Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
_after_hwframe+0x46/0xb0 If the floppy_alloc_disk() failed, disks of current drive will not be set, thus the lastest allocated set->tag cannot be freed in the error handling path. A simple call graph shown as below: floppy_module_init() floppy_init() do_floppy_init() for (drive = 0; drive < N_DRIVE; drive++) blk_mq_alloc_tag_set() blk_mq_alloc_tag_set_tags() blk_mq_realloc_tag_set_tags() # set->tag allocated floppy_alloc_disk() blk_mq_alloc_disk() # error occurred, disks failed to allocated ->out_put_disk: for (drive = 0; drive < N_DRIVE; drive++) if (!disks[drive][0]) # the last disks is not set and loop break break; blk_mq_free_tag_set() # the latest allocated set->tag leaked Fix this prob
e last disks is not set and loop break break; blk_mq_free_tag_set() # the latest allocated set->tag leaked Fix this problem by free the set->tag of current drive before jump to error handling path. [efremov: added stable list, changed title] References: - https://git.kernel.org/stable/c/f36d8c8651506aea5f09899f5356ece5d1384f50 - https://git.kernel.org/stable/c/75d8c8851a4da0190c2480e84315b5fd3d0356c5 - https://git.kernel.org/stable/c/55b3c66a0d441cd37154ae95e44d0b82ccfd580e - https://git.kernel.org/stable/c/f8ace2e304c5dd8a7328db9cd2b8a4b1b98d83ec
CVE ID: CVE-2022-50343 State: PUBLISHED Published: 2025-09-16T16:11:22.514Z Last Updated: 2025-09-16T16:11:35.603Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: rapidio: fix possible name leaks when rio_add_device() fails Patch series "rapidio: fix three possible memory leaks". This patchset fixes three name leaks in error handling. - patch #1 fixes two name leaks while rio_add_device() fails. - patch #2 fixes a name leak while rio_register_mport() fails. This patch (of 2): If rio_add_device() returns error, the name allocated by dev_set_name() need be freed. It should use put_device() to give up the reference in the error pat
the name allocated by dev_set_name() need be freed. It should use put_device() to give up the reference in the error path, so that the name can be freed in kobject_cleanup(), and the 'rdev' can be freed in rio_release_dev(). References: - https://git.kernel.org/stable/c/3b4676f274a6b5d001176f15d0542100bbf4b59a - https://git.kernel.org/stable/c/c482cb0deb57924335103fe592c379a076d867f8 - https://git.kernel.org/stable/c/80fad2e53eaed2b3a2ff596575f65669e13ceda5 - https://git.kernel.org/stable/c/440afd7fd9b164fdde6fc9da8c47d3d7f20dcce8 - https://git.kernel.org/stable/c/88fa351b20ca300693a206ccd3c4b0e0647944d8 - https://git.kernel.org/stable/c/ec3f04f74f50d0b6bac04d795c93c2b852753a7a - https://git
0ca300693a206ccd3c4b0e0647944d8 - https://git.kernel.org/stable/c/ec3f04f74f50d0b6bac04d795c93c2b852753a7a - https://git.kernel.org/stable/c/c413f65011ff8caffabcde0e1c3ceede48a48d6f - https://git.kernel.org/stable/c/85fbf58b15c09d3a6a03098c1e42ebfe9002f39d - https://git.kernel.org/stable/c/f9574cd48679926e2a569e1957a5a1bcc8a719ac
