CVE-2022-3595

CVE-2022-3595 affects the Linux kernel CIFS component, specifically the function sess_free_buffer in fs/cifs/sess.c , where the issue causes a double free . The root cause is improper buffer management leading to memory corruption with a direct impact on availability (as per CVSS metrics: Availab...

CVE-2022-48635

CVE-2022-48635 : In the Linux kernel, the dax_iomap_rw() path can enter an infinite loop when a tail read is issued with count=0 (as with tail reading via read()), causing a persistent WARNING from iomap_iter. The vulnerability is fixed by adding an explicit check for a 0 count in dax_iomap_rw(),...

CVE-2022-48690

Insight : CVE-2022-48690 refers to a Linux kernel fix in the ice driver for a DMA mappings leak when reallocating RX buffers while changing ring parameters. The leak occurred because kfree on rx_buf freed DMA mappings that were still active, leading to leaked DMA mappings during buffer substituti...

CVE-2022-48732

The CVE-2022-48732 issue affects the Linux kernel’s DRM Nouveau component, caused by an off-by-one error in BIOS boundary parsing of embedded init scripts. This bounds-checking flaw can reject access to the last byte, causing driver initialization to fail on Apple eMac systems with GeForce 2 MX G...

CVE-2022-48808

CVE-2022-48808 concerns a Linux kernel issue in DSA (dpaa2-eth) handling. On systems with LX2160A and Marvell DSA switches, rebooting while the DSA master is up could panic due to the master’s deregistration triggering NETDEV_GOING_DOWN and attempting to close slave interfaces after they were alr...

CVE-2022-48809

In CVE-2022-48809, the Linux kernel fixes a memory leak in net handling when uncloning an skb destination and its metadata. The root cause is that the uncloned dst+metadata is initialized with refcount 1 and briefly increased to 2 before attachment, leaving a path where the refcount cannot drop t...

CVE-2022-48810

In CVE-2022-48810, the Linux kernel fixes a RTNL lock handling issue in IPv4/IPv6 multicast code: ipmr and ip6mr_free_table() could be called on the failure path without proper RTNL protection. The patch ensures RTNL is held before freeing mroute tables, preventing an assertion failure observed i...

CVE-2022-48814

CVE-2022-48814 affects the Linux kernel DSA seville driver (VSC9959) where mdiobus was allocated/registered with devres. The root cause is a devres interaction causing mdiobus to be freed without prior unregistration, leading to mdiobus_free() panics when invoked from devm_mdiobus_free(). The pro...

CVE-2022-48823

CVE-2022-48823 affects the Linux kernel SCSI qedf driver. The issue is a refcount bug triggered when a LOGO is received during a TMF, which can cause an I/O to hang in the qedf driver. The provided connected advisories confirm the root cause (refcount during TMF/LOGO) and note that a fix was impl...

CVE-2022-48834

CVE-2022-48834 refers to a Linux kernel issue in the usb: usbtmc driver where usbtmc_ioctl_request incorrectly used usb_rcvctrlpipe() for all transfers (in or out). The fix separates control transfers by direction. The vulnerability impact described is a local issue tied to incorrect control pipe...

CVE-2022-48851

CVE-2022-48851 is a Linux kernel issue in the staging: gdm724x driver. The root cause is a use-after-free in gdm_lte_rx(), where netif_rx_ni() frees the skb, making it unsafe to dereference to read skb->len. The connected sources confirm the vulnerability and its resolution in the kernel, with...

CVE-2022-48860

CVE-2022-48860 affects the Linux kernel ethernet xemaclite_of_probe. The issue is a refcount leak from of_parse_phandle() that is addressed by calling of_node_put() in the probe/remove path. Impact is locally accessible with high availability risk stated; no exploitation details provided in the c...

CVE-2022-48902

CVE-2022-48902 is a Linux kernel issue in the btrfs extent_io path where a warned-on condition could occur when a page with PageError is encountered during extent buffer ops. The vulnerability arises from using assert_eb_page_uptodate() on non-uptodate pages, potentially exposing instability warn...

