admin/nvd-json-data-feeds
1
0 Fork 0
mirror of https://github.com/fkie-cad/nvd-json-data-feeds.git synced 2026-10-30 02:40:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Auto-Update: 2025-09-15T16:00:12.454207+00:00

Browse Source
This commit is contained in:
cad-safe-bot committed 2025-09-15 16:03:56 +00:00
1 parent 1bb13a3f4e
commit 8d6c037396
525 files changed
+11797 -1018
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

CVE-2022/CVE-2022-20xx/CVE-2022-2068.json
+6 -2
View File
@@ -2,8 +2,8 @@
"id": "CVE-2022-2068",
"sourceIdentifier": "[email protected]",
"published": "2022-06-21T15:15:09.060",
"lastModified": "2025-09-03T19:55:35.410",
"vulnStatus": "Analyzed",
"lastModified": "2025-09-15T14:15:33.363",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
@@ -774,6 +774,10 @@
"Patch"
]
},
{
"url": "https://gitlab.com/fraf0/cve-2022-1292-re_score-analysis",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6WZZBKUHQFGSKGNXXKICSRPL7AMVW5M5/",
"source": "af854a3a-2127-422b-91ae-364da2661108",
CVE-2022/CVE-2022-502xx/CVE-2022-50234.json
+41
View File
@@ -0,0 +1,41 @@
{
"id": "CVE-2022-50234",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T14:15:33.727",
"lastModified": "2025-09-15T15:21:42.937",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/af_unix: defer registered files gc to io_uring release\n\nInstead of putting io_uring's registered files in unix_gc() we want it\nto be done by io_uring itself. The trick here is to consider io_uring\nregistered files for cycle detection but not actually putting them down.\nBecause io_uring can't register other ring instances, this will remove\nall refs to the ring file triggering the ->release path and clean up\nwith io_ring_ctx_free().\n\n[axboe: add kerneldoc comment to skb, fold in skb leak fix]"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/0091bfc81741b8d3aeb3b7ab8636f911b2de6e80",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/04df9719df1865f6770af9bc7880874af0e594b2",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/75e94c7e8859e58aadc15a98cc9704edff47d4f2",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/813d8fe5d30388f73a21d3a2bf46b0a1fd72498c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b4293c01ee0d0ecdd3cb5801e13f62271144667a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c378c479c5175833bb22ff71974cda47d7b05401",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-502xx/CVE-2022-50235.json
+37
View File
@@ -0,0 +1,37 @@
{
"id": "CVE-2022-50235",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T14:15:33.877",
"lastModified": "2025-09-15T15:21:42.937",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Protect against send buffer overflow in NFSv2 READDIR\n\nRestore the previous limit on the @count argument to prevent a\nbuffer overflow attack."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/00b4492686e0497fdb924a9d4c8f6f99377e176c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/0e57d696f60dee6117a8ace0cac7c5761d375277",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c2a878095b5c6f04f90553a3c45872f990dab14e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/dc7f225090c29a5f3b9419b1af32846a201555e7",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f59c74df82f6ac9d2ea4e01aa3ae7c6c4481652d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-502xx/CVE-2022-50236.json
+29
View File
@@ -0,0 +1,29 @@
{
"id": "CVE-2022-50236",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T14:15:34.003",
"lastModified": "2025-09-15T15:21:42.937",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/mediatek: Fix crash on isr after kexec()\n\nIf the system is rebooted via isr(), the IRQ handler might\nbe triggered before the domain is initialized. Resulting on\nan invalid memory access error.\n\nFix:\n[ 0.500930] Unable to handle kernel read from unreadable memory at virtual address 0000000000000070\n[ 0.501166] Call trace:\n[ 0.501174] report_iommu_fault+0x28/0xfc\n[ 0.501180] mtk_iommu_isr+0x10c/0x1c0\n\n[ joro: Fixed spelling in commit message ]"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/00ef8885a945c37551547d8ac8361cacd20c4e42",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/85cc8a187f2de7a91e2cea522e9406fa12999269",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f13acee780cedb3e06a6dadf64d9104cccd2b9fc",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-502xx/CVE-2022-50239.json
+33
View File
@@ -0,0 +1,33 @@
{
"id": "CVE-2022-50239",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T14:15:34.130",
"lastModified": "2025-09-15T15:21:42.937",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncpufreq: qcom: fix writes in read-only memory region\n\nThis commit fixes a kernel oops because of a write in some read-only memory:\n\n\t[ 9.068287] Unable to handle kernel write to read-only memory at virtual address ffff800009240ad8\n\t..snip..\n\t[ 9.138790] Internal error: Oops: 9600004f [#1] PREEMPT SMP\n\t..snip..\n\t[ 9.269161] Call trace:\n\t[ 9.276271] __memcpy+0x5c/0x230\n\t[ 9.278531] snprintf+0x58/0x80\n\t[ 9.282002] qcom_cpufreq_msm8939_name_version+0xb4/0x190\n\t[ 9.284869] qcom_cpufreq_probe+0xc8/0x39c\n\t..snip..\n\nThe following line defines a pointer that point to a char buffer stored\nin read-only memory:\n\n\tchar *pvs_name = \"speedXX-pvsXX-vXX\";\n\nThis pointer is meant to hold a template \"speedXX-pvsXX-vXX\" where the\nXX values get overridden by the qcom_cpufreq_krait_name_version function. Since\nthe template is actually stored in read-only memory, when the function\nexecutes the following call we get an oops:\n\n\tsnprintf(*pvs_name, sizeof(\"speedXX-pvsXX-vXX\"), \"speed%d-pvs%d-v%d\",\n\t\t speed, pvs, pvs_ver);\n\nTo fix this issue, we instead store the template name onto the stack by\nusing the following syntax:\n\n\tchar pvs_name_buffer[] = \"speedXX-pvsXX-vXX\";\n\nBecause the `pvs_name` needs to be able to be assigned to NULL, the\ntemplate buffer is stored in the pvs_name_buffer and not under the\npvs_name variable."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/01039fb8e90c9cb684430414bff70cea9eb168c5",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/14d260f94ff89543597ffea13db8b277a810e08e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/794ded0bc461287a268bed21fea2eebb6e5d232c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b74ee4e301ca01e431e240c046173332966e2431",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-502xx/CVE-2022-50240.json
+21
View File
@@ -0,0 +1,21 @@
{
"id": "CVE-2022-50240",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T14:15:34.250",
"lastModified": "2025-09-15T15:21:42.937",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbinder: fix UAF of alloc->vma in race with munmap()\n\nIn commit 720c24192404 (\"ANDROID: binder: change down_write to\ndown_read\") binder assumed the mmap read lock is sufficient to protect\nalloc->vma inside binder_update_page_range(). This used to be accurate\nuntil commit dd2283f2605e (\"mm: mmap: zap pages with read mmap_sem in\nmunmap\"), which now downgrades the mmap_lock after detaching the vma\nfrom the rbtree in munmap(). Then it proceeds to teardown and free the\nvma with only the read lock held.\n\nThis means that accesses to alloc->vma in binder_update_page_range() now\nwill race with vm_area_free() in munmap() and can cause a UAF as shown\nin the following KASAN trace:\n\n ==================================================================\n BUG: KASAN: use-after-free in vm_insert_page+0x7c/0x1f0\n Read of size 8 at addr ffff16204ad00600 by task server/558\n\n CPU: 3 PID: 558 Comm: server Not tainted 5.10.150-00001-gdc8dcf942daa #1\n Hardware name: linux,dummy-virt (DT)\n Call trace:\n dump_backtrace+0x0/0x2a0\n show_stack+0x18/0x2c\n dump_stack+0xf8/0x164\n print_address_description.constprop.0+0x9c/0x538\n kasan_report+0x120/0x200\n __asan_load8+0xa0/0xc4\n vm_insert_page+0x7c/0x1f0\n binder_update_page_range+0x278/0x50c\n binder_alloc_new_buf+0x3f0/0xba0\n binder_transaction+0x64c/0x3040\n binder_thread_write+0x924/0x2020\n binder_ioctl+0x1610/0x2e5c\n __arm64_sys_ioctl+0xd4/0x120\n el0_svc_common.constprop.0+0xac/0x270\n do_el0_svc+0x38/0xa0\n el0_svc+0x1c/0x2c\n el0_sync_handler+0xe8/0x114\n el0_sync+0x180/0x1c0\n\n Allocated by task 559:\n kasan_save_stack+0x38/0x6c\n __kasan_kmalloc.constprop.0+0xe4/0xf0\n kasan_slab_alloc+0x18/0x2c\n kmem_cache_alloc+0x1b0/0x2d0\n vm_area_alloc+0x28/0x94\n mmap_region+0x378/0x920\n do_mmap+0x3f0/0x600\n vm_mmap_pgoff+0x150/0x17c\n ksys_mmap_pgoff+0x284/0x2dc\n __arm64_sys_mmap+0x84/0xa4\n el0_svc_common.constprop.0+0xac/0x270\n do_el0_svc+0x38/0xa0\n el0_svc+0x1c/0x2c\n el0_sync_handler+0xe8/0x114\n el0_sync+0x180/0x1c0\n\n Freed by task 560:\n kasan_save_stack+0x38/0x6c\n kasan_set_track+0x28/0x40\n kasan_set_free_info+0x24/0x4c\n __kasan_slab_free+0x100/0x164\n kasan_slab_free+0x14/0x20\n kmem_cache_free+0xc4/0x34c\n vm_area_free+0x1c/0x2c\n remove_vma+0x7c/0x94\n __do_munmap+0x358/0x710\n __vm_munmap+0xbc/0x130\n __arm64_sys_munmap+0x4c/0x64\n el0_svc_common.constprop.0+0xac/0x270\n do_el0_svc+0x38/0xa0\n el0_svc+0x1c/0x2c\n el0_sync_handler+0xe8/0x114\n el0_sync+0x180/0x1c0\n\n [...]\n ==================================================================\n\nTo prevent the race above, revert back to taking the mmap write lock\ninside binder_update_page_range(). One might expect an increase of mmap\nlock contention. However, binder already serializes these calls via top\nlevel alloc->mutex. Also, there was no performance impact shown when\nrunning the binder benchmark tests.\n\nNote this patch is specific to stable branches 5.4 and 5.10. Since in\nnewer kernel releases binder no longer caches a pointer to the vma.\nInstead, it has been refactored to use vma_lookup() which avoids the\nissue described here. This switch was introduced in commit a43cfc87caaf\n(\"android: binder: stop saving a pointer to the VMA\")."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/015ac18be7de25d17d6e5f1643cb3b60bfbe859e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-502xx/CVE-2022-50241.json
+37
View File
@@ -0,0 +1,37 @@
{
"id": "CVE-2022-50241",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T14:15:34.360",
"lastModified": "2025-09-15T15:21:42.937",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: fix use-after-free on source server when doing inter-server copy\n\nUse-after-free occurred when the laundromat tried to free expired\ncpntf_state entry on the s2s_cp_stateids list after inter-server\ncopy completed. The sc_cp_list that the expired copy state was\ninserted on was already freed.\n\nWhen COPY completes, the Linux client normally sends LOCKU(lock_state x),\nFREE_STATEID(lock_state x) and CLOSE(open_state y) to the source server.\nThe nfs4_put_stid call from nfsd4_free_stateid cleans up the copy state\nfrom the s2s_cp_stateids list before freeing the lock state's stid.\n\nHowever, sometimes the CLOSE was sent before the FREE_STATEID request.\nWhen this happens, the nfsd4_close_open_stateid call from nfsd4_close\nfrees all lock states on its st_locks list without cleaning up the copy\nstate on the sc_cp_list list. When the time the FREE_STATEID arrives the\nserver returns BAD_STATEID since the lock state was freed. This causes\nthe use-after-free error to occur when the laundromat tries to free\nthe expired cpntf_state.\n\nThis patch adds a call to nfs4_free_cpntf_statelist in\nnfsd4_close_open_stateid to clean up the copy state before calling\nfree_ol_stateid_reaplist to free the lock state's stid on the reaplist."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/019805fea91599b22dfa62ffb29c022f35abeb06",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/35aa0fb8c3033a3d78603356e96fc18c5b9cceb2",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6ea71246b7a02af675d733e72d14bd0d591d5f4a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/83b94969751a691347606dbe6b1865efcfa5a643",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/bbacfcde5fff25ac22597e8373a065c647da6738",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-502xx/CVE-2022-50242.json
+53
View File
@@ -0,0 +1,53 @@
{
"id": "CVE-2022-50242",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T14:15:34.487",
"lastModified": "2025-09-15T15:21:42.937",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrivers: net: qlcnic: Fix potential memory leak in qlcnic_sriov_init()\n\nIf vp alloc failed in qlcnic_sriov_init(), all previously allocated vp\nneeds to be freed."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/01de1123322e4fe1bbd0fcdf0982511b55519c03",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/0aefadf23ee5e33b747df195ace42d3be2025e4e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/132c502919bb08e16e3054cb28bb7b149ec20cf5",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/14b349a15c297cf3e01b5deb4116f7cf297b6184",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/15770edc01edfce773269e8a443ca8e420f6f859",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8399b9893548c03fdb18be277bf99d985dbde925",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a44490abaf00f5b0cc5c448a17eae331c6195d0a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/aa2d179544b6815b4a23c0c44543ba0971d49fce",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/dcae92a249551d1a447804b4be1c9fab0e8c95e8",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-502xx/CVE-2022-50243.json
+45
View File
@@ -0,0 +1,45 @@
{
"id": "CVE-2022-50243",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T14:15:34.620",
"lastModified": "2025-09-15T15:21:42.937",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: handle the error returned from sctp_auth_asoc_init_active_key\n\nWhen it returns an error from sctp_auth_asoc_init_active_key(), the\nactive_key is actually not updated. The old sh_key will be freeed\nwhile it's still used as active key in asoc. Then an use-after-free\nwill be triggered when sending patckets, as found by syzbot:\n\n sctp_auth_shkey_hold+0x22/0xa0 net/sctp/auth.c:112\n sctp_set_owner_w net/sctp/socket.c:132 [inline]\n sctp_sendmsg_to_asoc+0xbd5/0x1a20 net/sctp/socket.c:1863\n sctp_sendmsg+0x1053/0x1d50 net/sctp/socket.c:2025\n inet_sendmsg+0x99/0xe0 net/ipv4/af_inet.c:819\n sock_sendmsg_nosec net/socket.c:714 [inline]\n sock_sendmsg+0xcf/0x120 net/socket.c:734\n\nThis patch is to fix it by not replacing the sh_key when it returns\nerrors from sctp_auth_asoc_init_active_key() in sctp_auth_set_key().\nFor sctp_auth_set_active_key(), old active_key_id will be set back\nto asoc->active_key_id when the same thing happens."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/022152aaebe116a25c39818a07e175a8cd3c1e11",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/0f90099d18e3abdc01babf686f41f63fe04939c1",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/19d636b663e0e92951bba5fced929ca7fd25c552",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/382ff44716603a54f5fd238ddec6a2468e217612",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/3b0fcf5e29c0940e1169ce9c44f73edd98bdf12d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b8fa99a3a11bdd77fef6b4a97f1021eb30b5ba40",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f65955340e0044f5c41ac799a01698ac7dee8a4e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-502xx/CVE-2022-50244.json
+53
View File
@@ -0,0 +1,53 @@
{
"id": "CVE-2022-50244",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T14:15:34.763",
"lastModified": "2025-09-15T15:21:42.937",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncxl: fix possible null-ptr-deref in cxl_pci_init_afu|adapter()\n\nIf device_register() fails in cxl_pci_afu|adapter(), the device\nis not added, device_unregister() can not be called in the error\npath, otherwise it will cause a null-ptr-deref because of removing\nnot added device.\n\nAs comment of device_register() says, it should use put_device() to give\nup the reference in the error path. So split device_unregister() into\ndevice_del() and put_device(), then goes to put dev when register fails."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/02cd3032b154fa02fdf90e7467abaeed889330b2",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/0f63c0ddc2ea20d783d29243f4dbe0f9e95dfdec",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/139abd4c626a6f7ce02789ed5f73aa2256e0542b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/22511eefa61db26e12c97dd7ada3071dbdfcb004",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/2f5fd31b2f24b9b8a80ab566fd8c4e1e94cb4339",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/361412dae1690d4b5df6f92fc943cdc773c95cbc",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/82e5481428faf11c79b9c094dd24a1849bbf64ac",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/82e68432668ae75b4c814d160f6987ecb0681273",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c4b2e35df919d99bbbed033c2fa0b607f9f463b5",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-502xx/CVE-2022-50245.json
+53
View File
@@ -0,0 +1,53 @@
{
"id": "CVE-2022-50245",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T14:15:34.897",
"lastModified": "2025-09-15T15:21:42.937",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrapidio: fix possible UAF when kfifo_alloc() fails\n\nIf kfifo_alloc() fails in mport_cdev_open(), goto err_fifo and just free\npriv. But priv is still in the chdev->file_list, then list traversal\nmay cause UAF. This fixes the following smatch warning:\n\ndrivers/rapidio/devices/rio_mport_cdev.c:1930 mport_cdev_open() warn: '&priv->list' not removed from list"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/02d7d89f816951e0862147d751b1150d67aaebdd",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/2a6c75adf8192f07ddcdd4a1a13488c890a73919",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/2ba06e57f933f0eac242e8b389433da1cc00d4d5",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/2dfd60724d271a6ab99f93f40f38f2ced1ddbb87",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/2f5cc7fd73fd6253cc71214f0dd499cc62feb469",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/311b488405ac45af46756b1c8f1d27007b68b07e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/5ee850645e42f541ce1ea8130c2b27cc495f965c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a253dde0403a153075ffb254f6f7b2635e49e97a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/cb87af2c19c0993f6e21f75b963a5599c5a73e76",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-502xx/CVE-2022-50246.json
+41
View File
@@ -0,0 +1,41 @@
{
"id": "CVE-2022-50246",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T14:15:35.030",
"lastModified": "2025-09-15T15:21:42.937",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: tcpci: fix of node refcount leak in tcpci_register_port()\n\nI got the following report while doing device(mt6370-tcpc) load\ntest with CONFIG_OF_UNITTEST and CONFIG_OF_DYNAMIC enabled:\n\n OF: ERROR: memory leak, expected refcount 1 instead of 2,\n of_node_get()/of_node_put() unbalanced - destroy cset entry:\n attach overlay node /i2c/pmic@34/tcpc/connector\n\nThe 'fwnode' set in tcpci_parse_config() which is called\nin tcpci_register_port(), its node refcount is increased\nin device_get_named_child_node(). It needs be put while\nexiting, so call fwnode_handle_put() in the error path of\ntcpci_register_port() and in tcpci_unregister_port() to\navoid leak."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/0384e87e3fec735e47f1c133c796f32ef7a72a9b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/4f257e2eba419ab4cd880c822346450e4e7b2af3",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/5f125507d2270035dfcf83fbff6cff5a143e200c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ba75be6f0d9d028d20852564206565a4c03e3288",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d3b6c28a71f111a6c67ddc3238aab95910fd86cf",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e75a324409715bd71348f79a49aa61b69dbeb676",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-502xx/CVE-2022-50247.json
+33
View File
@@ -0,0 +1,33 @@
{
"id": "CVE-2022-50247",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T14:15:35.177",
"lastModified": "2025-09-15T15:21:42.937",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: xhci-mtk: fix leakage of shared hcd when fail to set wakeup irq\n\nCan not set the @shared_hcd to NULL before decrease the usage count\nby usb_put_hcd(), this will cause the shared hcd not released."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/03a88b0bafbe3f548729d970d8366f48718c9b19",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/05680a91ae60ddd0319e6618456f0883b5dd765d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c8e7463844888dc8344bbb9cbad88cdce9cb8077",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ffb14aac2658873050671198543b9b8194149c14",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-502xx/CVE-2022-50248.json
+41
View File
@@ -0,0 +1,41 @@
{
"id": "CVE-2022-50248",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T14:15:35.363",
"lastModified": "2025-09-15T15:21:42.937",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: fix double free on tx path.\n\nWe see kernel crashes and lockups and KASAN errors related to ax210\nfirmware crashes. One of the KASAN dumps pointed at the tx path,\nand it appears there is indeed a way to double-free an skb.\n\nIf iwl_mvm_tx_skb_sta returns non-zero, then the 'skb' sent into the\nmethod will be freed. But, in case where we build TSO skb buffer,\nthe skb may also be freed in error case. So, return 0 in that particular\nerror case and do cleanup manually.\n\nBUG: KASAN: use-after-free in __list_del_entry_valid+0x12/0x90\niwlwifi 0000:06:00.0: 0x00000000 | tsf hi\nRead of size 8 at addr ffff88813cfa4ba0 by task btserver/9650\n\nCPU: 4 PID: 9650 Comm: btserver Tainted: G W 5.19.8+ #5\niwlwifi 0000:06:00.0: 0x00000000 | time gp1\nHardware name: Default string Default string/SKYBAY, BIOS 5.12 02/19/2019\nCall Trace:\n <TASK>\n dump_stack_lvl+0x55/0x6d\n print_report.cold.12+0xf2/0x684\niwlwifi 0000:06:00.0: 0x1D0915A8 | time gp2\n ? __list_del_entry_valid+0x12/0x90\n kasan_report+0x8b/0x180\niwlwifi 0000:06:00.0: 0x00000001 | uCode revision type\n ? __list_del_entry_valid+0x12/0x90\n __list_del_entry_valid+0x12/0x90\niwlwifi 0000:06:00.0: 0x00000048 | uCode version major\n tcp_update_skb_after_send+0x5d/0x170\n __tcp_transmit_skb+0xb61/0x15c0\niwlwifi 0000:06:00.0: 0xDAA05125 | uCode version minor\n ? __tcp_select_window+0x490/0x490\niwlwifi 0000:06:00.0: 0x00000420 | hw version\n ? trace_kmalloc_node+0x29/0xd0\n ? __kmalloc_node_track_caller+0x12a/0x260\n ? memset+0x1f/0x40\n ? __build_skb_around+0x125/0x150\n ? __alloc_skb+0x1d4/0x220\n ? skb_zerocopy_clone+0x55/0x230\niwlwifi 0000:06:00.0: 0x00489002 | board version\n ? kmalloc_reserve+0x80/0x80\n ? rcu_read_lock_bh_held+0x60/0xb0\n tcp_write_xmit+0x3f1/0x24d0\niwlwifi 0000:06:00.0: 0x034E001C | hcmd\n ? __check_object_size+0x180/0x350\niwlwifi 0000:06:00.0: 0x24020000 | isr0\n tcp_sendmsg_locked+0x8a9/0x1520\niwlwifi 0000:06:00.0: 0x01400000 | isr1\n ? tcp_sendpage+0x50/0x50\niwlwifi 0000:06:00.0: 0x48F0000A | isr2\n ? lock_release+0xb9/0x400\n ? tcp_sendmsg+0x14/0x40\niwlwifi 0000:06:00.0: 0x00C3080C | isr3\n ? lock_downgrade+0x390/0x390\n ? do_raw_spin_lock+0x114/0x1d0\niwlwifi 0000:06:00.0: 0x00200000 | isr4\n ? rwlock_bug.part.2+0x50/0x50\niwlwifi 0000:06:00.0: 0x034A001C | last cmd Id\n ? rwlock_bug.part.2+0x50/0x50\n ? lockdep_hardirqs_on_prepare+0xe/0x200\niwlwifi 0000:06:00.0: 0x0000C2F0 | wait_event\n ? __local_bh_enable_ip+0x87/0xe0\n ? inet_send_prepare+0x220/0x220\niwlwifi 0000:06:00.0: 0x000000C4 | l2p_control\n tcp_sendmsg+0x22/0x40\n sock_sendmsg+0x5f/0x70\niwlwifi 0000:06:00.0: 0x00010034 | l2p_duration\n __sys_sendto+0x19d/0x250\niwlwifi 0000:06:00.0: 0x00000007 | l2p_mhvalid\n ? __ia32_sys_getpeername+0x40/0x40\niwlwifi 0000:06:00.0: 0x00000000 | l2p_addr_match\n ? rcu_read_lock_held_common+0x12/0x50\n ? rcu_read_lock_sched_held+0x5a/0xd0\n ? rcu_read_lock_bh_held+0xb0/0xb0\n ? rcu_read_lock_sched_held+0x5a/0xd0\n ? rcu_read_lock_sched_held+0x5a/0xd0\n ? lock_release+0xb9/0x400\n ? lock_downgrade+0x390/0x390\n ? ktime_get+0x64/0x130\n ? ktime_get+0x8d/0x130\n ? rcu_read_lock_held_common+0x12/0x50\n ? rcu_read_lock_sched_held+0x5a/0xd0\n ? rcu_read_lock_held_common+0x12/0x50\n ? rcu_read_lock_sched_held+0x5a/0xd0\n ? rcu_read_lock_bh_held+0xb0/0xb0\n ? rcu_read_lock_bh_held+0xb0/0xb0\n __x64_sys_sendto+0x6f/0x80\n do_syscall_64+0x34/0xb0\n entry_SYSCALL_64_after_hwframe+0x46/0xb0\nRIP: 0033:0x7f1d126e4531\nCode: 00 00 00 00 0f 1f 44 00 00 f3 0f 1e fa 48 8d 05 35 80 0c 00 41 89 ca 8b 00 85 c0 75 1c 45 31 c9 45 31 c0 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 67 c3 66 0f 1f 44 00 00 55 48 83 ec 20 48 89\nRSP: 002b:00007ffe21a679d8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c\nRAX: ffffffffffffffda RBX: 000000000000ffdc RCX: 00007f1d126e4531\nRDX: 0000000000010000 RSI: 000000000374acf0 RDI: 0000000000000014\nRBP: 00007ffe21a67ac0 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R\n---truncated---"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/0473cbae2137b963bd0eaa74336131cb1d3bc6c3",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/0e1e311fd929c6a8dcfddcb4748c47b07e39821f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/3a2ecd1ec14075117ccb3e85f0fed224578ec228",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8fabe41fba907e4fd826acbbdb42e09c681c515e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ae966649f665bc3868b935157dd4a3c31810dcc0",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d8e32f1bf1a9183a6aad560c6688500222d24299",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-502xx/CVE-2022-50249.json
