CVE-2022-48910

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: ensure we call ipv6mcdown at most once There are two reasons for addrconfnotify to be called with NETDEVDOWN: either the network device is actually going down, or IPv6 was disabled on the interface. If either of them...

CVE-2022-48925

In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Do not change route.addr.srcaddr outside state checks If the state is not idle then resolvepreparesrc should immediately fail and no change to global state should happen. However, it unconditionally overwrites the srcad...

CVE-2022-48925 RDMA/cma: Do not change route.addr.src_addr outside state checks

In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Do not change route.addr.srcaddr outside state checks If the state is not idle then resolvepreparesrc should immediately fail and no change to global state should happen. However, it unconditionally overwrites the srcad...

CVE-2022-48925

In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Do not change route.addr.srcaddr outside state checks If the state is not idle then resolvepreparesrc should immediately fail and no change to global state should happen. However, it unconditionally overwrites the srcad...

CVE-2022-48922

CVE-2022-48922 (Linux kernel, riscv) : Root cause is a NULL pointer dereference when irqsoff latency tracer is enabled because trace_hardirqs_on/off rely on the frame pointer (CALLER_ADDR1). If the frame pointer is repurposed, memory access faults can occur during boot. The issue was mitigated by...

CVE-2022-48915

In the Linux kernel, the following vulnerability has been resolved: thermal: core: Fix TZGETTRIP NULL pointer dereference Do not call gettriphyst from thermalgenlcmdtzgettrip if the thermal zone does not define one...

CVE-2022-48912 netfilter: fix use-after-free in __nf_register_net_hook()

In the Linux kernel, the following vulnerability has been resolved: netfilter: fix use-after-free in nfregisternethook We must not dereference @newhooks after nfhookmutex has been released, because other threads might have freed our allocated hooks already. BUG: KASAN: use-after-free in...

CVE-2022-48911 netfilter: nf_queue: fix possible use-after-free

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfqueue: fix possible use-after-free Eric Dumazet says: The sockhold side seems suspect, because there is no guarantee that skrefcnt is not already 0. On failure, we cannot queue the packet and need to indicate an erro...

CVE-2022-48910

The CVE-2022-48910 case concerns the Linux kernel IPv6 addrconf path: when NETDEV_DOWN is triggered for reasons other than actual interface down, repeated calls can leak one ifmcaddr6 per multicast group by leaking idev->mc_tomb. The fix is to ensure ipv6_mc_down() runs at most once per state ...

CVE-2022-48908 net: arcnet: com20020: Fix null-ptr-deref in com20020pci_probe()

In the Linux kernel, the following vulnerability has been resolved: net: arcnet: com20020: Fix null-ptr-deref in com20020pciprobe During driver initialization, the pointer of card info, i.e. the variable 'ci' is required. However, the definition of 'com20020pciidtable' reveals that this field is...

CVE-2022-48907 auxdisplay: lcd2s: Fix memory leak in ->remove()

In the Linux kernel, the following vulnerability has been resolved: auxdisplay: lcd2s: Fix memory leak in -remove Once allocated the struct lcd2sdata is never freed. Fix the memory leak by switching to devmkzalloc...

CVE-2022-48903 btrfs: fix relocation crash due to premature return from btrfs_commit_transaction()

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix relocation crash due to premature return from btrfscommittransaction We are seeing crashes similar to the following trace: 38.969182 WARNING: CPU: 20 PID: 2105 at fs/btrfs/relocation.c:4070...

CVE-2022-48903 btrfs: fix relocation crash due to premature return from btrfs_commit_transaction()

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix relocation crash due to premature return from btrfscommittransaction We are seeing crashes similar to the following trace: 38.969182 WARNING: CPU: 20 PID: 2105 at fs/btrfs/relocation.c:4070...

CVE-2022-48902 btrfs: do not WARN_ON() if we have PageError set

In the Linux kernel, the following vulnerability has been resolved: btrfs: do not WARNON if we have PageError set Whenever we do any extent buffer operations we call assertebpageuptodate to complain loudly if we're operating on an non-uptodate page. Our overnight tests caught this warning earlier...

CVE-2022-48900

Removed by vendor...

CVE-2024-43867

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: prime: fix refcount underflow Calling nouveauboref on a nouveaubo without initializing it and hence the backing ttmbo leads to a refcount underflow. Instead of calling nouveauboref in the unwind path of...

CVE-2022-48886

In the Linux kernel, the following vulnerability has been resolved: ice: Add check for kzalloc Add the check for the return value of kzalloc in order to avoid NULL pointer dereference. Moreover, use the goto-label to share the clean code...

CVE-2022-48875

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: sdata can be NULL during AMPDU start ieee80211txbasessionhandlestart may get NULL for sdata when a deauthentication is ongoing. Here a trace triggering the race with the hostapd test multiapfronthaulonap: gdb list...

CVE-2022-48874

A vulnerability was found in the Linux kernel's fastrpc.c driver. A race condition is possible between the time that the fastrpcmaplookup function unlocks a mutex and the reference count is increased by the fastrpcmapget function in the fastrpcmapfind function. This race condition could result in...

CVE-2022-48873

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: Don't remove map on createrprocess and devicerelease Do not remove the map from the list on error path in fastrpcinitcreateprocess, instead call fastrpcmapput, to avoid use-after-free. Do not remove it on...