CVE-2022-49151

In the Linux kernel, the following vulnerability has been resolved: can: mcbausb: properly check endpoint type Syzbot reported warning in usbsubmiturb which is caused by wrong endpoint type. We should check that in endpoint is actually present to prevent this warning. Found pipes are now saved to...

CVE-2022-49145

CVE-2022-49145 affects the Linux kernel's ACPI CPPC parsing of _CPC data. The root cause is an out-of-bounds access when the NumEntries field is less than 2, which could lead to improper access of the Revision element. A fix has been implemented in the kernel to avoid this access. The vulnerabili...

CVE-2022-49143

...

CVE-2022-49141

In the Linux kernel, the following vulnerability has been resolved: net: dsa: felix: fix possible NULL pointer dereference As the possible failure of the allocation, kzalloc may return NULL pointer. Therefore, it should be better to check the 'sgi' in order to prevent the dereference of NULL...

CVE-2022-49136 Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Fix queuing commands when HCIUNREGISTER is set hcicmdsyncqueue shall return an error if HCIUNREGISTER flag has been set as that means hciunregisterdev has been called so it will likely cause a uaf after the...

CVE-2022-49114

In the Linux kernel, the following vulnerability has been resolved: scsi: libfc: Fix use after free in fcexchabtsresp fcexchreleaseep will decrease the ep's reference count. When the reference count reaches zero, it is freed. But ep is still used in the following code, which will lead to a use...

CVE-2022-49113

In the Linux kernel, the following vulnerability has been resolved: powerpc/secvar: fix refcount leak in formatshow Refcount leak will happen when formatshow returns failure in multiple cases. Unified management of ofnodeput can fix this problem...

CVE-2022-49105 staging: wfx: fix an error handling in wfx_init_common()

In the Linux kernel, the following vulnerability has been resolved: staging: wfx: fix an error handling in wfxinitcommon One error handler of wfxinitcommon return without calling ieee80211freehwhw, which may result in memory leak. And I add one err label to unify the error handler, which is usefu...

CVE-2022-49096

In the Linux kernel, the following vulnerability has been resolved: net: sfc: add missing xdp queue reinitialization After rx/tx ring buffer size is changed, kernel panic occurs when it acts XDPTX or XDPREDIRECT. When tx/rx ring buffer size is changedethtool -G, sfc driver reallocates and...

CVE-2022-49093 skbuff: fix coalescing for page_pool fragment recycling

In the Linux kernel, the following vulnerability has been resolved: skbuff: fix coalescing for pagepool fragment recycling Fix a use-after-free when using pagepool with page fragments. We encountered this problem during normal RX in the hns3 driver: 1 Initially we have three descriptors in the RX...

CVE-2022-49089

In the Linux kernel, the following vulnerability has been resolved: IB/rdmavt: add lock to call to rvterrorqp to prevent a race condition The documentation of the function rvterrorqp says both rlock and slock need to be held when calling that function. It also asserts using lockdep that both of...

CVE-2022-49089 IB/rdmavt: add lock to call to rvt_error_qp to prevent a race condition

In the Linux kernel, the following vulnerability has been resolved: IB/rdmavt: add lock to call to rvterrorqp to prevent a race condition The documentation of the function rvterrorqp says both rlock and slock need to be held when calling that function. It also asserts using lockdep that both of...

CVE-2022-49082

CVE-2022-49082 in the Linux kernel: a use-after-free in mpt3sas during _scsih_expander_node_remove() was caused by freeing the port field via mpt3sas_transport_port_remove(), leading to a use-after-free when ioc_info() runs (e.g., during rmmod). The fix adds a local variable port_id to capture th...

CVE-2022-49079

In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: traverse devices under chunkmutex in btrfscanactivatezone btrfscanactivatezone can be called with the devicelistmutex already held, which will lead to a deadlock: insertdevextents // Takes devicelistmutex -...

CVE-2022-49076

In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Fix use-after-free bug for mm struct Under certain conditions, such as MPIAbort, the hfi1 cleanup code may represent the last reference held on the task mm. hfi1mmurbunregister then drops the last reference and the mm ...

CVE-2022-49067 powerpc: Fix virt_addr_valid() for 64-bit Book3E & 32-bit

In the Linux kernel, the following vulnerability has been resolved: powerpc: Fix virtaddrvalid for 64-bit Book3E & 32-bit mpe: On 64-bit Book3E vmalloc space starts at 0x8000000000000000. Because of the way pa works we have: pa0x8000000000000000 == 0, and therefore virttopfn0x8000000000000000 == ...

CVE-2022-49053

In the Linux kernel, the following vulnerability has been resolved: scsi: target: tcmu: Fix possible page UAF tcmutrygetdatapage looks up pages under cmdrlock, but it does not take refcount properly and just returns page pointer. When tcmutrygetdatapage returns, the returned page may have been...

CVE-2021-47657 drm/virtio: Ensure that objs is not NULL in virtio_gpu_array_put_free()

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: Ensure that objs is not NULL in virtiogpuarrayputfree If virtiogpuobjectshmeminit fails e.g. due to fault injection, as it happened in the bug report by syzbot, virtiogpuarrayputfree could be called with objs equal to...

CVE-2021-47650

CVE-2021-47650: In the Linux kernel, ASoC: soc-compress had a potential null pointer when codec_dai could be NULL if card->dai_link->num_codecs was 0, traced through snd_soc_register_card() -> snd_soc_bind_card() -> soc_init_pcm_runtime() -> snd_soc_dai_compress_new() -> snd_soc...

CVE-2021-47640

CVE-2021-47640 describes a Linux kernel vulnerability in the powerpc/KASAN pathway where the shadow page table was not updated correctly when PTE_RPN_SHIFT = 24 and PAGE_SHIFT = 12. The issue caused false positives and false negatives in KASAN reports (vmalloc-out-of-bounds in pcpu_alloc) and was...