+53
View File
@@ -0,0 +1,53 @@
{
"id": "CVE-2022-50249",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T14:15:35.497",
"lastModified": "2025-09-15T15:21:42.937",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmemory: of: Fix refcount leak bug in of_get_ddr_timings()\n\nWe should add the of_node_put() when breaking out of\nfor_each_child_of_node() as it will automatically increase\nand decrease the refcount."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/05215fb32010d4afb68fbdbb4d237df6e2d4567b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/1c6cac6fa4d08aea161f83d38117d733b3c3a000",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/2680690f9ce4e6abbb4f559e97271c15b7eeda97",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/62ccab6e3376f8a22167c3b81468ae4f3e7d25f1",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/68c9c4e6495b825be3a8946df1a0148399555fe4",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/85a40bfb8e7a170abcf9dae2c0898a1983e48daa",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a4d0bd4388e1a39df47e8aaa044ef6a7ee626e48",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a4f7eb83852a65b6f8dea7dcc42b7c76d4d9b0a3",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/daaec4b3fe2297b022c6b2d6bf48b6e5265a60b9",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-502xx/CVE-2022-50250.json
+45
View File
@@ -0,0 +1,45 @@
{
"id": "CVE-2022-50250",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T14:15:35.623",
"lastModified": "2025-09-15T15:21:42.937",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nregulator: core: fix use_count leakage when handling boot-on\n\nI found a use_count leakage towards supply regulator of rdev with\nboot-on option.\n\n\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n\u2502 regulator_dev A \u2502 \u2502 regulator_dev B \u2502\n\u2502 (boot-on) \u2502 \u2502 (boot-on) \u2502\n\u2502 use_count=0 \u2502\u25c0\u2500\u2500supply\u2500\u2500\u2502 use_count=1 \u2502\n\u2502 \u2502 \u2502 \u2502\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n\nIn case of rdev(A) configured with `regulator-boot-on', the use_count\nof supplying regulator(B) will increment inside\nregulator_enable(rdev->supply).\n\nThus, B will acts like always-on, and further balanced\nregulator_enable/disable cannot actually disable it anymore.\n\nHowever, B was also configured with `regulator-boot-on', we wish it\ncould be disabled afterwards."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/0591b14ce0398125439c759f889647369aa616a0",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/4b737246ff50f810d6ab4be13c1388a07f0c14b1",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/4dd6e1cc9c7403f1ee1b7eee85bc31b797ae8347",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/5bfc53df288e8ea54ca6866fb92034214940183f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/bc6c381df5793ebcf32db88a3e65acf7870379fc",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/dc3391d49479bc2bf8a2b88dbf86fdd800882fee",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/feb847e6591e8c7a09cc39721cc9ca74fd9a5d80",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-502xx/CVE-2022-50251.json
+53
View File
@@ -0,0 +1,53 @@
{
"id": "CVE-2022-50251",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T14:15:35.750",
"lastModified": "2025-09-15T15:21:42.937",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: vub300: fix return value check of mmc_add_host()\n\nmmc_add_host() may return error, if we ignore its return value, the memory\nthat allocated in mmc_alloc_host() will be leaked and it will lead a kernel\ncrash because of deleting not added device in the remove path.\n\nSo fix this by checking the return value and goto error path which will call\nmmc_free_host(), besides, the timer added before mmc_add_host() needs be del.\n\nAnd this patch fixes another missing call mmc_free_host() if usb_control_msg()\nfails."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/0613ad2401f88bdeae5594c30afe318e93b14676",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/2044b2ea77945f372ef161d1bbf814e471767ff2",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/25f05d762ca5e1c685002a53dd44f68e78ca3feb",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/3049a3b927a40d89d4582ff1033cd7953be773c7",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/3b29f8769d32016b2d89183db4d80c7a71b7e35e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/41ed46bdbd2878cd6567abe0974a445f8b1b8ec8",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a46e681151bbdacdf6b89ee8c4e5bad0555142bb",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/afc898019e7bf18c5eb7a0ac19852fcb1b341b3c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c9e85979b59cb86f0a15defa8199d740e2b36b90",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-502xx/CVE-2022-50252.json
+53
View File
@@ -0,0 +1,53 @@
{
"id": "CVE-2022-50252",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T14:15:35.877",
"lastModified": "2025-09-15T15:21:42.937",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nigb: Do not free q_vector unless new one was allocated\n\nAvoid potential use-after-free condition under memory pressure. If the\nkzalloc() fails, q_vector will be freed but left in the original\nadapter->q_vector[v_idx] array position."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/0200f0fbb11e359cc35af72ab10b2ec224e6f633",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/0668716506ca66f90d395f36ccdaebc3e0e84801",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/314f7092b27749bdde44c14095b5533afa2a3bc8",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/3cb18dea11196fb4a06f78294cec5e61985e1aff",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/56483aecf6b22eb7dff6315b3a174688c6ad494c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/64ca1969599857143e91aeec4440640656100803",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/68e8adbcaf7a8743e473343b38b9dad66e2ac6f3",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6e399577bd397a517df4b938601108c63769ce0a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f96bd8adc8adde25390965a8c1ee81b73cb62075",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-502xx/CVE-2022-50253.json
+49
View File
@@ -0,0 +1,49 @@
{
"id": "CVE-2022-50253",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T14:15:36.007",
"lastModified": "2025-09-15T15:21:42.937",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: make sure skb->len != 0 when redirecting to a tunneling device\n\nsyzkaller managed to trigger another case where skb->len == 0\nwhen we enter __dev_queue_xmit:\n\nWARNING: CPU: 0 PID: 2470 at include/linux/skbuff.h:2576 skb_assert_len include/linux/skbuff.h:2576 [inline]\nWARNING: CPU: 0 PID: 2470 at include/linux/skbuff.h:2576 __dev_queue_xmit+0x2069/0x35e0 net/core/dev.c:4295\n\nCall Trace:\n dev_queue_xmit+0x17/0x20 net/core/dev.c:4406\n __bpf_tx_skb net/core/filter.c:2115 [inline]\n __bpf_redirect_no_mac net/core/filter.c:2140 [inline]\n __bpf_redirect+0x5fb/0xda0 net/core/filter.c:2163\n ____bpf_clone_redirect net/core/filter.c:2447 [inline]\n bpf_clone_redirect+0x247/0x390 net/core/filter.c:2419\n bpf_prog_48159a89cb4a9a16+0x59/0x5e\n bpf_dispatcher_nop_func include/linux/bpf.h:897 [inline]\n __bpf_prog_run include/linux/filter.h:596 [inline]\n bpf_prog_run include/linux/filter.h:603 [inline]\n bpf_test_run+0x46c/0x890 net/bpf/test_run.c:402\n bpf_prog_test_run_skb+0xbdc/0x14c0 net/bpf/test_run.c:1170\n bpf_prog_test_run+0x345/0x3c0 kernel/bpf/syscall.c:3648\n __sys_bpf+0x43a/0x6c0 kernel/bpf/syscall.c:5005\n __do_sys_bpf kernel/bpf/syscall.c:5091 [inline]\n __se_sys_bpf kernel/bpf/syscall.c:5089 [inline]\n __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5089\n do_syscall_64+0x54/0x70 arch/x86/entry/common.c:48\n entry_SYSCALL_64_after_hwframe+0x61/0xc6\n\nThe reproducer doesn't really reproduce outside of syzkaller\nenvironment, so I'm taking a guess here. It looks like we\ndo generate correct ETH_HLEN-sized packet, but we redirect\nthe packet to the tunneling device. Before we do so, we\n__skb_pull l2 header and arrive again at skb->len == 0.\nDoesn't seem like we can do anything better than having\nan explicit check after __skb_pull?"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/07ec7b502800ba9f7b8b15cb01dd6556bb41aaca",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/1b65704b8c08ae92db29f720d3b298031131da53",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/5d3f4478d22b2cb1810f6fe0f797411e9d87b3e5",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6d935a02658be82585ecb39aab339faa84496650",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/772431f30ca040cfbf31b791d468bac6a9ca74d3",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e6a63203e5a90a39392fa1a7ffc60f5e9baf642a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f186303845a01cc7e991f9dc51d7e5a3cdc7aedb",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ffbccc5fb0a67424e12f7f8da210c04c8063f797",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-502xx/CVE-2022-50254.json
+25
View File
@@ -0,0 +1,25 @@
{
"id": "CVE-2022-50254",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T14:15:36.140",
"lastModified": "2025-09-15T15:21:42.937",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: ov8865: Fix an error handling path in ov8865_probe()\n\nThe commit in Fixes also introduced some new error handling which should\ngoto the existing error handling path.\nOtherwise some resources leak."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/080e0b7404850406628674b07286f16cc389a892",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/1f55a2273a7b41895ea6272e51ccb1d797cfd39b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-502xx/CVE-2022-50255.json
+33
View File
@@ -0,0 +1,33 @@
{
"id": "CVE-2022-50255",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T14:15:36.247",
"lastModified": "2025-09-15T15:21:42.937",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix reading strings from synthetic events\n\nThe follow commands caused a crash:\n\n # cd /sys/kernel/tracing\n # echo 's:open char file[]' > dynamic_events\n # echo 'hist:keys=common_pid:file=filename:onchange($file).trace(open,$file)' > events/syscalls/sys_enter_openat/trigger'\n # echo 1 > events/synthetic/open/enable\n\nBOOM!\n\nThe problem is that the synthetic event field \"char file[]\" will read\nthe value given to it as a string without any memory checks to make sure\nthe address is valid. The above example will pass in the user space\naddress and the sythetic event code will happily call strlen() on it\nand then strscpy() where either one will cause an oops when accessing\nuser space addresses.\n\nUse the helper functions from trace_kprobe and trace_eprobe that can\nread strings safely (and actually succeed when the address is from user\nspace and the memory is mapped in).\n\nNow the above can show:\n\n packagekitd-1721 [000] ...2. 104.597170: open: file=/usr/lib/rpm/fileattrs/cmake.attr\n in:imjournal-978 [006] ...2. 104.599642: open: file=/var/lib/rsyslog/imjournal.state.tmp\n packagekitd-1721 [000] ...2. 104.626308: open: file=/usr/lib/rpm/fileattrs/debuginfo.attr"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/0934ae9977c27133449b6dd8c6213970e7eece38",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/149198d0b884e4606ed1d29b330c70016d878276",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d9c79fbcbdb6cb10c07c85040eaf615180b26c48",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f8bae1853196b52ede50950387f5b48cf83b9815",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-502xx/CVE-2022-50256.json
+29
View File
@@ -0,0 +1,29 @@
{
"id": "CVE-2022-50256",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T14:15:36.363",
"lastModified": "2025-09-15T15:21:42.937",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/meson: remove drm bridges at aggregate driver unbind time\n\ndrm bridges added by meson_encoder_hdmi_init and meson_encoder_cvbs_init\nwere not manually removed at module unload time, which caused dangling\nreferences to freed memory to remain linked in the global bridge_list.\n\nWhen loading the driver modules back in, the same functions would again\ncall drm_bridge_add, and when traversing the global bridge_list, would\nend up peeking into freed memory.\n\nOnce again KASAN revealed the problem:\n\n[ +0.000095] =============================================================\n[ +0.000008] BUG: KASAN: use-after-free in __list_add_valid+0x9c/0x120\n[ +0.000018] Read of size 8 at addr ffff00003da291f0 by task modprobe/2483\n\n[ +0.000018] CPU: 3 PID: 2483 Comm: modprobe Tainted: G C O 5.19.0-rc6-lrmbkasan+ #1\n[ +0.000011] Hardware name: Hardkernel ODROID-N2Plus (DT)\n[ +0.000008] Call trace:\n[ +0.000006] dump_backtrace+0x1ec/0x280\n[ +0.000012] show_stack+0x24/0x80\n[ +0.000008] dump_stack_lvl+0x98/0xd4\n[ +0.000011] print_address_description.constprop.0+0x80/0x520\n[ +0.000011] print_report+0x128/0x260\n[ +0.000008] kasan_report+0xb8/0xfc\n[ +0.000008] __asan_report_load8_noabort+0x3c/0x50\n[ +0.000009] __list_add_valid+0x9c/0x120\n[ +0.000009] drm_bridge_add+0x6c/0x104 [drm]\n[ +0.000165] dw_hdmi_probe+0x1900/0x2360 [dw_hdmi]\n[ +0.000022] meson_dw_hdmi_bind+0x520/0x814 [meson_dw_hdmi]\n[ +0.000014] component_bind+0x174/0x520\n[ +0.000012] component_bind_all+0x1a8/0x38c\n[ +0.000010] meson_drv_bind_master+0x5e8/0xb74 [meson_drm]\n[ +0.000032] meson_drv_bind+0x20/0x2c [meson_drm]\n[ +0.000027] try_to_bring_up_aggregate_device+0x19c/0x390\n[ +0.000010] component_master_add_with_match+0x1c8/0x284\n[ +0.000009] meson_drv_probe+0x274/0x280 [meson_drm]\n[ +0.000026] platform_probe+0xd0/0x220\n[ +0.000009] really_probe+0x3ac/0xa80\n[ +0.000009] __driver_probe_device+0x1f8/0x400\n[ +0.000009] driver_probe_device+0x68/0x1b0\n[ +0.000009] __driver_attach+0x20c/0x480\n[ +0.000008] bus_for_each_dev+0x114/0x1b0\n[ +0.000009] driver_attach+0x48/0x64\n[ +0.000008] bus_add_driver+0x390/0x564\n[ +0.000009] driver_register+0x1a8/0x3e4\n[ +0.000009] __platform_driver_register+0x6c/0x94\n[ +0.000008] meson_drm_platform_driver_init+0x3c/0x1000 [meson_drm]\n[ +0.000027] do_one_initcall+0xc4/0x2b0\n[ +0.000011] do_init_module+0x154/0x570\n[ +0.000011] load_module+0x1a78/0x1ea4\n[ +0.000008] __do_sys_init_module+0x184/0x1cc\n[ +0.000009] __arm64_sys_init_module+0x78/0xb0\n[ +0.000009] invoke_syscall+0x74/0x260\n[ +0.000009] el0_svc_common.constprop.0+0xcc/0x260\n[ +0.000008] do_el0_svc+0x50/0x70\n[ +0.000007] el0_svc+0x68/0x1a0\n[ +0.000012] el0t_64_sync_handler+0x11c/0x150\n[ +0.000008] el0t_64_sync+0x18c/0x190\n\n[ +0.000016] Allocated by task 879:\n[ +0.000008] kasan_save_stack+0x2c/0x5c\n[ +0.000011] __kasan_kmalloc+0x90/0xd0\n[ +0.000007] __kmalloc+0x278/0x4a0\n[ +0.000011] mpi_resize+0x13c/0x1d0\n[ +0.000011] mpi_powm+0xd24/0x1570\n[ +0.000009] rsa_enc+0x1a4/0x30c\n[ +0.000009] pkcs1pad_verify+0x3f0/0x580\n[ +0.000009] public_key_verify_signature+0x7a8/0xba4\n[ +0.000010] public_key_verify_signature_2+0x40/0x60\n[ +0.000008] verify_signature+0xb4/0x114\n[ +0.000008] pkcs7_validate_trust_one.constprop.0+0x3b8/0x574\n[ +0.000009] pkcs7_validate_trust+0xb8/0x15c\n[ +0.000008] verify_pkcs7_message_sig+0xec/0x1b0\n[ +0.000012] verify_pkcs7_signature+0x78/0xac\n[ +0.000007] mod_verify_sig+0x110/0x190\n[ +0.000009] module_sig_check+0x114/0x1e0\n[ +0.000009] load_module+0xa0/0x1ea4\n[ +0.000008] __do_sys_init_module+0x184/0x1cc\n[ +0.000008] __arm64_sys_init_module+0x78/0xb0\n[ +0.000008] invoke_syscall+0x74/0x260\n[ +0.000009] el0_svc_common.constprop.0+0x1a8/0x260\n[ +0.000008] do_el0_svc+0x50/0x70\n[ +0.000007] el0_svc+0x68/0x1a0\n[ +0.000009] el0t_64_sync_handler+0x11c/0x150\n[ +0.000009] el0t_64\n---truncated---"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/09847723c12fc2753749cec3939a02ee92dac468",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/de2b6ebe0cb7746b5b6b35d79e150d934392b958",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/fc1fd114dde3d2623ac37676df3d74ffeedb0da8",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-502xx/CVE-2022-50257.json
+53
View File
@@ -0,0 +1,53 @@
{
"id": "CVE-2022-50257",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T14:15:36.487",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen/gntdev: Prevent leaking grants\n\nPrior to this commit, if a grant mapping operation failed partially,\nsome of the entries in the map_ops array would be invalid, whereas all\nof the entries in the kmap_ops array would be valid. This in turn would\ncause the following logic in gntdev_map_grant_pages to become invalid:\n\n for (i = 0; i < map->count; i++) {\n if (map->map_ops[i].status == GNTST_okay) {\n map->unmap_ops[i].handle = map->map_ops[i].handle;\n if (!use_ptemod)\n alloced++;\n }\n if (use_ptemod) {\n if (map->kmap_ops[i].status == GNTST_okay) {\n if (map->map_ops[i].status == GNTST_okay)\n alloced++;\n map->kunmap_ops[i].handle = map->kmap_ops[i].handle;\n }\n }\n }\n ...\n atomic_add(alloced, &map->live_grants);\n\nAssume that use_ptemod is true (i.e., the domain mapping the granted\npages is a paravirtualized domain). In the code excerpt above, note that\nthe \"alloced\" variable is only incremented when both kmap_ops[i].status\nand map_ops[i].status are set to GNTST_okay (i.e., both mapping\noperations are successful). However, as also noted above, there are\ncases where a grant mapping operation fails partially, breaking the\nassumption of the code excerpt above.\n\nThe aforementioned causes map->live_grants to be incorrectly set. In\nsome cases, all of the map_ops mappings fail, but all of the kmap_ops\nmappings succeed, meaning that live_grants may remain zero. This in turn\nmakes it impossible to unmap the successfully grant-mapped pages pointed\nto by kmap_ops, because unmap_grant_pages has the following snippet of\ncode at its beginning:\n\n if (atomic_read(&map->live_grants) == 0)\n return; /* Nothing to do */\n\nIn other cases where only some of the map_ops mappings fail but all\nkmap_ops mappings succeed, live_grants is made positive, but when the\nuser requests unmapping the grant-mapped pages, __unmap_grant_pages_done\nwill then make map->live_grants negative, because the latter function\ndoes not check if all of the pages that were requested to be unmapped\nwere actually unmapped, and the same function unconditionally subtracts\n\"data->count\" (i.e., a value that can be greater than map->live_grants)\nfrom map->live_grants. The side effects of a negative live_grants value\nhave not been studied.\n\nThe net effect of all of this is that grant references are leaked in one\nof the above conditions. In Qubes OS v4.1 (which uses Xen's grant\nmechanism extensively for X11 GUI isolation), this issue manifests\nitself with warning messages like the following to be printed out by the\nLinux kernel in the VM that had granted pages (that contain X11 GUI\nwindow data) to dom0: \"g.e. 0x1234 still pending\", especially after the\nuser rapidly resizes GUI VM windows (causing some grant-mapping\noperations to partially or completely fail, due to the fact that the VM\nunshares some of the pages as part of the window resizing, making the\npages impossible to grant-map from dom0).\n\nThe fix for this issue involves counting all successful map_ops and\nkmap_ops mappings separately, and then adding the sum to live_grants.\nDuring unmapping, only the number of successfully unmapped grants is\nsubtracted from live_grants. The code is also modified to check for\nnegative live_grants values after the subtraction and warn the user."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/0991028cd49567d7016d1b224fe0117c35059f86",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/0bccddd9b8f03ad57bb738f0d3da8845d4e1e579",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/1cb73704cb4778299609634a790a80daba582f7d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/273f6a4f71be12e2ec80a4919837d6e4fa933a04",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/3d056d81b93a787613eda44aeb21fc14c3392b34",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/49bb053b1ec367b6883030eb2cca696e91435679",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/49db6cb81400ba863e1a85e55fcdf1031807c23f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b043f2cab100bed3e0a999dcf38cc05b1e4a7e41",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/cb1ccfe7655380f77a58b340072f5f40bc285902",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-502xx/CVE-2022-50258.json
+49
View File
@@ -0,0 +1,49 @@
{
"id": "CVE-2022-50258",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T14:15:36.617",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds()\n\nThis patch fixes a stack-out-of-bounds read in brcmfmac that occurs\nwhen 'buf' that is not null-terminated is passed as an argument of\nstrsep() in brcmf_c_preinit_dcmds(). This buffer is filled with a firmware\nversion string by memcpy() in brcmf_fil_iovar_data_get().\nThe patch ensures buf is null-terminated.\n\nFound by a modified version of syzkaller.\n\n[ 47.569679][ T1897] brcmfmac: brcmf_fw_alloc_request: using brcm/brcmfmac43236b for chip BCM43236/3\n[ 47.582839][ T1897] brcmfmac: brcmf_c_process_clm_blob: no clm_blob available (err=-2), device may have limited channels available\n[ 47.601565][ T1897] ==================================================================\n[ 47.602574][ T1897] BUG: KASAN: stack-out-of-bounds in strsep+0x1b2/0x1f0\n[ 47.603447][ T1897] Read of size 1 at addr ffffc90001f6f000 by task kworker/0:2/1897\n[ 47.604336][ T1897]\n[ 47.604621][ T1897] CPU: 0 PID: 1897 Comm: kworker/0:2 Tainted: G O 5.14.0+ #131\n[ 47.605617][ T1897] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014\n[ 47.606907][ T1897] Workqueue: usb_hub_wq hub_event\n[ 47.607453][ T1897] Call Trace:\n[ 47.607801][ T1897] dump_stack_lvl+0x8e/0xd1\n[ 47.608295][ T1897] print_address_description.constprop.0.cold+0xf/0x334\n[ 47.609009][ T1897] ? strsep+0x1b2/0x1f0\n[ 47.609434][ T1897] ? strsep+0x1b2/0x1f0\n[ 47.609863][ T1897] kasan_report.cold+0x83/0xdf\n[ 47.610366][ T1897] ? strsep+0x1b2/0x1f0\n[ 47.610882][ T1897] strsep+0x1b2/0x1f0\n[ 47.611300][ T1897] ? brcmf_fil_iovar_data_get+0x3a/0xf0\n[ 47.611883][ T1897] brcmf_c_preinit_dcmds+0x995/0xc40\n[ 47.612434][ T1897] ? brcmf_c_set_joinpref_default+0x100/0x100\n[ 47.613078][ T1897] ? rcu_read_lock_sched_held+0xa1/0xd0\n[ 47.613662][ T1897] ? rcu_read_lock_bh_held+0xb0/0xb0\n[ 47.614208][ T1897] ? lock_acquire+0x19d/0x4e0\n[ 47.614704][ T1897] ? find_held_lock+0x2d/0x110\n[ 47.615236][ T1897] ? brcmf_usb_deq+0x1a7/0x260\n[ 47.615741][ T1897] ? brcmf_usb_rx_fill_all+0x5a/0xf0\n[ 47.616288][ T1897] brcmf_attach+0x246/0xd40\n[ 47.616758][ T1897] ? wiphy_new_nm+0x1703/0x1dd0\n[ 47.617280][ T1897] ? kmemdup+0x43/0x50\n[ 47.617720][ T1897] brcmf_usb_probe+0x12de/0x1690\n[ 47.618244][ T1897] ? brcmf_usbdev_qinit.constprop.0+0x470/0x470\n[ 47.618901][ T1897] usb_probe_interface+0x2aa/0x760\n[ 47.619429][ T1897] ? usb_probe_device+0x250/0x250\n[ 47.619950][ T1897] really_probe+0x205/0xb70\n[ 47.620435][ T1897] ? driver_allows_async_probing+0x130/0x130\n[ 47.621048][ T1897] __driver_probe_device+0x311/0x4b0\n[ 47.621595][ T1897] ? driver_allows_async_probing+0x130/0x130\n[ 47.622209][ T1897] driver_probe_device+0x4e/0x150\n[ 47.622739][ T1897] __device_attach_driver+0x1cc/0x2a0\n[ 47.623287][ T1897] bus_for_each_drv+0x156/0x1d0\n[ 47.623796][ T1897] ? bus_rescan_devices+0x30/0x30\n[ 47.624309][ T1897] ? lockdep_hardirqs_on_prepare+0x273/0x3e0\n[ 47.624907][ T1897] ? trace_hardirqs_on+0x46/0x160\n[ 47.625437][ T1897] __device_attach+0x23f/0x3a0\n[ 47.625924][ T1897] ? device_bind_driver+0xd0/0xd0\n[ 47.626433][ T1897] ? kobject_uevent_env+0x287/0x14b0\n[ 47.627057][ T1897] bus_probe_device+0x1da/0x290\n[ 47.627557][ T1897] device_add+0xb7b/0x1eb0\n[ 47.628027][ T1897] ? wait_for_completion+0x290/0x290\n[ 47.628593][ T1897] ? __fw_devlink_link_to_suppliers+0x5a0/0x5a0\n[ 47.629249][ T1897] usb_set_configuration+0xf59/0x16f0\n[ 47.629829][ T1897] usb_generic_driver_probe+0x82/0xa0\n[ 47.630385][ T1897] usb_probe_device+0xbb/0x250\n[ 47.630927][ T1897] ? usb_suspend+0x590/0x590\n[ 47.631397][ T1897] really_probe+0x205/0xb70\n[ 47.631855][ T1897] ? driver_allows_async_probing+0x130/0x130\n[ 47.632469][ T1897] __driver_probe_device+0x311/0x4b0\n[ 47.633002][ \n---truncated---"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/0a06cadcc2a0044e4a117cc0e61436fc3a0dad69",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/17dbe90e13f52848c460d253f15b765038ec6dc0",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/3a3a5e3f94068cd562d62a57da6983c8cd07d53c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/881f50d76c3892262730ddf5c894eb00310e736c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/89243a7b0ea19606ba1c2873c9d569026ccb344f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ba166e0ebdde3dfa833f0a3edaf2b2934d4a87f7",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d481fd6064bf215d7c5068e15aa390c3b16c9cd0",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d6ef66194bb4a6c18f5b9649bf62597909b040e4",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-502xx/CVE-2022-50259.json
