13859 matches found
CVE-2022-49989 xen/privcmd: fix error exit of privcmd_ioctl_dm_op()
In the Linux kernel, the following vulnerability has been resolved: xen/privcmd: fix error exit of privcmdioctldmop The error exit of privcmdioctldmop is calling unlockpages potentially with pages being NULL, leading to a NULL dereference. Additionally lockpages doesn't check for pinuserpagesfast...
CVE-2022-49980
In the Linux kernel, the following vulnerability has been resolved: USB: gadget: Fix use-after-free Read in usbudcuevent The syzbot fuzzer found a race between uevent callbacks and gadget driver unregistration that can cause a use-after-free bug:...
CVE-2022-49974
The CVE-2022-49974 vulnerability affects the Linux kernel HID Nintendo driver (drivers/hid/hid-nintendo.c) and stems from dereferencing a NULL pointer when queuing rumble work to a destroyed workqueue after disconnection, leading to a potential crash. The issue is mitigated by avoiding usage of t...
CVE-2022-49973
The CVE-2022-49973 entry concerns a Linux kernel vulnerability in sk_msg_recvmsg triggered by an incorrect last scatter-gather (sg) check. The root cause is a change to the last sg validation (to sg_is_last()) in sk_msg_recvmsg(), but the end of the scatterlist was not marked in sockmap redirecti...
CVE-2022-49973 skmsg: Fix wrong last sg check in sk_msg_recvmsg()
In the Linux kernel, the following vulnerability has been resolved: skmsg: Fix wrong last sg check in skmsgrecvmsg Fix one kernel NULL pointer dereference as below: 224.462334 Call Trace: 224.462394 tcpbpfrecvmsg+0xd3/0x380 224.462441 ? sockhasperm+0x78/0xa0 224.462463 tcpbpfrecvmsg+0x12e/0x220...
CVE-2022-49968 ieee802154/adf7242: defer destroy_workqueue call
In the Linux kernel, the following vulnerability has been resolved: ieee802154/adf7242: defer destroyworkqueue call There is a possible race condition use-after-free like below FREE | USE adf7242remove | adf7242channel canceldelayedworksync | destroyworkqueue 1 | adf7242cmdrx | moddelayedwork 2 |...
CVE-2022-49966 drm/amd/pm: add missing ->fini_microcode interface for Sienna Cichlid
In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: add missing -finimicrocode interface for Sienna Cichlid To avoid any potential memory leak...
CVE-2022-49965
Summary: CVE-2022-49965 pertains to the Linux kernel component drm/amd/pm, where missing fini interfaces for some SMU13 ASICs could allow a memory leak. The issue is described as resolved in the Linux kernel, with references to upstream code changes and multiple advisories. What’s affected: Linux...
CVE-2022-49963
In CVE-2022-49963, the Linux kernel vulnerability centers on the drm/i915/ttm CCS handling fix. The issue arises in migrate_copy(), where object copying and address translation fail for large objects: using plain integers can overflow, and emitting PTEs with the entire object size when src is lme...
CVE-2022-49963 drm/i915/ttm: fix CCS handling
In the Linux kernel, the following vulnerability has been resolved: drm/i915/ttm: fix CCS handling Crucible + recent Mesa seems to sometimes hit: GEMBUGONnumccsblks NUMCCSBLKSPERXFER And it looks like we can also trigger this with gemlmemswapping, if we modify the test to use slightly larger obje...
CVE-2022-49962 xhci: Fix null pointer dereference in remove if xHC has only one roothub
In the Linux kernel, the following vulnerability has been resolved: xhci: Fix null pointer dereference in remove if xHC has only one roothub The remove path in xhci platform driver tries to remove and put both main and shared hcds even if only a main hcd exists one roothub This causes a null...
CVE-2022-49961 bpf: Do mark_chain_precision for ARG_CONST_ALLOC_SIZE_OR_ZERO
In the Linux kernel, the following vulnerability has been resolved: bpf: Do markchainprecision for ARGCONSTALLOCSIZEORZERO Precision markers need to be propagated whenever we have an ARGCONST style argument, as the verifier cannot consider imprecise scalars to be equivalent for the purposes of...
CVE-2022-49954 Input: iforce - wake up after clearing IFORCE_XMIT_RUNNING flag
In the Linux kernel, the following vulnerability has been resolved: Input: iforce - wake up after clearing IFORCEXMITRUNNING flag syzbot is reporting hung task at inputunregisterdevice 1, for iforceclose waiting at waiteventinterruptible with dev-mutex held is blocking inputdisconnectdevice from...
CVE-2022-49947
CVE-2022-49947: Linux kernel binder null-ptr dereference in alloc->vma_vm_mm. Connected reports confirm a fix: initialize alloc->vma_vm_mm during open() and cache from current->mm to guarantee safe mmap_lock usage when a binder_proc has not mmap’d to set up alloc space. Descriptions deta...
CVE-2022-49943 USB: gadget: Fix obscure lockdep violation for udc_mutex
In the Linux kernel, the following vulnerability has been resolved: USB: gadget: Fix obscure lockdep violation for udcmutex A recent commit expanding the scope of the udclock mutex in the gadget core managed to cause an obscure and slightly bizarre lockdep violation. In abbreviated form:...
CVE-2022-49941
CVE-2022-49941 is rejected/not used; this entry does not represent an active vulnerability.
CVE-2022-49936
Summary (CVE-2022-49936) In the Linux kernel, the USB core vulnerable path is “Prevent nested device-reset calls.” The accompanying analysis shows a recursive locking violation in usb-storage when a nested reset occurs during device removal, caused by a reset being invoked while another is in pro...
CVE-2022-49934 wifi: mac80211: Fix UAF in ieee80211_scan_rx()
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Fix UAF in ieee80211scanrx ieee80211scanrx tries to access scanreq-flags after a null check, but a UAF is observed when the scan is completed and ieee80211scancompleted executes, which then calls cfg80211scandone...
AZL-63998 CVE-2025-38077 affecting package kernel for versions less than 6.6.96.1-1
In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-sysman: Avoid buffer overflow in currentpasswordstore If the 'buf' array received from the user contains an empty string, the 'length' variable will be zero. Accessing the 'buf' array element with index...