CVE-2022-48941

CVE-2022-48941 affects the Linux kernel ice driver handling of Virtual Functions (VFs). The issue arises from a concurrency gap between VF reset and VF removal. The patch that introduced ICE_VF_DEINIT_IN_PROGRESS aimed to prevent issues during teardown but inadvertently caused the PF to stop resp...

CVE-2022-49001

CVE-2022-49001 describes a race condition in the Linux kernel riscv path where, during vmap stack overflow handling, multiple harts can contend on the same shadow stack. The root cause is a race between switching to the shadow stack and calling get_overflow_stack() when more than one hart uses th...

CVE-2022-49091

In CVE-2022-49091, the Linux kernel DRM IMX code fixes a memory leak in imx_pd_connector_get_modes by avoiding leaking the display mode variable if of_get_drm_display_mode fails. This resolves a resource leak (Coverity ID 1443943) and was implemented in kernel updates referenced by the linked com...

CVE-2022-49144

CVE-2022-49144 pertains to the Linux kernel io_uring subsystem. The issue stems from a memory-leak when registering files: if there are no files to process in __io_sqe_files_scm(), the code frees resources but forgets to restore the uid, leading to a leak. The connected documents confirm this exa...

CVE-2022-49194

The CVE-2022-49194 issue affects the Linux kernel BCMGENET ethernet driver (net/bcmgenet) where GCC12’s relaxed memory access optimization can reorder register reads/writes. This undermines the assumed non-reordering of device memory and the barriers provided by other constructs (e.g., spinlocks)...

CVE-2022-49200

CVE-2022-49200 (Linux kernel): A bug in Bluetooth btmtksdio handling caused a kernel oops when btmtksdio_interrupt ran before sdio_set_drvdata was initialized. The issue happened because hdev->power_on could be queued and execute prior to sdio_set_drvdata being filled during btmtksdio_probe, a...

CVE-2022-49213

CVE-2022-49213 affects the Linux kernel, specifically the ath10k subsystem in the error path of ath10k_setup_msa_resources. The root cause is that the device_node pointer returned by of_parse_phandle() is assigned a refcount that is not always released on error paths, causing a refcount leak. The...

CVE-2022-49221

The CVE-2022-49221 issue affects the Linux kernel DRM MSM DP driver. A NULL pointer dereference could occur because struct dp_panel::connector was never assigned (connector stored in msm_dp::connector). The problem manifested during DP CTS test 4.2.2.6 when reading EDID, causing a NULL dereferenc...

CVE-2022-49234

CVE-2022-49234 is a Linux kernel vulnerability in the VLAN filtering path for DSA cross-chip setups. The issue: when a switch (sw1) p4 leaves a bridge, dsa_port_vlan_filtering would also be invoked for sw2p1 and sw3p1, potentially referencing a non-existent port and causing array out-of-bounds ac...

CVE-2022-49270

CVE-2022-49270 : In the Linux kernel, a use-after-free can occur in dm_cleanup_zoned_dev() if it is not called before blk_cleanup_disk() proceeds through its cleanup path (blk_cleanup_disk->blk_cleanup_queue()->kobject_put()->blk_release_queue()->…->blk_free_queue_rcu()). This raci...

CVE-2022-49424

CVE-2022-49424 is a Linux kernel issue in the Mediatek IOMMU driver. The root cause is a NULL pointer dereference when printing dev_name due to larbdev being NULL during probe (mtk_iommu_probe_device). The crash can occur in device_link_add() and is triggered by an incorrect DTS input. The public...

CVE-2022-49480

Technical details for CVE-2022-49480 are not publicly available in the provided documents; no affected products, root cause, impact, or remediation details are given here. Monitor for updates.

