Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
is not available") for exactly this reason, but apparently it never occurred to anyone to actually test NPT with the mitigation enabled. ------------[ cut here ]------------ spte = 0x800000018a600ee7, level = 2, rsvd bits = 0x800f0000001fe000 WARNING: CPU: 152 PID: 15966 at arch/x86/kvm/mmu/spte.c:215 make_spte+0x327/0x340 [kvm] Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 10.48.0 01/27/2022 RIP: 0010:make_spte+0x327/0x340 [kvm] Call Trace: <TASK> tdp_mmu_map_handle_target_level+0xc3/0x230 [kvm] kvm_tdp_mmu_map+0x343/0x3b0 [kvm] direct_page_fault+0x1ae/0x2a0 [kvm] kvm_tdp_page_fault+0x7d/0x90 [kvm] kvm_mmu_page_fault+0xfb/0x2e0 [kvm] npf_interception+0x55/0x90 [kvm_amd] svm
a0 [kvm] kvm_tdp_page_fault+0x7d/0x90 [kvm] kvm_mmu_page_fault+0xfb/0x2e0 [kvm] npf_interception+0x55/0x90 [kvm_amd] svm_invoke_exit_handler+0x31/0xf0 [kvm_amd] svm_handle_exit+0xf6/0x1d0 [kvm_amd] vcpu_enter_guest+0xb6d/0xee0 [kvm] ? kvm_pmu_trigger_event+0x6d/0x230 [kvm] vcpu_run+0x65/0x2c0 [kvm] kvm_arch_vcpu_ioctl_run+0x355/0x610 [kvm] kvm_vcpu_ioctl+0x551/0x610 [kvm] __se_sys_ioctl+0x77/0xc0 __x64_sys_ioctl+0x1d/0x20 do_syscall_64+0x44/0xa0 entry_SYSCALL_64_after_hwframe+0x46/0xb0 </TASK> ---[ end trace 0000000000000000 ]--- References: - https://git.kernel.org/stable/c/6271f2854b9233702e236e576b885a876dde4889 - https://git.kernel.org/stable/c/6c6ab524cfae0799e55c82b2c1d61f1af0156f8d
CVE ID: CVE-2022-50225 State: PUBLISHED Published: 2025-06-18T11:03:58.643Z Last Updated: 2025-06-18T11:03:58.643Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: riscv:uprobe fix SR_SPIE set/clear handling In riscv the process of uprobe going to clear spie before exec the origin insn,and set spie after that.But When access the page which origin insn has been placed a page fault may happen and irq was disabled in arch_uprobe_pre_xol function,It cause a WARN as follows. There is no need to clear/set spie in arch_uprobe_pre/post/abort_xol. We can just remove it. [ 31.684157] BUG: sleeping function called from invalid context at ke
_uprobe_pre/post/abort_xol. We can just remove it. [ 31.684157] BUG: sleeping function called from invalid context at kernel/locking/rwsem.c:1488 [ 31.684677] in_atomic(): 0, irqs_disabled(): 1, non_block: 0, pid: 76, name: work [ 31.684929] preempt_count: 0, expected: 0 [ 31.685969] CPU: 2 PID: 76 Comm: work Tainted: G [ 31.686542] Hardware name: riscv-virtio,qemu (DT) [ 31.686797] Call Trace: [ 31.687053] [<ffffffff80006442>] dump_backtrace+0x30/0x38 [ 31.687699] [<ffffffff80812118>] show_stack+0x40/0x4c [ 31.688141] [<ffffffff8081817a>] dump_stack_lvl+0x44/0x5c [ 31.688396] [<ffffffff808181aa>] dump_stack+0x18/0x20 [ 31.688653] [<ffffffff8003e454>] __might_resched+0x114/0x122 [ 31.688948]
96] [<ffffffff808181aa>] dump_stack+0x18/0x20 [ 31.688653] [<ffffffff8003e454>] __might_resched+0x114/0x122 [ 31.688948] [<ffffffff8003e4b2>] __might_sleep+0x50/0x7a [ 31.689435] [<ffffffff80822676>] down_read+0x30/0x130 [ 31.689728] [<ffffffff8000b650>] do_page_fault+0x166/x446 [ 31.689997] [<ffffffff80003c0c>] ret_from_exception+0x0/0xc References: - https://git.kernel.org/stable/c/c71e000db8536d27ec410abb3e314896a78b4f19 - https://git.kernel.org/stable/c/3811d51778900064d27d8c9a98f73410fb3b471d - https://git.kernel.org/stable/c/73fc099eaefd9a92c83b6c07dad066411fd5a192 - https://git.kernel.org/stable/c/3dbe5829408bc1586f75b4667ef60e5aab0209c7