+41
View File
@@ -0,0 +1,41 @@
{
"id": "CVE-2022-50259",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T14:15:36.750",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: fix race in sock_map_free()\n\nsock_map_free() calls release_sock(sk) without owning a reference\non the socket. This can cause use-after-free as syzbot found [1]\n\nJakub Sitnicki already took care of a similar issue\nin sock_hash_free() in commit 75e68e5bf2c7 (\"bpf, sockhash:\nSynchronize delete from bucket list on map free\")\n\n[1]\nrefcount_t: decrement hit 0; leaking memory.\nWARNING: CPU: 0 PID: 3785 at lib/refcount.c:31 refcount_warn_saturate+0x17c/0x1a0 lib/refcount.c:31\nModules linked in:\nCPU: 0 PID: 3785 Comm: kworker/u4:6 Not tainted 6.1.0-rc7-syzkaller-00103-gef4d3ea40565 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022\nWorkqueue: events_unbound bpf_map_free_deferred\nRIP: 0010:refcount_warn_saturate+0x17c/0x1a0 lib/refcount.c:31\nCode: 68 8b 31 c0 e8 75 71 15 fd 0f 0b e9 64 ff ff ff e8 d9 6e 4e fd c6 05 62 9c 3d 0a 01 48 c7 c7 80 bb 68 8b 31 c0 e8 54 71 15 fd <0f> 0b e9 43 ff ff ff 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c a2 fe ff\nRSP: 0018:ffffc9000456fb60 EFLAGS: 00010246\nRAX: eae59bab72dcd700 RBX: 0000000000000004 RCX: ffff8880207057c0\nRDX: 0000000000000000 RSI: 0000000000000201 RDI: 0000000000000000\nRBP: 0000000000000004 R08: ffffffff816fdabd R09: fffff520008adee5\nR10: fffff520008adee5 R11: 1ffff920008adee4 R12: 0000000000000004\nR13: dffffc0000000000 R14: ffff88807b1c6c00 R15: 1ffff1100f638dcf\nFS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000001b30c30000 CR3: 000000000d08e000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n<TASK>\n__refcount_dec include/linux/refcount.h:344 [inline]\nrefcount_dec include/linux/refcount.h:359 [inline]\n__sock_put include/net/sock.h:779 [inline]\ntcp_release_cb+0x2d0/0x360 net/ipv4/tcp_output.c:1092\nrelease_sock+0xaf/0x1c0 net/core/sock.c:3468\nsock_map_free+0x219/0x2c0 net/core/sock_map.c:356\nprocess_one_work+0x81c/0xd10 kernel/workqueue.c:2289\nworker_thread+0xb14/0x1330 kernel/workqueue.c:2436\nkthread+0x266/0x300 kernel/kthread.c:376\nret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306\n</TASK>"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/0a182f8d607464911756b4dbef5d6cad8de22469",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/4cabc3af4a6f36c222fecb15858c1060e59218e7",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/5c3568166129bc73fd6b37748d2d8f95cd8f22f3",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a443c55d96dede82a724df6e70a318ad15c199e1",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/be719496ae6a7fc325e9e5056a52f63ebc84cc0c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e8b2b392a646bf5cb9413c1cc7a39d99c1b65a62",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-502xx/CVE-2022-50260.json
+29
View File
@@ -0,0 +1,29 @@
{
"id": "CVE-2022-50260",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T14:15:36.873",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm: Make .remove and .shutdown HW shutdown consistent\n\nDrivers' .remove and .shutdown callbacks are executed on different code\npaths. The former is called when a device is removed from the bus, while\nthe latter is called at system shutdown time to quiesce the device.\n\nThis means that some overlap exists between the two, because both have to\ntake care of properly shutting down the hardware. But currently the logic\nused in these two callbacks isn't consistent in msm drivers, which could\nlead to kernel panic.\n\nFor example, on .remove the component is deleted and its .unbind callback\nleads to the hardware being shutdown but only if the DRM device has been\nmarked as registered.\n\nThat check doesn't exist in the .shutdown logic and this can lead to the\ndriver calling drm_atomic_helper_shutdown() for a DRM device that hasn't\nbeen properly initialized.\n\nA situation like this can happen if drivers for expected sub-devices fail\nto probe, since the .bind callback will never be executed. If that is the\ncase, drm_atomic_helper_shutdown() will attempt to take mutexes that are\nonly initialized if drm_mode_config_init() is called during a device bind.\n\nThis bug was attempted to be fixed in commit 623f279c7781 (\"drm/msm: fix\nshutdown hook in case GPU components failed to bind\"), but unfortunately\nit still happens in some cases as the one mentioned above, i.e:\n\n systemd-shutdown[1]: Powering off.\n kvm: exiting hardware virtualization\n platform wifi-firmware.0: Removing from iommu group 12\n platform video-firmware.0: Removing from iommu group 10\n ------------[ cut here ]------------\n WARNING: CPU: 6 PID: 1 at drivers/gpu/drm/drm_modeset_lock.c:317 drm_modeset_lock_all_ctx+0x3c4/0x3d0\n ...\n Hardware name: Google CoachZ (rev3+) (DT)\n pstate: a0400009 (NzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n pc : drm_modeset_lock_all_ctx+0x3c4/0x3d0\n lr : drm_modeset_lock_all_ctx+0x48/0x3d0\n sp : ffff80000805bb80\n x29: ffff80000805bb80 x28: ffff327c00128000 x27: 0000000000000000\n x26: 0000000000000000 x25: 0000000000000001 x24: ffffc95d820ec030\n x23: ffff327c00bbd090 x22: ffffc95d8215eca0 x21: ffff327c039c5800\n x20: ffff327c039c5988 x19: ffff80000805bbe8 x18: 0000000000000034\n x17: 000000040044ffff x16: ffffc95d80cac920 x15: 0000000000000000\n x14: 0000000000000315 x13: 0000000000000315 x12: 0000000000000000\n x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000\n x8 : ffff80000805bc28 x7 : 0000000000000000 x6 : 0000000000000000\n x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000\n x2 : ffff327c00128000 x1 : 0000000000000000 x0 : ffff327c039c59b0\n Call trace:\n drm_modeset_lock_all_ctx+0x3c4/0x3d0\n drm_atomic_helper_shutdown+0x70/0x134\n msm_drv_shutdown+0x30/0x40\n platform_shutdown+0x28/0x40\n device_shutdown+0x148/0x350\n kernel_power_off+0x38/0x80\n __do_sys_reboot+0x288/0x2c0\n __arm64_sys_reboot+0x28/0x34\n invoke_syscall+0x48/0x114\n el0_svc_common.constprop.0+0x44/0xec\n do_el0_svc+0x2c/0xc0\n el0_svc+0x2c/0x84\n el0t_64_sync_handler+0x11c/0x150\n el0t_64_sync+0x18c/0x190\n ---[ end trace 0000000000000000 ]---\n Unable to handle kernel NULL pointer dereference at virtual address 0000000000000018\n Mem abort info:\n ESR = 0x0000000096000004\n EC = 0x25: DABT (current EL), IL = 32 bits\n SET = 0, FnV = 0\n EA = 0, S1PTW = 0\n FSC = 0x04: level 0 translation fault\n Data abort info:\n ISV = 0, ISS = 0x00000004\n CM = 0, WnR = 0\n user pgtable: 4k pages, 48-bit VAs, pgdp=000000010eab1000\n [0000000000000018] pgd=0000000000000000, p4d=0000000000000000\n Internal error: Oops: 96000004 [#1] PREEMPT SMP\n ...\n Hardware name: Google CoachZ (rev3+) (DT)\n pstate: a0400009 (NzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n pc : ww_mutex_lock+0x28/0x32c\n lr : drm_modeset_lock_all_ctx+0x1b0/0x3d0\n sp : ffff80000805bb50\n x29: ffff80000805bb50 x28: ffff327c00128000 x27: 0000000000000000\n x26: 00000\n---truncated---"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/0a58d2ae572adaec8d046f8d35b40c2c32ac7468",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/0e6649a2e31ac157c711d583ec8f5ec59da5de0e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/26f9a766f87b33c50ed400a9500cc1dc9aced953",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-502xx/CVE-2022-50261.json
+53
View File
@@ -0,0 +1,53 @@
{
"id": "CVE-2022-50261",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T14:15:36.997",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/sti: Fix return type of sti_{dvo,hda,hdmi}_connector_mode_valid()\n\nWith clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG),\nindirect call targets are validated against the expected function\npointer prototype to make sure the call target is valid to help mitigate\nROP attacks. If they are not identical, there is a failure at run time,\nwhich manifests as either a kernel panic or thread getting killed. A\nproposed warning in clang aims to catch these at compile time, which\nreveals:\n\n drivers/gpu/drm/sti/sti_hda.c:637:16: error: incompatible function pointer types initializing 'enum drm_mode_status (*)(struct drm_connector *, struct drm_display_mode *)' with an expression of type 'int (struct drm_connector *, struct drm_display_mode *)' [-Werror,-Wincompatible-function-pointer-types-strict]\n .mode_valid = sti_hda_connector_mode_valid,\n ^~~~~~~~~~~~~~~~~~~~~~~~~~~~\n drivers/gpu/drm/sti/sti_dvo.c:376:16: error: incompatible function pointer types initializing 'enum drm_mode_status (*)(struct drm_connector *, struct drm_display_mode *)' with an expression of type 'int (struct drm_connector *, struct drm_display_mode *)' [-Werror,-Wincompatible-function-pointer-types-strict]\n .mode_valid = sti_dvo_connector_mode_valid,\n ^~~~~~~~~~~~~~~~~~~~~~~~~~~~\n drivers/gpu/drm/sti/sti_hdmi.c:1035:16: error: incompatible function pointer types initializing 'enum drm_mode_status (*)(struct drm_connector *, struct drm_display_mode *)' with an expression of type 'int (struct drm_connector *, struct drm_display_mode *)' [-Werror,-Wincompatible-function-pointer-types-strict]\n .mode_valid = sti_hdmi_connector_mode_valid,\n ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\n->mode_valid() in 'struct drm_connector_helper_funcs' expects a return\ntype of 'enum drm_mode_status', not 'int'. Adjust the return type of\nsti_{dvo,hda,hdmi}_connector_mode_valid() to match the prototype's to\nresolve the warning and CFI failure."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/04371a75a58422a301a9ff9ae3babd310ac3bb3f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/0ad811cc08a937d875cbad0149c1bab17f84ba05",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/511b48ee8e4aec2d03d2af06b363d9eb3230b017",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6e3c4d3fa5d458d685561ecbaf8daa9dba14979e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8f9941dea3a70b73f2063f9dcc4aaae6af03c5ba",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a075c21ee026f4a74f9fce5928ea3c8d18a8af13",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b2c92b2a3801b09b709cbefd9a9e4944b72400bf",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b4307c7d35e346b909edfdc1f280902150570bb6",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e578b0906b6a81479cd5b5b6c848a7096addf5e9",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-502xx/CVE-2022-50262.json
+33
View File
@@ -0,0 +1,33 @@
{
"id": "CVE-2022-50262",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:36.080",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: Validate BOOT record_size\n\nWhen the NTFS BOOT record_size field < 0, it represents a\nshift value. However, there is no sanity check on the shift result\nand the sbi->record_bits calculation through blksize_bits() assumes\nthe size always > 256, which could lead to NPD while mounting a\nmalformed NTFS image.\n\n[ 318.675159] BUG: kernel NULL pointer dereference, address: 0000000000000158\n[ 318.675682] #PF: supervisor read access in kernel mode\n[ 318.675869] #PF: error_code(0x0000) - not-present page\n[ 318.676246] PGD 0 P4D 0\n[ 318.676502] Oops: 0000 [#1] PREEMPT SMP NOPTI\n[ 318.676934] CPU: 0 PID: 259 Comm: mount Not tainted 5.19.0 #5\n[ 318.677289] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014\n[ 318.678136] RIP: 0010:ni_find_attr+0x2d/0x1c0\n[ 318.678656] Code: 89 ca 4d 89 c7 41 56 41 55 41 54 41 89 cc 55 48 89 fd 53 48 89 d3 48 83 ec 20 65 48 8b 04 25 28 00 00 00 48 89 44 24 180\n[ 318.679848] RSP: 0018:ffffa6c8c0297bd8 EFLAGS: 00000246\n[ 318.680104] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000080\n[ 318.680790] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\n[ 318.681679] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000\n[ 318.682577] R10: 0000000000000000 R11: 0000000000000005 R12: 0000000000000080\n[ 318.683015] R13: ffff8d5582e68400 R14: 0000000000000100 R15: 0000000000000000\n[ 318.683618] FS: 00007fd9e1c81e40(0000) GS:ffff8d55fdc00000(0000) knlGS:0000000000000000\n[ 318.684280] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 318.684651] CR2: 0000000000000158 CR3: 0000000002e1a000 CR4: 00000000000006f0\n[ 318.685623] Call Trace:\n[ 318.686607] <TASK>\n[ 318.686872] ? ntfs_alloc_inode+0x1a/0x60\n[ 318.687235] attr_load_runs_vcn+0x2b/0xa0\n[ 318.687468] mi_read+0xbb/0x250\n[ 318.687576] ntfs_iget5+0x114/0xd90\n[ 318.687750] ntfs_fill_super+0x588/0x11b0\n[ 318.687953] ? put_ntfs+0x130/0x130\n[ 318.688065] ? snprintf+0x49/0x70\n[ 318.688164] ? put_ntfs+0x130/0x130\n[ 318.688256] get_tree_bdev+0x16a/0x260\n[ 318.688407] vfs_get_tree+0x20/0xb0\n[ 318.688519] path_mount+0x2dc/0x9b0\n[ 318.688877] do_mount+0x74/0x90\n[ 318.689142] __x64_sys_mount+0x89/0xd0\n[ 318.689636] do_syscall_64+0x3b/0x90\n[ 318.689998] entry_SYSCALL_64_after_hwframe+0x63/0xcd\n[ 318.690318] RIP: 0033:0x7fd9e133c48a\n[ 318.690687] Code: 48 8b 0d 11 fa 2a 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 008\n[ 318.691357] RSP: 002b:00007ffd374406c8 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5\n[ 318.691632] RAX: ffffffffffffffda RBX: 0000564d0b051080 RCX: 00007fd9e133c48a\n[ 318.691920] RDX: 0000564d0b051280 RSI: 0000564d0b051300 RDI: 0000564d0b0596a0\n[ 318.692123] RBP: 0000000000000000 R08: 0000564d0b0512a0 R09: 0000000000000020\n[ 318.692349] R10: 00000000c0ed0000 R11: 0000000000000202 R12: 0000564d0b0596a0\n[ 318.692673] R13: 0000564d0b051280 R14: 0000000000000000 R15: 00000000ffffffff\n[ 318.693007] </TASK>\n[ 318.693271] Modules linked in:\n[ 318.693614] CR2: 0000000000000158\n[ 318.694446] ---[ end trace 0000000000000000 ]---\n[ 318.694779] RIP: 0010:ni_find_attr+0x2d/0x1c0\n[ 318.694952] Code: 89 ca 4d 89 c7 41 56 41 55 41 54 41 89 cc 55 48 89 fd 53 48 89 d3 48 83 ec 20 65 48 8b 04 25 28 00 00 00 48 89 44 24 180\n[ 318.696042] RSP: 0018:ffffa6c8c0297bd8 EFLAGS: 00000246\n[ 318.696531] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000080\n[ 318.698114] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\n[ 318.699286] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000\n[ 318.699795] R10: 0000000000000000 R11: 0000000000000005 R12: 0000000000000080\n[ 318.700236] R13: ffff8d5582e68400 R14: 0000000000000100 R15: 0000000000000000\n[ 318.700973] FS: 00007fd9e1c81e40(0000) GS:ffff8d55fdc00000(0000) knlGS:0000000000000000\n[\n---truncated---"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/0b66046266690454dc04e6307bcff4a5605b42a1",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8702e0dc987014f6d77740b693340f91344fd0ae",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/af7a195deae349f15baa765d000a5188920d61dd",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/db91a9c59162a9c56792ded88160442c0a2dabd5",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-502xx/CVE-2022-50263.json
+29
View File
@@ -0,0 +1,29 @@
{
"id": "CVE-2022-50263",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:36.560",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvdpasim: fix memory leak when freeing IOTLBs\n\nAfter commit bda324fd037a (\"vdpasim: control virtqueue support\"),\nvdpasim->iommu became an array of IOTLB, so we should clean the\nmappings of each free one by one instead of just deleting the ranges\nin the first IOTLB which may leak maps."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/0b7a04a30eef20e6b24926a45c0ce7906ae85bd6",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/16b22e27fba6fd816d0dcb98f42cc71f0836c27e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/54b210c90d2803a9f1c8fd2f0d08e90172e9a06d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-502xx/CVE-2022-50264.json
+41
View File
@@ -0,0 +1,41 @@
{
"id": "CVE-2022-50264",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:36.667",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: socfpga: Fix memory leak in socfpga_gate_init()\n\nFree @socfpga_clk and @ops on the error path to avoid memory leak issue."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/0b8ba891ad4d1ef6bfa4c72efc83f9f9f855f68b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/3e8fd1d0fab4d5c9a50d225dddc207deac12f13a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6f2198914fb9aac286a6ff6cf09b23752141e04f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9de42116fc4540f6a1ceb51fd037b734ab7be12e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9f9bb9f5ba9fd501a90f255eb746b4cf2ceeaaae",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/bd72ab5e6fc1c4d3e6b84636141d26a41b977b03",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-502xx/CVE-2022-50265.json
+49
View File
@@ -0,0 +1,49 @@
{
"id": "CVE-2022-50265",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:37.220",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nkcm: annotate data-races around kcm->rx_wait\n\nkcm->rx_psock can be read locklessly in kcm_rfree().\nAnnotate the read and writes accordingly.\n\nsyzbot reported:\n\nBUG: KCSAN: data-race in kcm_rcv_strparser / kcm_rfree\n\nwrite to 0xffff88810784e3d0 of 1 bytes by task 1823 on cpu 1:\nreserve_rx_kcm net/kcm/kcmsock.c:283 [inline]\nkcm_rcv_strparser+0x250/0x3a0 net/kcm/kcmsock.c:363\n__strp_recv+0x64c/0xd20 net/strparser/strparser.c:301\nstrp_recv+0x6d/0x80 net/strparser/strparser.c:335\ntcp_read_sock+0x13e/0x5a0 net/ipv4/tcp.c:1703\nstrp_read_sock net/strparser/strparser.c:358 [inline]\ndo_strp_work net/strparser/strparser.c:406 [inline]\nstrp_work+0xe8/0x180 net/strparser/strparser.c:415\nprocess_one_work+0x3d3/0x720 kernel/workqueue.c:2289\nworker_thread+0x618/0xa70 kernel/workqueue.c:2436\nkthread+0x1a9/0x1e0 kernel/kthread.c:376\nret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306\n\nread to 0xffff88810784e3d0 of 1 bytes by task 17869 on cpu 0:\nkcm_rfree+0x121/0x220 net/kcm/kcmsock.c:181\nskb_release_head_state+0x8e/0x160 net/core/skbuff.c:841\nskb_release_all net/core/skbuff.c:852 [inline]\n__kfree_skb net/core/skbuff.c:868 [inline]\nkfree_skb_reason+0x5c/0x260 net/core/skbuff.c:891\nkfree_skb include/linux/skbuff.h:1216 [inline]\nkcm_recvmsg+0x226/0x2b0 net/kcm/kcmsock.c:1161\n____sys_recvmsg+0x16c/0x2e0\n___sys_recvmsg net/socket.c:2743 [inline]\ndo_recvmmsg+0x2f1/0x710 net/socket.c:2837\n__sys_recvmmsg net/socket.c:2916 [inline]\n__do_sys_recvmmsg net/socket.c:2939 [inline]\n__se_sys_recvmmsg net/socket.c:2932 [inline]\n__x64_sys_recvmmsg+0xde/0x160 net/socket.c:2932\ndo_syscall_x64 arch/x86/entry/common.c:50 [inline]\ndo_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80\nentry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nvalue changed: 0x01 -> 0x00\n\nReported by Kernel Concurrency Sanitizer on:\nCPU: 0 PID: 17869 Comm: syz-executor.2 Not tainted 6.1.0-rc1-syzkaller-00010-gbb1a1146467a-dirty #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/0c745b5141a45a076f1cb9772a399f7ebcb0948a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/2733fb2ad5bfbe6538f2f93a21f2504e3dba9d6a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/62086d1c4602e4f2ec07b975165afc2ed0ff1be9",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/663682cd3192dd4f3547b7890a4391c72441001d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9ae47f11493509cde707af8ecc7eee04c8b8e635",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/dbc3a0b917c4f75292b1c0819c188e40fd3c8924",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e2a28807b1ceaa309164b92c38d73d12feea33df",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f1f7122bb2ef056afc6f91ce4c35ab6df1207c8d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-502xx/CVE-2022-50266.json
+29
View File
@@ -0,0 +1,29 @@
{
"id": "CVE-2022-50266",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:37.347",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nkprobes: Fix check for probe enabled in kill_kprobe()\n\nIn kill_kprobe(), the check whether disarm_kprobe_ftrace() needs to be\ncalled always fails. This is because before that we set the\nKPROBE_FLAG_GONE flag for kprobe so that \"!kprobe_disabled(p)\" is always\nfalse.\n\nThe disarm_kprobe_ftrace() call introduced by commit:\n\n 0cb2f1372baa (\"kprobes: Fix NULL pointer dereference at kprobe_ftrace_handler\")\n\nto fix the NULL pointer reference problem. When the probe is enabled, if\nwe do not disarm it, this problem still exists.\n\nFix it by putting the probe enabled check before setting the\nKPROBE_FLAG_GONE flag."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/0c76ef3f26d5ef2ac2c21b47e7620cff35809fbb",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c909985dd0c0f74b61e3f8f0e04bf8aa9c8b97c7",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f20a067f13106565816b4b6a6b665b2088a63824",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-502xx/CVE-2022-50267.json
+33
View File
@@ -0,0 +1,33 @@
{
"id": "CVE-2022-50267",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:37.460",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: rtsx_pci: fix return value check of mmc_add_host()\n\nmmc_add_host() may return error, if we ignore its return value, the memory\nthat allocated in mmc_alloc_host() will be leaked and it will lead a kernel\ncrash because of deleting not added device in the remove path.\n\nSo fix this by checking the return value and calling mmc_free_host() in the\nerror path, beside, runtime PM also needs be disabled."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/0c87db77423a282b3b38b8a6daf057b822680516",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/30dc645461dfc63e52b3af8ee4a98e17bf14bacf",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/5cd4e04eccaec140da6fa04db056a76282ee6852",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ffa9b2a79e3e959683efbad3f6db937eca9d38f5",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-502xx/CVE-2022-50268.json
+53
View File
@@ -0,0 +1,53 @@
{
