CVE-2022-49470 Bluetooth: btmtksdio: fix use-after-free at btmtksdio_recv_event

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtksdio: fix use-after-free at btmtksdiorecvevent We should not access skb buffer data anymore after hcirecvframe was called. 39.634809 BUG: KASAN: use-after-free in btmtksdiorecvevent+0x1b0 39.634855 Read of size 1 ...

CVE-2022-49454 PCI: mediatek: Fix refcount leak in mtk_pcie_subsys_powerup()

In the Linux kernel, the following vulnerability has been resolved: PCI: mediatek: Fix refcount leak in mtkpciesubsyspowerup The offindcompatiblenode function returns a node pointer with refcount incremented, We should use ofnodeput on it when done Add the missing ofnodeput to release the refcoun...

CVE-2022-49447 ARM: hisi: Add missing of_node_put after of_find_compatible_node

In the Linux kernel, the following vulnerability has been resolved: ARM: hisi: Add missing ofnodeput after offindcompatiblenode offindcompatiblenode will increment the refcount of the returned devicenode. Calling ofnodeput to avoid the refcount leak...

CVE-2022-49444

In the Linux kernel, the following vulnerability has been resolved: module: fix eshstrndx.shsize=0 OOB access It is trivial to craft a module to trigger OOB access in this line: if info-secstringsstrhdr-shsize - 1 != '\0' BUG: unable to handle page fault for address: ffffc90000aa0fff PGD 10000006...

CVE-2022-49434

The CVE-2022-49434 issue is in the Linux kernel where pci_dev_lock() historically acquired the config space access lock before the device lock, risking AB/BA deadlocks with sriov_numvfs_store() that already takes the device lock first. The fix is to reverse the order in pci_dev_lock() so it acqui...

CVE-2022-49429

CVE-2022-49429 affects the Linux kernel’s RDMA/hfi1 subsystem. When the hfi1 module is loaded with SDMA disabled (HFI1_CAP_SDMA off), a call to hfi1_write_iter() can dereference a NULL pointer, causing a kernel panic through the I/O path (sdma_select_user_engine → hfi1_user_sdma_process_request →...

CVE-2022-49421 video: fbdev: clcdfb: Fix refcount leak in clcdfb_of_vram_setup

In the Linux kernel, the following vulnerability has been resolved: video: fbdev: clcdfb: Fix refcount leak in clcdfbofvramsetup ofparsephandle returns a node pointer with refcount incremented, we should use ofnodeput on it when not need anymore. Add missing ofnodeput to avoid refcount leak...

CVE-2022-49419

In the Linux kernel, the following vulnerability has been resolved: video: fbdev: vesafb: Fix a use-after-free due early fbinfo cleanup Commit b3c9a924aab6 "fbdev: vesafb: Cleanup fbinfo in .fbdestroy rather than .remove" fixed a use-after-free error due the vesafb driver freeing the fbinfo in th...

CVE-2022-49418 NFSv4: Fix free of uninitialized nfs4_label on referral lookup.

In the Linux kernel, the following vulnerability has been resolved: NFSv4: Fix free of uninitialized nfs4label on referral lookup. Send along the already-allocated fattr along with nfs4fslocations, and drop the memcpy of fattr. We end up growing two more allocations, but this fixes up a crash as:...

CVE-2022-49413 bfq: Update cgroup information before merging bio

In the Linux kernel, the following vulnerability has been resolved: bfq: Update cgroup information before merging bio When the process is migrated to a different cgroup or in case of writeback just starts submitting bios associated with a different cgroup bfqmergebio can operate with stale cgroup...

CVE-2022-49406 block: Fix potential deadlock in blk_ia_range_sysfs_show()

In the Linux kernel, the following vulnerability has been resolved: block: Fix potential deadlock in blkiarangesysfsshow When being read, a sysfs attribute is already protected against removal with the kobject node active reference counter. As a result, in blkiarangesysfsshow, there is no need to...

CVE-2022-49403

The CVE-2022-49403 entry concerns the Linux kernel component lib/string_helpers. The vulnerability was resolved by adding an allocated strarray to a device’s resource list, ensuring automatic release when the device disappears. Root cause: strarray not being added to the device’s resource list, w...

CVE-2022-49394 blk-iolatency: Fix inflight count imbalances and IO hangs on offline

In the Linux kernel, the following vulnerability has been resolved: blk-iolatency: Fix inflight count imbalances and IO hangs on offline iolatency needs to track the number of inflight IOs per cgroup. As this tracking can be expensive, it is disabled when no cgroup has iolatency configured for th...

CVE-2022-49377 blk-mq: don't touch ->tagset in blk_mq_get_sq_hctx

In the Linux kernel, the following vulnerability has been resolved: blk-mq: don't touch -tagset in blkmqgetsqhctx blkmqrunhwqueues could be run when there isn't queued request and after queue is cleaned up, at that time tagset is freed, because tagset lifetime is covered by driver, and often free...

CVE-2022-49360

CVE-2022-49360 (Linux kernel, f2fs): The issue arises from a root-cause mismatch where ckpt.valid_block_count is inconsistent with the SIT table, causing a panic during garbage collection when the LFS allocator cannot find a free segment despite the filesystem reporting free blocks. The reference...

CVE-2022-49350

CVE-2022-49350 affects the Linux kernel in the net/mdio area, where the symbol mdio_bus_init is annotated with init and exported. The combination of EXPORT_SYMBOL with init places code in .init.text, which may be freed after init and lead to a kernel panic if accessed by modules. The public advis...

CVE-2022-49317 f2fs: avoid infinite loop to flush node pages

In the Linux kernel, the following vulnerability has been resolved: f2fs: avoid infinite loop to flush node pages xfstests/generic/475 can give EIO all the time which give an infinite loop to flush node page like below. Let's avoid it. 16418.518551 Call Trace: 16418.518553 ? dmsubmitbio+0x48/0x40...

CVE-2022-49312 staging: rtl8712: fix a potential memory leak in r871xu_drv_init()

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8712: fix a potential memory leak in r871xudrvinit In r871xudrvinit, if r8712initdrvsw fails, then the memory allocated by r8712allocioqueue in r8712usbdvobjinit is not properly released as there is no action will be...

CVE-2022-49273 rtc: pl031: fix rtc features null pointer dereference

In the Linux kernel, the following vulnerability has been resolved: rtc: pl031: fix rtc features null pointer dereference When there is no interrupt line, rtc alarm feature is disabled. The clearing of the alarm feature bit was being done prior to allocations of ldata-rtc device, resulting in a...

CVE-2022-49271 cifs: prevent bad output lengths in smb2_ioctl_query_info()

In the Linux kernel, the following vulnerability has been resolved: cifs: prevent bad output lengths in smb2ioctlqueryinfo When calling smb2ioctlqueryinfo with smbqueryinfo::flags=PASSTHRUFSCTL and smbqueryinfo::outputbufferlength=0, the following would return 0x10 buffer = memdupuserarg +...