Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ished by Guest. If value is zero meaning that a READY event is done, so the KVM can deliver another. But the kvm_arch_setup_async_pf() may produce a valid token with zero value, which is confused with previous mention and may lead the loss of this READY event. This bug may cause task blocked forever in Guest: INFO: task stress:7532 blocked for more than 1254 seconds. Not tainted 5.10.0 #16 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:stress state:D stack: 0 pid: 7532 ppid: 1409 flags:0x00000080 Call Trace: __schedule+0x1e7/0x650 schedule+0x46/0xb0 kvm_async_pf_task_wait_schedule+0xad/0xe0 ? exit_to_user_mode_prepare+0x60/0x70 __kvm_handle_async_pf+0x4f/0xb0
46/0xb0 kvm_async_pf_task_wait_schedule+0xad/0xe0 ? exit_to_user_mode_prepare+0x60/0x70 __kvm_handle_async_pf+0x4f/0xb0 ? asm_exc_page_fault+0x8/0x30 exc_page_fault+0x6f/0x110 ? asm_exc_page_fault+0x8/0x30 asm_exc_page_fault+0x1e/0x30 RIP: 0033:0x402d00 RSP: 002b:00007ffd31912500 EFLAGS: 00010206 RAX: 0000000000071000 RBX: ffffffffffffffff RCX: 00000000021a32b0 RDX: 000000000007d011 RSI: 000000000007d000 RDI: 00000000021262b0 RBP: 00000000021262b0 R08: 0000000000000003 R09: 0000000000000086 R10: 00000000000000eb R11: 00007fefbdf2baa0 R12: 0000000000000000 R13: 0000000000000002 R14: 000000000007d000 R15: 0000000000001000 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:/
002 R14: 000000000007d000 R15: 0000000000001000 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/72fdfc75d4217b32363cc80def3de2cb3fef3f02 - https://git.kernel.org/stable/c/4c3644b6c96c5daa5149e5abddc07234eea47c7c - https://git.kernel.org/stable/c/62040f5cd7d937de547836e747b6aa8212fec573 - https://git.kernel.org/stable/c/6f3c1fc53d86d580d8d6d749c4af23705e4f6f79
CVE ID: CVE-2022-48944 State: PUBLISHED Published: 2024-08-30T10:46:00.673Z Last Updated: 2025-05-04T12:44:03.886Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: sched: Fix yet more sched_fork() races Where commit 4ef0c5c6b5ba ("kernel/sched: Fix sched_fork() access an invalid sched_task_group") fixed a fork race vs cgroup, it opened up a race vs syscalls by not placing the task on the runqueue before it gets exposed through the pidhash. Commit 13765de8148f ("sched/fair: Fix fault in reweight_entity") is trying to fix a single instance of this, instead fix the whole class of issues, effectively reverting this commit. Additional
g to fix a single instance of this, instead fix the whole class of issues, effectively reverting this commit. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/3411613611a5cddf7e80908010dc87cb527dd13b - https://git.kernel.org/stable/c/c65cfd89cef669d90c59f3bf150af6458137a04f - https://git.kernel.org/stable/c/b1e8206582f9d680cff7d04828708c8b6ab32957
CVE ID: CVE-2022-48945 State: PUBLISHED Published: 2024-09-23T09:46:40.851Z Last Updated: 2025-05-04T08:26:39.996Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: media: vivid: fix compose size exceed boundary syzkaller found a bug: BUG: unable to handle page fault for address: ffffc9000a3b1000 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 100000067 P4D 100000067 PUD 10015f067 PMD 1121ca067 PTE 0 Oops: 0002 [#1] PREEMPT SMP CPU: 0 PID: 23489 Comm: vivid-000-vid-c Not tainted 6.1.0-rc1+ #512 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 RIP: 0