"id": "CVE-2022-50268",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:37.580",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: moxart: fix return value check of mmc_add_host()\n\nmmc_add_host() may return error, if we ignore its return value, the memory\nthat allocated in mmc_alloc_host() will be leaked and it will lead a kernel\ncrash because of deleting not added device in the remove path.\n\nSo fix this by checking the return value and goto error path which will call\nmmc_free_host()."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/0ca18d09c744fb030ae9bc5836c3e357e0237dea",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/40aa73c70e8a5706f9cbe01409a5e51cc0f1750e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/7c3b301ca8b0cab392c71da8fcdfa499074f8e97",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8f8bb62c7c5c833758ef1563fe738afd579c3efe",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a4c765f5d8e58138cff69f1510b2e8942ec37022",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a94d466f31a5201995d39bc1208e2c09ab04f0bf",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b174f2b36c638fc7737df6c8aac1889a646be98f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c7e9a2059fb943fc3c3fa12261518fd72a0fc136",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f0502fe86a2db2336c9498d2de3e97f22dcf85ae",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-502xx/CVE-2022-50269.json
+33
View File
@@ -0,0 +1,33 @@
{
"id": "CVE-2022-50269",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:37.707",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vkms: Fix memory leak in vkms_init()\n\nA memory leak was reported after the vkms module install failed.\n\nunreferenced object 0xffff88810bc28520 (size 16):\n comm \"modprobe\", pid 9662, jiffies 4298009455 (age 42.590s)\n hex dump (first 16 bytes):\n 01 01 00 64 81 88 ff ff 00 00 dc 0a 81 88 ff ff ...d............\n backtrace:\n [<00000000e7561ff8>] kmalloc_trace+0x27/0x60\n [<000000000b1954a0>] 0xffffffffc45200a9\n [<00000000abbf1da0>] do_one_initcall+0xd0/0x4f0\n [<000000001505ee87>] do_init_module+0x1a4/0x680\n [<00000000958079ad>] load_module+0x6249/0x7110\n [<00000000117e4696>] __do_sys_finit_module+0x140/0x200\n [<00000000f74b12d2>] do_syscall_64+0x35/0x80\n [<000000008fc6fcde>] entry_SYSCALL_64_after_hwframe+0x46/0xb0\n\nThe reason is that the vkms_init() returns without checking the return\nvalue of vkms_create(), and if the vkms_create() failed, the config\nallocated at the beginning of vkms_init() is leaked.\n\n vkms_init()\n config = kmalloc(...) # config allocated\n ...\n return vkms_create() # vkms_create failed and config is leaked\n\nFix this problem by checking return value of vkms_create() and free the\nconfig if error happened."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/07ab77154d6fd2d67e465ab5ce30083709950f02",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/0d0b368b9d104b437e1f4850ae94bdb9a3601e89",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/bad13de764888b765ceaa4668893b52bd16653cc",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/bebd60ec3bf21062f103e32e6203c6daabdbd51b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-502xx/CVE-2022-50270.json
+29
View File
@@ -0,0 +1,29 @@
{
"id": "CVE-2022-50270",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:37.820",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix the assign logic of iocb\n\ncommit 18ae8d12991b (\"f2fs: show more DIO information in tracepoint\")\nintroduces iocb field in 'f2fs_direct_IO_enter' trace event\nAnd it only assigns the pointer and later it accesses its field\nin trace print log.\n\nUnable to handle kernel paging request at virtual address ffffffc04cef3d30\nMem abort info:\nESR = 0x96000007\nEC = 0x25: DABT (current EL), IL = 32 bits\n\n pc : trace_raw_output_f2fs_direct_IO_enter+0x54/0xa4\n lr : trace_raw_output_f2fs_direct_IO_enter+0x2c/0xa4\n sp : ffffffc0443cbbd0\n x29: ffffffc0443cbbf0 x28: ffffff8935b120d0 x27: ffffff8935b12108\n x26: ffffff8935b120f0 x25: ffffff8935b12100 x24: ffffff8935b110c0\n x23: ffffff8935b10000 x22: ffffff88859a936c x21: ffffff88859a936c\n x20: ffffff8935b110c0 x19: ffffff8935b10000 x18: ffffffc03b195060\n x17: ffffff8935b11e76 x16: 00000000000000cc x15: ffffffef855c4f2c\n x14: 0000000000000001 x13: 000000000000004e x12: ffff0000ffffff00\n x11: ffffffef86c350d0 x10: 00000000000010c0 x9 : 000000000fe0002c\n x8 : ffffffc04cef3d28 x7 : 7f7f7f7f7f7f7f7f x6 : 0000000002000000\n x5 : ffffff8935b11e9a x4 : 0000000000006250 x3 : ffff0a00ffffff04\n x2 : 0000000000000002 x1 : ffffffef86a0a31f x0 : ffffff8935b10000\n Call trace:\n trace_raw_output_f2fs_direct_IO_enter+0x54/0xa4\n print_trace_fmt+0x9c/0x138\n print_trace_line+0x154/0x254\n tracing_read_pipe+0x21c/0x380\n vfs_read+0x108/0x3ac\n ksys_read+0x7c/0xec\n __arm64_sys_read+0x20/0x30\n invoke_syscall+0x60/0x150\n el0_svc_common.llvm.1237943816091755067+0xb8/0xf8\n do_el0_svc+0x28/0xa0\n\nFix it by copying the required variables for printing and while at\nit fix the similar issue at some other places in the same file."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/0db18eec0d9a7ee525209e31e3ac2f673545b12f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b4244ca341ea95c52ee8fa93d04f5af3e584dd37",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d555aa37566c5c3728f2e52047a9722eae2aed93",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-502xx/CVE-2022-50271.json
+49
View File
@@ -0,0 +1,49 @@
{
"id": "CVE-2022-50271",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:37.930",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvhost/vsock: Use kvmalloc/kvfree for larger packets.\n\nWhen copying a large file over sftp over vsock, data size is usually 32kB,\nand kmalloc seems to fail to try to allocate 32 32kB regions.\n\n vhost-5837: page allocation failure: order:4, mode:0x24040c0\n Call Trace:\n [<ffffffffb6a0df64>] dump_stack+0x97/0xdb\n [<ffffffffb68d6aed>] warn_alloc_failed+0x10f/0x138\n [<ffffffffb68d868a>] ? __alloc_pages_direct_compact+0x38/0xc8\n [<ffffffffb664619f>] __alloc_pages_nodemask+0x84c/0x90d\n [<ffffffffb6646e56>] alloc_kmem_pages+0x17/0x19\n [<ffffffffb6653a26>] kmalloc_order_trace+0x2b/0xdb\n [<ffffffffb66682f3>] __kmalloc+0x177/0x1f7\n [<ffffffffb66e0d94>] ? copy_from_iter+0x8d/0x31d\n [<ffffffffc0689ab7>] vhost_vsock_handle_tx_kick+0x1fa/0x301 [vhost_vsock]\n [<ffffffffc06828d9>] vhost_worker+0xf7/0x157 [vhost]\n [<ffffffffb683ddce>] kthread+0xfd/0x105\n [<ffffffffc06827e2>] ? vhost_dev_set_owner+0x22e/0x22e [vhost]\n [<ffffffffb683dcd1>] ? flush_kthread_worker+0xf3/0xf3\n [<ffffffffb6eb332e>] ret_from_fork+0x4e/0x80\n [<ffffffffb683dcd1>] ? flush_kthread_worker+0xf3/0xf3\n\nWork around by doing kvmalloc instead."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/0d720c3f0a03e97867deab7e480ba3d3e19837ba",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/0e3f72931fc47bb81686020cc643cde5d9cd0bb8",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/36c9f340c60413e28f980c0224c4e9d35851526b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/7aac8c63f604e6a6a46560c0f0188cd0332cf320",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a99fc6d818161d6f1ff3307de8bf5237f6cc34d8",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b4a5905fd2ef841cd61e969ea692c213c2e5c1f7",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e28a4e7f0296824c61a81e7fd54ab48bad3e75ad",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e6d0152c95108651f1880c1ddfab47cb9e3e62d0",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-502xx/CVE-2022-50272.json
+53
View File
@@ -0,0 +1,53 @@
{
"id": "CVE-2022-50272",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:38.073",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()\n\nWei Chen reports a kernel bug as blew:\n\ngeneral protection fault, probably for non-canonical address\nKASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]\n...\nCall Trace:\n<TASK>\n__i2c_transfer+0x77e/0x1930 drivers/i2c/i2c-core-base.c:2109\ni2c_transfer+0x1d5/0x3d0 drivers/i2c/i2c-core-base.c:2170\ni2cdev_ioctl_rdwr+0x393/0x660 drivers/i2c/i2c-dev.c:297\ni2cdev_ioctl+0x75d/0x9f0 drivers/i2c/i2c-dev.c:458\nvfs_ioctl fs/ioctl.c:51 [inline]\n__do_sys_ioctl fs/ioctl.c:870 [inline]\n__se_sys_ioctl+0xfb/0x170 fs/ioctl.c:856\ndo_syscall_x64 arch/x86/entry/common.c:50 [inline]\ndo_syscall_64+0x3d/0x90 arch/x86/entry/common.c:80\nentry_SYSCALL_64_after_hwframe+0x63/0xcd\nRIP: 0033:0x7fd834a8bded\n\nIn az6027_i2c_xfer(), if msg[i].addr is 0x99,\na null-ptr-deref will caused when accessing msg[i].buf.\nFor msg[i].len is 0 and msg[i].buf is null.\n\nFix this by checking msg[i].len in az6027_i2c_xfer()."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/0ed554fd769a19ea8464bb83e9ac201002ef74ad",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/210fcf64be4db82c0e190e74b5111e4eef661a7a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/2b6a8a1a32746981044e7ab06649c804acb4068a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/559891d430e3f3a178040c4371ed419edbfa7d65",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6b60cf73a931af34b7a0a3f467a79d9fe0df2d70",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6fbc44731a4665cbe92a5090e9804a388a72214b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/7abfe467cd685f5da7ecb415441e45e3e4e2baa8",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8b256d23361c51aa4b7fdb71176c1ca50966fb39",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c712d1ccbfb787620422b437a5b8fac0802547bd",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-502xx/CVE-2022-50273.json
+41
View File
@@ -0,0 +1,41 @@
{
"id": "CVE-2022-50273",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:38.207",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to do sanity check on destination blkaddr during recovery\n\nAs Wenqing Liu reported in bugzilla:\n\nhttps://bugzilla.kernel.org/show_bug.cgi?id=216456\n\nloop5: detected capacity change from 0 to 131072\nF2FS-fs (loop5): recover_inode: ino = 6, name = hln, inline = 1\nF2FS-fs (loop5): recover_data: ino = 6 (i_size: recover) err = 0\nF2FS-fs (loop5): recover_inode: ino = 6, name = hln, inline = 1\nF2FS-fs (loop5): recover_data: ino = 6 (i_size: recover) err = 0\nF2FS-fs (loop5): recover_inode: ino = 6, name = hln, inline = 1\nF2FS-fs (loop5): recover_data: ino = 6 (i_size: recover) err = 0\nF2FS-fs (loop5): Bitmap was wrongly set, blk:5634\n------------[ cut here ]------------\nWARNING: CPU: 3 PID: 1013 at fs/f2fs/segment.c:2198\nRIP: 0010:update_sit_entry+0xa55/0x10b0 [f2fs]\nCall Trace:\n <TASK>\n f2fs_do_replace_block+0xa98/0x1890 [f2fs]\n f2fs_replace_block+0xeb/0x180 [f2fs]\n recover_data+0x1a69/0x6ae0 [f2fs]\n f2fs_recover_fsync_data+0x120d/0x1fc0 [f2fs]\n f2fs_fill_super+0x4665/0x61e0 [f2fs]\n mount_bdev+0x2cf/0x3b0\n legacy_get_tree+0xed/0x1d0\n vfs_get_tree+0x81/0x2b0\n path_mount+0x47e/0x19d0\n do_mount+0xce/0xf0\n __x64_sys_mount+0x12c/0x1a0\n do_syscall_64+0x38/0x90\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nIf we enable CONFIG_F2FS_CHECK_FS config, it will trigger a kernel panic\ninstead of warning.\n\nThe root cause is: in fuzzed image, SIT table is inconsistent with inode\nmapping table, result in triggering such warning during SIT table update.\n\nThis patch introduces a new flag DATA_GENERIC_ENHANCE_UPDATE, w/ this\nflag, data block recovery flow can check destination blkaddr's validation\nin SIT table, and skip f2fs_replace_block() to avoid inconsistent status."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/0ef4ca04a3f9223ff8bc440041c524b2123e09a3",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/3a4d24d746866dd45d970bd565ff3886e839366a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/68b1e607559d3dc85f94b0d738d7c4e8029b0cfa",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/73fb4bd2c055a393816f078f158cdd3025006f1d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8f0a47def4722c5fd8d6b9268b5ffed8a249e2db",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ed854f10e6afd5cbd5c3274d4c4df4bfe0ab4362",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-502xx/CVE-2022-50274.json
+49
View File
@@ -0,0 +1,49 @@
{
"id": "CVE-2022-50274",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:38.330",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: dvbdev: adopts refcnt to avoid UAF\n\ndvb_unregister_device() is known that prone to use-after-free.\nThat is, the cleanup from dvb_unregister_device() releases the dvb_device\neven if there are pointers stored in file->private_data still refer to it.\n\nThis patch adds a reference counter into struct dvb_device and delays its\ndeallocation until no pointer refers to the object."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/0fc044b2b5e2d05a1fa1fb0d7f270367a7855d79",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/219b44bf94203bd433aa91b7796475bf656348e5",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/2abd73433872194bccdf1432a0980e4ec5273c2a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6d18b44bb44e1f4d97dfe0efe92ac0f0984739c2",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/88a6f8a72d167294c0931c7874941bf37a41b6dd",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9945d05d6693710574f354c5dbddc47f5101eb77",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a2f0a08aa613176c9688c81d7b598a7779974991",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ac521bbe3d00fa574e66a9361763f2b37725bc97",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-502xx/CVE-2022-50275.json
+49
View File
@@ -0,0 +1,49 @@
{
"id": "CVE-2022-50275",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:38.457",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/radeon: Add the missed acpi_put_table() to fix memory leak\n\nWhen the radeon driver reads the bios information from ACPI\ntable in radeon_acpi_vfct_bios(), it misses to call acpi_put_table()\nto release the ACPI memory after the init, so add acpi_put_table()\nproperly to fix the memory leak.\n\nv2: fix text formatting (Alex)"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/10276a20be1115e1f76c189330da2992df980eee",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/4539e3211a9bd2418e76797718a4e60a7ae34fcf",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/4760fa67aff6bd8ef0b14c1fa04c295e734c7309",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/50113de0f1e913c0b733e21d3e61fe9c0f2e9d50",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6d25bc63708145c10f9c099d5c005602a7f2ef5f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9e203e437310f61fdf3c1107f41f85864cf4f6b1",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a0f26560be2c566b62331cb0eeffa52929aa4d44",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b4b30f56ec512e2c35fc0761bc90b0e519d8fa6e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-502xx/CVE-2022-50276.json
+41
View File
@@ -0,0 +1,41 @@
{
"id": "CVE-2022-50276",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:38.583",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: fix null pointer dereferencing in power_supply_get_battery_info\n\nwhen kmalloc() fail to allocate memory in kasprintf(), propname\nwill be NULL, strcmp() called by of_get_property() will cause\nnull pointer dereference.\n\nSo return ENOMEM if kasprintf() return NULL pointer."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/104bb8a663451404a26331263ce5b96c34504049",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/279af90e65cbdb3e5c4519b0043324d7876bc5ec",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/5beadb55f4e36fafe5d6df5dcd5f85d803f3f134",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8ea68b4e3fa9392ef9dae303abc8735a033c280f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b8131efb89d9f837c9244f900f0fc2699fd1181d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d21534ab4fd7883e1c8037a76671d4e8b6ea14cb",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-502xx/CVE-2022-50277.json
+29
View File
@@ -0,0 +1,29 @@
{
"id": "CVE-2022-50277",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:38.700",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: don't allow journal inode to have encrypt flag\n\nMounting a filesystem whose journal inode has the encrypt flag causes a\nNULL dereference in fscrypt_limit_io_blocks() when the 'inlinecrypt'\nmount option is used.\n\nThe problem is that when jbd2_journal_init_inode() calls bmap(), it\neventually finds its way into ext4_iomap_begin(), which calls\nfscrypt_limit_io_blocks(). fscrypt_limit_io_blocks() requires that if\nthe inode is encrypted, then its encryption key must already be set up.\nThat's not the case here, since the journal inode is never \"opened\" like\na normal file would be. Hence the crash.\n\nA reproducer is:\n\n mkfs.ext4 -F /dev/vdb\n debugfs -w /dev/vdb -R \"set_inode_field <8> flags 0x80808\"\n mount /dev/vdb /mnt -o inlinecrypt\n\nTo fix this, make ext4 consider journal inodes with the encrypt flag to\nbe invalid. (Note, maybe other flags should be rejected on the journal\ninode too. For now, this is just the minimal fix for the above issue.)\n\nI've marked this as fixing the commit that introduced the call to\nfscrypt_limit_io_blocks(), since that's what made an actual crash start\nbeing possible. But this fix could be applied to any version of ext4\nthat supports the encrypt feature."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/105c78e12468413e426625831faa7db4284e1fec",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/1f7a6626f611aa06d7907aa45b484708dd5ac8bc",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/bcc5057e1781a3ee889225480d995c3b5cbde555",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-502xx/CVE-2022-50278.json
+53
View File
@@ -0,0 +1,53 @@
{
"id": "CVE-2022-50278",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:38.817",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nPNP: fix name memory leak in pnp_alloc_dev()\n\nAfter commit 1fa5ae857bb1 (\"driver core: get rid of struct device's\nbus_id string array\"), the name of device is allocated dynamically,\nmove dev_set_name() after pnp_add_id() to avoid memory leak."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/110d7b0325c55ff3620073ba4201845f59e22ebf",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/1f50c7497a5f89de0c31f2edf086af41ff834320",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/290dd73b943c95c006df973257076ff163adf4d0",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/693a0c13c1f0c0fcaa1e38cb806cc0789bd415aa",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/81b024df4755e6bb6993b786584eca6eabbb9791",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/bbcf772216aa237036cc3ae3158288d0a95aaf4d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c12b314bb23dc0c83e03402cc84574700947e3b2",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/dac87e295cddc8ab316cff14ab2071b5221d84fa",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ea77b4b761cd75e5456f677311babfa0418f289a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-502xx/CVE-2022-50279.json
+45
View File
@@ -0,0 +1,45 @@
{
"id": "CVE-2022-50279",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:38.940",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit()\n\nThere is a global-out-of-bounds reported by KASAN:\n\n BUG: KASAN: global-out-of-bounds in\n _rtl8812ae_eq_n_byte.part.0+0x3d/0x84 [rtl8821ae]\n Read of size 1 at addr ffffffffa0773c43 by task NetworkManager/411\n\n CPU: 6 PID: 411 Comm: NetworkManager Tainted: G D\n 6.1.0-rc8+ #144 e15588508517267d37\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009),\n Call Trace:\n <TASK>\n ...\n kasan_report+0xbb/0x1c0\n _rtl8812ae_eq_n_byte.part.0+0x3d/0x84 [rtl8821ae]\n rtl8821ae_phy_bb_config.cold+0x346/0x641 [rtl8821ae]\n rtl8821ae_hw_init+0x1f5e/0x79b0 [rtl8821ae]\n ...\n </TASK>\n\nThe root cause of the problem is that the comparison order of\n\"prate_section\" in _rtl8812ae_phy_set_txpower_limit() is wrong. The\n_rtl8812ae_eq_n_byte() is used to compare the first n bytes of the two\nstrings from tail to head, which causes the problem. In the\n_rtl8812ae_phy_set_txpower_limit(), it was originally intended to meet\nthis requirement by carefully designing the comparison order.\nFor example, \"pregulation\" and \"pbandwidth\" are compared in order of\nlength from small to large, first is 3 and last is 4. However, the\ncomparison order of \"prate_section\" dose not obey such order requirement,\ntherefore when \"prate_section\" is \"HT\", when comparing from tail to head,\nit will lead to access out of bounds in _rtl8812ae_eq_n_byte(). As\nmentioned above, the _rtl8812ae_eq_n_byte() has the same function as\nstrcmp(), so just strcmp() is enough.\n\nFix it by removing _rtl8812ae_eq_n_byte() and use strcmp() barely.\nAlthough it can be fixed by adjusting the comparison order of\n\"prate_section\", this may cause the value of \"rate_section\" to not be\nfrom 0 to 5. In addition, commit \"21e4b0726dc6\" not only moved driver\nfrom staging to regular tree, but also added setting txpower limit\nfunction during the driver config phase, so the problem was introduced\nby this commit."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/057b52461dc005ecd85a3e4998913b1492ec0f72",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/0c962dcd6bf64b78eaffc09e497a2beb4e48bc32",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/117dbeda22ec5ea0918254d03b540ef8b8a64d53",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/1e950b9a841bc96e98ee25680d5c7aa305120be1",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/28ea268d95e57cdf6394a058f0d854206d478772",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f1fe40120de6ad4ffa8299fde035a5feba10d4fb",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/fc3442247716fc426bbcf62ed65e086e48a6d44f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-502xx/CVE-2022-50280.json
+53
View File
@@ -0,0 +1,53 @@
{
"id": "CVE-2022-50280",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:39.067",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npnode: terminate at peers of source\n\nThe propagate_mnt() function handles mount propagation when creating\nmounts and propagates the source mount tree @source_mnt to all\napplicable nodes of the destination propagation mount tree headed by\n@dest_mnt.\n\nUnfortunately it contains a bug where it fails to terminate at peers of\n@source_mnt when looking up copies of the source mount that become\nmasters for copies of the source mount tree mounted on top of slaves in\nthe destination propagation tree causing a NULL dereference.\n\nOnce the mechanics of the bug are understood it's easy to trigger.\nBecause of unprivileged user namespaces it is available to unprivileged\nusers.\n\nWhile fixing this bug we've gotten confused multiple times due to\nunclear terminology or missing concepts. So let's start this with some\nclarifications:\n\n* The terms \"master\" or \"peer\" denote a shared mount. A shared mount\n belongs to a peer group.\n\n* A peer group is a set of shared mounts that propagate to each other.\n They are identified by a peer group id. The peer group id is available\n in @shared_mnt->mnt_group_id.\n Shared mounts within the same peer group have the same peer group id.\n The peers in a peer group can be reached via @shared_mnt->mnt_share.\n\n* The terms \"slave mount\" or \"dependent mount\" denote a mount that\n receives propagation from a peer in a peer group. IOW, shared mounts\n may have slave mounts and slave mounts have shared mounts as their\n master. Slave mounts of a given peer in a peer group are listed on\n that peers slave list available at @shared_mnt->mnt_slave_list.\n\n* The term \"master mount\" denotes a mount in a peer group. IOW, it\n denotes a shared mount or a peer mount in a peer group. The term\n \"master mount\" - or \"master\" for short - is mostly used when talking\n in the context of slave mounts that receive propagation from a master\n mount. A master mount of a slave identifies the closest peer group a\n slave mount receives propagation from. The master mount of a slave can\n be identified via @slave_mount->mnt_master. Different slaves may point\n to different masters in the same peer group.\n\n* Multiple peers in a peer group can have non-empty ->mnt_slave_lists.\n Non-empty ->mnt_slave_lists of peers don't intersect. Consequently, to\n ensure all slave mounts of a peer group are visited the\n ->mnt_slave_lists of all peers in a peer group have to be walked.\n\n* Slave mounts point to a peer in the closest peer group they receive\n propagation from via @slave_mnt->mnt_master (see above). Together with\n these peers they form a propagation group (see below). The closest\n peer group can thus be identified through the peer group id\n @slave_mnt->mnt_master->mnt_group_id of the peer/master that a slave\n mount receives propagation from.\n\n* A shared-slave mount is a slave mount to a peer group pg1 while also\n a peer in another peer group pg2. IOW, a peer group may receive\n propagation from another peer group.\n\n If a peer group pg1 is a slave to another peer group pg2 then all\n peers in peer group pg1 point to the same peer in peer group pg2 via\n ->mnt_master. IOW, all peers in peer group pg1 appear on the same\n ->mnt_slave_list. IOW, they cannot be slaves to different peer groups.\n\n* A pure slave mount is a slave mount that is a slave to a peer group\n but is not a peer in another peer group.\n\n* A propagation group denotes the set of mounts consisting of a single\n peer group pg1 and all slave mounts and shared-slave mounts that point\n to a peer in that peer group via ->mnt_master. IOW, all slave mounts\n such that @slave_mnt->mnt_master->mnt_group_id is equal to\n @shared_mnt->mnt_group_id.\n\n The concept of a propagation group makes it easier to talk about a\n single propagation level in a propagation tree.\n\n For example, in propagate_mnt() the immediate peers of @dest_mnt and\n all slaves of @dest_mnt's peer group form a propagation group pr\n---truncated---"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/11933cf1d91d57da9e5c53822a540bbdc2656c16",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/2dae4211b579ce98985876a73a78466e285238ff",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/784a4f995ee24460aa72e00b085612fad57ebce5",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/7f57df69de7f05302fad584eb8e3f34de39e0311",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b591b2919d018ef91b4a9571edca94105bcad3df",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c24cc476acd8bccb5af54849aac5e779d8223bf5",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/cad0d17fb2b0540180ab59e2cd48ad348cc1ee4c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/cc997490be65da0af8c75a6244fc80bb66c53ce0",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e7c9f10c44a8919cd8bbd51b228c84d0caf7d518",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-502xx/CVE-2022-50281.json
