CVE-2022-49574

CVE-2022-49574 is a Linux kernel security issue involving a data race in reading the sysctl_tcp_recovery variable within the TCP stack. The root cause is concurrent modification of sysctl_tcp_recovery while it is being read, which could lead to inconsistent reads or memory corruption. The descrip...

CVE-2022-49561 netfilter: conntrack: re-fetch conntrack after insertion

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: re-fetch conntrack after insertion In case the conntrack is clashing, insertion can free skb-nfct and set skb-nfct to the already-confirmed entry. This wasn't found before because the conntrack entry and the...

CVE-2022-49556 KVM: SVM: Use kzalloc for sev ioctl interfaces to prevent kernel data leak

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Use kzalloc for sev ioctl interfaces to prevent kernel data leak For some sev ioctl interfaces, the length parameter that is passed maybe less than or equal to SEVFWBLOBMAXSIZE, but larger than the data that PSP firmwar...

CVE-2022-49505

In the Linux kernel, the following vulnerability has been resolved: NFC: NULL out the dev-rfkill to prevent UAF Commit 3e3b5dfcd16a "NFC: reorder the logic in nfcun,registerdevice" assumes the deviceisregistered in function nfcdevup will help to check when the rfkill is unregistered. However, thi...

CVE-2022-49485 drm/v3d: Fix null pointer dereference of pointer perfmon

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Fix null pointer dereference of pointer perfmon In the unlikely event that pointer perfmon is null the WARNON return path occurs after the pointer has already been deferenced. Fix this by only dereferencing perfmon after...

CVE-2022-49447 ARM: hisi: Add missing of_node_put after of_find_compatible_node

In the Linux kernel, the following vulnerability has been resolved: ARM: hisi: Add missing ofnodeput after offindcompatiblenode offindcompatiblenode will increment the refcount of the returned devicenode. Calling ofnodeput to avoid the refcount leak...

CVE-2022-49423

Summary: CVE-2022-49423 relates to the Linux kernel where RTLA tracing could dereference a NULL record in several tracing tools. Root cause (as documented): NULL pointer dereference of the variable record in multiple files (osnoise_hist.c, osnoise_top.c, timerlat_hist.c, timerlat_top.c) before ca...

CVE-2022-49419

The Linux kernel contains a use-after-free vulnerability in the vesafb driver (specifically in the vesafb_remove() function). The issue arises from incorrect cleanup logic for the fb_info pointer; while a previous fix addressed cases where .fb_destroy followed .remove, a secondary scenario exists...

CVE-2022-49390 macsec: fix UAF bug for real_dev

In the Linux kernel, the following vulnerability has been resolved: macsec: fix UAF bug for realdev Create a new macsec device but not get reference to realdev. That can not ensure that realdev is freed after macsec. That will trigger the UAF bug for realdev as following:...

CVE-2022-49373

CVE-2022-49373 affects the Linux kernel watchdog ts4800_wdt refcount handling. According to connected docs, the issue arises because of_parse_phandle() returns a node pointer with its refcount incremented and missing of_node_put() on error paths, leading to a refcount leak in ts4800_wdt_probe. Th...

CVE-2022-49354 ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe

In the Linux kernel, the following vulnerability has been resolved: ata: pataocteoncf: Fix refcount leak in octeoncfprobe offinddevicebynode takes reference, we should use putdevice to release it when not need anymore. Add missing putdevice to avoid refcount leak...

CVE-2022-49351 net: altera: Fix refcount leak in altera_tse_mdio_create

In the Linux kernel, the following vulnerability has been resolved: net: altera: Fix refcount leak in alteratsemdiocreate Every iteration of foreachchildofnode decrements the reference count of the previous node. When break from a foreachchildofnode loop, we need to explicitly call ofnodeput on t...

CVE-2022-49348

In Linux kernels affected by CVE-2022-49348, the EXT4_FC_REPLAY bit in sbi->s_mount_state was causing a risk: a corrupted on-disk superblock could set EXT4_FC_REPLAY in s_mount_state, bypassing sanity checks and triggering a BUG() in ext4_es_cache_extent(). The available connected documents co...

CVE-2022-49324

In the Linux kernel, the following vulnerability has been resolved: mips: cpc: Fix refcount leak in mipscpcdefaultphysbase Add the missing ofnodeput to release the refcount incremented by offindcompatiblenode...

CVE-2022-49255 f2fs: fix missing free nid in f2fs_handle_failed_inode

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix missing free nid in f2fshandlefailedinode This patch fixes xfstests/generic/475 failure. 293.680694 F2FS-fs dm-1: May loss orphan inode, run fsck to fix. 293.685358 Buffer I/O error on dev dm-1, logical block 8388592,...

CVE-2022-49237

In the Linux kernel, the following vulnerability has been resolved: ath11k: add missing ofnodeput to avoid leak The node pointer is returned by offindnodebytype or ofparsephandle with refcount incremented. Calling ofnodeput to aovid the refcount leak...

CVE-2022-49214 powerpc/64s: Don't use DSISR for SLB faults

In the Linux kernel, the following vulnerability has been resolved: powerpc/64s: Don't use DSISR for SLB faults Since commit 46ddcb3950a2 "powerpc/mm: Show if a bad page fault on data is read or write." we use pagefaultiswriteregs-dsisr in badpagefault to determine if the fault is for a read or...

CVE-2022-49117 mips: ralink: fix a refcount leak in ill_acc_of_setup()

In the Linux kernel, the following vulnerability has been resolved: mips: ralink: fix a refcount leak in illaccofsetup ofnodeputnp needs to be called when pdev == NULL...

CVE-2022-49094 net/tls: fix slab-out-of-bounds bug in decrypt_internal

In the Linux kernel, the following vulnerability has been resolved: net/tls: fix slab-out-of-bounds bug in decryptinternal The memory size of tlsctx-rx.iv for AES128-CCM is 12 setting in tlssetswoffload. The return value of cryptoaeadivsize for "ccmaes" is 16. So memcpy require 16 bytes from 12...

CVE-2022-49079 btrfs: zoned: traverse devices under chunk_mutex in btrfs_can_activate_zone

In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: traverse devices under chunkmutex in btrfscanactivatezone btrfscanactivatezone can be called with the devicelistmutex already held, which will lead to a deadlock: insertdevextents // Takes devicelistmutex -...