CVE-2022-49026

In the Linux kernel, the following vulnerability has been resolved: e100: Fix possible use after free in e100xmitprepare In e100xmitprepare, if we can't map the skb, then return -ENOMEM, so e100xmitframe will return NETDEVTXBUSY and the upper layer will resend the skb. But the skb is already free...

CVE-2022-49024 can: m_can: pci: add missing m_can_class_free_dev() in probe/remove methods

In the Linux kernel, the following vulnerability has been resolved: can: mcan: pci: add missing mcanclassfreedev in probe/remove methods In mcanpciremove and error handling path of mcanpciprobe, mcanclassfreedev should be called to free resource allocated by mcanclassallocatedev, otherwise there...

CVE-2022-49024

In the Linux kernel, the following vulnerability has been resolved: can: mcan: pci: add missing mcanclassfreedev in probe/remove methods In mcanpciremove and error handling path of mcanpciprobe, mcanclassfreedev should be called to free resource allocated by mcanclassallocatedev, otherwise there...

CVE-2022-49022 wifi: mac8021: fix possible oob access in ieee80211_get_rate_duration

In the Linux kernel, the following vulnerability has been resolved: wifi: mac8021: fix possible oob access in ieee80211getrateduration Fix possible out-of-bound access in ieee80211getrateduration routine as reported by the following UBSAN report: UBSAN: array-index-out-of-bounds in...

CVE-2022-49023 wifi: cfg80211: fix buffer overflow in elem comparison

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: fix buffer overflow in elem comparison For vendor elements, the code here assumes that 5 octets are present without checking. Since the element itself is already checked to fit, we only need to check the length...

CVE-2022-49022 wifi: mac8021: fix possible oob access in ieee80211_get_rate_duration

In the Linux kernel, the following vulnerability has been resolved: wifi: mac8021: fix possible oob access in ieee80211getrateduration Fix possible out-of-bound access in ieee80211getrateduration routine as reported by the following UBSAN report: UBSAN: array-index-out-of-bounds in...

CVE-2022-49022

In the Linux kernel, the following vulnerability has been resolved: wifi: mac8021: fix possible oob access in ieee80211getrateduration Fix possible out-of-bound access in ieee80211getrateduration routine as reported by the following UBSAN report: UBSAN: array-index-out-of-bounds in...

CVE-2022-49019

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: nixge: fix NULL dereference In function nixgehwdmabdrelease dereference of NULL pointer priv-rxbdv is possible for the case of its allocation failure in nixgehwdmabdinit. Move for loop with priv-rxbdv dereference...

CVE-2022-49020

In the Linux kernel, the following vulnerability has been resolved: net/9p: Fix a potential socket leak in p9socketopen Both p9fdcreatetcp and p9fdcreateunix will call p9socketopen. If the creation of p9transfd fails, p9fdcreatetcp and p9fdcreateunix will return an error directly instead of...

CVE-2022-49018

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix sleep in atomic at close time Matt reported a splat at msk close time: BUG: sleeping function called from invalid context at net/mptcp/protocol.c:2877 inatomic: 1, irqsdisabled: 0, nonblock: 0, pid: 155, name:...

CVE-2022-49017

In the Linux kernel, the following vulnerability has been resolved: tipc: re-fetch skb cb after tipcmsgvalidate As the call trace shows, the original skb was freed in tipcmsgvalidate, and dereferencing the old skb cb would cause an use-after-free crash. BUG: KASAN: use-after-free in...

CVE-2022-49015

In the Linux kernel, the following vulnerability has been resolved: net: hsr: Fix potential use-after-free The skb is delivered to netifrx which may free it, after calling this, dereferencing skb may trigger use-after-free...

CVE-2022-49014

In the Linux kernel, the following vulnerability has been resolved: net: tun: Fix use-after-free in tundetach syzbot reported use-after-free in tundetach 1. This causes call trace like below: ================================================================== BUG: KASAN: use-after-free in...

CVE-2022-49013

In the Linux kernel, the following vulnerability has been resolved: sctp: fix memory leak in sctpstreamoutqmigrate When sctpstreamoutqmigrate is called to release stream out resources, the memory pointed to by priohead in stream out is not released. The memory leak information is as follows:...

CVE-2022-49012

In the Linux kernel, the following vulnerability has been resolved: afs: Fix server-active leak in afsputserver The atomicread was accidentally replaced with atomicincreturn, which prevents the server from getting cleaned up and causes rmmod to hang with a warning: Can't purge s=00000001...

CVE-2022-49010 hwmon: (coretemp) Check for null before removing sysfs attrs

In the Linux kernel, the following vulnerability has been resolved: hwmon: coretemp Check for null before removing sysfs attrs If coretempaddcore gets an error then pdata-coredataindx is already NULL and has been kfreed. Don't pass that to sysfsremovegroup as that will crash in sysfsremovegroup...

CVE-2022-49010

In the Linux kernel, the following vulnerability has been resolved: hwmon: coretemp Check for null before removing sysfs attrs If coretempaddcore gets an error then pdata-coredataindx is already NULL and has been kfreed. Don't pass that to sysfsremovegroup as that will crash in sysfsremovegroup...

CVE-2022-49009

The CVE-2022-49009 issue affects the Linux kernel component hwmon:asus-ec-sensors, where devm_kcalloc may return NULL and the return value must be checked to avoid NULL pointer dereference. The provided documents confirm a resolved vulnerability with a fix implementing checks for the NULL return ...

CVE-2022-49009

In the Linux kernel, the following vulnerability has been resolved: hwmon: asus-ec-sensors Add checks for devmkcalloc As the devmkcalloc may return NULL, the return value needs to be checked to avoid NULL poineter dereference...

CVE-2022-49005 ASoC: ops: Fix bounds check for _sx controls

In the Linux kernel, the following vulnerability has been resolved: ASoC: ops: Fix bounds check for sx controls For sx controls the semantics of the max field is not the usual one, max is the number of steps rather than the maximum value. This means that our check in sndsocputvolswsx needs to jus...