+37
View File
@@ -0,0 +1,37 @@
{
"id": "CVE-2022-50281",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:39.190",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nMIPS: SGI-IP27: Fix platform-device leak in bridge_platform_create()\n\nIn error case in bridge_platform_create after calling\nplatform_device_add()/platform_device_add_data()/\nplatform_device_add_resources(), release the failed\n'pdev' or it will be leak, call platform_device_put()\nto fix this problem.\n\nBesides, 'pdev' is divided into 'pdev_wd' and 'pdev_bd',\nuse platform_device_unregister() to release sgi_w1\nresources when xtalk-bridge registration fails."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/11bec9cba4de06b3c0e9e4041453c2caaa1cbec1",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/48025893b3e31b917ad654d28d23fff66681cac4",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/93296e7ab774230b7c36541dead10b6da39b650f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d7ac29e60d0ff71e9e414af595b8c92800f7fa90",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/da2aecef866b476438d02c662507a0e4e818da9d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-502xx/CVE-2022-50282.json
+53
View File
@@ -0,0 +1,53 @@
{
"id": "CVE-2022-50282",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:39.310",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nchardev: fix error handling in cdev_device_add()\n\nWhile doing fault injection test, I got the following report:\n\n------------[ cut here ]------------\nkobject: '(null)' (0000000039956980): is not initialized, yet kobject_put() is being called.\nWARNING: CPU: 3 PID: 6306 at kobject_put+0x23d/0x4e0\nCPU: 3 PID: 6306 Comm: 283 Tainted: G W 6.1.0-rc2-00005-g307c1086d7c9 #1253\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014\nRIP: 0010:kobject_put+0x23d/0x4e0\nCall Trace:\n <TASK>\n cdev_device_add+0x15e/0x1b0\n __iio_device_register+0x13b4/0x1af0 [industrialio]\n __devm_iio_device_register+0x22/0x90 [industrialio]\n max517_probe+0x3d8/0x6b4 [max517]\n i2c_device_probe+0xa81/0xc00\n\nWhen device_add() is injected fault and returns error, if dev->devt is not set,\ncdev_add() is not called, cdev_del() is not needed. Fix this by checking dev->devt\nin error path."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/11fa7fefe3d8fac7da56bc9aa3dd5fb3081ca797",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/28dc61cc49c6e995121c6d86bef4b73df78dda80",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/34d17b39bceef25e4cf9805cd59250ae05d0a139",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/5d2146889fad4cb9e6c13e790d4cfd871486eca8",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6acf8597c5b04f455ee0649e11e5f3bcd28f381e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/85a5660491b507d33662b8e81c142e6041e642eb",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b5de1eac71fec1af7723f1083d23a24789fd795c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c46db6088bccff5115674d583fef46ede80077a2",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d85b5247a79355b8432bfd9ac871f96117f750d4",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-502xx/CVE-2022-50283.json
+25
View File
@@ -0,0 +1,25 @@
{
"id": "CVE-2022-50283",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:39.437",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: core: add missing of_node_get() in dynamic partitions code\n\nThis fixes unbalanced of_node_put():\n[ 1.078910] 6 cmdlinepart partitions found on MTD device gpmi-nand\n[ 1.085116] Creating 6 MTD partitions on \"gpmi-nand\":\n[ 1.090181] 0x000000000000-0x000008000000 : \"nandboot\"\n[ 1.096952] 0x000008000000-0x000009000000 : \"nandfit\"\n[ 1.103547] 0x000009000000-0x00000b000000 : \"nandkernel\"\n[ 1.110317] 0x00000b000000-0x00000c000000 : \"nanddtb\"\n[ 1.115525] ------------[ cut here ]------------\n[ 1.120141] refcount_t: addition on 0; use-after-free.\n[ 1.125328] WARNING: CPU: 0 PID: 1 at lib/refcount.c:25 refcount_warn_saturate+0xdc/0x148\n[ 1.133528] Modules linked in:\n[ 1.136589] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.0.0-rc7-next-20220930-04543-g8cf3f7\n[ 1.146342] Hardware name: Freescale i.MX8DXL DDR3L EVK (DT)\n[ 1.151999] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[ 1.158965] pc : refcount_warn_saturate+0xdc/0x148\n[ 1.163760] lr : refcount_warn_saturate+0xdc/0x148\n[ 1.168556] sp : ffff800009ddb080\n[ 1.171866] x29: ffff800009ddb080 x28: ffff800009ddb35a x27: 0000000000000002\n[ 1.179015] x26: ffff8000098b06ad x25: ffffffffffffffff x24: ffff0a00ffffff05\n[ 1.186165] x23: ffff00001fdf6470 x22: ffff800009ddb367 x21: 0000000000000000\n[ 1.193314] x20: ffff00001fdfebe8 x19: ffff00001fdfec50 x18: ffffffffffffffff\n[ 1.200464] x17: 0000000000000000 x16: 0000000000000118 x15: 0000000000000004\n[ 1.207614] x14: 0000000000000fff x13: ffff800009bca248 x12: 0000000000000003\n[ 1.214764] x11: 00000000ffffefff x10: c0000000ffffefff x9 : 4762cb2ccb52de00\n[ 1.221914] x8 : 4762cb2ccb52de00 x7 : 205d313431303231 x6 : 312e31202020205b\n[ 1.229063] x5 : ffff800009d55c1f x4 : 0000000000000001 x3 : 0000000000000000\n[ 1.236213] x2 : 0000000000000000 x1 : ffff800009954be6 x0 : 000000000000002a\n[ 1.243365] Call trace:\n[ 1.245806] refcount_warn_saturate+0xdc/0x148\n[ 1.250253] kobject_get+0x98/0x9c\n[ 1.253658] of_node_get+0x20/0x34\n[ 1.257072] of_fwnode_get+0x3c/0x54\n[ 1.260652] fwnode_get_nth_parent+0xd8/0xf4\n[ 1.264926] fwnode_full_name_string+0x3c/0xb4\n[ 1.269373] device_node_string+0x498/0x5b4\n[ 1.273561] pointer+0x41c/0x5d0\n[ 1.276793] vsnprintf+0x4d8/0x694\n[ 1.280198] vprintk_store+0x164/0x528\n[ 1.283951] vprintk_emit+0x98/0x164\n[ 1.287530] vprintk_default+0x44/0x6c\n[ 1.291284] vprintk+0xf0/0x134\n[ 1.294428] _printk+0x54/0x7c\n[ 1.297486] of_node_release+0xe8/0x128\n[ 1.301326] kobject_put+0x98/0xfc\n[ 1.304732] of_node_put+0x1c/0x28\n[ 1.308137] add_mtd_device+0x484/0x6d4\n[ 1.311977] add_mtd_partitions+0xf0/0x1d0\n[ 1.316078] parse_mtd_partitions+0x45c/0x518\n[ 1.320439] mtd_device_parse_register+0xb0/0x274\n[ 1.325147] gpmi_nand_probe+0x51c/0x650\n[ 1.329074] platform_probe+0xa8/0xd0\n[ 1.332740] really_probe+0x130/0x334\n[ 1.336406] __driver_probe_device+0xb4/0xe0\n[ 1.340681] driver_probe_device+0x3c/0x1f8\n[ 1.344869] __driver_attach+0xdc/0x1a4\n[ 1.348708] bus_for_each_dev+0x80/0xcc\n[ 1.352548] driver_attach+0x24/0x30\n[ 1.356127] bus_add_driver+0x108/0x1f4\n[ 1.359967] driver_register+0x78/0x114\n[ 1.363807] __platform_driver_register+0x24/0x30\n[ 1.368515] gpmi_nand_driver_init+0x1c/0x28\n[ 1.372798] do_one_initcall+0xbc/0x238\n[ 1.376638] do_initcall_level+0x94/0xb4\n[ 1.380565] do_initcalls+0x54/0x94\n[ 1.384058] do_basic_setup+0x1c/0x28\n[ 1.387724] kernel_init_freeable+0x110/0x188\n[ 1.392084] kernel_init+0x20/0x1a0\n[ 1.395578] ret_from_fork+0x10/0x20\n[ 1.399157] ---[ end trace 0000000000000000 ]---\n[ 1.403782] ------------[ cut here ]------------"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/12b58961de0bd88b3c7dfa5d21f6d67f4678b780",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9e54ce00505d291ef88f2c05e5eef46269daf83c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-502xx/CVE-2022-50284.json
+29
View File
@@ -0,0 +1,29 @@
{
"id": "CVE-2022-50284",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:39.550",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipc: fix memory leak in init_mqueue_fs()\n\nWhen setup_mq_sysctls() failed in init_mqueue_fs(), mqueue_inode_cachep is\nnot released. In order to fix this issue, the release path is reordered."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/12b677f2c697d61e5ddbcb6c1650050a39392f54",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/28dad915abe46d38c5799a0c8130e9a2a1540385",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/86273624a68d07f129dc182b8394f487ed4de484",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-502xx/CVE-2022-50285.json
+49
View File
@@ -0,0 +1,49 @@
{
"id": "CVE-2022-50285",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:39.660",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages\n\nThe h->*_huge_pages counters are protected by the hugetlb_lock, but\nalloc_huge_page has a corner case where it can decrement the counter\noutside of the lock.\n\nThis could lead to a corrupted value of h->resv_huge_pages, which we have\nobserved on our systems.\n\nTake the hugetlb_lock before decrementing h->resv_huge_pages to avoid a\npotential race."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/112a005d1ded04a4b41b6d01833cc0bda90625cc",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/11993652d0b49e27272db0a37aa828d8a3a4b92b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/12df140f0bdfae5dcfc81800970dd7f6f632e00c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/2b35432d324898ec41beb27031d2a1a864a4d40e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/3e50a07b6a5fcd39df1534d3fdaca4292a65efe6",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/568e3812b1778b4c0c229649b59977d88f400ece",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/629c986e19fe9481227c7cdfd9a105bbc104d245",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c828fab903725279aa9dc6ae3d44bb7e4778f92c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-502xx/CVE-2022-50286.json
+41
View File
@@ -0,0 +1,41 @@
{
"id": "CVE-2022-50286",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:39.790",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix delayed allocation bug in ext4_clu_mapped for bigalloc + inline\n\nWhen converting files with inline data to extents, delayed allocations\nmade on a file system created with both the bigalloc and inline options\ncan result in invalid extent status cache content, incorrect reserved\ncluster counts, kernel memory leaks, and potential kernel panics.\n\nWith bigalloc, the code that determines whether a block must be\ndelayed allocated searches the extent tree to see if that block maps\nto a previously allocated cluster. If not, the block is delayed\nallocated, and otherwise, it isn't. However, if the inline option is\nalso used, and if the file containing the block is marked as able to\nstore data inline, there isn't a valid extent tree associated with\nthe file. The current code in ext4_clu_mapped() calls\next4_find_extent() to search the non-existent tree for a previously\nallocated cluster anyway, which typically finds nothing, as desired.\nHowever, a side effect of the search can be to cache invalid content\nfrom the non-existent tree (garbage) in the extent status tree,\nincluding bogus entries in the pending reservation tree.\n\nTo fix this, avoid searching the extent tree when allocating blocks\nfor bigalloc + inline files that are being converted from inline to\nextent mapped."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/131294c35ed6f777bd4e79d42af13b5c41bf2775",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6f4200ec76a0d31200c308ec5a71c68df5417004",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/81b915181c630ee1cffa052e52874fe4e1ba91ac",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9404839e0c9db5a517ea83c0ca3388b39d105fdf",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c0c8edbc8abbe8f16d80a1d794d1ba2c12b6f193",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d440d6427a5e3a877c1c259b8d2b216ddb65e185",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-502xx/CVE-2022-50287.json
+29
View File
@@ -0,0 +1,29 @@
{
"id": "CVE-2022-50287",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:39.907",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/bios: fix a memory leak in generate_lfp_data_ptrs\n\nWhen (size != 0 || ptrs->lvds_ entries != 3), the program tries to\nfree() the ptrs. However, the ptrs is not created by calling kzmalloc(),\nbut is obtained by pointer offset operation.\nThis may lead to memory leaks or undefined behavior.\n\nFix this by replacing the arguments of kfree() with ptrs_block.\n\n(cherry picked from commit 7674cd0b7d28b952151c3df26bbfa7e07eb2b4ec)"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/1382901f75a5a7dc8eac05059fd0c7816def4eae",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/4758d04014cfe6cdb6e9b4738d1d6728487bbb3a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/7c852e8f93f04e57c1e3883caa72542469c6c4c4",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-502xx/CVE-2022-50288.json
+49
View File
@@ -0,0 +1,49 @@
{
"id": "CVE-2022-50288",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:40.020",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nqlcnic: prevent ->dcb use-after-free on qlcnic_dcb_enable() failure\n\nadapter->dcb would get silently freed inside qlcnic_dcb_enable() in\ncase qlcnic_dcb_attach() would return an error, which always happens\nunder OOM conditions. This would lead to use-after-free because both\nof the existing callers invoke qlcnic_dcb_get_info() on the obtained\npointer, which is potentially freed at that point.\n\nPropagate errors from qlcnic_dcb_enable(), and instead free the dcb\npointer at callsite using qlcnic_dcb_free(). This also removes the now\nunused qlcnic_clear_dcb_ops() helper, which was a simple wrapper around\nkfree() also causing memory leaks for partially initialized dcb.\n\nFound by Linux Verification Center (linuxtesting.org) with the SVACE\nstatic analysis tool."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/13a7c8964afcd8ca43c0b6001ebb0127baa95362",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/36999236f0b12d5de21a6f40e93b570727b9ceb2",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/513787ff9a331b461115e8a145a983d650a84fcb",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8df1dc04ce0e4c03b51a756749c250a9cb17d707",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8f97eeb02a553cdc78c83a0596448a370e1518c4",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/95df720e64a6409d8152827a776c43f615e3321a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a2a694e6edbdb3efb34e1613a31fdcf6cf444a55",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d12a7510293d3370b234b0b7c5eda33e58786768",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-502xx/CVE-2022-50289.json
+53
View File
@@ -0,0 +1,53 @@
{
"id": "CVE-2022-50289",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:40.157",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: fix memory leak in ocfs2_stack_glue_init()\n\nocfs2_table_header should be free in ocfs2_stack_glue_init() if\nocfs2_sysfs_init() failed, otherwise kmemleak will report memleak.\n\nBUG: memory leak\nunreferenced object 0xffff88810eeb5800 (size 128):\n comm \"modprobe\", pid 4507, jiffies 4296182506 (age 55.888s)\n hex dump (first 32 bytes):\n c0 40 14 a0 ff ff ff ff 00 00 00 00 01 00 00 00 .@..............\n 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n backtrace:\n [<000000001e59e1cd>] __register_sysctl_table+0xca/0xef0\n [<00000000c04f70f7>] 0xffffffffa0050037\n [<000000001bd12912>] do_one_initcall+0xdb/0x480\n [<0000000064f766c9>] do_init_module+0x1cf/0x680\n [<000000002ba52db0>] load_module+0x6441/0x6f20\n [<000000009772580d>] __do_sys_finit_module+0x12f/0x1c0\n [<00000000380c1f22>] do_syscall_64+0x3f/0x90\n [<000000004cf473bc>] entry_SYSCALL_64_after_hwframe+0x63/0xcd"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/0000281f019111526f7abccc61f2746d2eb626ca",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/0b2128b70849f2728949babfc1c760096ef72f5d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/13b6269dd022aaa69ca8d1df374ab327504121cf",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/61d68cf2ba79128c48d4b3fa4d10c34dc18ba572",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6f6c13776cbee4b6a515f4cd3b859f046be4f6f9",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/7c8bf45cea9c8d6fb3e14d8cd5ae60e0372f39b7",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/802abe2bc654e87334e6a0ab6c1adc2b6d5f6394",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b0822faebd79971617abd495beb2d6f5356b88bf",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f5f2682d3a34dd8350bf63f232d885fd95f25b92",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-502xx/CVE-2022-50290.json
+37
View File
@@ -0,0 +1,37 @@
{
"id": "CVE-2022-50290",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:40.280",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: fix memory leak in ieee80211_if_add()\n\nWhen register_netdevice() failed in ieee80211_if_add(), ndev->tstats\nisn't released. Fix it."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/13e5afd3d773c6fc6ca2b89027befaaaa1ea7293",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/147537737a3c83e07a5295de38424c21d354d2a4",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/2e32f1299814e8aa2e75aa58704543a36ea3e201",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9a50a7f64243bd21a84353c371f3977b9ffd9fa5",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b2c0b94f48373ee743a4d63825a9d52364418837",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-502xx/CVE-2022-50291.json
+49
View File
@@ -0,0 +1,49 @@
{
"id": "CVE-2022-50291",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:40.400",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nkcm: annotate data-races around kcm->rx_psock\n\nkcm->rx_psock can be read locklessly in kcm_rfree().\nAnnotate the read and writes accordingly.\n\nWe do the same for kcm->rx_wait in the following patch.\n\nsyzbot reported:\nBUG: KCSAN: data-race in kcm_rfree / unreserve_rx_kcm\n\nwrite to 0xffff888123d827b8 of 8 bytes by task 2758 on cpu 1:\nunreserve_rx_kcm+0x72/0x1f0 net/kcm/kcmsock.c:313\nkcm_rcv_strparser+0x2b5/0x3a0 net/kcm/kcmsock.c:373\n__strp_recv+0x64c/0xd20 net/strparser/strparser.c:301\nstrp_recv+0x6d/0x80 net/strparser/strparser.c:335\ntcp_read_sock+0x13e/0x5a0 net/ipv4/tcp.c:1703\nstrp_read_sock net/strparser/strparser.c:358 [inline]\ndo_strp_work net/strparser/strparser.c:406 [inline]\nstrp_work+0xe8/0x180 net/strparser/strparser.c:415\nprocess_one_work+0x3d3/0x720 kernel/workqueue.c:2289\nworker_thread+0x618/0xa70 kernel/workqueue.c:2436\nkthread+0x1a9/0x1e0 kernel/kthread.c:376\nret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306\n\nread to 0xffff888123d827b8 of 8 bytes by task 5859 on cpu 0:\nkcm_rfree+0x14c/0x220 net/kcm/kcmsock.c:181\nskb_release_head_state+0x8e/0x160 net/core/skbuff.c:841\nskb_release_all net/core/skbuff.c:852 [inline]\n__kfree_skb net/core/skbuff.c:868 [inline]\nkfree_skb_reason+0x5c/0x260 net/core/skbuff.c:891\nkfree_skb include/linux/skbuff.h:1216 [inline]\nkcm_recvmsg+0x226/0x2b0 net/kcm/kcmsock.c:1161\n____sys_recvmsg+0x16c/0x2e0\n___sys_recvmsg net/socket.c:2743 [inline]\ndo_recvmmsg+0x2f1/0x710 net/socket.c:2837\n__sys_recvmmsg net/socket.c:2916 [inline]\n__do_sys_recvmmsg net/socket.c:2939 [inline]\n__se_sys_recvmmsg net/socket.c:2932 [inline]\n__x64_sys_recvmmsg+0xde/0x160 net/socket.c:2932\ndo_syscall_x64 arch/x86/entry/common.c:50 [inline]\ndo_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80\nentry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nvalue changed: 0xffff88812971ce00 -> 0x0000000000000000\n\nReported by Kernel Concurrency Sanitizer on:\nCPU: 0 PID: 5859 Comm: syz-executor.3 Not tainted 6.0.0-syzkaller-12189-g19d17ab7c68b-dirty #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/12a0eb340c9a22e0f8c00d2c0c1a60695ead926a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/13dba69e18d04c8eec7596369f2a0596b0260275",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/15e4dabda11b0fa31d510a915d1a580f47dfc92e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/1b8a5692ab25db4ef1c2cc8e5d21f7a65dc3d079",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/342d918cf9a45df9cf11bbe7162b851adefd178f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/bf46af730e58d340f6f740bc69a07c5f6b85c655",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c325f92d8d9b223d5842609ca067e898e9d34566",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e94395e916b48a5b912a0a04570981b5b091acb0",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-502xx/CVE-2022-50292.json
+25
View File
@@ -0,0 +1,25 @@
{
"id": "CVE-2022-50292",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:40.530",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm/dp: fix bridge lifetime\n\nDevice-managed resources allocated post component bind must be tied to\nthe lifetime of the aggregate DRM device or they will not necessarily be\nreleased when binding of the aggregate device is deferred.\n\nThis can lead resource leaks or failure to bind the aggregate device\nwhen binding is later retried and a second attempt to allocate the\nresources is made.\n\nFor the DP bridges, previously allocated bridges will leak on probe\ndeferral.\n\nFix this by amending the DP parser interface and tying the lifetime of\nthe bridge device to the DRM device rather than DP platform device.\n\nPatchwork: https://patchwork.freedesktop.org/patch/502667/"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/16194958f888d63839042d1190f7001e5ddec47b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/7eda6977e8058dd45607a5bbc6517a0f42ccd6c9",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-502xx/CVE-2022-50293.json
+33
View File
@@ -0,0 +1,33 @@
{
"id": "CVE-2022-50293",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:40.640",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: do not BUG_ON() on ENOMEM when dropping extent items for a range\n\nIf we get -ENOMEM while dropping file extent items in a given range, at\nbtrfs_drop_extents(), due to failure to allocate memory when attempting to\nincrement the reference count for an extent or drop the reference count,\nwe handle it with a BUG_ON(). This is excessive, instead we can simply\nabort the transaction and return the error to the caller. In fact most\ncallers of btrfs_drop_extents(), directly or indirectly, already abort\nthe transaction if btrfs_drop_extents() returns any error.\n\nAlso, we already have error paths at btrfs_drop_extents() that may return\n-ENOMEM and in those cases we abort the transaction, like for example\nanything that changes the b+tree may return -ENOMEM due to a failure to\nallocate a new extent buffer when COWing an existing extent buffer, such\nas a call to btrfs_duplicate_item() for example.\n\nSo replace the BUG_ON() calls with proper logic to abort the transaction\nand return the error."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/162d053e15fe985f754ef495a96eb3db970c43ed",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/1baf3370e2dc5e6bd1368348736189457dab2a27",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/50f993da945074b2a069da099a0331b23a0c89a0",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/7fbcb635c8fc927d139f3302babcf1b42c09265c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-502xx/CVE-2022-50294.json