CVE ID: CVE-2022-50344 State: PUBLISHED Published: 2025-09-16T16:11:23.345Z Last Updated: 2025-09-16T16:11:36.950Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ext4: fix null-ptr-deref in ext4_write_info I caught a null-ptr-deref bug as follows: ================================================================== KASAN: null-ptr-deref in range [0x0000000000000068-0x000000000000006f] CPU: 1 PID: 1589 Comm: umount Not tainted 5.10.0-02219-dirty #339 RIP: 0010:ext4_write_info+0x53/0x1b0 [...] Call Trace: dquot_writeback_dquots+0x341/0x9a0 ext4_sync_fs+0x19e/0x800 __sync_filesystem+0x83/0x100 sync_filesystem+0x89/0xf0 generic_shutd
iteback_dquots+0x341/0x9a0 ext4_sync_fs+0x19e/0x800 __sync_filesystem+0x83/0x100 sync_filesystem+0x89/0xf0 generic_shutdown_super+0x79/0x3e0 kill_block_super+0xa1/0x110 deactivate_locked_super+0xac/0x130 deactivate_super+0xb6/0xd0 cleanup_mnt+0x289/0x400 __cleanup_mnt+0x16/0x20 task_work_run+0x11c/0x1c0 exit_to_user_mode_prepare+0x203/0x210 syscall_exit_to_user_mode+0x5b/0x3a0 do_syscall_64+0x59/0x70 entry_SYSCALL_64_after_hwframe+0x44/0xa9 ================================================================== Above issue may happen as follows: ------------------------------------- exit_to_user_mode_prepare task_work_run __cleanup_mnt cleanup_mnt deactivate_super deactivate_locked_super kill_blo
---- exit_to_user_mode_prepare task_work_run __cleanup_mnt cleanup_mnt deactivate_super deactivate_locked_super kill_block_super generic_shutdown_super shrink_dcache_for_umount dentry = sb->s_root sb->s_root = NULL <--- Here set NULL sync_filesystem __sync_filesystem sb->s_op->sync_fs > ext4_sync_fs dquot_writeback_dquots sb->dq_op->write_info > ext4_write_info ext4_journal_start(d_inode(sb->s_root), EXT4_HT_QUOTA, 2) d_inode(sb->s_root) s_root->d_inode <--- Null pointer dereference To solve this problem, we use ext4_journal_start_sb directly to avoid s_root being used. References: - https://git.kernel.org/stable/c/dc451578446afd03c0c21913993c08898a691435 - https://git.kernel.org/stable/c/f4
erences: - https://git.kernel.org/stable/c/dc451578446afd03c0c21913993c08898a691435 - https://git.kernel.org/stable/c/f4b5ff0b794aa94afac7269c494550ca2f66511b - https://git.kernel.org/stable/c/947264e00c46de19a016fd81218118c708fed2f3 - https://git.kernel.org/stable/c/3638aa1c7d87c0ca0aef23cf58cae2c48e7daca4 - https://git.kernel.org/stable/c/f34ab95162763cd7352f46df169296eec28b688d - https://git.kernel.org/stable/c/533c60a0b97cee5daab376933f486207e6680fb7 - https://git.kernel.org/stable/c/4a657319cfabd6199fd0b7b65bbebf6ded7a11c1 - https://git.kernel.org/stable/c/bb420e8afc854d2a1caaa23a0c129839acfb7888 - https://git.kernel.org/stable/c/f9c1f248607d5546075d3f731e7607d5571f2b60
CVE ID: CVE-2022-50345 State: REJECTED Published: 2025-09-16T16:11:24.171Z Last Updated: 2025-09-29T18:26:13.939Z Description: No description available.
