7301 matches found
CVE-2022-48937 io_uring: add a schedule point in io_add_buffers()
In the Linux kernel, the following vulnerability has been resolved: iouring: add a schedule point in ioaddbuffers Looping 65535 times doing kmalloc calls can trigger soft lockups, especially with DEBUG features like KASAN. 253.536212 watchdog: BUG: soft lockup - CPU64 stuck for 26s!...
CVE-2022-48935 netfilter: nf_tables: unregister flowtable hooks on netns exit
In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: unregister flowtable hooks on netns exit Unregister flowtable hooks before they are releases via nftablesflowtabledestroy otherwise hook core reports UAF. BUG: KASAN: use-after-free in...
CVE-2022-48935
CVE-2022-48935 concerns a Linux kernel vulnerability in netfilter nf_tables. The issue arises when unregistering flowtable hooks on netns exit: if flowtable hooks are not unregistered before nf_tables_flowtable_destroy(), the hook core can report a use-after-free (KASAN) in nf_hook_entries_grow. ...
CVE-2022-48932 net/mlx5: DR, Fix slab-out-of-bounds in mlx5_cmd_dr_create_fte
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: DR, Fix slab-out-of-bounds in mlx5cmddrcreatefte When adding a rule with 32 destinations, we hit the following out-of-band access issue: BUG: KASAN: slab-out-of-bounds in mlx5cmddrcreatefte+0x18ee/0x1e70 This patch fixe...
CVE-2022-48925
In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Do not change route.addr.srcaddr outside state checks If the state is not idle then resolvepreparesrc should immediately fail and no change to global state should happen. However, it unconditionally overwrites the srcad...
CVE-2022-48910
In the Linux kernel, the following vulnerability has been resolved: net: ipv6: ensure we call ipv6mcdown at most once There are two reasons for addrconfnotify to be called with NETDEVDOWN: either the network device is actually going down, or IPv6 was disabled on the interface. If either of them...
CVE-2022-48925
In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Do not change route.addr.srcaddr outside state checks If the state is not idle then resolvepreparesrc should immediately fail and no change to global state should happen. However, it unconditionally overwrites the srcad...
CVE-2022-48925 RDMA/cma: Do not change route.addr.src_addr outside state checks
In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Do not change route.addr.srcaddr outside state checks If the state is not idle then resolvepreparesrc should immediately fail and no change to global state should happen. However, it unconditionally overwrites the srcad...
CVE-2022-48925
In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Do not change route.addr.srcaddr outside state checks If the state is not idle then resolvepreparesrc should immediately fail and no change to global state should happen. However, it unconditionally overwrites the srcad...
CVE-2022-48922
CVE-2022-48922 (Linux kernel, riscv) : Root cause is a NULL pointer dereference when irqsoff latency tracer is enabled because trace_hardirqs_on/off rely on the frame pointer (CALLER_ADDR1). If the frame pointer is repurposed, memory access faults can occur during boot. The issue was mitigated by...
CVE-2022-48915
In the Linux kernel, the following vulnerability has been resolved: thermal: core: Fix TZGETTRIP NULL pointer dereference Do not call gettriphyst from thermalgenlcmdtzgettrip if the thermal zone does not define one...
CVE-2022-48912 netfilter: fix use-after-free in __nf_register_net_hook()
In the Linux kernel, the following vulnerability has been resolved: netfilter: fix use-after-free in nfregisternethook We must not dereference @newhooks after nfhookmutex has been released, because other threads might have freed our allocated hooks already. BUG: KASAN: use-after-free in...
CVE-2022-48911 netfilter: nf_queue: fix possible use-after-free
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfqueue: fix possible use-after-free Eric Dumazet says: The sockhold side seems suspect, because there is no guarantee that skrefcnt is not already 0. On failure, we cannot queue the packet and need to indicate an erro...
CVE-2022-48910
The CVE-2022-48910 case concerns the Linux kernel IPv6 addrconf path: when NETDEV_DOWN is triggered for reasons other than actual interface down, repeated calls can leak one ifmcaddr6 per multicast group by leaking idev->mc_tomb. The fix is to ensure ipv6_mc_down() runs at most once per state ...
CVE-2022-48908 net: arcnet: com20020: Fix null-ptr-deref in com20020pci_probe()
In the Linux kernel, the following vulnerability has been resolved: net: arcnet: com20020: Fix null-ptr-deref in com20020pciprobe During driver initialization, the pointer of card info, i.e. the variable 'ci' is required. However, the definition of 'com20020pciidtable' reveals that this field is...
CVE-2022-48907 auxdisplay: lcd2s: Fix memory leak in ->remove()
In the Linux kernel, the following vulnerability has been resolved: auxdisplay: lcd2s: Fix memory leak in -remove Once allocated the struct lcd2sdata is never freed. Fix the memory leak by switching to devmkzalloc...
CVE-2022-48903 btrfs: fix relocation crash due to premature return from btrfs_commit_transaction()
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix relocation crash due to premature return from btrfscommittransaction We are seeing crashes similar to the following trace: 38.969182 WARNING: CPU: 20 PID: 2105 at fs/btrfs/relocation.c:4070...
CVE-2022-48903 btrfs: fix relocation crash due to premature return from btrfs_commit_transaction()
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix relocation crash due to premature return from btrfscommittransaction We are seeing crashes similar to the following trace: 38.969182 WARNING: CPU: 20 PID: 2105 at fs/btrfs/relocation.c:4070...
CVE-2022-48902 btrfs: do not WARN_ON() if we have PageError set
In the Linux kernel, the following vulnerability has been resolved: btrfs: do not WARNON if we have PageError set Whenever we do any extent buffer operations we call assertebpageuptodate to complain loudly if we're operating on an non-uptodate page. Our overnight tests caught this warning earlier...