CVE-2021-47583

In the Linux kernel, the following vulnerability has been resolved: media: mxl111sf: change mutexinit location Syzbot reported, that mxl111sfctrlmsg uses uninitialized mutex. The problem was in wrong mutexinit location. Previous mutexinit&state-;msglock call was in -init function, but dvbusbv2ini...

CVE-2021-47582

In the Linux kernel, the following vulnerability has been resolved: USB: core: Make doproccontrol and doprocbulk killable The USBDEVFSCONTROL and USBDEVFSBULK ioctls invoke usbstartwaiturb, which contains an uninterruptible wait with a user-specified timeout value. If timeout value is very large...

CVE-2022-48760

The CVE-2022-48760 entry concerns a Linux kernel USB subsystem hang in usb_kill_urb() caused by memory-access ordering issues (SB pattern) between usb_kill_urb() and __usb_hcd_giveback_urb() on SMP systems. The vulnerability is fixed by adding memory barriers, specifically using the smp_mb__after...

CVE-2021-47598

In the Linux kernel, the following vulnerability has been resolved: schcake: do not call cakedestroy from cakeinit qdiscs are not supposed to call their own destroy method from init, because core stack already does that. syzbot was able to trigger use after free: DEBUGLOCKSWARNONlock-magic != loc...

CVE-2022-48760

In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix hang in usbkillurb by adding memory barriers The syzbot fuzzer has identified a bug in which processes hang waiting for usbkillurb to return. It turns out the issue is not unlinking the URB; that works just fine...

CVE-2021-47598

In the Linux kernel, the following vulnerability has been resolved: schcake: do not call cakedestroy from cakeinit qdiscs are not supposed to call their own destroy method from init, because core stack already does that. syzbot was able to trigger use after free: DEBUGLOCKSWARNONlock-magic != loc...

CVE-2021-47588

In the Linux kernel, the following vulnerability has been resolved: sit: do not call ipip6devfree from sitinitnet ipip6devfree is sit dev-privdestructor, already called by registernetdevice if something goes wrong. Alternative would be to make ipip6devfree robust against multiple invocations, but...

CVE-2021-47583

In the Linux kernel, the following vulnerability has been resolved: media: mxl111sf: change mutexinit location Syzbot reported, that mxl111sfctrlmsg uses uninitialized mutex. The problem was in wrong mutexinit location. Previous mutexinit&state-msglock call was in -init function, but dvbusbv2init...

CVE-2021-47583

In the Linux kernel, the following vulnerability has been resolved: media: mxl111sf: change mutexinit location Syzbot reported, that mxl111sfctrlmsg uses uninitialized mutex. The problem was in wrong mutexinit location. Previous mutexinit&state-msglock call was in -init function, but dvbusbv2init...

CVE-2021-47588

In the Linux kernel, the following vulnerability has been resolved: sit: do not call ipip6devfree from sitinitnet ipip6devfree is sit dev-privdestructor, already called by registernetdevice if something goes wrong. Alternative would be to make ipip6devfree robust against multiple invocations, but...

CVE-2021-47598

In the Linux kernel, the following vulnerability has been resolved: schcake: do not call cakedestroy from cakeinit qdiscs are not supposed to call their own destroy method from init, because core stack already does that. syzbot was able to trigger use after free: DEBUGLOCKSWARNONlock-magic != loc...

CVE-2021-47602

In the Linux kernel, the following vulnerability has been resolved: mac80211: track only QoS data frames for admission control For admission control, obviously all of that only works for QoS data frames, otherwise we cannot even access the QoS field in the header. Syzbot reported see below an...

CVE-2021-47598 sch_cake: do not call cake_destroy() from cake_init()

In the Linux kernel, the following vulnerability has been resolved: schcake: do not call cakedestroy from cakeinit qdiscs are not supposed to call their own destroy method from init, because core stack already does that. syzbot was able to trigger use after free: DEBUGLOCKSWARNONlock-magic != loc...

CVE-2021-47588 sit: do not call ipip6_dev_free() from sit_init_net()

In the Linux kernel, the following vulnerability has been resolved: sit: do not call ipip6devfree from sitinitnet ipip6devfree is sit dev-privdestructor, already called by registernetdevice if something goes wrong. Alternative would be to make ipip6devfree robust against multiple invocations, but...

CVE-2021-47588 sit: do not call ipip6_dev_free() from sit_init_net()

In the Linux kernel, the following vulnerability has been resolved: sit: do not call ipip6devfree from sitinitnet ipip6devfree is sit dev-privdestructor, already called by registernetdevice if something goes wrong. Alternative would be to make ipip6devfree robust against multiple invocations, but...

CVE-2021-47583 media: mxl111sf: change mutex_init() location

In the Linux kernel, the following vulnerability has been resolved: media: mxl111sf: change mutexinit location Syzbot reported, that mxl111sfctrlmsg uses uninitialized mutex. The problem was in wrong mutexinit location. Previous mutexinit&state-msglock call was in -init function, but dvbusbv2init...

CVE-2021-47583 media: mxl111sf: change mutex_init() location

In the Linux kernel, the following vulnerability has been resolved: media: mxl111sf: change mutexinit location Syzbot reported, that mxl111sfctrlmsg uses uninitialized mutex. The problem was in wrong mutexinit location. Previous mutexinit&state-msglock call was in -init function, but dvbusbv2init...

CVE-2021-47583

CVE-2021-47583 affects the Linux kernel’s media/mxl111sf driver. Syzbot reported an uninitialized mutex in mxl111sf_ctrl_msg() due to the previous mutex_init(&state->msg_lock) being called too late. The order of dvb_usbv2_init() calls meant mxl111sf_ctrl_msg() could run from frontend_attach be...

CVE-2021-47579

Mode C: CVE-2021-47579 affects the Linux kernel overlayfs component (ovl) with a WARN_ON path in ovl_workdir_create() when mkdir returns a dentry without an inode (not instantiated). The fix, described in the connected advisories, calls ovl_mkdir_real() directly from ovl_workdir_create() and reje...

CVE-2021-47579 ovl: fix warning in ovl_create_real()

In the Linux kernel, the following vulnerability has been resolved: ovl: fix warning in ovlcreatereal Syzbot triggered the following warning in ovlworkdircreate - ovlcreatereal: if !err && WARNON!newdentry-dinode The reason is that the cgroup2 filesystem returns from mkdir without instantiating t...