tainted 6.1.0-rc1+ #512 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 RIP: 0010:memcpy_erms+0x6/0x10 [...] Call Trace: <TASK> ? tpg_fill_plane_buffer+0x856/0x15b0 vivid_fillbuff+0x8ac/0x1110 vivid_thread_vid_cap_tick+0x361/0xc90 vivid_thread_vid_cap+0x21a/0x3a0 kthread+0x143/0x180 ret_from_fork+0x1f/0x30 </TASK> This is because we forget to check boundary after adjust compose->height int V4L2_SEL_TGT_CROP case. Add v4l2_rect_map_inside() to fix this problem for this case. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/8c0ee15d9a102c732d0745566d254040085d5663 - https://git.kernel.org/stable/c/5edc360
es: - https://git.kernel.org/stable/c/8c0ee15d9a102c732d0745566d254040085d5663 - https://git.kernel.org/stable/c/5edc3604151919da8da0fb092b71d7dce07d848a - https://git.kernel.org/stable/c/9c7fba9503b826f0c061d136f8f0c9f953ed18b9 - https://git.kernel.org/stable/c/54f259906039dbfe46c550011409fa16f72370f6 - https://git.kernel.org/stable/c/f9d19f3a044ca651b0be52a4bf951ffe74259b9f - https://git.kernel.org/stable/c/ab54081a2843aefb837812fac5488cc8f1696142 - https://git.kernel.org/stable/c/ccb5392c4fea0e7d9f7ab35567e839d74cb3998b - https://git.kernel.org/stable/c/2f558c5208b0f70c8140e08ce09fcc84da48e789 - https://git.kernel.org/stable/c/94a7ad9283464b75b12516c5512541d467cefcf8
CVE ID: CVE-2022-48946 State: PUBLISHED Published: 2024-10-21T20:05:35.818Z Last Updated: 2025-05-04T08:26:41.201Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: udf: Fix preallocation discarding at indirect extent boundary When preallocation extent is the first one in the extent block, the code would corrupt extent tree header instead. Fix the problem and use udf_delete_aext() for deleting extent to avoid some code duplication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/c8b6fa4511a7900db9fb0353b630d4d2ed1ba99c - https://git.kernel.org/stable/c/7665857f88557c372da35534165721
l.org/stable/c/c8b6fa4511a7900db9fb0353b630d4d2ed1ba99c - https://git.kernel.org/stable/c/7665857f88557c372da35534165721156756f77f - https://git.kernel.org/stable/c/72f651c96c8aadf087fd782d551bf7db648a8c2e - https://git.kernel.org/stable/c/4d835efd561dfb9bf5409f11f4ecd428d5d29226 - https://git.kernel.org/stable/c/1a075f4a549481ce6e8518d8379f193ccec6b746 - https://git.kernel.org/stable/c/63dbbd8f1499b0a161e701a04aa50148d60bd1f7 - https://git.kernel.org/stable/c/ae56d9a017724f130cf1a263dd82a78d2a6e3852 - https://git.kernel.org/stable/c/12a88f572d6d94b5c0b72e2d1782cc2e96ac06cf - https://git.kernel.org/stable/c/cfe4c1b25dd6d2f056afc00b7c98bcb3dd0b1fc3
CVE ID: CVE-2022-48947 State: PUBLISHED Published: 2024-10-21T20:05:36.491Z Last Updated: 2025-05-04T08:26:42.230Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix u8 overflow By keep sending L2CAP_CONF_REQ packets, chan->num_conf_rsp increases multiple times and eventually it will wrap around the maximum number (i.e., 255). This patch prevents this by adding a boundary check with L2CAP_MAX_CONF_RSP Btmon log: Bluetooth monitor ver 5.64 = Note: Linux version 6.1.0-rc2 (x86_64) 0.264594 = Note: Bluetooth subsystem version 2.22 0.264636 @ MGMT Open: btmon (privileged) version 1.22 {0x0001} 0.272191 = New Index