CVE-2022-49488

In CVE-2022-49488, the Linux kernel subsystem drm/msm/mdp5 is affected. The root cause is that mdp5_get_global_state could return the error -EDEADLK while acquiring the modeset lock, but mdp5_mixer_release did not propagate this error, risking a NULL dereference. The mitigation is a patch to have...

CVE-2022-49506

The CVE-2022-49506 issue affects the Linux kernel DRM/Mediatek path, where a race between the vblank callback registration and disabling vblank could yield NULL callback data in the ovl IRQ path, risking kernel panic. The documented fix adds a vblank callback registration flow: register callback ...

CVE-2022-49512

CVE-2022-49512 affects the Linux kernel’s mtd: rawnand: denali driver. The issue arises because the driver did not use managed device resources, leading to kernel faults (example: timeout waiting for IRQ, page fault on supervisor write) when a NAND device is probed. The vulnerability is resolved ...

CVE-2022-49772

CVE-2022-49772 affects the Linux kernel’s ALSA USB audio driver (snd_usbmidi_output_open). The vulnerability arises from a NULL port check that used snd_BUG_ON(); although the check is valid for unexpected NULL ports, this scenario can occur when a device reports an invalid endpoint during descri...

CVE-2022-49802

CVE-2022-49802 affects the Linux kernel ftrace: a NULL pointer dereference can occur in ftrace_add_mod() when ftrace_mod was not initialized as a list head. The issue arises because kzalloc() can leave list pointers NULL and code may call list_del() on an uninitialized entry, triggering an Oops a...

CVE-2022-49813

In CVE-2022-49813, the vulnerability is in the Linux kernel ena driver. The root cause is in ena_init() where the workqueue created by create_singlethread_workqueue() is not destroyed if pci_register_driver() fails, causing a resource leak. The fix adds a call to destroy_workqueue() on pci_regist...

CVE-2022-49823

In CVE-2022-49823, the Linux kernel’s ata_tdev_add() in libata-transport is vulnerable because it does not verify the return value of transport_add_device(). If transport_add_device() fails, the subsequent removal path calls transport_remove_device() and device_del() on a device that may not have...

CVE-2022-49835

CVE-2022-49835 relates to the Linux kernel ALSA: hda subsystem where memory leaks could occur in add_widget_node due to how kobject_add allocates kobject->name and may not free the kobject on error. The root cause is failure to recycle resources when kobject_add fails, leading to a potential m...

CVE-2022-49917

CVE-2022-49917 affects the Linux kernel IPVS subsystem (ip_vs_app_net_cleanup and ip_vs_app_net_init). If ip_vs_app fails to be created during init, removal still proceeds, causing the ip_vs_app entry to be missing and a WARNING in fs/proc/generic.c: remove_proc_entry. The issue is demonstrated b...

CVE-2022-49973

The CVE-2022-49973 entry concerns a Linux kernel vulnerability in sk_msg_recvmsg triggered by an incorrect last scatter-gather (sg) check. The root cause is a change to the last sg validation (to sg_is_last()) in sk_msg_recvmsg(), but the end of the scatterlist was not marked in sockmap redirecti...

CVE-2022-49979

CVE-2022-49979 concerns a Linux kernel refcount bug in sk_psock_get triggered during an SMC fallback in the connect path, due to a mismatch in the sk_user_data field used by both smc and psock. The root cause is the shared use of sk_user_data by two subsystems; the patch adds a new bit (SK_USER_D...

CVE-2022-49991

CVE-2022-49991 concerns the Linux kernel memory management subsystem, specifically the hugetlb path. In the MCOPY_ATOMIC_CONTINUE path for a non-shared VMA, pages from the page cache can be installed into ptes, but hugepage_add_new_anon_rmap is erroneously invoked for these pages, corrupting page...

CVE-2022-50008

CVE-2022-50008 affects the Linux kernel kprobes subsystem. The issue arises when __disable_kprobe() and its call to disarm_kprobe() interact with a probe that has already been disarmed, triggering WARN_ONCE() and leading to incomplete cleanup. This can cause an infinite loop in tk->rp.kp.list ...

