pointer values

In the Linux kernel, the following vulnerability has been resolved: ice: always check VF VSI pointer values The icegetvfvsi function can return NULL in some cases, such as if handling messages during a reset where the VSI is being removed and recreated. Several places throughout the driver do not...

CVE-2022-49513 cpufreq: governor: Use kobject release() method to free dbs_data

In the Linux kernel, the following vulnerability has been resolved: cpufreq: governor: Use kobject release method to free dbsdata The struct dbsdata embeds a struct govattrset and the struct govattrset embeds a kobject. Since every kobject must have a release method and we can't use kfree to free...

CVE-2022-49506

In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Add vblank register/unregister callback functions We encountered a kernel panic issue that callback data will be NULL when it's using in ovl irq handler. There is a timing issue between mtkdispovlirqhandler and...

CVE-2022-49504

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Inhibit aborts if external loopback plug is inserted After running a short external loopback test, when the external loopback is removed and a normal cable inserted that is directly connected to a target device, the...

CVE-2022-49502 media: rga: fix possible memory leak in rga_probe

In the Linux kernel, the following vulnerability has been resolved: media: rga: fix possible memory leak in rgaprobe rga-m2mdev needs to be freed when rgaprobe fails...

CVE-2022-49497

CVE-2022-49497 is a Linux kernel issue in the networking code where two BUG() calls were present in skb_checksum_help(). The vulnerability was resolved by removing these BUG()s and replacing them with WARN_ON_ONCE() so skb_checksum_help() can return an error code instead of triggering a crash whe...

CVE-2022-49495

CVE-2022-49495 : In the Linux kernel, the drm/msm/hdmi driver fails to check the return value of platform_get_resource_byname(), which can lead to a null-pointer dereference if NULL is returned. The issue has been fixed by applying a patch that adds the necessary NULL check (Patchwork: 482992). S...

CVE-2022-49495

In the Linux kernel, the following vulnerability has been resolved: drm/msm/hdmi: check return value after calling platformgetresourcebyname It will cause null-ptr-deref if platformgetresourcebyname returns NULL, we need check the return value. Patchwork:...

CVE-2022-49491 drm/rockchip: vop: fix possible null-ptr-deref in vop_bind()

In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: vop: fix possible null-ptr-deref in vopbind It will cause null-ptr-deref in resourcesize, if platformgetresource returns NULL, move calling resourcesize after devmioremapresource that will check 'res' to avoid...