te: Bluetooth subsystem version 2.22 0.264636 @ MGMT Open: btmon (privileged) version 1.22 {0x0001} 0.272191 = New Index: 00:00:00:00:00:00 (Primary,Virtual,hci0) [hci0] 13.877604 @ RAW Open: 9496 (privileged) version 2.22 {0x0002} 13.890741 = Open Index: 00:00:00:00:00:00 [hci0] 13.900426 (...) > ACL Data RX: Handle 200 flags 0x00 dlen 1033 #32 [hci0] 14.273106 invalid packet size (12 != 1033) 08 00 01 00 02 01 04 00 01 10 ff ff ............ > ACL Data RX: Handle 200 flags 0x00 dlen 1547 #33 [hci0] 14.273561 invalid packet size (14 != 1547) 0a 00 01 00 04 01 06 00 40 00 00 00 00 00 ........@..... > ACL Data RX: Handle 200 flags 0x00 dlen 2061 #34 [hci0] 14.274390 invalid packet size (16 !=
00 00 00 ........@..... > ACL Data RX: Handle 200 flags 0x00 dlen 2061 #34 [hci0] 14.274390 invalid packet size (16 != 2061) 0c 00 01 00 04 01 08 00 40 00 00 00 00 00 00 04 ........@....... > ACL Data RX: Handle 200 flags 0x00 dlen 2061 #35 [hci0] 14.274932 invalid packet size (16 != 2061) 0c 00 01 00 04 01 08 00 40 00 00 00 07 00 03 00 ........@....... = bluetoothd: Bluetooth daemon 5.43 14.401828 > ACL Data RX: Handle 200 flags 0x00 dlen 1033 #36 [hci0] 14.275753 invalid packet size (12 != 1033) 08 00 01 00 04 01 04 00 40 00 00 00 ........@... Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/49d5867819ab7c744852b45509e8469839c07e0e - https:/
CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/49d5867819ab7c744852b45509e8469839c07e0e - https://git.kernel.org/stable/c/95f1847a361c7b4bf7d74c06ecb6968455082c1a - https://git.kernel.org/stable/c/ad528fde0702903208d0a79d88d5a42ae3fc235b - https://git.kernel.org/stable/c/9fdc79b571434af7bc742da40a3405f038b637a7 - https://git.kernel.org/stable/c/f3fe6817156a2ad4b06f01afab04638a34d7c9a6 - https://git.kernel.org/stable/c/19a78143961a197de8502f4f29c453b913dc3c29 - https://git.kernel.org/stable/c/5550bbf709c323194881737fd290c4bada9e6ead - https://git.kernel.org/stable/c/bcd70260ef56e0aee8a4fc6cd214a419900b0765
CVE ID: CVE-2022-48948 State: PUBLISHED Published: 2024-10-21T20:05:37.122Z Last Updated: 2025-05-04T08:26:43.404Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: Prevent buffer overflow in setup handler Setup function uvc_function_setup permits control transfer requests with up to 64 bytes of payload (UVC_MAX_REQUEST_SIZE), data stage handler for OUT transfer uses memcpy to copy req->actual bytes to uvc_event->data.data array of size 60. This may result in an overflow of 4 bytes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/4972e3528b968665b596b5434764ff8fd94
nalyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/4972e3528b968665b596b5434764ff8fd9446d35 - https://git.kernel.org/stable/c/06fd17ee92c8f1704c7e54ec0fd50ae0542a49a5 - https://git.kernel.org/stable/c/bc8380fe5768c564f921f7b4eaba932e330b9e4b - https://git.kernel.org/stable/c/b8fb1cba934ea122b50f13a4f9d6fc4fdc43d2be - https://git.kernel.org/stable/c/c79538f32df12887f110dcd6b9c825b482905f24 - https://git.kernel.org/stable/c/6b41a35b41f77821db24f2d8f66794b390a585c5 - https://git.kernel.org/stable/c/7b1f773277a72f9756d47a41b94e43506cce1954 - https://git.kernel.org/stable/c/d1a92bb8d697f170d93fe922da763d7d156b8841 - https://git.kernel.org/stable/c/4c92670b1672736