CVE ID: CVE-2022-50226 State: PUBLISHED Published: 2025-06-18T11:03:59.275Z Last Updated: 2025-06-18T11:03:59.275Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Use kzalloc for sev ioctl interfaces to prevent kernel memory leak For some sev ioctl interfaces, input may be passed that is less than or equal to SEV_FW_BLOB_MAX_SIZE, but larger than the data that PSP firmware returns. In this case, kmalloc will allocate memory that is the size of the input rather than the size of the data. Since PSP firmware doesn't fully overwrite the buffer, the sev ioctl interfaces with the issue may return uninitialized slab memor
firmware doesn't fully overwrite the buffer, the sev ioctl interfaces with the issue may return uninitialized slab memory. Currently, all of the ioctl interfaces in the ccp driver are safe, but to prevent future problems, change all ioctl interfaces that allocate memory with kmalloc to use kzalloc and memset the data buffer to zero in sev_ioctl_do_platform_status. References: - https://git.kernel.org/stable/c/4c5300f6f5e18b11c02a92f136e69b98fddba15e - https://git.kernel.org/stable/c/f2a920daa780956b987c14b9f23de7c3c8915bf2 - https://git.kernel.org/stable/c/caa395aa16e7c9193fd7fa6cde462dd8229d4953 - https://git.kernel.org/stable/c/e11fb0a3a39bb42da35fa662c46ce7391f277436 - https://git.kernel.
fd7fa6cde462dd8229d4953 - https://git.kernel.org/stable/c/e11fb0a3a39bb42da35fa662c46ce7391f277436 - https://git.kernel.org/stable/c/13dc15a3f5fd7f884e4bfa8c011a0ae868df12ae
CVE ID: CVE-2022-50227 State: PUBLISHED Published: 2025-06-18T11:03:59.885Z Last Updated: 2025-06-18T11:03:59.885Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: KVM: x86/xen: Initialize Xen timer only once Add a check for existing xen timers before initializing a new one. Currently kvm_xen_init_timer() is called on every KVM_XEN_VCPU_ATTR_TYPE_TIMER, which is causing the following ODEBUG crash when vcpu->arch.xen.timer is already set. ODEBUG: init active (active state 0) object type: hrtimer hint: xen_timer_callbac0 RIP: 0010:debug_print_object+0x16e/0x250 lib/debugobjects.c:502 Call Trace: __debug_object_init debug_hrtimer_in
allbac0 RIP: 0010:debug_print_object+0x16e/0x250 lib/debugobjects.c:502 Call Trace: __debug_object_init debug_hrtimer_init debug_init hrtimer_init kvm_xen_init_timer kvm_xen_vcpu_set_attr kvm_arch_vcpu_ioctl kvm_vcpu_ioctl vfs_ioctl References: - https://git.kernel.org/stable/c/9a9b5771e930f408c3419799000f76a9abaf2278 - https://git.kernel.org/stable/c/af735db31285fa699384c649be72a9f32ecbb665
CVE ID: CVE-2022-50228 State: PUBLISHED Published: 2025-06-18T11:04:05.491Z Last Updated: 2025-06-18T11:04:05.491Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 Don't BUG/WARN on interrupt injection due to GIF being cleared, since it's trivial for userspace to force the situation via KVM_SET_VCPU_EVENTS (even if having at least a WARN there would be correct for KVM internally generated injections). kernel BUG at arch/x86/kvm/svm/svm.c:3386! invalid opcode: 0000 [#1] SMP CPU: 15 PID: 926 Comm: smm_test Not tainted 5.17.0-rc3+ #264 Hardware name: QEMU Standard PC (
