CVE-2022-49423 rtla: Avoid record NULL pointer dereference

In the Linux kernel, the following vulnerability has been resolved: rtla: Avoid record NULL pointer dereference Fix the following null/derefnull.cocci errors: ./tools/tracing/rtla/src/osnoisehist.c:870:31-36: ERROR: record is NULL but dereferenced. ./tools/tracing/rtla/src/osnoisetop.c:650:31-36:...

CVE-2022-49420 net: annotate races around sk->sk_bound_dev_if

In the Linux kernel, the following vulnerability has been resolved: net: annotate races around sk-skbounddevif UDP sendmsg is lockless, and reads sk-skbounddevif while this field can be changed by another thread. Adds minimal annotations to avoid KCSAN splats for UDP. Following patches will add...

CVE-2022-49415

In the Linux kernel, the following vulnerability has been resolved: ipmi:ipmb: Fix refcount leak in ipmiipmbprobe ofparsephandle returns a node pointer with refcount incremented, we should use ofnodeput on it when done. Add missing ofnodeput to avoid refcount leak...

CVE-2022-49411 bfq: Make sure bfqg for which we are queueing requests is online

In the Linux kernel, the following vulnerability has been resolved: bfq: Make sure bfqg for which we are queueing requests is online Bios queued into BFQ IO scheduler can be associated with a cgroup that was already offlined. This may then cause insertion of this bfqgroup into a service tree. But...

CVE-2022-49409 ext4: fix bug_on in __es_tree_search

In the Linux kernel, the following vulnerability has been resolved: ext4: fix bugon in estreesearch Hulk Robot reported a BUGON: ================================================================== kernel BUG at fs/ext4/extentsstatus.c:199! ... RIP: 0010:ext4esend fs/ext4/extentsstatus.c:199 inline...

CVE-2022-49404 RDMA/hfi1: Fix potential integer multiplication overflow errors

In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Fix potential integer multiplication overflow errors When multiplying of different types, an overflow is possible even when storing the result in a larger type. This is because the conversion is done after the...

CVE-2022-49398 usb: dwc3: gadget: Replace list_for_each_entry_safe() if using giveback

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: Replace listforeachentrysafe if using giveback The listforeachentrysafe macro saves the current item n and the item after n+1, so that n can be safely removed without corrupting the list. However, when traversi...

CVE-2022-49395 um: Fix out-of-bounds read in LDT setup

In the Linux kernel, the following vulnerability has been resolved: um: Fix out-of-bounds read in LDT setup syscallstubdata expects the datacount parameter to be the number of longs, not bytes. ================================================================== BUG: KASAN: stack-out-of-bounds in...

CVE-2022-49390

The CVE-2022-49390 entry concerns a Linux kernel macsec vulnerability in which a new macsec device could be created without holding a reference to the underlying real_dev, enabling a use-after-free in macsec_get_iflink and related paths. Root cause: lack of proper reference handling for real_dev ...

CVE-2022-49374 tipc: check attribute length for bearer name

In the Linux kernel, the following vulnerability has been resolved: tipc: check attribute length for bearer name syzbot reported uninit-value: ===================================================== BUG: KMSAN: uninit-value in stringnocheck lib/vsprintf.c:644 inline BUG: KMSAN: uninit-value in...

CVE-2022-49374

In the Linux kernel, the following vulnerability has been resolved: tipc: check attribute length for bearer name syzbot reported uninit-value: ===================================================== BUG: KMSAN: uninit-value in stringnocheck lib/vsprintf.c:644 inline BUG: KMSAN: uninit-value in...

CVE-2022-49375

The CVE-2022-49375 entry concerns the Linux kernel rtc: mt6397 driver. The described vulnerability is a potential null-pointer dereference when platform_get_resource() returns NULL, caused by not checking the return value. The connected documentation states the fix is to check the return value of...

CVE-2022-49359 drm/panfrost: Job should reference MMU not file_priv

In the Linux kernel, the following vulnerability has been resolved: drm/panfrost: Job should reference MMU not filepriv For a while now it's been allowed for a MMU context to outlive it's corresponding panfrostpriv, however the job structure still references panfrostpriv to get hold of the MMU...

CVE-2022-49349 ext4: fix use-after-free in ext4_rename_dir_prepare

In the Linux kernel, the following vulnerability has been resolved: ext4: fix use-after-free in ext4renamedirprepare We got issue as follows: EXT4-fs loop0: mounted filesystem without journal. Opts: ,errors=continue ext4getfirstdirblock: bh-bdata=0xffff88810bee6000 len=34478 ext4getfirstdirblock:...

CVE-2022-49340 ip_gre: test csum_start instead of transport header

In the Linux kernel, the following vulnerability has been resolved: ipgre: test csumstart instead of transport header GRE with TUNNELCSUM will apply local checksum offload on CHECKSUMPARTIAL packets. ipgrexmit must validate csumstart after an optional skbpull, else lcocsum may trigger an overflow...

CVE-2022-49339 net: ipv6: unexport __init-annotated seg6_hmac_init()

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: unexport init-annotated seg6hmacinit EXPORTSYMBOL and init is a bad combination because the .init.text section is freed up after the initialization. Hence, modules cannot use symbols annotated init. The access to a fre...

CVE-2022-49335 drm/amdgpu/cs: make commands with 0 chunks illegal behaviour.

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/cs: make commands with 0 chunks illegal behaviour. Submitting a cs with 0 chunks, causes an oops later, found trying to execute the wrong userspace driver. MESALOADERDRIVEROVERRIDE=v3d glxinfo 172536.665184 BUG: kernel...

CVE-2022-49325

CVE-2022-49325 affects the Linux kernel’s TCP path, specifically the snd_cwnd field. The advisory notes historical bugs where tp->snd_cwnd could be zero or otherwise illegal, and that syzbot WARN_ON_ONCE(!tp->prior_cwnd) could trigger. The fix introduces accessors to read/set tp->snd_cwn...

CVE-2022-49306 usb: dwc3: host: Stop setting the ACPI companion

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: host: Stop setting the ACPI companion It is no longer needed. The sysdev pointer is now used when assigning the ACPI companions to the xHCI ports and USB devices. Assigning the ACPI companion here resulted in the...

CVE-2022-49305 drivers: staging: rtl8192u: Fix deadlock in ieee80211_beacons_stop()

In the Linux kernel, the following vulnerability has been resolved: drivers: staging: rtl8192u: Fix deadlock in ieee80211beaconsstop There is a deadlock in ieee80211beaconsstop, which is shown below: Thread 1 | Thread 2 | ieee80211sendbeacon ieee80211beaconsstop | modtimer spinlockirqsave //1 |...