+49
View File
@@ -0,0 +1,49 @@
{
"id": "CVE-2022-50294",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:40.757",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: libertas: fix memory leak in lbs_init_adapter()\n\nWhen kfifo_alloc() failed in lbs_init_adapter(), cmd buffer is not\nreleased. Add free memory to processing error path."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/037f84c0bfae5c436c651d0e804264e2648010ec",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/16a03958618fb91bb1bc7077cf3211055162cc2f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/23b34e08de5c2380414c9d3c33e8235094bcccae",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/4c102ad59bfa66c0f6662af64fa3b9007b02c20f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/653d13a73e498d0bb6aeaf689aaa960defa7878b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/98e0ff6980c89239d9e5d3da90d791c2383dc23a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9c8f50c7433bdfba1588831c413136ecc3f29f99",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d46c33f667b05c22bc5c5b69aa730349c4b6fe31",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-502xx/CVE-2022-50295.json
+25
View File
@@ -0,0 +1,25 @@
{
"id": "CVE-2022-50295",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:40.880",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/msg_ring: Fix NULL pointer dereference in io_msg_send_fd()\n\nSyzkaller produced the below call trace:\n\n BUG: KASAN: null-ptr-deref in io_msg_ring+0x3cb/0x9f0\n Write of size 8 at addr 0000000000000070 by task repro/16399\n\n CPU: 0 PID: 16399 Comm: repro Not tainted 6.1.0-rc1 #28\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7\n Call Trace:\n <TASK>\n dump_stack_lvl+0xcd/0x134\n ? io_msg_ring+0x3cb/0x9f0\n kasan_report+0xbc/0xf0\n ? io_msg_ring+0x3cb/0x9f0\n kasan_check_range+0x140/0x190\n io_msg_ring+0x3cb/0x9f0\n ? io_msg_ring_prep+0x300/0x300\n io_issue_sqe+0x698/0xca0\n io_submit_sqes+0x92f/0x1c30\n __do_sys_io_uring_enter+0xae4/0x24b0\n....\n RIP: 0033:0x7f2eaf8f8289\n RSP: 002b:00007fff40939718 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa\n RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f2eaf8f8289\n RDX: 0000000000000000 RSI: 0000000000006f71 RDI: 0000000000000004\n RBP: 00007fff409397a0 R08: 0000000000000000 R09: 0000000000000039\n R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004006d0\n R13: 00007fff40939880 R14: 0000000000000000 R15: 0000000000000000\n </TASK>\n Kernel panic - not syncing: panic_on_warn set ...\n\nWe don't have a NULL check on file_ptr in io_msg_send_fd() function,\nso when file_ptr is NUL src_file is also NULL and get_file()\ndereferences a NULL pointer and leads to above crash.\n\nAdd a NULL check to fix this issue."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/0163e04ea64cc3dfaa12390286e5f2f481c3b2e3",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/16bbdfe5fb0e78e0acb13e45fc127e9a296913f2",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-502xx/CVE-2022-50296.json
+53
View File
@@ -0,0 +1,53 @@
{
"id": "CVE-2022-50296",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:40.987",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nUM: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK\n\nWhen CONFIG_CPUMASK_OFFSTACK and CONFIG_DEBUG_PER_CPU_MAPS is selected,\ncpu_max_bits_warn() generates a runtime warning similar as below while\nwe show /proc/cpuinfo. Fix this by using nr_cpu_ids (the runtime limit)\ninstead of NR_CPUS to iterate CPUs.\n\n[ 3.052463] ------------[ cut here ]------------\n[ 3.059679] WARNING: CPU: 3 PID: 1 at include/linux/cpumask.h:108 show_cpuinfo+0x5e8/0x5f0\n[ 3.070072] Modules linked in: efivarfs autofs4\n[ 3.076257] CPU: 0 PID: 1 Comm: systemd Not tainted 5.19-rc5+ #1052\n[ 3.099465] Stack : 9000000100157b08 9000000000f18530 9000000000cf846c 9000000100154000\n[ 3.109127] 9000000100157a50 0000000000000000 9000000100157a58 9000000000ef7430\n[ 3.118774] 90000001001578e8 0000000000000040 0000000000000020 ffffffffffffffff\n[ 3.128412] 0000000000aaaaaa 1ab25f00eec96a37 900000010021de80 900000000101c890\n[ 3.138056] 0000000000000000 0000000000000000 0000000000000000 0000000000aaaaaa\n[ 3.147711] ffff8000339dc220 0000000000000001 0000000006ab4000 0000000000000000\n[ 3.157364] 900000000101c998 0000000000000004 9000000000ef7430 0000000000000000\n[ 3.167012] 0000000000000009 000000000000006c 0000000000000000 0000000000000000\n[ 3.176641] 9000000000d3de08 9000000001639390 90000000002086d8 00007ffff0080286\n[ 3.186260] 00000000000000b0 0000000000000004 0000000000000000 0000000000071c1c\n[ 3.195868] ...\n[ 3.199917] Call Trace:\n[ 3.203941] [<90000000002086d8>] show_stack+0x38/0x14c\n[ 3.210666] [<9000000000cf846c>] dump_stack_lvl+0x60/0x88\n[ 3.217625] [<900000000023d268>] __warn+0xd0/0x100\n[ 3.223958] [<9000000000cf3c90>] warn_slowpath_fmt+0x7c/0xcc\n[ 3.231150] [<9000000000210220>] show_cpuinfo+0x5e8/0x5f0\n[ 3.238080] [<90000000004f578c>] seq_read_iter+0x354/0x4b4\n[ 3.245098] [<90000000004c2e90>] new_sync_read+0x17c/0x1c4\n[ 3.252114] [<90000000004c5174>] vfs_read+0x138/0x1d0\n[ 3.258694] [<90000000004c55f8>] ksys_read+0x70/0x100\n[ 3.265265] [<9000000000cfde9c>] do_syscall+0x7c/0x94\n[ 3.271820] [<9000000000202fe4>] handle_syscall+0xc4/0x160\n[ 3.281824] ---[ end trace 8b484262b4b8c24c ]---"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/16c546e148fa6d14a019431436a6f7b4087dbccd",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/2e3863cc02c156b51b50592d43ffa6a13b680b0d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/5177bdc38eaa1c1ca6302214ab06913540cd00a2",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6a73e6edcbf3cdd82796dcdf0c0f5fe5d91021af",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/7efe61dc6aa45aab8a40e304fa2dae21e33b0db4",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/844748412be03a236dcf4a208b588162a275e189",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8f96aa67c2ccbd7e41b8dc992b8d13cfe206d571",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/cd251d39b13485eb94ee65bb000d024e02c00e45",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/dbd964a733db015bbb9dff592c259c736398140f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-502xx/CVE-2022-50297.json
+53
View File
@@ -0,0 +1,53 @@
{
"id": "CVE-2022-50297",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:41.110",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath9k: verify the expected usb_endpoints are present\n\nThe bug arises when a USB device claims to be an ATH9K but doesn't\nhave the expected endpoints. (In this case there was an interrupt\nendpoint where the driver expected a bulk endpoint.) The kernel\nneeds to be able to handle such devices without getting an internal error.\n\nusb 1-1: BOGUS urb xfer, pipe 3 != type 1\nWARNING: CPU: 3 PID: 500 at drivers/usb/core/urb.c:493 usb_submit_urb+0xce2/0x1430 drivers/usb/core/urb.c:493\nModules linked in:\nCPU: 3 PID: 500 Comm: kworker/3:2 Not tainted 5.10.135-syzkaller #0\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014\nWorkqueue: events request_firmware_work_func\nRIP: 0010:usb_submit_urb+0xce2/0x1430 drivers/usb/core/urb.c:493\nCall Trace:\n ath9k_hif_usb_alloc_rx_urbs drivers/net/wireless/ath/ath9k/hif_usb.c:908 [inline]\n ath9k_hif_usb_alloc_urbs+0x75e/0x1010 drivers/net/wireless/ath/ath9k/hif_usb.c:1019\n ath9k_hif_usb_dev_init drivers/net/wireless/ath/ath9k/hif_usb.c:1109 [inline]\n ath9k_hif_usb_firmware_cb+0x142/0x530 drivers/net/wireless/ath/ath9k/hif_usb.c:1242\n request_firmware_work_func+0x12e/0x240 drivers/base/firmware_loader/main.c:1097\n process_one_work+0x9af/0x1600 kernel/workqueue.c:2279\n worker_thread+0x61d/0x12f0 kernel/workqueue.c:2425\n kthread+0x3b4/0x4a0 kernel/kthread.c:313\n ret_from_fork+0x22/0x30 arch/x86/entry/entry_64.S:299\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/0b7e6d681e00a96cde2b32a15ffa70e1be2e3209",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/16ef02bad239f11f322df8425d302be62f0443ce",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/1824ccabee5445347b83642e4087cc2eca070343",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/2d2eccf52ea0215c8d386b62af0b5fd4fc122bd5",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/932f0a5e829fb0b823f96d7fa9a0f4fc96660b77",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c319196a0e34ed2e66d6f876f58d8d446335c2a7",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ca57748593ddd8e46d033fbaeb9d01ec533a6bfe",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d008a202a0528a058bac658e657c010ce8534f4a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d64436af0bc3c9e579be761d7684f228fb95f3bb",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-502xx/CVE-2022-50298.json
+33
View File
@@ -0,0 +1,33 @@
{
"id": "CVE-2022-50298",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:41.240",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nslimbus: qcom-ngd: cleanup in probe error path\n\nAdd proper error path in probe() to cleanup resources previously\nacquired/allocated to fix warnings visible during probe deferral:\n\n notifier callback qcom_slim_ngd_ssr_notify already registered\n WARNING: CPU: 6 PID: 70 at kernel/notifier.c:28 notifier_chain_register+0x5c/0x90\n Modules linked in:\n CPU: 6 PID: 70 Comm: kworker/u16:1 Not tainted 6.0.0-rc3-next-20220830 #380\n Call trace:\n notifier_chain_register+0x5c/0x90\n srcu_notifier_chain_register+0x44/0x90\n qcom_register_ssr_notifier+0x38/0x4c\n qcom_slim_ngd_ctrl_probe+0xd8/0x400\n platform_probe+0x6c/0xe0\n really_probe+0xbc/0x2d4\n __driver_probe_device+0x78/0xe0\n driver_probe_device+0x3c/0x12c\n __device_attach_driver+0xb8/0x120\n bus_for_each_drv+0x78/0xd0\n __device_attach+0xa8/0x1c0\n device_initial_probe+0x18/0x24\n bus_probe_device+0xa0/0xac\n deferred_probe_work_func+0x88/0xc0\n process_one_work+0x1d4/0x320\n worker_thread+0x2cc/0x44c\n kthread+0x110/0x114\n ret_from_fork+0x10/0x20"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/0c76110a3129c8d56d8fb7b6270dcc0c5c2f1a41",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/16f14551d0df9e7cd283545d7d748829594d912f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/1d567179f27788925dc90fe5e905cdabfce7d190",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ef5c42e6eb29a86abbcd4b2fd427e5194e51053c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-502xx/CVE-2022-50299.json
+49
View File
@@ -0,0 +1,49 @@
{
"id": "CVE-2022-50299",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:41.353",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd: Replace snprintf with scnprintf\n\nCurrent code produces a warning as shown below when total characters\nin the constituent block device names plus the slashes exceeds 200.\nsnprintf() returns the number of characters generated from the given\ninput, which could cause the expression \u201c200 \u2013 len\u201d to wrap around\nto a large positive number. Fix this by using scnprintf() instead,\nwhich returns the actual number of characters written into the buffer.\n\n[ 1513.267938] ------------[ cut here ]------------\n[ 1513.267943] WARNING: CPU: 15 PID: 37247 at <snip>/lib/vsprintf.c:2509 vsnprintf+0x2c8/0x510\n[ 1513.267944] Modules linked in: <snip>\n[ 1513.267969] CPU: 15 PID: 37247 Comm: mdadm Not tainted 5.4.0-1085-azure #90~18.04.1-Ubuntu\n[ 1513.267969] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 05/09/2022\n[ 1513.267971] RIP: 0010:vsnprintf+0x2c8/0x510\n<-snip->\n[ 1513.267982] Call Trace:\n[ 1513.267986] snprintf+0x45/0x70\n[ 1513.267990] ? disk_name+0x71/0xa0\n[ 1513.267993] dump_zones+0x114/0x240 [raid0]\n[ 1513.267996] ? _cond_resched+0x19/0x40\n[ 1513.267998] raid0_run+0x19e/0x270 [raid0]\n[ 1513.268000] md_run+0x5e0/0xc50\n[ 1513.268003] ? security_capable+0x3f/0x60\n[ 1513.268005] do_md_run+0x19/0x110\n[ 1513.268006] md_ioctl+0x195e/0x1f90\n[ 1513.268007] blkdev_ioctl+0x91f/0x9f0\n[ 1513.268010] block_ioctl+0x3d/0x50\n[ 1513.268012] do_vfs_ioctl+0xa9/0x640\n[ 1513.268014] ? __fput+0x162/0x260\n[ 1513.268016] ksys_ioctl+0x75/0x80\n[ 1513.268017] __x64_sys_ioctl+0x1a/0x20\n[ 1513.268019] do_syscall_64+0x5e/0x200\n[ 1513.268021] entry_SYSCALL_64_after_hwframe+0x44/0xa9"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/1727fd5015d8f93474148f94e34cda5aa6ad4a43",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/3b0a2bd51f60418ecd67493586a2bb2174199de3",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/41ca95033a0c47cd6dace1f0a36a6eb5ebe799e6",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/5d8259c9d1915a50c60c7d6e9e7fb9b7da64a175",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/76694e9ce0b2238c0a5f3ba54f9361dd3770ec78",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/897b1450abe5a67c842a5d24173ce4449ccdfa94",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/97238b88583c27c9d3b4a0cedb45f816523f17c3",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f95825c4e51cf9a653b0ef947ac78401fc9d3a40",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-503xx/CVE-2022-50300.json
+33
View File
@@ -0,0 +1,33 @@
{
"id": "CVE-2022-50300",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:41.483",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix extent map use-after-free when handling missing device in read_one_chunk\n\nStore the error code before freeing the extent_map. Though it's\nreference counted structure, in that function it's the first and last\nallocation so this would lead to a potential use-after-free.\n\nThe error can happen eg. when chunk is stored on a missing device and\nthe degraded mount option is missing.\n\nBugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=216721"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/169a4cf46882974d4db6d85eb623ec898e51bbc0",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/1742e1c90c3da344f3bb9b1f1309b3f47482756a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b8e7ed42bc3ca0d0e4191ee394d34962d3624c22",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/fce3713197ebba239e1c7e02174ed216ea1ee014",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-503xx/CVE-2022-50301.json
+53
View File
@@ -0,0 +1,53 @@
{
"id": "CVE-2022-50301",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:41.597",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/omap: Fix buffer overflow in debugfs\n\nThere are two issues here:\n\n1) The \"len\" variable needs to be checked before the very first write.\n Otherwise if omap2_iommu_dump_ctx() with \"bytes\" less than 32 it is a\n buffer overflow.\n2) The snprintf() function returns the number of bytes that *would* have\n been copied if there were enough space. But we want to know the\n number of bytes which were *actually* copied so use scnprintf()\n instead."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/0c7043a5b5c3b35f5dc8875757f71e7f491d64d4",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/184233a5202786b20220acd2d04ddf909ef18f29",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/2fee0dbfaeaaa4bda04279ce772c4572b1429d04",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/4010a1afaae1c0fb9c2cac5de703bed29b1f1782",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/648472df221f2bbffb433b964bcb87baccc586d8",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/706e359cf046c142db290244c3f4938b20fbe805",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9814cc350e0765ce69244bf55ae4c8b29facd27e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/bd0438f534b2e31b12f0b39b355c5dc2bbdaf854",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ec53b99b6b9da8b501f001595a6260c03b42d5b7",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-503xx/CVE-2022-50302.json
+37
View File
@@ -0,0 +1,37 @@
{
"id": "CVE-2022-50302",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:41.720",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlockd: set other missing fields when unlocking files\n\nvfs_lock_file() expects the struct file_lock to be fully initialised by\nthe caller. Re-exported NFSv3 has been seen to Oops if the fl_file field\nis NULL."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/18ebd35b61b4693a0ddc270b6d4f18def232e770",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/31c93ee5f1e4dc278b562e20f3c3274ac34997f3",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/688575aef211b0986fc51010116f5888a99d76a2",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/95d42a8d3d4ae84a0bd3ee23e1fee240cdf0a9f0",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d7aa9f7778316beb690f6e2763b6d672ad8b256f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-503xx/CVE-2022-50303.json
+29
View File
@@ -0,0 +1,29 @@
{
"id": "CVE-2022-50303",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:41.840",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Fix double release compute pasid\n\nIf kfd_process_device_init_vm returns failure after vm is converted to\ncompute vm and vm->pasid set to compute pasid, KFD will not take\npdd->drm_file reference. As a result, drm close file handler maybe\ncalled to release the compute pasid before KFD process destroy worker to\nrelease the same pasid and set vm->pasid to zero, this generates below\nWARNING backtrace and NULL pointer access.\n\nAdd helper amdgpu_amdkfd_gpuvm_set_vm_pasid and call it at the last step\nof kfd_process_device_init_vm, to ensure vm pasid is the original pasid\nif acquiring vm failed or is the compute pasid with pdd->drm_file\nreference taken to avoid double release same pasid.\n\n amdgpu: Failed to create process VM object\n ida_free called for id=32770 which is not allocated.\n WARNING: CPU: 57 PID: 72542 at ../lib/idr.c:522 ida_free+0x96/0x140\n RIP: 0010:ida_free+0x96/0x140\n Call Trace:\n amdgpu_pasid_free_delayed+0xe1/0x2a0 [amdgpu]\n amdgpu_driver_postclose_kms+0x2d8/0x340 [amdgpu]\n drm_file_free.part.13+0x216/0x270 [drm]\n drm_close_helper.isra.14+0x60/0x70 [drm]\n drm_release+0x6e/0xf0 [drm]\n __fput+0xcc/0x280\n ____fput+0xe/0x20\n task_work_run+0x96/0xc0\n do_exit+0x3d0/0xc10\n\n BUG: kernel NULL pointer dereference, address: 0000000000000000\n RIP: 0010:ida_free+0x76/0x140\n Call Trace:\n amdgpu_pasid_free_delayed+0xe1/0x2a0 [amdgpu]\n amdgpu_driver_postclose_kms+0x2d8/0x340 [amdgpu]\n drm_file_free.part.13+0x216/0x270 [drm]\n drm_close_helper.isra.14+0x60/0x70 [drm]\n drm_release+0x6e/0xf0 [drm]\n __fput+0xcc/0x280\n ____fput+0xe/0x20\n task_work_run+0x96/0xc0\n do_exit+0x3d0/0xc10"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/1a799c4c190ea9f0e81028e3eb3037ed0ab17ff5",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/89f0d766c9e3fdeafbed6f855d433c2768cde862",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a02c07b619899179384fde06f951530438a3512d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-503xx/CVE-2022-50304.json
+29
View File
@@ -0,0 +1,29 @@
{
"id": "CVE-2022-50304",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:41.953",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: core: fix possible resource leak in init_mtd()\n\nI got the error report while inject fault in init_mtd():\n\nsysfs: cannot create duplicate filename '/devices/virtual/bdi/mtd-0'\nCall Trace:\n <TASK>\n dump_stack_lvl+0x67/0x83\n sysfs_warn_dup+0x60/0x70\n sysfs_create_dir_ns+0x109/0x120\n kobject_add_internal+0xce/0x2f0\n kobject_add+0x98/0x110\n device_add+0x179/0xc00\n device_create_groups_vargs+0xf4/0x100\n device_create+0x7b/0xb0\n bdi_register_va.part.13+0x58/0x2d0\n bdi_register+0x9b/0xb0\n init_mtd+0x62/0x171 [mtd]\n do_one_initcall+0x6c/0x3c0\n do_init_module+0x58/0x222\n load_module+0x268e/0x27d0\n __do_sys_finit_module+0xd5/0x140\n do_syscall_64+0x37/0x90\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\n </TASK>\nkobject_add_internal failed for mtd-0 with -EEXIST, don't try to register\n\tthings with the same name in the same directory.\nError registering mtd class or bdi: -17\n\nIf init_mtdchar() fails in init_mtd(), mtd_bdi will not be unregistered,\nas a result, we can't load the mtd module again, to fix this by calling\nbdi_unregister(mtd_bdi) after out_procfs label."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/1aadf01e5076b9ab6bf294b9622335c651314895",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/26c304a3f136009c5a2a04e2bf3ac6aa25aabcb4",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/78816504100cbd8e6836df9f58cc4fbb8b262f1c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-503xx/CVE-2022-50305.json
+29
View File
@@ -0,0 +1,29 @@
{
"id": "CVE-2022-50305",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:42.077",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: sof_es8336: fix possible use-after-free in sof_es8336_remove()\n\nsof_es8336_remove() calls cancel_delayed_work(). However, that\nfunction does not wait until the work function finishes. This\nmeans that the callback function may still be running after\nthe driver's remove function has finished, which would result\nin a use-after-free.\n\nFix by calling cancel_delayed_work_sync(), which ensures that\nthe work is properly cancelled, no longer running, and unable\nto re-schedule itself."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/1b41beaa7a58467505ec3023af8aad74f878b888",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/390a1a98288a53b2e7555097d83c6e55d579b166",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b85102a3aa3810a09eb55692e8cd6ffbb304e57d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-503xx/CVE-2022-50306.json
+29
View File
@@ -0,0 +1,29 @@
{
"id": "CVE-2022-50306",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:42.267",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix potential out of bound read in ext4_fc_replay_scan()\n\nFor scan loop must ensure that at least EXT4_FC_TAG_BASE_LEN space. If remain\nspace less than EXT4_FC_TAG_BASE_LEN which will lead to out of bound read\nwhen mounting corrupt file system image.\nADD_RANGE/HEAD/TAIL is needed to add extra check when do journal scan, as this\nthree tags will read data during scan, tag length couldn't less than data length\nwhich will read."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/1b45cc5c7b920fd8bf72e5a888ec7abeadf41e09",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6969367c1500c15eddc38fda12f6d15518ad6d03",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f234294812c9b68d603650d28743eafb718e7ad5",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-503xx/CVE-2022-50307.json
+29
View File
@@ -0,0 +1,29 @@
{
"id": "CVE-2022-50307",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:42.377",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/cio: fix out-of-bounds access on cio_ignore free\n\nThe channel-subsystem-driver scans for newly available devices whenever\ndevice-IDs are removed from the cio_ignore list using a command such as:\n\n echo free >/proc/cio_ignore\n\nSince an I/O device scan might interfer with running I/Os, commit\n172da89ed0ea (\"s390/cio: avoid excessive path-verification requests\")\nintroduced an optimization to exclude online devices from the scan.\n\nThe newly added check for online devices incorrectly assumes that\nan I/O-subchannel's drvdata points to a struct io_subchannel_private.\nFor devices that are bound to a non-default I/O subchannel driver, such\nas the vfio_ccw driver, this results in an out-of-bounds read access\nduring each scan.\n\nFix this by changing the scan logic to rely on a driver-independent\nonline indication. For this we can use struct subchannel->config.ena,\nwhich is the driver's requested subchannel-enabled state. Since I/Os\ncan only be started on enabled subchannels, this matches the intent\nof the original optimization of not scanning devices where I/O might\nbe running."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/0e501fd0f38e42304bfa0d46a812d93f80294a87",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/106ab66cf5467726ca5ead51623043d37c06820a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/1b6074112742f65ece71b0f299ca5a6a887d2db6",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-503xx/CVE-2022-50308.json
+37
View File
@@ -0,0 +1,37 @@
{