CVE ID: CVE-2022-50346 State: PUBLISHED Published: 2025-09-16T16:11:39.179Z Last Updated: 2025-09-16T16:11:39.179Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ext4: init quota for 'old.inode' in 'ext4_rename' Syzbot found the following issue: ext4_parse_param: s_want_extra_isize=128 ext4_inode_info_init: s_want_extra_isize=32 ext4_rename: old.inode=ffff88823869a2c8 old.dir=ffff888238699828 new.inode=ffff88823869d7e8 new.dir=ffff888238699828 __ext4_mark_inode_dirty: inode=ffff888238699828 ea_isize=32 want_ea_size=128 __ext4_mark_inode_dirty: inode=ffff88823869a2c8 ea_isize=32 want_ea_size=128 ext4_xattr_block_set: inode=ffff8
_size=128 __ext4_mark_inode_dirty: inode=ffff88823869a2c8 ea_isize=32 want_ea_size=128 ext4_xattr_block_set: inode=ffff88823869a2c8 ------------[ cut here ]------------ WARNING: CPU: 13 PID: 2234 at fs/ext4/xattr.c:2070 ext4_xattr_block_set.cold+0x22/0x980 Modules linked in: RIP: 0010:ext4_xattr_block_set.cold+0x22/0x980 RSP: 0018:ffff888227d3f3b0 EFLAGS: 00010202 RAX: 0000000000000001 RBX: ffff88823007a000 RCX: 0000000000000000 RDX: 0000000000000a03 RSI: 0000000000000040 RDI: ffff888230078178 RBP: 0000000000000000 R08: 000000000000002c R09: ffffed1075c7df8e R10: ffff8883ae3efc6b R11: ffffed1075c7df8d R12: 0000000000000000 R13: ffff88823869a2c8 R14: ffff8881012e0460 R15: dffffc0000000000 FS:
3efc6b R11: ffffed1075c7df8d R12: 0000000000000000 R13: ffff88823869a2c8 R14: ffff8881012e0460 R15: dffffc0000000000 FS: 00007f350ac1f740(0000) GS:ffff8883ae200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f350a6ed6a0 CR3: 0000000237456000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ? ext4_xattr_set_entry+0x3b7/0x2320 ? ext4_xattr_block_set+0x0/0x2020 ? ext4_xattr_set_entry+0x0/0x2320 ? ext4_xattr_check_entries+0x77/0x310 ? ext4_xattr_ibody_set+0x23b/0x340 ext4_xattr_move_to_block+0x594/0x720 ext4_expand_extra_isize_ea+
k_entries+0x77/0x310 ? ext4_xattr_ibody_set+0x23b/0x340 ext4_xattr_move_to_block+0x594/0x720 ext4_expand_extra_isize_ea+0x59a/0x10f0 __ext4_expand_extra_isize+0x278/0x3f0 __ext4_mark_inode_dirty.cold+0x347/0x410 ext4_rename+0xed3/0x174f vfs_rename+0x13a7/0x2510 do_renameat2+0x55d/0x920 __x64_sys_rename+0x7d/0xb0 do_syscall_64+0x3b/0xa0 entry_SYSCALL_64_after_hwframe+0x72/0xdc As 'ext4_rename' will modify 'old.inode' ctime and mark inode dirty, which may trigger expand 'extra_isize' and allocate block. If inode didn't init quota will lead to warning. To solve above issue, init 'old.inode' firstly in 'ext4_rename'. References: - https://git.kernel.org/stable/c/67f6d5a4043f3db0c6bb0e14a0d97a7be
it 'old.inode' firstly in 'ext4_rename'. References: - https://git.kernel.org/stable/c/67f6d5a4043f3db0c6bb0e14a0d97a7be8bfb8b5 - https://git.kernel.org/stable/c/33fd7031d634f3b46e59f61adfbb0ea9fe514fef - https://git.kernel.org/stable/c/7dfb8259f66faafa68d23a261b284d2c2c67649b - https://git.kernel.org/stable/c/f263e349bacc2f303526dcfa61c4bc50132418b1 - https://git.kernel.org/stable/c/84a2f2ed49d6a4d92b354219077434c57d334620 - https://git.kernel.org/stable/c/def7a39091e60e1c4a2f623629082a00092602be - https://git.kernel.org/stable/c/135ba9146f4d38abed48a540ef8a8770ff0bd34f - https://git.kernel.org/stable/c/13271fbbe85d73a7c47058f56a52f2a7f00d6e39 - https://git.kernel.org/stable/c/fae381a3d79bb
https://git.kernel.org/stable/c/13271fbbe85d73a7c47058f56a52f2a7f00d6e39 - https://git.kernel.org/stable/c/fae381a3d79bb94aa2eb752170d47458d778b797