lid opcode: 0000 [#1] SMP CPU: 15 PID: 926 Comm: smm_test Not tainted 5.17.0-rc3+ #264 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:svm_inject_irq+0xab/0xb0 [kvm_amd] Code: <0f> 0b 0f 1f 00 0f 1f 44 00 00 80 3d ac b3 01 00 00 55 48 89 f5 53 RSP: 0018:ffffc90000b37d88 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff88810a234ac0 RCX: 0000000000000006 RDX: 0000000000000000 RSI: ffffc90000b37df7 RDI: ffff88810a234ac0 RBP: ffffc90000b37df7 R08: ffff88810a1fa410 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: ffff888109571000 R14: ffff88810a234ac0 R15: 0000000000000000 FS: 0000000001821380(0000) GS:ffff88846fdc0000
0000000 R13: ffff888109571000 R14: ffff88810a234ac0 R15: 0000000000000000 FS: 0000000001821380(0000) GS:ffff88846fdc0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f74fc550008 CR3: 000000010a6fe000 CR4: 0000000000350ea0 Call Trace: <TASK> inject_pending_event+0x2f7/0x4c0 [kvm] kvm_arch_vcpu_ioctl_run+0x791/0x17a0 [kvm] kvm_vcpu_ioctl+0x26d/0x650 [kvm] __x64_sys_ioctl+0x82/0xb0 do_syscall_64+0x3b/0xc0 entry_SYSCALL_64_after_hwframe+0x44/0xae </TASK> References: - https://git.kernel.org/stable/c/2c49adeb020995236e63722ef6d0bee14372f471 - https://git.kernel.org/stable/c/6fcbab82ccbcde915644085f73d3487938bda42d - https://git.kernel.org/stable/c/c3396c
f471 - https://git.kernel.org/stable/c/6fcbab82ccbcde915644085f73d3487938bda42d - https://git.kernel.org/stable/c/c3396c1c8b87510f2ac2a674948156577559d42d - https://git.kernel.org/stable/c/68e1313bb8809e8addcd9431f2bfea0e8ddbca80 - https://git.kernel.org/stable/c/8bb683490278005b4caf61e22b0828a04d282e86 - https://git.kernel.org/stable/c/6afe88fbb40eac3291a8728688d61fdc745d8008 - https://git.kernel.org/stable/c/3d4e2d884da6312df7c9b85fbf671de49204ead6 - https://git.kernel.org/stable/c/2eee1dba70f57148fc7f8252613bfae6bd4b04e3 - https://git.kernel.org/stable/c/f17c31c48e5cde9895a491d91c424eeeada3e134
CVE ID: CVE-2022-50229 State: PUBLISHED Published: 2025-06-18T11:04:06.069Z Last Updated: 2025-06-18T11:04:06.069Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ALSA: bcd2000: Fix a UAF bug on the error path of probing When the driver fails in snd_card_register() at probe time, it will free the 'bcd2k->midi_out_urb' before killing it, which may cause a UAF bug. The following log can reveal it: [ 50.727020] BUG: KASAN: use-after-free in bcd2000_input_complete+0x1f1/0x2e0 [snd_bcd2000] [ 50.727623] Read of size 8 at addr ffff88810fab0e88 by task swapper/4/0 [ 50.729530] Call Trace: [ 50.732899] bcd2000_input_complete+0x1f1/0x2e0
8 at addr ffff88810fab0e88 by task swapper/4/0 [ 50.729530] Call Trace: [ 50.732899] bcd2000_input_complete+0x1f1/0x2e0 [snd_bcd2000] Fix this by adding usb_kill_urb() before usb_free_urb(). References: - https://git.kernel.org/stable/c/a718eba7e458e2f40531be3c6b6a0028ca7fcace - https://git.kernel.org/stable/c/4fc41f7ebb7efca282f1740ea934d16f33c1d109 - https://git.kernel.org/stable/c/5e7338f4dd92b2f8915a82abfa1dd3ad3464bea0 - https://git.kernel.org/stable/c/05e0bb8c3c4dde3e21b9c1cf9395afb04e8b24db - https://git.kernel.org/stable/c/348620464a5c127399ac09b266f494f393661952 - https://git.kernel.org/stable/c/64ca7f50ad96c2c65ae390b954925a36eabe04aa - https://git.kernel.org/stable/c/1d6a246cf97c