"id": "CVE-2022-50308",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:42.487",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: qcom: Add checks for devm_kcalloc\n\nAs the devm_kcalloc may return NULL, the return value needs to be checked\nto avoid NULL poineter dereference."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/1bf5ee979076ceb121ee51c95197d890b1cee7f4",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/4518d7cc38b7d1a7ce5a7878ca601c91e19fe47d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/7830e2289eb4b74970b6cd1b6cc68dcd021c2281",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b1e4f92dd0c1d3c162d7ca6c1196995565cca96d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f849c116d320e85d1e2c2804c0edb0be3953b62d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-503xx/CVE-2022-50309.json
+53
View File
@@ -0,0 +1,53 @@
{
"id": "CVE-2022-50309",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:42.617",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: xilinx: vipp: Fix refcount leak in xvip_graph_dma_init\n\nof_get_child_by_name() returns a node pointer with refcount\nincremented, we should use of_node_put() on it when not need anymore.\nAdd missing of_node_put() to avoid refcount leak."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/1c78f19c3a0ea312a8178a6bfd8934eb93e9b10a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/22b93530bbe6af9dce8e520bb6e978d1bda39d2b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/2630cc88327a5557aa0d9cc63be95e3c6e0a55b3",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/2ea7caa9684687cf3adc1467cf4af3653a776192",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/3336210948b22c2db43e9df2ea403d251b4d24ab",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/3c38467c3255c428cdbd3cefaccca4662f302dc9",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/59b315353252abe7b8fdb8651ca31b8484ce287a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6e7b3b1e4e9f739800cd8010b75a9bee8d808cee",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/7b0efe7534071e0153708886355d80db69525d50",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-503xx/CVE-2022-50310.json
+25
View File
@@ -0,0 +1,25 @@
{
"id": "CVE-2022-50310",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:42.750",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nip6mr: fix UAF issue in ip6mr_sk_done() when addrconf_init_net() failed\n\nIf the initialization fails in calling addrconf_init_net(), devconf_all is\nthe pointer that has been released. Then ip6mr_sk_done() is called to\nrelease the net, accessing devconf->mc_forwarding directly causes invalid\npointer access.\n\nThe process is as follows:\nsetup_net()\n\tops_init()\n\t\taddrconf_init_net()\n\t\tall = kmemdup(...) ---> alloc \"all\"\n\t\t...\n\t\tnet->ipv6.devconf_all = all;\n\t\t__addrconf_sysctl_register() ---> failed\n\t\t...\n\t\tkfree(all); ---> ipv6.devconf_all invalid\n\t\t...\n\tops_exit_list()\n\t\t...\n\t\tip6mr_sk_done()\n\t\t\tdevconf = net->ipv6.devconf_all;\n\t\t\t//devconf is invalid pointer\n\t\t\tif (!devconf || !atomic_read(&devconf->mc_forwarding))\n\nThe following is the Call Trace information:\nBUG: KASAN: use-after-free in ip6mr_sk_done+0x112/0x3a0\nRead of size 4 at addr ffff888075508e88 by task ip/14554\nCall Trace:\n<TASK>\ndump_stack_lvl+0x8e/0xd1\nprint_report+0x155/0x454\nkasan_report+0xba/0x1f0\nkasan_check_range+0x35/0x1b0\nip6mr_sk_done+0x112/0x3a0\nrawv6_close+0x48/0x70\ninet_release+0x109/0x230\ninet6_release+0x4c/0x70\nsock_release+0x87/0x1b0\nigmp6_net_exit+0x6b/0x170\nops_exit_list+0xb0/0x170\nsetup_net+0x7ac/0xbd0\ncopy_net_ns+0x2e6/0x6b0\ncreate_new_namespaces+0x382/0xa50\nunshare_nsproxy_namespaces+0xa6/0x1c0\nksys_unshare+0x3a4/0x7e0\n__x64_sys_unshare+0x2d/0x40\ndo_syscall_64+0x35/0x80\nentry_SYSCALL_64_after_hwframe+0x46/0xb0\nRIP: 0033:0x7f7963322547\n\n</TASK>\nAllocated by task 14554:\nkasan_save_stack+0x1e/0x40\nkasan_set_track+0x21/0x30\n__kasan_kmalloc+0xa1/0xb0\n__kmalloc_node_track_caller+0x4a/0xb0\nkmemdup+0x28/0x60\naddrconf_init_net+0x1be/0x840\nops_init+0xa5/0x410\nsetup_net+0x5aa/0xbd0\ncopy_net_ns+0x2e6/0x6b0\ncreate_new_namespaces+0x382/0xa50\nunshare_nsproxy_namespaces+0xa6/0x1c0\nksys_unshare+0x3a4/0x7e0\n__x64_sys_unshare+0x2d/0x40\ndo_syscall_64+0x35/0x80\nentry_SYSCALL_64_after_hwframe+0x46/0xb0\n\nFreed by task 14554:\nkasan_save_stack+0x1e/0x40\nkasan_set_track+0x21/0x30\nkasan_save_free_info+0x2a/0x40\n____kasan_slab_free+0x155/0x1b0\nslab_free_freelist_hook+0x11b/0x220\n__kmem_cache_free+0xa4/0x360\naddrconf_init_net+0x623/0x840\nops_init+0xa5/0x410\nsetup_net+0x5aa/0xbd0\ncopy_net_ns+0x2e6/0x6b0\ncreate_new_namespaces+0x382/0xa50\nunshare_nsproxy_namespaces+0xa6/0x1c0\nksys_unshare+0x3a4/0x7e0\n__x64_sys_unshare+0x2d/0x40\ndo_syscall_64+0x35/0x80\nentry_SYSCALL_64_after_hwframe+0x46/0xb0"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/1ca695207ed2271ecbf8ee6c641970f621c157cc",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/22a68c3b9362eaac7b035eba09e95e6b3f7a912c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-503xx/CVE-2022-50311.json
+49
View File
@@ -0,0 +1,49 @@
{
"id": "CVE-2022-50311",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:42.860",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncxl: Fix refcount leak in cxl_calc_capp_routing\n\nof_get_next_parent() returns a node pointer with refcount incremented,\nwe should use of_node_put() on it when not need anymore.\nThis function only calls of_node_put() in normal path,\nmissing it in the error path.\nAdd missing of_node_put() to avoid refcount leak."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/1d09697ff22908ae487fc8c4fbde1811732be523",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/2d7b6580384e6d65419933ddc525bd176095da54",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/651e8bc9d0418c20a1989b7c078c64c2a6346fa3",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6a310e8db5409676b4b3e6c1f54dff174e4fd04d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/81c8bbf5b2b5f0c8030fff1716c00849cda8571a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c9bebc503881c1391f6c4f820134884adecf1519",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ee870f72465015327ad96204b0e92450d04870cd",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f2d60f6ba173cded65081cee690b67802395a479",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-503xx/CVE-2022-50312.json
+53
View File
@@ -0,0 +1,53 @@
{
"id": "CVE-2022-50312",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:42.980",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrivers: serial: jsm: fix some leaks in probe\n\nThis error path needs to unwind instead of just returning directly."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/1d5859ef229e381f4db38dce8ed58e4bf862006b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/3bf05c2650cf6b8d83bf0b0d808cc78c6ee7e84c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/3ea1fd63fdf0e83b491c2a9f25b395aa0e4bf6e8",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6066bd69ffba3a6abc7c0793ccba1da79b7d77e3",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6be8e565a4a60530797a974d0a3d0e30656166a1",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/71ffe5111f0ffa2fd43c14fd176c6f05d4e82212",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/737594536dc3ce732976c0d84bb1dcc842065521",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/744c2d33a88b082d9d504520f0132b3d688547b2",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ff9a5e50fb1910be33e62925bc7ee3bef474879e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-503xx/CVE-2022-50313.json
+41
View File
@@ -0,0 +1,41 @@
{
"id": "CVE-2022-50313",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:43.120",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: fix order >= MAX_ORDER warning due to crafted negative i_size\n\nAs syzbot reported [1], the root cause is that i_size field is a\nsigned type, and negative i_size is also less than EROFS_BLKSIZ.\nAs a consequence, it's handled as fast symlink unexpectedly.\n\nLet's fall back to the generic path to deal with such unusual i_size.\n\n[1] https://lore.kernel.org/r/[email protected]"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/0ab621fcdff1a58ff4de51a8590fa92a0ecd34be",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/17a0cdbd7b0cf0fc0d7ca4187a67f8f1c18c291f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/1dd73601a1cba37a0ed5f89a8662c90191df5873",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6235fb899b25fd287d5e42635ff82196395708cc",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/acc2f40b980c61a9178b72cdedd150b829064997",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b6c8330f5b0f22149957a2e4977fd0f01a9db7cd",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-503xx/CVE-2022-50314.json
+49
View File
@@ -0,0 +1,49 @@
{
"id": "CVE-2022-50314",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:43.247",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnbd: Fix hung when signal interrupts nbd_start_device_ioctl()\n\nsyzbot reported hung task [1]. The following program is a simplified\nversion of the reproducer:\n\nint main(void)\n{\n\tint sv[2], fd;\n\n\tif (socketpair(AF_UNIX, SOCK_STREAM, 0, sv) < 0)\n\t\treturn 1;\n\tif ((fd = open(\"/dev/nbd0\", 0)) < 0)\n\t\treturn 1;\n\tif (ioctl(fd, NBD_SET_SIZE_BLOCKS, 0x81) < 0)\n\t\treturn 1;\n\tif (ioctl(fd, NBD_SET_SOCK, sv[0]) < 0)\n\t\treturn 1;\n\tif (ioctl(fd, NBD_DO_IT) < 0)\n\t\treturn 1;\n\treturn 0;\n}\n\nWhen signal interrupt nbd_start_device_ioctl() waiting the condition\natomic_read(&config->recv_threads) == 0, the task can hung because it\nwaits the completion of the inflight IOs.\n\nThis patch fixes the issue by clearing queue, not just shutdown, when\nsignal interrupt nbd_start_device_ioctl()."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/1de7c3cf48fc41cd95adb12bd1ea9033a917798a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/3575949513ea3b387b30dac1e69468a923c86caf",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/35fb7d4a53d9e36d1b91161ea9870d9c6d57dccf",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/3ba3846cb3e2fb3c6fbf79e998472821b298419e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/62006a72b05e0d38727eef5188700f2488be5e89",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b2700f98b3f4dd19fb4315b70581e5caff89eb49",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c0d73be0af8c1310713bc39a8d7a22e35084e14f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c7b4641bd2395c2f3cd3b0a0cbf292ed9d489398",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-503xx/CVE-2022-50315.json
+49
View File
@@ -0,0 +1,49 @@
{
"id": "CVE-2022-50315",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:43.373",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS\n\nUBSAN complains about array-index-out-of-bounds:\n[ 1.980703] kernel: UBSAN: array-index-out-of-bounds in /build/linux-9H675w/linux-5.15.0/drivers/ata/libahci.c:968:41\n[ 1.980709] kernel: index 15 is out of range for type 'ahci_em_priv [8]'\n[ 1.980713] kernel: CPU: 0 PID: 209 Comm: scsi_eh_8 Not tainted 5.15.0-25-generic #25-Ubuntu\n[ 1.980716] kernel: Hardware name: System manufacturer System Product Name/P5Q3, BIOS 1102 06/11/2010\n[ 1.980718] kernel: Call Trace:\n[ 1.980721] kernel: <TASK>\n[ 1.980723] kernel: show_stack+0x52/0x58\n[ 1.980729] kernel: dump_stack_lvl+0x4a/0x5f\n[ 1.980734] kernel: dump_stack+0x10/0x12\n[ 1.980736] kernel: ubsan_epilogue+0x9/0x45\n[ 1.980739] kernel: __ubsan_handle_out_of_bounds.cold+0x44/0x49\n[ 1.980742] kernel: ahci_qc_issue+0x166/0x170 [libahci]\n[ 1.980748] kernel: ata_qc_issue+0x135/0x240\n[ 1.980752] kernel: ata_exec_internal_sg+0x2c4/0x580\n[ 1.980754] kernel: ? vprintk_default+0x1d/0x20\n[ 1.980759] kernel: ata_exec_internal+0x67/0xa0\n[ 1.980762] kernel: sata_pmp_read+0x8d/0xc0\n[ 1.980765] kernel: sata_pmp_read_gscr+0x3c/0x90\n[ 1.980768] kernel: sata_pmp_attach+0x8b/0x310\n[ 1.980771] kernel: ata_eh_revalidate_and_attach+0x28c/0x4b0\n[ 1.980775] kernel: ata_eh_recover+0x6b6/0xb30\n[ 1.980778] kernel: ? ahci_do_hardreset+0x180/0x180 [libahci]\n[ 1.980783] kernel: ? ahci_stop_engine+0xb0/0xb0 [libahci]\n[ 1.980787] kernel: ? ahci_do_softreset+0x290/0x290 [libahci]\n[ 1.980792] kernel: ? trace_event_raw_event_ata_eh_link_autopsy_qc+0xe0/0xe0\n[ 1.980795] kernel: sata_pmp_eh_recover.isra.0+0x214/0x560\n[ 1.980799] kernel: sata_pmp_error_handler+0x23/0x40\n[ 1.980802] kernel: ahci_error_handler+0x43/0x80 [libahci]\n[ 1.980806] kernel: ata_scsi_port_error_handler+0x2b1/0x600\n[ 1.980810] kernel: ata_scsi_error+0x9c/0xd0\n[ 1.980813] kernel: scsi_error_handler+0xa1/0x180\n[ 1.980817] kernel: ? scsi_unjam_host+0x1c0/0x1c0\n[ 1.980820] kernel: kthread+0x12a/0x150\n[ 1.980823] kernel: ? set_kthread_struct+0x50/0x50\n[ 1.980826] kernel: ret_from_fork+0x22/0x30\n[ 1.980831] kernel: </TASK>\n\nThis happens because sata_pmp_init_links() initialize link->pmp up to\nSATA_PMP_MAX_PORTS while em_priv is declared as 8 elements array.\n\nI can't find the maximum Enclosure Management ports specified in AHCI\nspec v1.3.1, but \"12.2.1 LED message type\" states that \"Port Multiplier\nInformation\" can utilize 4 bits, which implies it can support up to 16\nports. Hence, use SATA_PMP_MAX_PORTS as EM_MAX_SLOTS to resolve the\nissue.\n\nBugLink: https://bugs.launchpad.net/bugs/1970074"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/1e41e693f458eef2d5728207dbd327cd3b16580a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/303d0f761431d848dd8d7ff9fd9b8c101879cabe",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/383b7c50f5445ff8dbbf03080905648d6980c39d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/67a00c299c5c143817c948fbc7de1a2fa1af38fb",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8fbe13de1cc7cef2564be3cbf60400b33eee023b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d6314d5f68764550c84d732ce901ddd3ac6b415f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/da2ea4a961d9f89ed248734e7032350c260dc3a3",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f70bd4339cb68bc7e206af4c922bc0d249244403",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-503xx/CVE-2022-50316.json
+29
View File
@@ -0,0 +1,29 @@
{
"id": "CVE-2022-50316",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:43.500",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\norangefs: Fix kmemleak in orangefs_sysfs_init()\n\nWhen insert and remove the orangefs module, there are kobjects memory\nleaked as below:\n\nunreferenced object 0xffff88810f95af00 (size 64):\n comm \"insmod\", pid 783, jiffies 4294813439 (age 65.512s)\n hex dump (first 32 bytes):\n a0 83 af 01 81 88 ff ff 08 af 95 0f 81 88 ff ff ................\n 08 af 95 0f 81 88 ff ff 00 00 00 00 00 00 00 00 ................\n backtrace:\n [<0000000031ab7788>] kmalloc_trace+0x27/0xa0\n [<000000005a6e4dfe>] orangefs_sysfs_init+0x42/0x3a0\n [<00000000722645ca>] 0xffffffffa02780fe\n [<000000004232d9f7>] do_one_initcall+0x87/0x2a0\n [<0000000054f22384>] do_init_module+0xdf/0x320\n [<000000003263bdea>] load_module+0x2f98/0x3330\n [<0000000052cd4153>] __do_sys_finit_module+0x113/0x1b0\n [<00000000250ae02b>] do_syscall_64+0x35/0x80\n [<00000000f11c03c7>] entry_SYSCALL_64_after_hwframe+0x46/0xb0\n\nunreferenced object 0xffff88810f95ae80 (size 64):\n comm \"insmod\", pid 783, jiffies 4294813439 (age 65.512s)\n hex dump (first 32 bytes):\n c8 90 0f 02 81 88 ff ff 88 ae 95 0f 81 88 ff ff ................\n 88 ae 95 0f 81 88 ff ff 00 00 00 00 00 00 00 00 ................\n backtrace:\n [<0000000031ab7788>] kmalloc_trace+0x27/0xa0\n [<000000001a4841fa>] orangefs_sysfs_init+0xc7/0x3a0\n [<00000000722645ca>] 0xffffffffa02780fe\n [<000000004232d9f7>] do_one_initcall+0x87/0x2a0\n [<0000000054f22384>] do_init_module+0xdf/0x320\n [<000000003263bdea>] load_module+0x2f98/0x3330\n [<0000000052cd4153>] __do_sys_finit_module+0x113/0x1b0\n [<00000000250ae02b>] do_syscall_64+0x35/0x80\n [<00000000f11c03c7>] entry_SYSCALL_64_after_hwframe+0x46/0xb0\n\nunreferenced object 0xffff88810f95ae00 (size 64):\n comm \"insmod\", pid 783, jiffies 4294813440 (age 65.511s)\n hex dump (first 32 bytes):\n 60 87 a1 00 81 88 ff ff 08 ae 95 0f 81 88 ff ff `...............\n 08 ae 95 0f 81 88 ff ff 00 00 00 00 00 00 00 00 ................\n backtrace:\n [<0000000031ab7788>] kmalloc_trace+0x27/0xa0\n [<000000005915e797>] orangefs_sysfs_init+0x12b/0x3a0\n [<00000000722645ca>] 0xffffffffa02780fe\n [<000000004232d9f7>] do_one_initcall+0x87/0x2a0\n [<0000000054f22384>] do_init_module+0xdf/0x320\n [<000000003263bdea>] load_module+0x2f98/0x3330\n [<0000000052cd4153>] __do_sys_finit_module+0x113/0x1b0\n [<00000000250ae02b>] do_syscall_64+0x35/0x80\n [<00000000f11c03c7>] entry_SYSCALL_64_after_hwframe+0x46/0xb0\n\nunreferenced object 0xffff88810f95ad80 (size 64):\n comm \"insmod\", pid 783, jiffies 4294813440 (age 65.511s)\n hex dump (first 32 bytes):\n 78 90 0f 02 81 88 ff ff 88 ad 95 0f 81 88 ff ff x...............\n 88 ad 95 0f 81 88 ff ff 00 00 00 00 00 00 00 00 ................\n backtrace:\n [<0000000031ab7788>] kmalloc_trace+0x27/0xa0\n [<000000007a14eb35>] orangefs_sysfs_init+0x1ac/0x3a0\n [<00000000722645ca>] 0xffffffffa02780fe\n [<000000004232d9f7>] do_one_initcall+0x87/0x2a0\n [<0000000054f22384>] do_init_module+0xdf/0x320\n [<000000003263bdea>] load_module+0x2f98/0x3330\n [<0000000052cd4153>] __do_sys_finit_module+0x113/0x1b0\n [<00000000250ae02b>] do_syscall_64+0x35/0x80\n [<00000000f11c03c7>] entry_SYSCALL_64_after_hwframe+0x46/0xb0\n\nunreferenced object 0xffff88810f95ac00 (size 64):\n comm \"insmod\", pid 783, jiffies 4294813440 (age 65.531s)\n hex dump (first 32 bytes):\n e0 ff 67 02 81 88 ff ff 08 ac 95 0f 81 88 ff ff ..g.............\n 08 ac 95 0f 81 88 ff ff 00 00 00 00 00 00 00 00 ................\n backtrace:\n [<0000000031ab7788>] kmalloc_trace+0x27/0xa0\n [<000000001f38adcb>] orangefs_sysfs_init+0x291/0x3a0\n [<00000000722645ca>] 0xffffffffa02780fe\n [<000000004232d9f7>] do_one_initcall+0x87/0x2a0\n [<0000000054f22384>] do_init_module+0xdf/0x320\n [<000000003263bdea>] load_module+0x2f98/0x3330\n [<0000000052cd4153>] __do_sys_finit_module+0x113/0x1b0\n [<00000000250ae02b>] do_syscall_64+0x35/\n---truncated---"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/1f2c0e8a587bcafad85019a2d80f158d8d41a868",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/22409490294180c39be7dd0e5b2667d41556307d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9ce4ba7fff5af36da82dc5964221367630621b99",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-503xx/CVE-2022-50317.json
+49
View File
@@ -0,0 +1,49 @@
{
"id": "CVE-2022-50317",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:43.620",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/bridge: megachips: Fix a null pointer dereference bug\n\nWhen removing the module we will get the following warning:\n\n[ 31.911505] i2c-core: driver [stdp2690-ge-b850v3-fw] unregistered\n[ 31.912484] general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN PTI\n[ 31.913338] KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]\n[ 31.915280] RIP: 0010:drm_bridge_remove+0x97/0x130\n[ 31.921825] Call Trace:\n[ 31.922533] stdp4028_ge_b850v3_fw_remove+0x34/0x60 [megachips_stdpxxxx_ge_b850v3_fw]\n[ 31.923139] i2c_device_remove+0x181/0x1f0\n\nThe two bridges (stdp2690, stdp4028) do not probe at the same time, so\nthe driver does not call ge_b850v3_resgiter() when probing, causing the\ndriver to try to remove the object that has not been initialized.\n\nFix this by checking whether both the bridges are probed."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/1daf69228e310938177119c4eadcd30fc75c81e0",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/1ff673333d46d2c1b053ebd0c1c7c7c79e36943e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/21764467ab396d9f08921e0a5ffa1214244e1ad9",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/4610e7a4111fa3f3ce27c09d6d94008c55f1cd31",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/5bc20bafcd87ba0858ab772cefc7047cb51bc249",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/7371fad5cfe6eada6bb5523c895fd6074b15c2b9",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/877e92e9b1bdeb580b31a46061005936be902cd4",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/aaa512ad1e59f2edf8a9e4f2b167a44b24670679",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-503xx/CVE-2022-50318.json
+45
View File
@@ -0,0 +1,45 @@
{
"id": "CVE-2022-50318",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:43.750",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/x86/intel/uncore: Fix reference count leak in hswep_has_limit_sbox()\n\npci_get_device() will increase the reference count for the returned\n'dev'. We need to call pci_dev_put() to decrease the reference count.\nSince 'dev' is only used in pci_read_config_dword(), let's add\npci_dev_put() right after it."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/1ff9dd6e7071a561f803135c1d684b13c7a7d01d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/3485f197518061371568f842405159aa9e4df551",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/48f32b9a74e2ac8e854bb87bfefdbc745125a123",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/5a96c10a56037db006ba6769307a9731cf6073be",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/bd66877c0b3b42eed0ecee0bd2a2a505c1e54177",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c0539d5d474ee6fa4ebc41f927a0f98f81244f25",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e293263248f25c6b8aa1caf7c1103d40aa03311e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-503xx/CVE-2022-50319.json
+33
View File
@@ -0,0 +1,33 @@
{
"id": "CVE-2022-50319",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:43.880",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncoresight: trbe: remove cpuhp instance node before remove cpuhp state\n\ncpuhp_state_add_instance() and cpuhp_state_remove_instance() should\nbe used in pairs. Or there will lead to the warn on\ncpuhp_remove_multi_state() since the cpuhp_step list is not empty.\n\nThe following is the error log with 'rmmod coresight-trbe':\nError: Removing state 215 which has instances left.\nCall trace:\n __cpuhp_remove_state_cpuslocked+0x144/0x160\n __cpuhp_remove_state+0xac/0x100\n arm_trbe_device_remove+0x2c/0x60 [coresight_trbe]\n platform_remove+0x34/0x70\n device_remove+0x54/0x90\n device_release_driver_internal+0x1e4/0x250\n driver_detach+0x5c/0xb0\n bus_remove_driver+0x64/0xc0\n driver_unregister+0x3c/0x70\n platform_driver_unregister+0x20/0x30\n arm_trbe_exit+0x1c/0x658 [coresight_trbe]\n __arm64_sys_delete_module+0x1ac/0x24c\n invoke_syscall+0x50/0x120\n el0_svc_common.constprop.0+0x58/0x1a0\n do_el0_svc+0x38/0xd0\n el0_svc+0x2c/0xc0\n el0t_64_sync_handler+0x1ac/0x1b0\n el0t_64_sync+0x19c/0x1a0\n ---[ end trace 0000000000000000 ]---"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/18b9202188a4e59923834c60b5c82ea1da7d1811",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/20ee8c223f792947378196307d8e707c9cdc2d61",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/2ea334960afcd49385840c7afd59fc5f8d3ce682",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/3c18888bc0b51835c74123b1e04d5df11543724c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-503xx/CVE-2022-50320.json
+33
View File
@@ -0,0 +1,33 @@
{