CVE ID: CVE-2022-50347 State: PUBLISHED Published: 2025-09-16T16:11:39.891Z Last Updated: 2025-09-16T16:11:39.891Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mmc: rtsx_usb_sdmmc: fix return value check of mmc_add_host() mmc_add_host() may return error, if we ignore its return value, the memory that allocated in mmc_alloc_host() will be leaked and it will lead a kernel crash because of deleting not added device in the remove path. So fix this by checking the return value and calling mmc_free_host() in the error path, besides, led_classdev_unregister() and pm_runtime_disable() also need be called. References: - https://git.ke
rror path, besides, led_classdev_unregister() and pm_runtime_disable() also need be called. References: - https://git.kernel.org/stable/c/d7ad7278be401b09c9f9a9f522cf4c449c7fd489 - https://git.kernel.org/stable/c/e598c9683fe1cf97c2b11b800cc3cee072108220 - https://git.kernel.org/stable/c/89303ddbb502c3bc8edbf864f9f85500c8fe07e9 - https://git.kernel.org/stable/c/937112e991ed25d1727d878734adcbef3b900274 - https://git.kernel.org/stable/c/7fa922c7a3dd623fd59f1af50e8896fd9ca7f654 - https://git.kernel.org/stable/c/df683201c7ffbd21a806a7cad657b661c5ebfb6f - https://git.kernel.org/stable/c/1491667d5450778a265eddddd294219acfd648cb - https://git.kernel.org/stable/c/a522e26a20a43dcfbef9ee9f71ed803290e85
table/c/1491667d5450778a265eddddd294219acfd648cb - https://git.kernel.org/stable/c/a522e26a20a43dcfbef9ee9f71ed803290e852b0 - https://git.kernel.org/stable/c/fc38a5a10e9e5a75eb9189854abeb8405b214cc9
CVE ID: CVE-2022-50348 State: PUBLISHED Published: 2025-09-16T16:11:40.617Z Last Updated: 2025-09-16T16:11:40.617Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: nfsd: Fix a memory leak in an error handling path If this memdup_user() call fails, the memory allocated in a previous call a few lines above should be freed. Otherwise it leaks. References: - https://git.kernel.org/stable/c/acc393aecda05bf64ed13b732931462e07a1bf08 - https://git.kernel.org/stable/c/e060c4b9f33c1fca74df26d57a98e784295327e6 - https://git.kernel.org/stable/c/aed8816305575b38dcc77feb6f1bc1d0ed32f5b8 - https://git.kernel.org/stable/c/733dd17158f96aaa25408dc
t.kernel.org/stable/c/aed8816305575b38dcc77feb6f1bc1d0ed32f5b8 - https://git.kernel.org/stable/c/733dd17158f96aaa25408dc39bbb2738fda9300e - https://git.kernel.org/stable/c/cc3bca2110ac85cd964da997ef83d84cab0d49fb - https://git.kernel.org/stable/c/fd1ef88049de09bc70d60b549992524cfc0e66ff
CVE ID: CVE-2022-50349 State: PUBLISHED Published: 2025-09-16T16:11:41.340Z Last Updated: 2025-09-16T16:11:41.340Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: misc: tifm: fix possible memory leak in tifm_7xx1_switch_media() If device_register() returns error in tifm_7xx1_switch_media(), name of kobject which is allocated in dev_set_name() called in device_add() is leaked. Never directly free @dev after calling device_register(), even if it returned an error! Always use put_device() to give up the reference initialized. References: - https://git.kernel.org/stable/c/2bbb222a54ff501f77ce593d21b76b79c905045e - https://git.kernel