CVE-2022-50045

CVE-2022-50045 is a Linux kernel issue affecting the powerpc/pci path. The vulnerability arose from a locking interaction in get_phb_number(), which could cause a DEBUG_ATOMIC_SLEEP warning when sleep-prone OF routines are called while a hose_spinlock is held. The resolution involves modifying ge...

CVE-2022-50120

The CVE-2022-50120 issue in the Linux kernel’s remoteproc driver (imx_rproc) is documented in multiple sources. It concerns a refcount leak in imx_rproc_addr_init caused by of_parse_phandle() returning a node pointer with an incremented refcount; the fix is to call of_node_put() on it when it is ...

CVE-2022-50125

CVE-2022-50125 is a Linux kernel issue affecting ASoC: cros_ec_codec through a refcount leak in cros_ec_codec_platform_probe. The root cause is that of_parse_phandle() returns a node pointer with its refcount incremented, and the fix adds of_node_put() when the node is no longer needed to avoid t...

CVE-2022-50185

In CVE-2022-50185, the Linux kernel drm/radeon path ni_set_mc_special_registers() is vulnerable to a potential buffer overflow. The last case label could write mc_reg_address[j] and mc_data[j] when j equals SMC_NISLANDS_MC_REGISTER_ARRAY_SIZE due to missing bounds checks after the last j++. The f...

CVE-2023-39179

CVE-2023-39179 affects the Linux kernel ksmbd module and is triggered by SMB2 read requests. The vulnerability arises from insufficient validation of user-supplied data, allowing a read past the end of an allocated buffer. Impact is potential disclosure of sensitive information on affected system...

CVE-2023-52736

The CVE-2023-52736 entry concerns the Linux kernel ALSA HDA stack. The vulnerability arises from how ASoC codec drivers reuse hda_codec_driver_probe/remove() from hda_bind.c and how snd_hda_codec_cleanup_for_unbind() unsets the preset. Preset is assigned once during device/driver matching, but AS...

CVE-2023-52746

CVE-2023-52746 concerns a Spectre v1 gadget in the Linux kernel’s xfrm_xlate32_attr() path. The vulnerability arises from using the user-provided nla_type as an array index when type > XFRMA_MAX, potentially leaking kernel memory. The patch set introduces array_index_nospec() use to prevent sp...

CVE-2023-52787

CVE-2023-52787: Linux kernel vulnerability in blk-mq handling of bio integrity. The issue could cause a kernel panic when queue usage counters aren’t properly held during bio_integrity_prep and bio merge. Fixes in updated kernels require calling bio_integrity_prep() with a reliably grabbed queue ...

CVE-2023-52807

CVE-2023-52807 affects the Linux kernel net/hns3 driver. The vulnerability arises from an array of strings used to display coalesce info, which may allow out-of-bounds reads when the kernel adds a new mode or state and coalesce info is read via debugfs. A patch fixes the bound-checking/array sizi...

CVE-2023-52874

CVE-2023-52874 (Linux kernel) concerns x86/tdx: after TDCALL, RSI was not cleared when zeroing the guest-visible register bitmap in the TDX_HYPERCALL path. The description notes the RSI bit was present in the bitmap when first added, removed later, and subsequently not XORed back after a pop RSI ...

CVE-2023-53011

The CVE-2023-53011 issue concerns the Linux kernel’s stmmac driver (DWMAC5) where, by default, all safety features were enabled. If a hardware platform did not provide a safety_feat_cfg entry, enabling the automotive safety package could trigger a NULL pointer dereference during network device op...

CVE-2023-53139

The CVE-2023-53139 issue is in the Linux kernel’s NFC FDP code: it adds a null check for devm_kmalloc_array in fdp_nci_i2c_read_device_properties. If devm_kmalloc_array fails and fw_vsc_cfg is NULL, an out-of-bounds write can occur in device_property_read_u8_array. The vulnerability is addressed ...