https://git.kernel.org/stable/c/64ca7f50ad96c2c65ae390b954925a36eabe04aa - https://git.kernel.org/stable/c/1d6a246cf97c380f2da76591f03019dd9c9599c3 - https://git.kernel.org/stable/c/b0d4af0a4763ddc02344789ef2a281c494bc330d - https://git.kernel.org/stable/c/ffb2759df7efbc00187bfd9d1072434a13a54139
CVE ID: CVE-2022-50230 State: PUBLISHED Published: 2025-06-18T11:04:06.716Z Last Updated: 2025-10-10T15:46:06.315Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: arm64: set UXN on swapper page tables [ This issue was fixed upstream by accident in c3cee924bd85 ("arm64: head: cover entire kernel image in initial ID map") as part of a large refactoring of the arm64 boot flow. This simple fix is therefore preferred for -stable backporting ] On a system that implements FEAT_EPAN, read/write access to the idmap is denied because UXN is not set on the swapper PTEs. As a result, idmap_kpti_install_ng_mappings panics the kernel when acc
enied because UXN is not set on the swapper PTEs. As a result, idmap_kpti_install_ng_mappings panics the kernel when accessing __idmap_kpti_flag. Fix it by setting UXN on these PTEs. References: - https://git.kernel.org/stable/c/9283e708a9b8529e7aafac9ab5c5c79a9fab8846 - https://git.kernel.org/stable/c/c3cee924bd855184d15bc4aa6088dcf8e2c1394c
CVE ID: CVE-2022-50231 State: PUBLISHED Published: 2025-06-18T11:04:07.315Z Last Updated: 2025-06-18T11:04:07.315Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: crypto: arm64/poly1305 - fix a read out-of-bound A kasan error was reported during fuzzing: BUG: KASAN: slab-out-of-bounds in neon_poly1305_blocks.constprop.0+0x1b4/0x250 [poly1305_neon] Read of size 4 at addr ffff0010e293f010 by task syz-executor.5/1646715 CPU: 4 PID: 1646715 Comm: syz-executor.5 Kdump: loaded Not tainted 5.10.0.aarch64 #1 Hardware name: Huawei TaiShan 2280 /BC11SPCD, BIOS 1.59 01/31/2019 Call trace: dump_backtrace+0x0/0x394 show_stack+0x34/0x4c arch/
ame: Huawei TaiShan 2280 /BC11SPCD, BIOS 1.59 01/31/2019 Call trace: dump_backtrace+0x0/0x394 show_stack+0x34/0x4c arch/arm64/kernel/stacktrace.c:196 __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x158/0x1e4 lib/dump_stack.c:118 print_address_description.constprop.0+0x68/0x204 mm/kasan/report.c:387 __kasan_report+0xe0/0x140 mm/kasan/report.c:547 kasan_report+0x44/0xe0 mm/kasan/report.c:564 check_memory_region_inline mm/kasan/generic.c:187 [inline] __asan_load4+0x94/0xd0 mm/kasan/generic.c:252 neon_poly1305_blocks.constprop.0+0x1b4/0x250 [poly1305_neon] neon_poly1305_do_update+0x6c/0x15c [poly1305_neon] neon_poly1305_update+0x9c/0x1c4 [poly1305_neon] crypto_shash_update crypto/shash.c:
do_update+0x6c/0x15c [poly1305_neon] neon_poly1305_update+0x9c/0x1c4 [poly1305_neon] crypto_shash_update crypto/shash.c:131 [inline] shash_finup_unaligned+0x84/0x15c crypto/shash.c:179 crypto_shash_finup+0x8c/0x140 crypto/shash.c:193 shash_digest_unaligned+0xb8/0xe4 crypto/shash.c:201 crypto_shash_digest+0xa4/0xfc crypto/shash.c:217 crypto_shash_tfm_digest+0xb4/0x150 crypto/shash.c:229 essiv_skcipher_setkey+0x164/0x200 [essiv] crypto_skcipher_setkey+0xb0/0x160 crypto/skcipher.c:612 skcipher_setkey+0x3c/0x50 crypto/algif_skcipher.c:305 alg_setkey+0x114/0x2a0 crypto/af_alg.c:220 alg_setsockopt+0x19c/0x210 crypto/af_alg.c:253 __sys_setsockopt+0x190/0x2e0 net/socket.c:2123 __do_sys_setsockopt ne