"id": "CVE-2022-50320",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:43.997",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: tables: FPDT: Don't call acpi_os_map_memory() on invalid phys address\n\nOn a Packard Bell Dot SC (Intel Atom N2600 model) there is a FPDT table\nwhich contains invalid physical addresses, with high bits set which fall\noutside the range of the CPU-s supported physical address range.\n\nCalling acpi_os_map_memory() on such an invalid phys address leads to\nthe below WARN_ON in ioremap triggering resulting in an oops/stacktrace.\n\nAdd code to verify the physical address before calling acpi_os_map_memory()\nto fix / avoid the oops.\n\n[ 1.226900] ioremap: invalid physical address 3001000000000000\n[ 1.226949] ------------[ cut here ]------------\n[ 1.226962] WARNING: CPU: 1 PID: 1 at arch/x86/mm/ioremap.c:200 __ioremap_caller.cold+0x43/0x5f\n[ 1.226996] Modules linked in:\n[ 1.227016] CPU: 1 PID: 1 Comm: swapper/0 Not tainted 6.0.0-rc3+ #490\n[ 1.227029] Hardware name: Packard Bell dot s/SJE01_CT, BIOS V1.10 07/23/2013\n[ 1.227038] RIP: 0010:__ioremap_caller.cold+0x43/0x5f\n[ 1.227054] Code: 96 00 00 e9 f8 af 24 ff 89 c6 48 c7 c7 d8 0c 84 99 e8 6a 96 00 00 e9 76 af 24 ff 48 89 fe 48 c7 c7 a8 0c 84 99 e8 56 96 00 00 <0f> 0b e9 60 af 24 ff 48 8b 34 24 48 c7 c7 40 0d 84 99 e8 3f 96 00\n[ 1.227067] RSP: 0000:ffffb18c40033d60 EFLAGS: 00010286\n[ 1.227084] RAX: 0000000000000032 RBX: 3001000000000000 RCX: 0000000000000000\n[ 1.227095] RDX: 0000000000000001 RSI: 00000000ffffdfff RDI: 00000000ffffffff\n[ 1.227105] RBP: 3001000000000000 R08: 0000000000000000 R09: ffffb18c40033c18\n[ 1.227115] R10: 0000000000000003 R11: ffffffff99d62fe8 R12: 0000000000000008\n[ 1.227124] R13: 0003001000000000 R14: 0000000000001000 R15: 3001000000000000\n[ 1.227135] FS: 0000000000000000(0000) GS:ffff913a3c080000(0000) knlGS:0000000000000000\n[ 1.227146] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 1.227156] CR2: 0000000000000000 CR3: 0000000018c26000 CR4: 00000000000006e0\n[ 1.227167] Call Trace:\n[ 1.227176] <TASK>\n[ 1.227185] ? acpi_os_map_iomem+0x1c9/0x1e0\n[ 1.227215] ? kmem_cache_alloc_trace+0x187/0x370\n[ 1.227254] acpi_os_map_iomem+0x1c9/0x1e0\n[ 1.227288] acpi_init_fpdt+0xa8/0x253\n[ 1.227308] ? acpi_debugfs_init+0x1f/0x1f\n[ 1.227339] do_one_initcall+0x5a/0x300\n[ 1.227406] ? rcu_read_lock_sched_held+0x3f/0x80\n[ 1.227442] kernel_init_freeable+0x28b/0x2cc\n[ 1.227512] ? rest_init+0x170/0x170\n[ 1.227538] kernel_init+0x16/0x140\n[ 1.227552] ret_from_fork+0x1f/0x30\n[ 1.227639] </TASK>\n[ 1.227647] irq event stamp: 186819\n[ 1.227656] hardirqs last enabled at (186825): [<ffffffff98184a6e>] __up_console_sem+0x5e/0x70\n[ 1.227672] hardirqs last disabled at (186830): [<ffffffff98184a53>] __up_console_sem+0x43/0x70\n[ 1.227686] softirqs last enabled at (186576): [<ffffffff980fbc9d>] __irq_exit_rcu+0xed/0x160\n[ 1.227701] softirqs last disabled at (186569): [<ffffffff980fbc9d>] __irq_exit_rcu+0xed/0x160\n[ 1.227715] ---[ end trace 0000000000000000 ]---"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/16046a716c8e1f447909bec9b478d58e6e25e513",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/211391bf04b3c74e250c566eeff9cf808156c693",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/30eca146c89d216dda95868ce00a2d35cf73d5a4",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/90bfc9ae875dfbed2e6089516520204cd431dba3",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-503xx/CVE-2022-50321.json
+49
View File
@@ -0,0 +1,49 @@
{
"id": "CVE-2022-50321",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:44.110",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit()\n\nThe brcmf_netdev_start_xmit() returns NETDEV_TX_OK without freeing skb\nin case of pskb_expand_head() fails, add dev_kfree_skb() to fix it.\nCompile tested only."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/212fde3fe76e962598ce1d47b97cc78afdfc71b3",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/3a4d18318f473e97d628f410215b3fac32d07aed",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/4c55fdebc1c358de96bfab52ed309d58a3ba66ef",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/7f159116d620615779adbf88a5d94713702216d8",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d869a189505224601e310c7769cb90b0e2f60b31",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e08e6812efb6a8c676e733de0518594d1517e0d9",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e5d01e85cf46628647cd696cb72ba4659b18967f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e8ef89e5b89ee041a94eecfb6c31fcc237f9168c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-503xx/CVE-2022-50322.json
+29
View File
@@ -0,0 +1,29 @@
{
"id": "CVE-2022-50322",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:44.240",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrtc: msc313: Fix function prototype mismatch in msc313_rtc_probe()\n\nWith clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG),\nindirect call targets are validated against the expected function\npointer prototype to make sure the call target is valid to help mitigate\nROP attacks. If they are not identical, there is a failure at run time,\nwhich manifests as either a kernel panic or thread getting killed.\n\nmsc313_rtc_probe() was passing clk_disable_unprepare() directly, which\ndid not have matching prototypes for devm_add_action_or_reset()'s\ncallback argument. Refactor to use devm_clk_get_enabled() instead.\n\nThis was found as a result of Clang's new -Wcast-function-type-strict\nflag, which is more sensitive than the simpler -Wcast-function-type,\nwhich only checks for type width mismatches."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/21b8a1dd56a163825e5749b303858fb902ebf198",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/5affaaf3334c9274131dae889ed79ea0553d61b4",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ba50fee6b41bcbafaeed3c51f90d37d1480ff9a0",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-503xx/CVE-2022-50323.json
+29
View File
@@ -0,0 +1,29 @@
{
"id": "CVE-2022-50323",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:44.357",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: do not sense pfmemalloc status in skb_append_pagefrags()\n\nskb_append_pagefrags() is used by af_unix and udp sendpage()\nimplementation so far.\n\nIn commit 326140063946 (\"tcp: TX zerocopy should not sense\npfmemalloc status\") we explained why we should not sense\npfmemalloc status for pages owned by user space.\n\nWe should also use skb_fill_page_desc_noacc()\nin skb_append_pagefrags() to avoid following KCSAN report:\n\nBUG: KCSAN: data-race in lru_add_fn / skb_append_pagefrags\n\nwrite to 0xffffea00058fc1c8 of 8 bytes by task 17319 on cpu 0:\n__list_add include/linux/list.h:73 [inline]\nlist_add include/linux/list.h:88 [inline]\nlruvec_add_folio include/linux/mm_inline.h:323 [inline]\nlru_add_fn+0x327/0x410 mm/swap.c:228\nfolio_batch_move_lru+0x1e1/0x2a0 mm/swap.c:246\nlru_add_drain_cpu+0x73/0x250 mm/swap.c:669\nlru_add_drain+0x21/0x60 mm/swap.c:773\nfree_pages_and_swap_cache+0x16/0x70 mm/swap_state.c:311\ntlb_batch_pages_flush mm/mmu_gather.c:59 [inline]\ntlb_flush_mmu_free mm/mmu_gather.c:256 [inline]\ntlb_flush_mmu+0x5b2/0x640 mm/mmu_gather.c:263\ntlb_finish_mmu+0x86/0x100 mm/mmu_gather.c:363\nexit_mmap+0x190/0x4d0 mm/mmap.c:3098\n__mmput+0x27/0x1b0 kernel/fork.c:1185\nmmput+0x3d/0x50 kernel/fork.c:1207\ncopy_process+0x19fc/0x2100 kernel/fork.c:2518\nkernel_clone+0x166/0x550 kernel/fork.c:2671\n__do_sys_clone kernel/fork.c:2812 [inline]\n__se_sys_clone kernel/fork.c:2796 [inline]\n__x64_sys_clone+0xc3/0xf0 kernel/fork.c:2796\ndo_syscall_x64 arch/x86/entry/common.c:50 [inline]\ndo_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80\nentry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nread to 0xffffea00058fc1c8 of 8 bytes by task 17325 on cpu 1:\npage_is_pfmemalloc include/linux/mm.h:1817 [inline]\n__skb_fill_page_desc include/linux/skbuff.h:2432 [inline]\nskb_fill_page_desc include/linux/skbuff.h:2453 [inline]\nskb_append_pagefrags+0x210/0x600 net/core/skbuff.c:3974\nunix_stream_sendpage+0x45e/0x990 net/unix/af_unix.c:2338\nkernel_sendpage+0x184/0x300 net/socket.c:3561\nsock_sendpage+0x5a/0x70 net/socket.c:1054\npipe_to_sendpage+0x128/0x160 fs/splice.c:361\nsplice_from_pipe_feed fs/splice.c:415 [inline]\n__splice_from_pipe+0x222/0x4d0 fs/splice.c:559\nsplice_from_pipe fs/splice.c:594 [inline]\ngeneric_splice_sendpage+0x89/0xc0 fs/splice.c:743\ndo_splice_from fs/splice.c:764 [inline]\ndirect_splice_actor+0x80/0xa0 fs/splice.c:931\nsplice_direct_to_actor+0x305/0x620 fs/splice.c:886\ndo_splice_direct+0xfb/0x180 fs/splice.c:974\ndo_sendfile+0x3bf/0x910 fs/read_write.c:1255\n__do_sys_sendfile64 fs/read_write.c:1323 [inline]\n__se_sys_sendfile64 fs/read_write.c:1309 [inline]\n__x64_sys_sendfile64+0x10c/0x150 fs/read_write.c:1309\ndo_syscall_x64 arch/x86/entry/common.c:50 [inline]\ndo_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80\nentry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nvalue changed: 0x0000000000000000 -> 0xffffea00058fc188\n\nReported by Kernel Concurrency Sanitizer on:\nCPU: 1 PID: 17325 Comm: syz-executor.0 Not tainted 6.1.0-rc1-syzkaller-00158-g440b7895c990-dirty #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/11/2022"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/228ebc41dfab5b5d34cd76835ddb0ca8ee12f513",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/847a2859814b31392340a2b16604b25afaa92dcc",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/92b4c5c3fa810212da20088bcc6c0a77fc8607bd",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-503xx/CVE-2022-50324.json
+53
View File
@@ -0,0 +1,53 @@
{
"id": "CVE-2022-50324",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:44.473",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: maps: pxa2xx-flash: fix memory leak in probe\n\nFree 'info' upon remapping error to avoid a memory leak.\n\n[<[email protected]>: Reword the commit log]"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/1d0c2b762dad2b8dd166e17c0e90b88b86a3284f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/2399401feee27c639addc5b7e6ba519d3ca341bf",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6fa9550ef3e13d7e9b2d4db6dd57292ccd072a90",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/932baf593eb63dff40e40d7674f076fb7932cd5b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a1b061cafdbcb1ff259731f30e2bdc1de64dcaba",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/cb3f35f44887a8486737fe88d58050f1df290758",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/cf9c4c25caad05c6b492cbba739a467511814279",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e2324a0912ad26a0ea5baaf81aed0ca880804158",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f35981083cb3fc1ba6427c1543152c5e3f59d104",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-503xx/CVE-2022-50325.json
+29
View File
@@ -0,0 +1,29 @@
{
"id": "CVE-2022-50325",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:44.600",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: Intel: avs: Fix potential RX buffer overflow\n\nIf an event caused firmware to return invalid RX size for\nLARGE_CONFIG_GET, memcpy_fromio() could end up copying too many bytes.\nFix by utilizing min_t()."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/0bad12fee5ae16ab439d97c66c4238f5f4cc7f68",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/23ae34e033b2c0e5e88237af82b163b296fd6aa9",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ec1f0c12cb2e614c3fa8e9402f7ffcf82166078a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-503xx/CVE-2022-50326.json
+25
View File
@@ -0,0 +1,25 @@
{
"id": "CVE-2022-50326",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:44.710",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: airspy: fix memory leak in airspy probe\n\nThe commit ca9dc8d06ab6 (\"media: airspy: respect the DMA coherency\n rules\") moves variable buf from stack to heap, however, it only frees\nbuf in the error handling code, missing deallocation in the success\npath.\n\nFix this by freeing buf in the success path since this variable does not\nhave any references in other code."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/23bc5eb55f8c9607965c20d9ddcc13cb1ae59568",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f4285dd02b6b2ca3435b65fb62c053dd9408fd71",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-503xx/CVE-2022-50327.json
+41
View File
@@ -0,0 +1,41 @@
{
"id": "CVE-2022-50327",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:44.827",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: processor: idle: Check acpi_fetch_acpi_dev() return value\n\nThe return value of acpi_fetch_acpi_dev() could be NULL, which would\ncause a NULL pointer dereference to occur in acpi_device_hid().\n\n[ rjw: Subject and changelog edits, added empty line after if () ]"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/2437513a814b3e93bd02879740a8a06e52e2cf7d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/2ecd629c788bbfb96be058edade2e934d3763eaf",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8e8b5f12ee4ab6f5d252c9ca062a4ada9554e6d9",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ad1190744da9d812da55b76f2afce750afb0a3bd",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b85f0e292f73f353eea915499604fbf50c8238b4",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/fdee7a0acc566c4194d40a501b8a1584e86cc208",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-503xx/CVE-2022-50328.json
+37
View File
@@ -0,0 +1,37 @@
{
"id": "CVE-2022-50328",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:44.953",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\njbd2: fix potential use-after-free in jbd2_fc_wait_bufs\n\nIn 'jbd2_fc_wait_bufs' use 'bh' after put buffer head reference count\nwhich may lead to use-after-free.\nSo judge buffer if uptodate before put buffer head reference count."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/1d4d16daec2a6689b6d3fbfc7d2078643adc6619",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/243d1a5d505d0b0460c9af0ad56ed4a56ef0bebd",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/2e6d9f381c1ed844531a577783fc352de7a44c8a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d11d2ded293976a1a0d9d9471827a44dc9e3c63f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/effd9b3c029ecdd853a11933dcf857f5a7ca8c3d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-503xx/CVE-2022-50329.json
+37
View File
@@ -0,0 +1,37 @@
{
"id": "CVE-2022-50329",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:45.067",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock, bfq: fix uaf for bfqq in bfq_exit_icq_bfqq\n\nCommit 64dc8c732f5c (\"block, bfq: fix possible uaf for 'bfqq->bic'\")\nwill access 'bic->bfqq' in bic_set_bfqq(), however, bfq_exit_icq_bfqq()\ncan free bfqq first, and then call bic_set_bfqq(), which will cause uaf.\n\nFix the problem by moving bfq_exit_bfqq() behind bic_set_bfqq()."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/1425f1bb5df5239021fd09ebc2a5e8070e705d36",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/1ed959fef5b1c6f1a7a3fbea543698c30ebd6678",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/246cf66e300b76099b5dbd3fdd39e9a5dbc53f02",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/7949b0df3dd9f4817ed4a4e989fa9ee81df6205f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/cfe5b38c37720313eff0dec5517442c7ab3c9a20",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-503xx/CVE-2022-50330.json
+49
View File
@@ -0,0 +1,49 @@
{
"id": "CVE-2022-50330",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:45.187",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: cavium - prevent integer overflow loading firmware\n\nThe \"code_length\" value comes from the firmware file. If your firmware\nis untrusted realistically there is probably very little you can do to\nprotect yourself. Still we try to limit the damage as much as possible.\nAlso Smatch marks any data read from the filesystem as untrusted and\nprints warnings if it not capped correctly.\n\nThe \"ntohl(ucode->code_length) * 2\" multiplication can have an\ninteger overflow."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/172c8a24fc8312cf6b88d3c88469653fdcb1c127",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/2526d6bf27d15054bb0778b2f7bc6625fd934905",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/371fa5129af53a79f6dddc90fe5bb0825cbe72a4",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/3a720eb89026c5241b8c4abb33370dc6fb565eee",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/584561e94260268abe1c83e00d9c205565cb7bc5",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/90e483e7f20c32287d2a9da967e122938f52737a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c4d4c2afd08dfb3cd1c880d1811ede2568e81a6d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e29fd7a6852376d2cfb95ad5d6d3eeff93f815e9",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-503xx/CVE-2022-50331.json
+29
View File
@@ -0,0 +1,29 @@
{
"id": "CVE-2022-50331",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:45.310",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwwan_hwsim: fix possible memory leak in wwan_hwsim_dev_new()\n\nInject fault while probing module, if device_register() fails,\nbut the refcount of kobject is not decreased to 0, the name\nallocated in dev_set_name() is leaked. Fix this by calling\nput_device(), so that name can be freed in callback function\nkobject_cleanup().\n\nunreferenced object 0xffff88810152ad20 (size 8):\n comm \"modprobe\", pid 252, jiffies 4294849206 (age 22.713s)\n hex dump (first 8 bytes):\n 68 77 73 69 6d 30 00 ff hwsim0..\n backtrace:\n [<000000009c3504ed>] __kmalloc_node_track_caller+0x44/0x1b0\n [<00000000c0228a5e>] kvasprintf+0xb5/0x140\n [<00000000cff8c21f>] kvasprintf_const+0x55/0x180\n [<0000000055a1e073>] kobject_set_name_vargs+0x56/0x150\n [<000000000a80b139>] dev_set_name+0xab/0xe0"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/258ad2fe5ede773625adfda88b173f4123e59f45",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/50c31fa952309536c6e4461ff815ddccc8dff9d5",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d87973314aba6de80a49f4271dd9be4ddc08e729",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-503xx/CVE-2022-50332.json
+21
View File
@@ -0,0 +1,21 @@
{
"id": "CVE-2022-50332",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:45.427",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvideo/aperture: Call sysfb_disable() before removing PCI devices\n\nCall sysfb_disable() from aperture_remove_conflicting_pci_devices()\nbefore removing PCI devices. Without, simpledrm can still bind to\nsimple-framebuffer devices after the hardware driver has taken over\nthe hardware. Both drivers interfere with each other and results are\nundefined.\n\nReported modesetting errors [1] are shown below.\n\n---- snap ----\nrcu: INFO: rcu_sched detected expedited stalls on CPUs/tasks: { 13-.... } 7 jiffies s: 165 root: 0x2000/.\nrcu: blocking rcu_node structures (internal RCU debug):\nTask dump for CPU 13:\ntask:X state:R running task stack: 0 pid: 4242 ppid: 4228 flags:0x00000008\nCall Trace:\n <TASK>\n ? commit_tail+0xd7/0x130\n ? drm_atomic_helper_commit+0x126/0x150\n ? drm_atomic_commit+0xa4/0xe0\n ? drm_plane_get_damage_clips.cold+0x1c/0x1c\n ? drm_atomic_helper_dirtyfb+0x19e/0x280\n ? drm_mode_dirtyfb_ioctl+0x10f/0x1e0\n ? drm_mode_getfb2_ioctl+0x2d0/0x2d0\n ? drm_ioctl_kernel+0xc4/0x150\n ? drm_ioctl+0x246/0x3f0\n ? drm_mode_getfb2_ioctl+0x2d0/0x2d0\n ? __x64_sys_ioctl+0x91/0xd0\n ? do_syscall_64+0x60/0xd0\n ? entry_SYSCALL_64_after_hwframe+0x4b/0xb5\n </TASK>\n...\nrcu: INFO: rcu_sched detected expedited stalls on CPUs/tasks: { 13-.... } 30 jiffies s: 169 root: 0x2000/.\nrcu: blocking rcu_node structures (internal RCU debug):\nTask dump for CPU 13:\ntask:X state:R running task stack: 0 pid: 4242 ppid: 4228 flags:0x0000400e\nCall Trace:\n <TASK>\n ? memcpy_toio+0x76/0xc0\n ? memcpy_toio+0x1b/0xc0\n ? drm_fb_memcpy_toio+0x76/0xb0\n ? drm_fb_blit_toio+0x75/0x2b0\n ? simpledrm_simple_display_pipe_update+0x132/0x150\n ? drm_atomic_helper_commit_planes+0xb6/0x230\n ? drm_atomic_helper_commit_tail+0x44/0x80\n ? commit_tail+0xd7/0x130\n ? drm_atomic_helper_commit+0x126/0x150\n ? drm_atomic_commit+0xa4/0xe0\n ? drm_plane_get_damage_clips.cold+0x1c/0x1c\n ? drm_atomic_helper_dirtyfb+0x19e/0x280\n ? drm_mode_dirtyfb_ioctl+0x10f/0x1e0\n ? drm_mode_getfb2_ioctl+0x2d0/0x2d0\n ? drm_ioctl_kernel+0xc4/0x150\n ? drm_ioctl+0x246/0x3f0\n ? drm_mode_getfb2_ioctl+0x2d0/0x2d0\n ? __x64_sys_ioctl+0x91/0xd0\n ? do_syscall_64+0x60/0xd0\n ? entry_SYSCALL_64_after_hwframe+0x4b/0xb5\n </TASK>\n\nThe problem was added by commit 5e0137612430 (\"video/aperture: Disable\nand unregister sysfb devices via aperture helpers\") to v6.0.3 and does\nnot exist in the mainline branch.\n\nThe mainline commit 5e0137612430 (\"video/aperture: Disable and\nunregister sysfb devices via aperture helpers\") has been backported\nfrom v6.0-rc1 to stable v6.0.3 from a larger patch series [2] that\nreworks fbdev framebuffer ownership. The backport misses a change to\naperture_remove_conflicting_pci_devices(). Mainline itself is fine,\nbecause the function does not exist there as a result of the patch\nseries.\n\nInstead of backporting the whole series, fix the additional function."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/25a6688f27ff54f97adf7cce1d7e18c38bf51eb4",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-503xx/CVE-2022-50333.json
+53
View File
@@ -0,0 +1,53 @@
{
"id": "CVE-2022-50333",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:45.537",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: jfs: fix shift-out-of-bounds in dbDiscardAG\n\nThis should be applied to most URSAN bugs found recently by syzbot,\nby guarding the dbMount. As syzbot feeding rubbish into the bmap\ndescriptor."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/0183c8f46ab5bcd0740f41c87f5141c6ca2bf1bb",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/10b87da8fae79c7daf5eda6a9e4f1d31b85b4d92",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/25e70c6162f207828dd405b432d8f2a98dbf7082",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/3d340b684dcec5e34efc470227cd1c7d2df121ad",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/50163a115831ef4e6402db5a7ef487d1989d7249",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/624843f1bac448150f6859999c72c4841c14a2e3",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/911999b193735cd378517b6cd5fe585ee345d49c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ab5cd3d62c2493eca3337e7d0178cc7bd819ca64",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f8d4d0bac603616e2fa4a3907e81ed13f8f3c380",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-503xx/CVE-2022-50334.json
+41
View File
@@ -0,0 +1,41 @@
{
"id": "CVE-2022-50334",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T15:15:45.677",
"lastModified": "2025-09-15T15:22:27.090",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhugetlbfs: fix null-ptr-deref in hugetlbfs_parse_param()\n\nSyzkaller reports a null-ptr-deref bug as follows:\n======================================================\nKASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\nRIP: 0010:hugetlbfs_parse_param+0x1dd/0x8e0 fs/hugetlbfs/inode.c:1380\n[...]\nCall Trace:\n <TASK>\n vfs_parse_fs_param fs/fs_context.c:148 [inline]\n vfs_parse_fs_param+0x1f9/0x3c0 fs/fs_context.c:129\n vfs_parse_fs_string+0xdb/0x170 fs/fs_context.c:191\n generic_parse_monolithic+0x16f/0x1f0 fs/fs_context.c:231\n do_new_mount fs/namespace.c:3036 [inline]\n path_mount+0x12de/0x1e20 fs/namespace.c:3370\n do_mount fs/namespace.c:3383 [inline]\n __do_sys_mount fs/namespace.c:3591 [inline]\n __se_sys_mount fs/namespace.c:3568 [inline]\n __x64_sys_mount+0x27f/0x300 fs/namespace.c:3568\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\n [...]\n </TASK>\n======================================================\n\nAccording to commit \"vfs: parse: deal with zero length string value\",\nkernel will set the param->string to null pointer in vfs_parse_fs_string()\nif fs string has zero length.\n\nYet the problem is that, hugetlbfs_parse_param() will dereference the\nparam->string, without checking whether it is a null pointer. To be more\nspecific, if hugetlbfs_parse_param() parses an illegal mount parameter,\nsuch as \"size=,\", kernel will constructs struct fs_parameter with null\npointer in vfs_parse_fs_string(), then passes this struct fs_parameter to\nhugetlbfs_parse_param(), which triggers the above null-ptr-deref bug.\n\nThis patch solves it by adding sanity check on param->string\nin hugetlbfs_parse_param()."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/26215b7ee923b9251f7bb12c4e5f09dc465d35f2",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/965e8f8ae0f642b5528f5a82b7bcaf15a659d5bd",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9a8862820cbf1f18dca4f3b4c289d88561b3a384",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/dcd28191be9bbf307ba51a5b485773a55b0037c4",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f2207145693ae5697a7b59e2add4b92f9e5b0e3c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/fa71639873518e3587632ae58e25e4a96b57fa90",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
Loaded 100 of 525 files, more files were not shown because too many files have changed in this diff. Show more