tps://git.kernel.org/stable/c/d1a92bb8d697f170d93fe922da763d7d156b8841 - https://git.kernel.org/stable/c/4c92670b16727365699fe4b19ed32013bab2c107
CVE ID: CVE-2022-48949 State: PUBLISHED Published: 2024-10-21T20:05:37.782Z Last Updated: 2025-05-04T08:26:44.707Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: igb: Initialize mailbox message for VF reset When a MAC address is not assigned to the VF, that portion of the message sent to the VF is not set. The memory, however, is allocated from the stack meaning that information may be leaked to the VM. Initialize the message buffer to 0 so that no information is passed to the VM in this case. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/a6629659af3f5c6a91e3914ea62554c975ab77f
st Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/a6629659af3f5c6a91e3914ea62554c975ab77f4 - https://git.kernel.org/stable/c/ef1d739dd1f362aec081278ff92f943c31eb177a - https://git.kernel.org/stable/c/c581439a977545d61849a72e8ed631cfc8a2a3c1 - https://git.kernel.org/stable/c/f2479c3daaabccbac6c343a737615d0c595c6dc4 - https://git.kernel.org/stable/c/367e1e3399dbc56fc669740c4ab60e35da632b0e - https://git.kernel.org/stable/c/51fd5ede7ed42f272682a0c33d6f0767b3484a3d - https://git.kernel.org/stable/c/c383c7c35c7bc15e07a04eefa060a8a80cbeae29 - https://git.kernel.org/stable/c/de5dc44370fbd6b46bd7f1a1e00369be54a041c8
CVE ID: CVE-2022-48950 State: PUBLISHED Published: 2024-10-21T20:05:38.440Z Last Updated: 2025-05-04T08:26:46.165Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: perf: Fix perf_pending_task() UaF Per syzbot it is possible for perf_pending_task() to run after the event is free()'d. There are two related but distinct cases: - the task_work was already queued before destroying the event; - destroying the event itself queues the task_work. The first cannot be solved using task_work_cancel() since perf_release() itself might be called from a task_work (____fput), which means the current->task_works list is already empty and task_wor
self might be called from a task_work (____fput), which means the current->task_works list is already empty and task_work_cancel() won't be able to find the perf_pending_task() entry. The simplest alternative is extending the perf_event lifetime to cover the task_work. The second is just silly, queueing a task_work while you know the event is going away makes no sense and is easily avoided by re-arranging how the event is marked STATE_DEAD and ensuring it goes through STATE_OFF on the way down. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/8bffa95ac19ff27c8261904f89d36c7fcf215d59 - https://git.kernel.org/stable/c/78e1317a174edbfd1182599bf76c
nel.org/stable/c/8bffa95ac19ff27c8261904f89d36c7fcf215d59 - https://git.kernel.org/stable/c/78e1317a174edbfd1182599bf76c092a2877672c - https://git.kernel.org/stable/c/517e6a301f34613bff24a8e35b5455884f2d83d8
CVE ID: CVE-2022-48951 State: PUBLISHED Published: 2024-10-21T20:05:39.092Z Last Updated: 2025-05-04T08:26:47.681Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ASoC: ops: Check bounds for second channel in snd_soc_put_volsw_sx() The bounds checks in snd_soc_put_volsw_sx() are only being applied to the first channel, meaning it is possible to write out of bounds values to the second channel in stereo controls. Add appropriate checks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/56288987843c3cb343e81e5fa51549cbaf541bd0 - https://git.kernel.org/stable/c/cf1c225f1927891ae388562b