220 alg_setsockopt+0x19c/0x210 crypto/af_alg.c:253 __sys_setsockopt+0x190/0x2e0 net/socket.c:2123 __do_sys_setsockopt net/socket.c:2134 [inline] __se_sys_setsockopt net/socket.c:2131 [inline] __arm64_sys_setsockopt+0x78/0x94 net/socket.c:2131 __invoke_syscall arch/arm64/kernel/syscall.c:36 [inline] invoke_syscall+0x64/0x100 arch/arm64/kernel/syscall.c:48 el0_svc_common.constprop.0+0x220/0x230 arch/arm64/kernel/syscall.c:155 do_el0_svc+0xb4/0xd4 arch/arm64/kernel/syscall.c:217 el0_svc+0x24/0x3c arch/arm64/kernel/entry-common.c:353 el0_sync_handler+0x160/0x164 arch/arm64/kernel/entry-common.c:369 el0_sync+0x160/0x180 arch/arm64/kernel/entry.S:683 This error can be reproduced by the following c
el/entry-common.c:369 el0_sync+0x160/0x180 arch/arm64/kernel/entry.S:683 This error can be reproduced by the following code compiled as ko on a system with kasan enabled: #include <linux/module.h> #include <linux/crypto.h> #include <crypto/hash.h> #include <crypto/poly1305.h> char test_data[] = "\x00\x01\x02\x03\x04\x05\x06\x07" "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f" "\x10\x11\x12\x13\x14\x15\x16\x17" "\x18\x19\x1a\x1b\x1c\x1d\x1e"; int init(void) { struct crypto_shash *tfm = NULL; char *data = NULL, *out = NULL; tfm = crypto_alloc_shash("poly1305", 0, 0); data = kmalloc(POLY1305_KEY_SIZE - 1, GFP_KERNEL); out = kmalloc(POLY1305_DIGEST_SIZE, GFP_KERNEL); memcpy(data, test_data, POLY1305_KEY_SIZE
05_KEY_SIZE - 1, GFP_KERNEL); out = kmalloc(POLY1305_DIGEST_SIZE, GFP_KERNEL); memcpy(data, test_data, POLY1305_KEY_SIZE - 1); crypto_shash_tfm_digest(tfm, data, POLY1305_KEY_SIZE - 1, out); kfree(data); kfree(out); return 0; } void deinit(void) { } module_init(init) module_exit(deinit) MODULE_LICENSE("GPL"); The root cause of the bug sits in neon_poly1305_blocks. The logic neon_poly1305_blocks() performed is that if it was called with both s[] and r[] uninitialized, it will first try to initialize them with the data from the first "block" that it believed to be 32 bytes in length. First 16 bytes are used as the key and the next 16 bytes for s[]. This would lead to the aforementioned read ou
length. First 16 bytes are used as the key and the next 16 bytes for s[]. This would lead to the aforementioned read out-of-bound. However, after calling poly1305_init_arch(), only 16 bytes were deducted from the input and s[] is initialized yet again with the following 16 bytes. The second initialization of s[] is certainly redundent which indicates that the first initialization should be for r[] only. This patch fixes the issue by calling poly1305_init_arm64() instead o ---truncated--- References: - https://git.kernel.org/stable/c/3c77292d52b341831cb09c24ca4112a1e4f9e91f - https://git.kernel.org/stable/c/3d4c28475ee352c440b83484b72b1320ff76364a - https://git.kernel.org/stable/c/8d25a08599
