CVE-2022-49863

CVE-2022-49863 affects the Linux kernel CAN stack (af_can) where can_rx_register() dereferences ml_priv when dev_rcv_lists is NULL, leading to a NULL pointer dereference during CAN socket binding. The issue occurs during a sequence that binds a vxcan/bond setup to a CAN socket via netlink/socket ...

CVE-2022-49863 can: af_can: fix NULL pointer dereference in can_rx_register()

In the Linux kernel, the following vulnerability has been resolved: can: afcan: fix NULL pointer dereference in canrxregister It causes NULL pointer dereference when testing as following: a use syscallNRsocket, 0x10ul, 3ul, 0 to create netlink socket. b use syscallNRsendmsg, ... to create bond li...

CVE-2022-49862

CVE-2022-49862 concerns the Linux kernel TIPC subsystem. The issue arises in tipc_nl_compat_name_table_dump_header where the msg->req TLV length is not properly validated, following a prior change intended to fix uninit-value behavior when TLV_GET_DATA_LEN() can be negative. This can lead to i...

CVE-2022-49860

CVE-2022-49860 : The provided connected documents describe a Linux kernel vulnerability in the dmaengine: ti: k3-udma-glue subsystem, where a memory leak could occur if device_register() fails. The root cause is that, on failure, the code should call put_device() to release a reference, and the n...

CVE-2022-49859

CVE-2022-49859 concerns the Linux kernel net: lapbether vulnerability where if lapb_register() fails during the first up event, NAPI is not disabled and an invalid opcode can occur when the device goes up the second time. Public sources (Red Hat, Debian OSV, UBUNTU/Ubuntu OSV, Nessus/NASL, NVD/NV...

CVE-2022-49858 octeontx2-pf: Fix SQE threshold checking

In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: Fix SQE threshold checking Current way of checking available SQE count which is based on HW updated SQB count could result in driver submitting an SQE even before CQE for the previously transmitted SQE at the same...

CVE-2022-49857

CVE-2022-49857 – Linux kernel (Marvell Prestera) : A memory leak in prestera_rxtx_switch_init() was fixed. When prestera_sdma_switch_init() failed, the memory pointed to sw->rxtx wasn’t released. The connected documents confirm a fix was implemented to properly release resources; no exploitati...

CVE-2022-49851

In the Linux kernel, the following vulnerability has been resolved: riscv: fix reserved memory setup Currently, RISC-V sets up reserved memory using the "early" copy of the device tree. As a result, when trying to get a reserved memory region using ofreservedmemlookup, the pointer to reserved...

CVE-2022-49848 phy: qcom-qmp-combo: fix NULL-deref on runtime resume

In the Linux kernel, the following vulnerability has been resolved: phy: qcom-qmp-combo: fix NULL-deref on runtime resume Commit fc64623637da "phy: qcom-qmp-combo,usb: add support for separate PCSUSB region" started treating the PCSUSB registers as potentially separate from the PCS registers but...

CVE-2022-49846 udf: Fix a slab-out-of-bounds write bug in udf_find_entry()

In the Linux kernel, the following vulnerability has been resolved: udf: Fix a slab-out-of-bounds write bug in udffindentry Syzbot reported a slab-out-of-bounds Write bug: loop0: detected capacity change from 0 to 2048 ================================================================== BUG: KASAN:...

CVE-2022-49846

CVE-2022-49846 : In the Linux kernel, a slab-out-of-bounds write bug was reported in udf_find_entry() (fs/udf/namei.c). The issue is demonstrated via a KASAN report during an open path through udf_lookup and namei, with a 256-byte kmalloc object involved. The advisory notes that this has been fix...

CVE-2022-49846 udf: Fix a slab-out-of-bounds write bug in udf_find_entry()

In the Linux kernel, the following vulnerability has been resolved: udf: Fix a slab-out-of-bounds write bug in udffindentry Syzbot reported a slab-out-of-bounds Write bug: loop0: detected capacity change from 0 to 2048 ================================================================== BUG: KASAN:...

CVE-2022-49843

...

CVE-2022-49842 ASoC: core: Fix use-after-free in snd_soc_exit()

In the Linux kernel, the following vulnerability has been resolved: ASoC: core: Fix use-after-free in sndsocexit KASAN reports a use-after-free: BUG: KASAN: use-after-free in devicedel+0xb5b/0xc60 Read of size 8 at addr ffff888008655050 by task rmmod/387 CPU: 2 PID: 387 Comm: rmmod Hardware name:...

CVE-2022-49827 drm: Fix potential null-ptr-deref in drm_vblank_destroy_worker()

In the Linux kernel, the following vulnerability has been resolved: drm: Fix potential null-ptr-deref in drmvblankdestroyworker drmvblankinit call drmmaddactionorreset with drmvblankinitrelease as action. If drmmaddaction failed, will directly call drmvblankinitrelease with the vblank whose worke...

CVE-2022-49826

CVE-2022-49826 — Linux kernel (ata: libata-transport) The vulnerability arises in the error path of ata_tport_add() where put_device() followed by ata_tport_release() can cause an extra decrement of the refcount on ap->host, leading to a NULL pointer dereference during unbind/stop (as ports ar...

CVE-2022-49826 ata: libata-transport: fix double ata_host_put() in ata_tport_add()

In the Linux kernel, the following vulnerability has been resolved: ata: libata-transport: fix double atahostput in atatportadd In the error path in atatportadd, when calling putdevice, atatportrelease is called, it will put the refcount of 'ap-host'. And then atahostput is called again, the...

CVE-2022-49825 ata: libata-transport: fix error handling in ata_tport_add()

In the Linux kernel, the following vulnerability has been resolved: ata: libata-transport: fix error handling in atatportadd In atatportadd, the return value of transportadddevice is not checked. As a result, it causes null-ptr-deref while removing the module, because transportremovedevice is...

CVE-2022-49815 erofs: fix missing xas_retry() in fscache mode

In the Linux kernel, the following vulnerability has been resolved: erofs: fix missing xasretry in fscache mode The xarray iteration only holds the RCU read lock and thus may encounter XARETRYENTRY if there's process modifying the xarray concurrently. This will cause oops when referring to the...

CVE-2022-49809 net/x25: Fix skb leak in x25_lapb_receive_frame()

In the Linux kernel, the following vulnerability has been resolved: net/x25: Fix skb leak in x25lapbreceiveframe x25lapbreceiveframe using skbcopy to get a private copy of skb, the new skb should be freed in the undersized/fragmented skb error handling path. Otherwise there is a memory leak...