CVE-2022-49649 xen/netback: avoid entering xenvif_rx_next_skb() with an empty rx queue

In the Linux kernel, the following vulnerability has been resolved: xen/netback: avoid entering xenvifrxnextskb with an empty rx queue xenvifrxnextskb is expecting the rx queue not being empty, but in case the loop in xenvifrxaction is doing multiple iterations, the availability of another skb in...

CVE-2022-49635

CVE-2022-49635 affects the Linux kernel. The issue is in drm/i915/selftests, where a subtraction overflow can occur when hole_end is small, and addr + 2 * min_alignment can overflow in mock tests. A patch was applied (cherry picked from commit ab3edc679c552a466e4bf0b11af3666008bd65a2) to fix both...

CVE-2022-49634

CVE-2022-49634 : In the Linux kernel, there are data-races in sysctl access to proc_dou8vec_minmax() due to concurrent readers/writers. The fix changes proc_dou8vec_minmax() to use internal READ_ONCE() and WRITE_ONCE() to mitigate races on the sysctl side. The patch notes indicate the function it...

CVE-2022-49627 ima: Fix potential memory leak in ima_init_crypto()

In the Linux kernel, the following vulnerability has been resolved: ima: Fix potential memory leak in imainitcrypto On failure to allocate the SHA1 tfm, IMA fails to initialize and exits without freeing the imaalgoarray. Add the missing kfree for imaalgoarray to avoid the potential memory leak...

CVE-2022-49626

In CVE-2022-49626, the Linux kernel sfc (Solarflare) driver had a use-after-free: vf->pci_dev could be freed during pci_disable_sriov and later read in efx_ef10_sriov_free_vf_vswitching. The root cause is reading a freed vf->pci_dev in the SR-IOV disable path. A patch fixes this by setting ...

CVE-2022-49602

The CVE-2022-49602 entry refers to a data race in the Linux kernel’s sysctl_fwmark_reflect reader. The race occurs while reading sysctl_fwmark_reflect, which could be changed concurrently; the fix is to apply READ_ONCE() to the reader to ensure a consistent read. Connected advisories (EulerOS/Ope...

CVE-2022-49574

CVE-2022-49574 is a Linux kernel security issue involving a data race in reading the sysctl_tcp_recovery variable within the TCP stack. The root cause is concurrent modification of sysctl_tcp_recovery while it is being read, which could lead to inconsistent reads or memory corruption. The descrip...

CVE-2022-49561 netfilter: conntrack: re-fetch conntrack after insertion

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: re-fetch conntrack after insertion In case the conntrack is clashing, insertion can free skb-nfct and set skb-nfct to the already-confirmed entry. This wasn't found before because the conntrack entry and the...

CVE-2022-49556 KVM: SVM: Use kzalloc for sev ioctl interfaces to prevent kernel data leak

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Use kzalloc for sev ioctl interfaces to prevent kernel data leak For some sev ioctl interfaces, the length parameter that is passed maybe less than or equal to SEVFWBLOBMAXSIZE, but larger than the data that PSP firmwar...

CVE-2022-49505

In the Linux kernel, the following vulnerability has been resolved: NFC: NULL out the dev-rfkill to prevent UAF Commit 3e3b5dfcd16a "NFC: reorder the logic in nfcun,registerdevice" assumes the deviceisregistered in function nfcdevup will help to check when the rfkill is unregistered. However, thi...

CVE-2022-49485 drm/v3d: Fix null pointer dereference of pointer perfmon

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Fix null pointer dereference of pointer perfmon In the unlikely event that pointer perfmon is null the WARNON return path occurs after the pointer has already been deferenced. Fix this by only dereferencing perfmon after...

CVE-2022-49447 ARM: hisi: Add missing of_node_put after of_find_compatible_node

In the Linux kernel, the following vulnerability has been resolved: ARM: hisi: Add missing ofnodeput after offindcompatiblenode offindcompatiblenode will increment the refcount of the returned devicenode. Calling ofnodeput to avoid the refcount leak...

CVE-2022-49423

Summary: CVE-2022-49423 relates to the Linux kernel where RTLA tracing could dereference a NULL record in several tracing tools. Root cause (as documented): NULL pointer dereference of the variable record in multiple files (osnoise_hist.c, osnoise_top.c, timerlat_hist.c, timerlat_top.c) before ca...

CVE-2022-49419

The CVE-2022-49419 issue affects the Linux kernel vesafb (video: fbdev) where use-after-free can occur if the fb_info is freed in the .remove path before or after .fb_destroy. The underlying cause is an ordering bug: the code previously freed fb_info in .remove, which could reference freed memory...

CVE-2022-49390 macsec: fix UAF bug for real_dev

In the Linux kernel, the following vulnerability has been resolved: macsec: fix UAF bug for realdev Create a new macsec device but not get reference to realdev. That can not ensure that realdev is freed after macsec. That will trigger the UAF bug for realdev as following:...

CVE-2022-49373

CVE-2022-49373 affects the Linux kernel watchdog ts4800_wdt refcount handling. According to connected docs, the issue arises because of_parse_phandle() returns a node pointer with its refcount incremented and missing of_node_put() on error paths, leading to a refcount leak in ts4800_wdt_probe. Th...

CVE-2022-49354 ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe

In the Linux kernel, the following vulnerability has been resolved: ata: pataocteoncf: Fix refcount leak in octeoncfprobe offinddevicebynode takes reference, we should use putdevice to release it when not need anymore. Add missing putdevice to avoid refcount leak...

CVE-2022-49351 net: altera: Fix refcount leak in altera_tse_mdio_create

In the Linux kernel, the following vulnerability has been resolved: net: altera: Fix refcount leak in alteratsemdiocreate Every iteration of foreachchildofnode decrements the reference count of the previous node. When break from a foreachchildofnode loop, we need to explicitly call ofnodeput on t...

CVE-2022-49348

In Linux kernels affected by CVE-2022-49348, the EXT4_FC_REPLAY bit in sbi->s_mount_state was causing a risk: a corrupted on-disk superblock could set EXT4_FC_REPLAY in s_mount_state, bypassing sanity checks and triggering a BUG() in ext4_es_cache_extent(). The available connected documents co...

CVE-2022-49324

In the Linux kernel, the following vulnerability has been resolved: mips: cpc: Fix refcount leak in mipscpcdefaultphysbase Add the missing ofnodeput to release the refcount incremented by offindcompatiblenode...