CVE-2022-48812

CVE-2022-48812 concerns the Linux kernel: the net: dsa: lantiq_gswip code should not use devres for mdiobus allocation/registration. The root cause is that mdiobus_free() can panic when invoked via devm_mdiobus_free() because devres_release_all() may free a bus that is still registered, especiall...

CVE-2022-48810 ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure path

In the Linux kernel, the following vulnerability has been resolved: ipmr,ip6mr: acquire RTNL before calling ip6mrfreetable on failure path ip6mrfreetable can only be called under RTNL lock. RTNL: assertion failed at net/core/dev.c 10367 WARNING: CPU: 1 PID: 5890 at net/core/dev.c:10367...

CVE-2022-48806 eeprom: ee1004: limit i2c reads to I2C_SMBUS_BLOCK_MAX

In the Linux kernel, the following vulnerability has been resolved: eeprom: ee1004: limit i2c reads to I2CSMBUSBLOCKMAX Commit effa453168a7 "i2c: i801: Don't silently correct invalid transfer size" revealed that ee1004eepromread did not properly limit how many bytes to read at once. In particular...

CVE-2022-48803

In CVE-2022-48803, the Linux kernel patch fixes a bounds issue in the TI PHY code used on the TI J721e platform. _get_table_maxdiv() could read beyond clk_div_table in phy-j721e-wiz.c, triggering a global-out-of-bounds access reported under KASAN. The remediation is adding a sentinel entry to clk...

CVE-2022-48802 fs/proc: task_mmu.c: don't read mapcount for migration entry

In the Linux kernel, the following vulnerability has been resolved: fs/proc: taskmmu.c: don't read mapcount for migration entry The syzbot reported the below BUG: kernel BUG at include/linux/page-flags.h:785! invalid opcode: 0000 1 PREEMPT SMP KASAN CPU: 1 PID: 4392 Comm: syz-executor560 Not...

CVE-2022-48798

In the Linux kernel, the following vulnerability has been resolved: s390/cio: verify the driver availability for pathevent call If no driver is attached to a device or the driver does not provide the pathevent function, an FCES path-event on this device could end up in a kernel-panic. Verify the...

CVE-2022-48798 s390/cio: verify the driver availability for path_event call

In the Linux kernel, the following vulnerability has been resolved: s390/cio: verify the driver availability for pathevent call If no driver is attached to a device or the driver does not provide the pathevent function, an FCES path-event on this device could end up in a kernel-panic. Verify the...

CVE-2022-48799 perf: Fix list corruption in perf_cgroup_switch()

In the Linux kernel, the following vulnerability has been resolved: perf: Fix list corruption in perfcgroupswitch There's list corruption on cgrpcpuctxlist. This happens on the following path: perfcgroupswitch: listforeachentrycgrpcpuctxlist cpuctxschedin ctxschedin ctxpinnedschedin mergeschedin...

CVE-2022-48797

CVE-2022-48797 concerns a Linux kernel issue where NUMA balancing could alter COW page writability. The bug was traced to change_pte_range() using page_mapcount(page) to decide NUMA protection, which is incorrect; the recommended fix is to use page_count() (as reported by Oded Gabbay). Connected ...

CVE-2021-47624 net/sunrpc: fix reference count leaks in rpc_sysfs_xprt_state_change

In the Linux kernel, the following vulnerability has been resolved: net/sunrpc: fix reference count leaks in rpcsysfsxprtstatechange The refcount leak issues take place in an error handling path. When the 3rd argument buf doesn't match with "offline", "online" or "remove", the function simply...

CVE-2021-47623

In the Linux kernel, the following vulnerability has been resolved: powerpc/fixmap: Fix VM debug warning on unmap Unmapping a fixmap entry is done by calling setfixmap with FIXMAPPAGECLEAR as flags. Today, powerpc setfixmap calls mapkernelpage. mapkernelpage is not happy when called a second time...

CVE-2022-48785 ipv6: mcast: use rcu-safe version of ipv6_get_lladdr()

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: use rcu-safe version of ipv6getlladdr Some time ago 8965779d2c0e "ipv6,mcast: always hold idev-lock before mcalock" switched ipv6getlladdr to ipv6getlladdr, which is rcu-unsafe version. That was OK, because idev-lock...

CVE-2022-48783 net: dsa: lantiq_gswip: fix use after free in gswip_remove()

In the Linux kernel, the following vulnerability has been resolved: net: dsa: lantiqgswip: fix use after free in gswipremove ofnodeputpriv-ds-slavemiibus-dev.ofnode should be done before mdiobusfreepriv-ds-slavemiibus...

CVE-2022-48780 net/smc: Avoid overwriting the copies of clcsock callback functions

In the Linux kernel, the following vulnerability has been resolved: net/smc: Avoid overwriting the copies of clcsock callback functions The callback functions of clcsock will be saved and replaced during the fallback. But if the fallback happens more than once, then the copies of these callback...

CVE-2022-48780

In the Linux kernel, the following vulnerability has been resolved: net/smc: Avoid overwriting the copies of clcsock callback functions The callback functions of clcsock will be saved and replaced during the fallback. But if the fallback happens more than once, then the copies of these callback...

CVE-2022-48775 Drivers: hv: vmbus: Fix memory leak in vmbus_add_channel_kobj

In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Fix memory leak in vmbusaddchannelkobj kobjectinitandadd takes reference even when it fails. According to the doc of kobjectinitandadd： If this function returns an error, kobjectput must be called to properly...

CVE-2022-48774 dmaengine: ptdma: Fix the error handling path in pt_core_init()

In the Linux kernel, the following vulnerability has been resolved: dmaengine: ptdma: Fix the error handling path in ptcoreinit In order to free resources correctly in the error handling path of ptcoreinit, 2 goto's have to be switched. Otherwise, some resources will leak and we will try to relea...

CVE-2022-48774 dmaengine: ptdma: Fix the error handling path in pt_core_init()

In the Linux kernel, the following vulnerability has been resolved: dmaengine: ptdma: Fix the error handling path in ptcoreinit In order to free resources correctly in the error handling path of ptcoreinit, 2 goto's have to be switched. Otherwise, some resources will leak and we will try to relea...

CVE-2022-48774 dmaengine: ptdma: Fix the error handling path in pt_core_init()

In the Linux kernel, the following vulnerability has been resolved: dmaengine: ptdma: Fix the error handling path in ptcoreinit In order to free resources correctly in the error handling path of ptcoreinit, 2 goto's have to be switched. Otherwise, some resources will leak and we will try to relea...

CVE-2024-41008

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: change vm-taskinfo handling This patch changes the handling and lifecycle of vm-taskinfo object. The major changes are: - vm-taskinfo is a dynamically allocated ptr now, and its uasge is reference counted. - introduci...