.kernel.org/stable/c/56288987843c3cb343e81e5fa51549cbaf541bd0 - https://git.kernel.org/stable/c/cf1c225f1927891ae388562b78ced7840c3723b9 - https://git.kernel.org/stable/c/18a168d85eadcfd45f015b5ecd2a97801b959e43 - https://git.kernel.org/stable/c/9796d07c753164b7e6b0d7ef23fb4482840a9ef8 - https://git.kernel.org/stable/c/50b5f6d4d9d2d69a7498c44fd8b26e13d73d3d98 - https://git.kernel.org/stable/c/cf611d786796ec33da09d8c83d7d7f4e557b27de - https://git.kernel.org/stable/c/1798b62d642e7b3d4ea3403914c3caf4e438465d - https://git.kernel.org/stable/c/97eea946b93961fffd29448dcda7398d0d51c4b2
CVE ID: CVE-2022-48952 State: PUBLISHED Published: 2024-10-21T20:05:39.755Z Last Updated: 2025-05-04T12:44:04.996Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: PCI: mt7621: Add sentinel to quirks table Current driver is missing a sentinel in the struct soc_device_attribute array, which causes an oops when assessed by the soc_device_match(mt7621_pcie_quirks_match) call. This was only exposed once the CONFIG_SOC_MT7621 mt7621 soc_dev_attr was fixed to register the SOC as a device, in: commit 7c18b64bba3b ("mips: ralink: mt7621: do not use kzalloc too early") Fix it by adding the required sentinel. Additional Analyst Notes: - CI
s: ralink: mt7621: do not use kzalloc too early") Fix it by adding the required sentinel. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/3e9c395ef2d52975b2c2894d2da09d6db2958bc6 - https://git.kernel.org/stable/c/cb7323ece786f243f6d6ccf2e5b2b27b736bdc04 - https://git.kernel.org/stable/c/a4997bae1b5b012c8a6e2643e26578a7bc2cae36 - https://git.kernel.org/stable/c/19098934f910b4d47cb30251dd39ffa57bef9523
CVE ID: CVE-2022-48953 State: PUBLISHED Published: 2024-10-21T20:05:40.399Z Last Updated: 2025-05-04T08:26:50.082Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: rtc: cmos: Fix event handler registration ordering issue Because acpi_install_fixed_event_handler() enables the event automatically on success, it is incorrect to call it before the handler routine passed to it is ready to handle events. Unfortunately, the rtc-cmos driver does exactly the incorrect thing by calling cmos_wake_setup(), which passes rtc_handler() to acpi_install_fixed_event_handler(), before cmos_do_probe(), because rtc_handler() uses dev_get_drvdata() to
handler() to acpi_install_fixed_event_handler(), before cmos_do_probe(), because rtc_handler() uses dev_get_drvdata() to get to the cmos object pointer and the driver data pointer is only populated in cmos_do_probe(). This leads to a NULL pointer dereference in rtc_handler() on boot if the RTC fixed event happens to be active at the init time. To address this issue, change the initialization ordering of the driver so that cmos_wake_setup() is always called after a successful cmos_do_probe() call. While at it, change cmos_pnp_probe() to call cmos_do_probe() after the initial if () statement used for computing the IRQ argument to be passed to cmos_do_probe() which is cleaner than calling it in