initialized. References: - https://git.kernel.org/stable/c/2bbb222a54ff501f77ce593d21b76b79c905045e - https://git.kernel.org/stable/c/d861b7d41b17942b337d4b87a70de7cd1dc44d4e - https://git.kernel.org/stable/c/1695b1adcc3a7d985cd22fa3b55761edf3fab50d - https://git.kernel.org/stable/c/ee2715faf7e7153f5142ed09aacfa89a64d45dcb - https://git.kernel.org/stable/c/57c857353d5020bdec8284d9c0fee447484fe5e0 - https://git.kernel.org/stable/c/848c45964ded537107e010aaf353aa30a0855387 - https://git.kernel.org/stable/c/35abbc8406cc39e72d3ce85f6e869555afe50d54 - https://git.kernel.org/stable/c/ef843ee20576039126d34d6eb5f45d14c3e6ce18 - https://git.kernel.org/stable/c/fd2c930cf6a5b9176382c15f9acb1996e76e25ad
CVE ID: CVE-2022-50350 State: PUBLISHED Published: 2025-09-16T16:11:42.029Z Last Updated: 2025-10-29T10:50:12.804Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix a race condition between login_work and the login thread In case a malicious initiator sends some random data immediately after a login PDU; the iscsi_target_sk_data_ready() callback will schedule the login_work and, at the same time, the negotiation may end without clearing the LOGIN_FLAGS_INITIAL_PDU flag (because no additional PDU exchanges are required to complete the login). The login has been completed but the login_work function will fin
nal PDU exchanges are required to complete the login). The login has been completed but the login_work function will find the LOGIN_FLAGS_INITIAL_PDU flag set and will never stop from rescheduling itself; at this point, if the initiator drops the connection, the iscsit_conn structure will be freed, login_work will dereference a released socket structure and the kernel crashes. BUG: kernel NULL pointer dereference, address: 0000000000000230 PF: supervisor write access in kernel mode PF: error_code(0x0002) - not-present page Workqueue: events iscsi_target_do_login_rx [iscsi_target_mod] RIP: 0010:_raw_read_lock_bh+0x15/0x30 Call trace: iscsi_target_do_login_rx+0x75/0x3f0 [iscsi_target_mod] proc
arget_mod] RIP: 0010:_raw_read_lock_bh+0x15/0x30 Call trace: iscsi_target_do_login_rx+0x75/0x3f0 [iscsi_target_mod] process_one_work+0x1e8/0x3c0 Fix this bug by forcing login_work to stop after the login has been completed and the socket callbacks have been restored. Add a comment to clearify the return values of iscsi_target_do_login() References: - https://git.kernel.org/stable/c/1533b8b3058db618409f41554ebe768c2e3acfae - https://git.kernel.org/stable/c/3ecdca49ca49d4770639d81503c873b6d25887c4 - https://git.kernel.org/stable/c/fec1b2fa62c162d03f5dcd7b03e3c89d3116d49f
CVE ID: CVE-2022-50351 State: PUBLISHED Published: 2025-09-16T16:11:42.725Z Last Updated: 2025-09-16T16:11:42.725Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: cifs: Fix xid leak in cifs_create() If the cifs already shutdown, we should free the xid before return, otherwise, the xid will be leaked. References: - https://git.kernel.org/stable/c/593d877c39aa9f3fe1a4b5b022492886d7d700ec - https://git.kernel.org/stable/c/92aa09c86ef297976a3c27c6574c0839418dc2c4 - https://git.kernel.org/stable/c/fee0fb1f15054bb6a0ede452acb42da5bef4d587
CVE ID: CVE-2022-50352 State: PUBLISHED Published: 2025-09-16T16:11:43.458Z Last Updated: 2025-09-16T16:11:43.458Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: hns: fix possible memory leak in hnae_ae_register() Inject fault while probing module, if device_register() fails, but the refcount of kobject is not decreased to 0, the name allocated in dev_set_name() is leaked. Fix this by calling put_device(), so that name can be freed in callback function kobject_cleanup(). unreferenced object 0xffff00c01aba2100 (size 128): comm "systemd-udevd", pid 1259, jiffies 4294903284 (age 294.152s) hex dump (first 32 bytes): 68 6e 61 6
