CVE-2022-49071

CVE-2022-49071 affects the Linux kernel where drm/panel: ili9341 handling of an optional regulator could dereference a NULL or error pointer if the regulator lookup fails. The patch ensures that a failed optional regulator lookup resets the pointer to NULL, and notes that related functions like m...

CVE-2022-49070 fbdev: Fix unregistering of framebuffers without device

In the Linux kernel, the following vulnerability has been resolved: fbdev: Fix unregistering of framebuffers without device OF framebuffers do not have an underlying device in the Linux device hierarchy. Do a regular unregister call instead of hot unplugging such a non-existing device. Fixes a NU...

CVE-2022-49066 veth: Ensure eth header is in skb's linear part

In the Linux kernel, the following vulnerability has been resolved: veth: Ensure eth header is in skb's linear part After feeding a decapsulated packet to a veth device with actmirred, skbheadlen may be 0. But vethxmit calls devforwardskb, which expects at least ETHHLEN byte of linear data as...

CVE-2022-49066 veth: Ensure eth header is in skb's linear part

In the Linux kernel, the following vulnerability has been resolved: veth: Ensure eth header is in skb's linear part After feeding a decapsulated packet to a veth device with actmirred, skbheadlen may be 0. But vethxmit calls devforwardskb, which expects at least ETHHLEN byte of linear data as...

CVE-2022-49063 ice: arfs: fix use-after-free when freeing @rx_cpu_rmap

In the Linux kernel, the following vulnerability has been resolved: ice: arfs: fix use-after-free when freeing @rxcpurmap The CI testing bots triggered the following splat: 718.203054 BUG: KASAN: use-after-free in freeirqcpurmap+0x53/0x80 718.206349 Read of size 4 at addr ffff8881bd127e00 by task...

CVE-2022-49063

In the Linux kernel, the following vulnerability has been resolved: ice: arfs: fix use-after-free when freeing @rxcpurmap The CI testing bots triggered the following splat: 718.203054 BUG: KASAN: use-after-free in freeirqcpurmap+0x53/0x80 718.206349 Read of size 4 at addr ffff8881bd127e00 by task...

CVE-2022-49063

The CVE (CVE-2022-49063) affects the Linux kernel in the ice driver’s ARFS feature, where use-after-free can occur when freeing @rx_cpu_rmap. The issue arises because free_irq_cpu_rmap() is invoked after (devm_)free_irq(), causing the code to operate on IRQ descriptors that may already be freed, ...

CVE-2022-49059

The CVE-2022-49059 issue is a Linux kernel vulnerability in NFC/NCI where a race between a delayed mechanism (timer) and a workqueue can lead to a use-after-free when detaching an NCI device. The fix added flush_workqueue to prevent this UAF by ensuring the timer/workqueue lifecycle cannot race w...

CVE-2022-49057 block: null_blk: end timed out poll request

In the Linux kernel, the following vulnerability has been resolved: block: nullblk: end timed out poll request When poll request is timed out, it is removed from the poll list, but not completed, so the request is leaked, and never get chance to complete. Fix the issue by ending it in timeout...

CVE-2022-49055 drm/amdkfd: Check for potential null return of kmalloc_array()

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check for potential null return of kmallocarray As the kmallocarray may return null, the 'eventwaitersi.wait' would lead to null-pointer dereference. Therefore, it is better to check the return value of kmallocarray t...

CVE-2022-49055

CVE-2022-49055 : In the Linux kernel, the drm/amdkfd code fixes a null-pointer dereference risk by validating the return value of kmalloc_array(). The vulnerable path could dereference event_waiters[i].wait if kmalloc_array() returns NULL. The fix adds a NULL check before using the allocated memo...

CVE-2022-49052

In the Linux kernel, the following vulnerability has been resolved: mm: fix unexpected zeroed page mapping with zram swap Two processes under CLONEVM cloning, user process can be corrupted by seeing zeroed page unexpectedly. CPU A CPU B doswappage doswappage SWPSYNCHRONOUSIO path SWPSYNCHRONOUSIO...

CVE-2022-49052

Summary (CVE-2022-49052) : The Linux kernel memory management path mm/page_io.c with zram swap could expose zeroed data to a process during CLONE_VM cloning, leading to potential data corruption. The root cause was the bogus swap_slot_free_notify in the CLONE_VM scenario, which didn’t correctly t...

CVE-2022-49048 ipv6: fix panic when forwarding a pkt with no in6 dev

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix panic when forwarding a pkt with no in6 dev kongweibin reported a kernel panic in ip6forward when input interface has no in6 dev associated. The following tc commands were used to reproduce this panic: tc qdisc del dev...

CVE-2022-49047

CVE-2022-49047 corresponds to a Linux kernel UAF risk in ep93xx clock code (ep93xx_clk_register_gate()) that was addressed by a fix in arch/arm/mach-ep93xx/clock.c. The vulnerability manifested as a use-after-free (memory after it is freed) between IS_ERR(clk) handling and returning &psc->hw, ...

CVE-2021-47656

Summary (CVE-2021-47656): In the Linux kernel’s jffs2 subsystem, a use-after-free occurs in jffs2_clear_xattr_subsystem during mounting a jffs2 image when an abnormal block is encountered. The code path frees an xattr_ref object twice (UAF) due to a call sequence in jffs2_build_filesystem/jffs2_d...

CVE-2021-47657

CVE-2021-47657: In the Linux kernel, the vulnerability affects drm/virtio by risking a NULL pointer use in virtio_gpu_array_put_free() if virtio_gpu_object_shmem_init() fails. The problem arises when objs is NULL and virtio_gpu_array_put_free() is invoked. The fix is to ensure objs is not NULL in...

CVE-2021-47656

In the Linux kernel, the following vulnerability has been resolved: jffs2: fix use-after-free in jffs2clearxattrsubsystem When we mount a jffs2 image, assume that the first few blocks of the image are normal and contain at least one xattr-related inode, but the next block is abnormal. As a result...

CVE-2021-47648 gpu: host1x: Fix a memory leak in 'host1x_remove()'

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix a memory leak in 'host1xremove' Add a missing 'host1xchannellistfree' call in the remove function, as already done in the error handling path of the probe function...

CVE-2021-47633 ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111

In the Linux kernel, the following vulnerability has been resolved: ath5k: fix OOB in ath5keepromreadpcalinfo5111 The bug was found during fuzzing. Stacktrace locates it in ath5keepromconvertpcalinfo5111. When none of the curve is selected in the loop, idx can go up to AR5KEEPROMNPDCURVES. The li...