if () statement used for computing the IRQ argument to be passed to cmos_do_probe() which is cleaner than calling it in each branch of that if () (local variable "irq" can be of type int, because it is passed to that function as an argument of type int). Note that commit 6492fed7d8c9 ("rtc: rtc-cmos: Do not check ACPI_FADT_LOW_POWER_S0") caused this issue to affect a larger number of systems, because previously it only affected systems with ACPI_FADT_LOW_POWER_S0 set, but it is present regardless of that commit. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/0bcfccb48696aba475f046c2021f0733659ce0ef - https://git.kernel.org/stable/c/60c6e563a
: - https://git.kernel.org/stable/c/0bcfccb48696aba475f046c2021f0733659ce0ef - https://git.kernel.org/stable/c/60c6e563a843032cf6ff84b2fb732cd8754fc10d - https://git.kernel.org/stable/c/1ba745fce13d19775100eece30b0bfb8b8b10ea6 - https://git.kernel.org/stable/c/4919d3eb2ec0ee364f7e3cf2d99646c1b224fae8
CVE ID: CVE-2022-48954 State: PUBLISHED Published: 2024-10-21T20:05:41.057Z Last Updated: 2025-05-04T08:26:51.141Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: s390/qeth: fix use-after-free in hsci KASAN found that addr was dereferenced after br2dev_event_work was freed. ================================================================== BUG: KASAN: use-after-free in qeth_l2_br2dev_worker+0x5ba/0x6b0 Read of size 1 at addr 00000000fdcea440 by task kworker/u760:4/540 CPU: 17 PID: 540 Comm: kworker/u760:4 Tainted: G E 6.1.0-20221128.rc7.git1.5aa3bed4ce83.300.fc36.s390x+kasan #1 Hardware name: IBM 8561 T01 703 (LPAR) Workqueue: 0
ed: G E 6.1.0-20221128.rc7.git1.5aa3bed4ce83.300.fc36.s390x+kasan #1 Hardware name: IBM 8561 T01 703 (LPAR) Workqueue: 0.0.8000_event qeth_l2_br2dev_worker Call Trace: [<000000016944d4ce>] dump_stack_lvl+0xc6/0xf8 [<000000016942cd9c>] print_address_description.constprop.0+0x34/0x2a0 [<000000016942d118>] print_report+0x110/0x1f8 [<0000000167a7bd04>] kasan_report+0xfc/0x128 [<000000016938d79a>] qeth_l2_br2dev_worker+0x5ba/0x6b0 [<00000001673edd1e>] process_one_work+0x76e/0x1128 [<00000001673ee85c>] worker_thread+0x184/0x1098 [<000000016740718a>] kthread+0x26a/0x310 [<00000001672c606a>] __ret_from_fork+0x8a/0xe8 [<00000001694711da>] ret_from_fork+0xa/0x40 Allocated by task 108338: kasan_save_st
672c606a>] __ret_from_fork+0x8a/0xe8 [<00000001694711da>] ret_from_fork+0xa/0x40 Allocated by task 108338: kasan_save_stack+0x40/0x68 kasan_set_track+0x36/0x48 __kasan_kmalloc+0xa0/0xc0 qeth_l2_switchdev_event+0x25a/0x738 atomic_notifier_call_chain+0x9c/0xf8 br_switchdev_fdb_notify+0xf4/0x110 fdb_notify+0x122/0x180 fdb_add_entry.constprop.0.isra.0+0x312/0x558 br_fdb_add+0x59e/0x858 rtnl_fdb_add+0x58a/0x928 rtnetlink_rcv_msg+0x5f8/0x8d8 netlink_rcv_skb+0x1f2/0x408 netlink_unicast+0x570/0x790 netlink_sendmsg+0x752/0xbe0 sock_sendmsg+0xca/0x110 ____sys_sendmsg+0x510/0x6a8 ___sys_sendmsg+0x12a/0x180 __sys_sendmsg+0xe6/0x168 __do_sys_socketcall+0x3c8/0x468 do_syscall+0x22c/0x328 __do_syscall+0x94