2100 (size 128): comm "systemd-udevd", pid 1259, jiffies 4294903284 (age 294.152s) hex dump (first 32 bytes): 68 6e 61 65 30 00 00 00 18 21 ba 1a c0 00 ff ff hnae0....!...... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<0000000034783f26>] slab_post_alloc_hook+0xa0/0x3e0 [<00000000748188f2>] __kmem_cache_alloc_node+0x164/0x2b0 [<00000000ab0743e8>] __kmalloc_node_track_caller+0x6c/0x390 [<000000006c0ffb13>] kvasprintf+0x8c/0x118 [<00000000fa27bfe1>] kvasprintf_const+0x60/0xc8 [<0000000083e10ed7>] kobject_set_name_vargs+0x3c/0xc0 [<000000000b87affc>] dev_set_name+0x7c/0xa0 [<000000003fd8fe26>] hnae_ae_register+0xcc/0x190 [hnae] [<00000000fe97edc9>] hns_dsaf_ae_i
affc>] dev_set_name+0x7c/0xa0 [<000000003fd8fe26>] hnae_ae_register+0xcc/0x190 [hnae] [<00000000fe97edc9>] hns_dsaf_ae_init+0x9c/0x108 [hns_dsaf] [<00000000c36ff1eb>] hns_dsaf_probe+0x548/0x748 [hns_dsaf] References: - https://git.kernel.org/stable/c/a3c148955c22fe1d94d7a2096005679c1f22eddf - https://git.kernel.org/stable/c/3b78453cca046d3b03853f0d077ad3ad130db886 - https://git.kernel.org/stable/c/7ae1345f6ad715acbcdc9e1ac28153684fd498bb - https://git.kernel.org/stable/c/dfc0337c6dceb6449403b33ecb141f4a1458a1e9 - https://git.kernel.org/stable/c/2974f3b330ef25f5d34a4948d04290c2cd7802cf - https://git.kernel.org/stable/c/91f8f5342bee726ed5692583d58f69e7cc9ae60e - https://git.kernel.org/stable/c
0c2cd7802cf - https://git.kernel.org/stable/c/91f8f5342bee726ed5692583d58f69e7cc9ae60e - https://git.kernel.org/stable/c/02dc0db19d944b4a90941db505ecf1aaec714be4 - https://git.kernel.org/stable/c/ff2f5ec5d009844ec28f171123f9e58750cef4bf
CVE ID: CVE-2022-50353 State: PUBLISHED Published: 2025-09-17T14:56:06.761Z Last Updated: 2025-09-17T14:56:06.761Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mmc: wmt-sdmmc: fix return value check of mmc_add_host() mmc_add_host() may return error, if we ignore its return value, the memory that allocated in mmc_alloc_host() will be leaked and it will lead a kernel crash because of deleting not added device in the remove path. So fix this by checking the return value and goto error path which will call mmc_free_host(), besides, clk_disable_unprepare() also needs be called. References: - https://git.kernel.org/stable/c/70b0620
ree_host(), besides, clk_disable_unprepare() also needs be called. References: - https://git.kernel.org/stable/c/70b0620afab3c69d95a7e2dd7ceff162a21c4009 - https://git.kernel.org/stable/c/ecd6f77af3478f5223aa4011642a891b7dc91228 - https://git.kernel.org/stable/c/c7a328cea791cc2769b6417943939420913b4a46 - https://git.kernel.org/stable/c/9bedf64dda84b29151e41591d8ded9ff0e6d336a - https://git.kernel.org/stable/c/58c3a8d0f1abeb1ca5c2df948be58ad4f7bb6f67 - https://git.kernel.org/stable/c/b40ac3b696a9c84b36211ef0c3f5a422650c101b - https://git.kernel.org/stable/c/eb7a2d516d4fbd165c07877a20feccb047342b1f - https://git.kernel.org/stable/c/29276d56f6ed138db0f38cd31aedc0b725c8c76c
CVE ID: CVE-2022-50354 State: PUBLISHED Published: 2025-09-17T14:56:07.596Z Last Updated: 2025-10-29T10:50:15.325Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix kfd_process_device_init_vm error handling Should only destroy the ib_mem and let process cleanup worker to free the outstanding BOs. Reset the pointer in pdd->qpd structure, to avoid NULL pointer access in process destroy worker. BUG: kernel NULL pointer dereference, address: 0000000000000010 Call Trace: amdgpu_amdkfd_gpuvm_unmap_gtt_bo_from_kernel+0x46/0xb0 [amdgpu] kfd_process_device_destroy_cwsr_dgpu+0x40/0x70 [amdgpu] kfd_process_destroy_pdds+0x71/0
