CVE-2022-48750 hwmon: (nct6775) Fix crash in clear_caseopen

In the Linux kernel, the following vulnerability has been resolved: hwmon: nct6775 Fix crash in clearcaseopen Paweł Marciniak reports the following crash, observed when clearing the chassis intrusion alarm. BUG: kernel NULL pointer dereference, address: 0000000000000028 PGD 0 P4D 0 Oops: 0000 1...

CVE-2022-48750 hwmon: (nct6775) Fix crash in clear_caseopen

In the Linux kernel, the following vulnerability has been resolved: hwmon: nct6775 Fix crash in clearcaseopen Paweł Marciniak reports the following crash, observed when clearing the chassis intrusion alarm. BUG: kernel NULL pointer dereference, address: 0000000000000028 PGD 0 P4D 0 Oops: 0000 1...

CVE-2022-48746 net/mlx5e: Fix handling of wrong devices during bond netevent

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix handling of wrong devices during bond netevent Current implementation of bond netevent handler only check if the handled netdev is VF representor and it missing a check if the VF representor is on the same phys...

CVE-2022-48745

The CVE-2022-48745 entry refers to a Linux kernel vulnerability in the net/mlx5 component where a race condition can occur due to del_timer() usage during the fw reset polling flow. The affected code substitutes del_timer() with del_timer_sync() to avoid deactivation of a timer while its interrup...

CVE-2022-48743 net: amd-xgbe: Fix skb data length underflow

In the Linux kernel, the following vulnerability has been resolved: net: amd-xgbe: Fix skb data length underflow There will be BUGON triggered in include/linux/skbuff.h leading to intermittent kernel panic, when the skb length underflow is detected. Fix this by dropping the packet if such length...

CVE-2022-48732 drm/nouveau: fix off by one in BIOS boundary checking

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix off by one in BIOS boundary checking Bounds checking when parsing init scripts embedded in the BIOS reject access to the last byte. This causes driver initialization to fail on Apple eMac's with GeForce 2 MX GPUs...

CVE-2022-48731 mm/kmemleak: avoid scanning potential huge holes

In the Linux kernel, the following vulnerability has been resolved: mm/kmemleak: avoid scanning potential huge holes When using devmrequestfreememregion and devmmemremappages to add ZONEDEVICE memory, if requested free mem region's end pfn were hugee.g., 0x400000000, the nodeendpfn will be also...

CVE-2022-48731 mm/kmemleak: avoid scanning potential huge holes

In the Linux kernel, the following vulnerability has been resolved: mm/kmemleak: avoid scanning potential huge holes When using devmrequestfreememregion and devmmemremappages to add ZONEDEVICE memory, if requested free mem region's end pfn were hugee.g., 0x400000000, the nodeendpfn will be also...

CVE-2022-48730 dma-buf: heaps: Fix potential spectre v1 gadget

In the Linux kernel, the following vulnerability has been resolved: dma-buf: heaps: Fix potential spectre v1 gadget It appears like nr could be a Spectre v1 gadget as it's supplied by a user and used as an array index. Prevent the contents of kernel memory from being leaked to userspace via...

CVE-2022-48728 IB/hfi1: Fix AIP early init panic

In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fix AIP early init panic An early failure in hfi1ipoibsetuprn can lead to the following panic: BUG: unable to handle kernel NULL pointer dereference at 00000000000001b0 PGD 0 P4D 0 Oops: 0002 1 SMP NOPTI Workqueue: event...

CVE-2022-48727 KVM: arm64: Avoid consuming a stale esr value when SError occur

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Avoid consuming a stale esr value when SError occur When any exception other than an IRQ occurs, the CPU updates the ESREL2 register with the exception syndrome. An SError may also become pending, and will be...

CVE-2022-48713

The CVE-2022-48713 issue concerns the Linux kernel perf/x86/intel/pt path where a PT stop filter in single-range output mode could crash the kernel. The root cause was a missing check for buf->single before calling pt_buffer_region_size, leading to a NULL pointer dereference when ToPA is not c...

CVE-2024-38620

Summary: Linux kernel Bluetooth stack removed HCI_AMP support; with BT_HS removed, AMP controllers are no longer used, leading to removal of AMP capability and hdev->dev_type. What changes: removal of HCI_AMP controllers, elimination of AMP vs Primary differentiation, and associated dev_type f...

CVE-2021-47603

In the Linux kernel, the following vulnerability has been resolved: audit: improve robustness of the audit queue handling If the audit daemon were ever to get stuck in a stopped state the kernel's kauditdthread could get blocked attempting to send audit records to the userspace audit daemon. With...

CVE-2021-47601

In the Linux kernel, the following vulnerability has been resolved: tee: amdtee: fix an ISERR vs NULL bug The getfreepages function does not return error pointers it returns NULL so fix this condition to avoid a NULL dereference...

CVE-2021-47574

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2021-47613 i2c: virtio: fix completion handling

In the Linux kernel, the following vulnerability has been resolved: i2c: virtio: fix completion handling The driver currently assumes that the notify callback is only received when the device is done with all the queued buffers. However, this is not true, since the notify callback could be called...

CVE-2021-47609 firmware: arm_scpi: Fix string overflow in SCPI genpd driver

In the Linux kernel, the following vulnerability has been resolved: firmware: armscpi: Fix string overflow in SCPI genpd driver Without the bound checks for scpipd-name, it could result in the buffer overflow when copying the SCPI device name from the corresponding device tree node as the name...

CVE-2021-47605 vduse: fix memory corruption in vduse_dev_ioctl()

In the Linux kernel, the following vulnerability has been resolved: vduse: fix memory corruption in vdusedevioctl The "config.offset" comes from the user. There needs to a check to prevent it being out of bounds. The "config.offset" and "dev-configsize" variables are both type u32. So if the offs...

CVE-2021-47603

In the Linux kernel, the following vulnerability has been resolved: audit: improve robustness of the audit queue handling If the audit daemon were ever to get stuck in a stopped state the kernel's kauditdthread could get blocked attempting to send audit records to the userspace audit daemon. With...