ys_sendmsg+0x12a/0x180 __sys_sendmsg+0xe6/0x168 __do_sys_socketcall+0x3c8/0x468 do_syscall+0x22c/0x328 __do_syscall+0x94/0xf0 system_call+0x82/0xb0 Freed by task 540: kasan_save_stack+0x40/0x68 kasan_set_track+0x36/0x48 kasan_save_free_info+0x4c/0x68 ____kasan_slab_free+0x14e/0x1a8 __kasan_slab_free+0x24/0x30 __kmem_cache_free+0x168/0x338 qeth_l2_br2dev_worker+0x154/0x6b0 process_one_work+0x76e/0x1128 worker_thread+0x184/0x1098 kthread+0x26a/0x310 __ret_from_fork+0x8a/0xe8 ret_from_fork+0xa/0x40 Last potentially related work creation: kasan_save_stack+0x40/0x68 __kasan_record_aux_stack+0xbe/0xd0 insert_work+0x56/0x2e8 __queue_work+0x4ce/0xd10 queue_work_on+0xf4/0x100 qeth_l2_switchdev_event+
rd_aux_stack+0xbe/0xd0 insert_work+0x56/0x2e8 __queue_work+0x4ce/0xd10 queue_work_on+0xf4/0x100 qeth_l2_switchdev_event+0x520/0x738 atomic_notifier_call_chain+0x9c/0xf8 br_switchdev_fdb_notify+0xf4/0x110 fdb_notify+0x122/0x180 fdb_add_entry.constprop.0.isra.0+0x312/0x558 br_fdb_add+0x59e/0x858 rtnl_fdb_add+0x58a/0x928 rtnetlink_rcv_msg+0x5f8/0x8d8 netlink_rcv_skb+0x1f2/0x408 netlink_unicast+0x570/0x790 netlink_sendmsg+0x752/0xbe0 sock_sendmsg+0xca/0x110 ____sys_sendmsg+0x510/0x6a8 ___sys_sendmsg+0x12a/0x180 __sys_sendmsg+0xe6/0x168 __do_sys_socketcall+0x3c8/0x468 do_syscall+0x22c/0x328 __do_syscall+0x94/0xf0 system_call+0x82/0xb0 Second to last potentially related work creation: kasan_save_s
+0x22c/0x328 __do_syscall+0x94/0xf0 system_call+0x82/0xb0 Second to last potentially related work creation: kasan_save_stack+0x40/0x68 __kasan_record_aux_stack+0xbe/0xd0 kvfree_call_rcu+0xb2/0x760 kernfs_unlink_open_file+0x348/0x430 kernfs_fop_release+0xc2/0x320 __fput+0x1ae/0x768 task_work_run+0x1bc/0x298 exit_to_user_mode_prepare+0x1a0/0x1a8 __do_syscall+0x94/0xf0 system_call+0x82/0xb0 The buggy address belongs to the object at 00000000fdcea400 which belongs to the cache kmalloc-96 of size 96 The buggy address is located 64 bytes inside of 96-byte region [00000000fdcea400, 00000000fdcea460) The buggy address belongs to the physical page: page:000000005a9c26e8 refcount:1 mapcount:0 mapping:
, 00000000fdcea460) The buggy address belongs to the physical page: page:000000005a9c26e8 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xfdcea flags: 0x3ffff00000000200(slab|node=0|zone=1|lastcpupid=0x1ffff) raw: 3ffff00000000200 0000000000000000 0000000100000122 000000008008cc00 raw: 0000000000000000 0020004100000000 ffffffff00000001 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: 00000000fdcea300: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc 00000000fdcea380: fb fb fb fb fb fb f ---truncated--- Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/db6343a5b0d9661f2dd76f653c
itional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/db6343a5b0d9661f2dd76f653c6d274d38234d2b - https://git.kernel.org/stable/c/bde0dfc7c4569406a6ddeec363d04a1df7b3073f - https://git.kernel.org/stable/c/ebaaadc332cd21e9df4dcf9ce12552d9354bbbe4
CVE ID: CVE-2022-48955 State: PUBLISHED Published: 2024-10-21T20:05:41.715Z Last Updated: 2025-05-04T08:26:52.772Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: thunderbolt: fix memory leak in tbnet_open() When tb_ring_alloc_rx() failed in tbnet_open(), ida that allocated in tb_xdomain_alloc_out_hopid() is not released. Add tb_xdomain_release_out_hopid() to the error path to release ida. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/b9274dbe399952a8175db2e1ee148b7c9ba2b538 - https://git.kernel.org/stable/c/ed6e955f3b7e0e622c080f4bcb5427a5e1af4c2a - https://git.kernel.org/