o_from_kernel+0x46/0xb0 [amdgpu] kfd_process_device_destroy_cwsr_dgpu+0x40/0x70 [amdgpu] kfd_process_destroy_pdds+0x71/0x190 [amdgpu] kfd_process_wq_release+0x2a2/0x3b0 [amdgpu] process_one_work+0x2a1/0x600 worker_thread+0x39/0x3d0 References: - https://git.kernel.org/stable/c/b6e78bd3bf2eb964c95eb2596d3cd367307a20b5 - https://git.kernel.org/stable/c/9d74d1f52e16d8e07f7fbe52e96d6391418a2fe9 - https://git.kernel.org/stable/c/29d48b87db64b6697ddad007548e51d032081c59
CVE ID: CVE-2022-50355 State: PUBLISHED Published: 2025-09-17T14:56:08.356Z Last Updated: 2025-09-17T14:56:08.356Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: staging: vt6655: fix some erroneous memory clean-up loops In some initialization functions of this driver, memory is allocated with 'i' acting as an index variable and increasing from 0. The commit in "Fixes" introduces some clean-up codes in case of allocation failure, which free memory in reverse order with 'i' decreasing to 0. However, there are some problems: - The case i=0 is left out. Thus memory is leaked. - In case memory allocation fails right from the start,
me problems: - The case i=0 is left out. Thus memory is leaked. - In case memory allocation fails right from the start, the memory freeing loops will start with i=-1 and invalid memory locations will be accessed. One of these loops has been fixed in commit c8ff91535880 ("staging: vt6655: fix potential memory leak"). Fix the remaining erroneous loops. References: - https://git.kernel.org/stable/c/637672a71f5016a40b0a6c0f3c8ad25eacedc8c3 - https://git.kernel.org/stable/c/88b9cc60f26e8a05d1ddbddf91b09ca2915f20e0 - https://git.kernel.org/stable/c/95ac62e8545be2b0a8cae0beef7c682e2e470e48 - https://git.kernel.org/stable/c/f19e5b7df54590c831f350381963f25585c8f7d5 - https://git.kernel.org/stable/c/a
e2e470e48 - https://git.kernel.org/stable/c/f19e5b7df54590c831f350381963f25585c8f7d5 - https://git.kernel.org/stable/c/a9e9806d1c315bc50dce05479a079b9a104474b8 - https://git.kernel.org/stable/c/ed11b73c963292e7b49c0f37025c58ed3b7921d6 - https://git.kernel.org/stable/c/2a2db520e3ca5aafba7c211abfd397666c9b5f9d
CVE ID: CVE-2022-50356 State: PUBLISHED Published: 2025-09-17T14:56:09.165Z Last Updated: 2025-09-17T14:56:09.165Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: sched: sfb: fix null pointer access issue when sfb_init() fails When the default qdisc is sfb, if the qdisc of dev_queue fails to be inited during mqprio_init(), sfb_reset() is invoked to clear resources. In this case, the q->qdisc is NULL, and it will cause gpf issue. The process is as follows: qdisc_create_dflt() sfb_init() tcf_block_get() --->failed, q->qdisc is NULL ... qdisc_put() ... sfb_reset() qdisc_reset(q->qdisc) --->q->qdisc is NULL ops = qdisc->ops The
failed, q->qdisc is NULL ... qdisc_put() ... sfb_reset() qdisc_reset(q->qdisc) --->q->qdisc is NULL ops = qdisc->ops The following is the Call Trace information: general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f] RIP: 0010:qdisc_reset+0x2b/0x6f0 Call Trace: <TASK> sfb_reset+0x37/0xd0 qdisc_reset+0xed/0x6f0 qdisc_destroy+0x82/0x4c0 qdisc_put+0x9e/0xb0 qdisc_create_dflt+0x2c3/0x4a0 mqprio_init+0xa71/0x1760 qdisc_create+0x3eb/0x1000 tc_modify_qdisc+0x408/0x1720 rtnetlink_rcv_msg+0x38e/0xac0 netlink_rcv_skb+0x12d/0x3a0 netlink_unicast+0x4a2/0x740 netlink_sendmsg+0x826/