- https://git.kernel.org/stable/c/3d4c28475ee352c440b83484b72b1320ff76364a - https://git.kernel.org/stable/c/8d25a08599df7ca3093eb7ca731c7cd41cbfbb51 - https://git.kernel.org/stable/c/d069dcffef849b8fd10030fd73007a79612803e6 - https://git.kernel.org/stable/c/7ae19d422c7da84b5f13bc08b98bd737a08d3a53
CVE ID: CVE-2022-50232 State: PUBLISHED Published: 2025-06-18T11:04:07.956Z Last Updated: 2025-10-10T15:46:07.476Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: arm64: set UXN on swapper page tables [ This issue was fixed upstream by accident in c3cee924bd85 ("arm64: head: cover entire kernel image in initial ID map") as part of a large refactoring of the arm64 boot flow. This simple fix is therefore preferred for -stable backporting ] On a system that implements FEAT_EPAN, read/write access to the idmap is denied because UXN is not set on the swapper PTEs. As a result, idmap_kpti_install_ng_mappings panics the kernel when acc
enied because UXN is not set on the swapper PTEs. As a result, idmap_kpti_install_ng_mappings panics the kernel when accessing __idmap_kpti_flag. Fix it by setting UXN on these PTEs. References: - https://git.kernel.org/stable/c/775871d4be0d75e219cca937af843a4a1b60489a - https://git.kernel.org/stable/c/c3cee924bd855184d15bc4aa6088dcf8e2c1394c
CVE ID: CVE-2022-50233 State: PUBLISHED Published: 2025-08-09T14:30:51.639Z Last Updated: 2025-10-29T10:50:07.782Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} Both dev_name and short_name are not guaranteed to be NULL terminated so this instead use strnlen and then attempt to determine if the resulting string needs to be truncated or not. References: - https://git.kernel.org/stable/c/dd7b8cdde098cf9f7c8de409b5b7bbb98f97be80
CVE ID: CVE-2022-50234 State: PUBLISHED Published: 2025-09-15T14:01:38.199Z Last Updated: 2025-09-15T14:01:38.199Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: io_uring/af_unix: defer registered files gc to io_uring release Instead of putting io_uring's registered files in unix_gc() we want it to be done by io_uring itself. The trick here is to consider io_uring registered files for cycle detection but not actually putting them down. Because io_uring can't register other ring instances, this will remove all refs to the ring file triggering the ->release path and clean up with io_ring_ctx_free(). [axboe: add kerneldoc comment
refs to the ring file triggering the ->release path and clean up with io_ring_ctx_free(). [axboe: add kerneldoc comment to skb, fold in skb leak fix] References: - https://git.kernel.org/stable/c/04df9719df1865f6770af9bc7880874af0e594b2 - https://git.kernel.org/stable/c/c378c479c5175833bb22ff71974cda47d7b05401 - https://git.kernel.org/stable/c/813d8fe5d30388f73a21d3a2bf46b0a1fd72498c - https://git.kernel.org/stable/c/b4293c01ee0d0ecdd3cb5801e13f62271144667a - https://git.kernel.org/stable/c/75e94c7e8859e58aadc15a98cc9704edff47d4f2 - https://git.kernel.org/stable/c/0091bfc81741b8d3aeb3b7ab8636f911b2de6e80
CVE ID: CVE-2022-50235 State: PUBLISHED Published: 2025-09-15T14:01:41.043Z Last Updated: 2025-09-15T14:01:41.043Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: NFSD: Protect against send buffer overflow in NFSv2 READDIR Restore the previous limit on the @count argument to prevent a buffer overflow attack. References: - https://git.kernel.org/stable/c/0e57d696f60dee6117a8ace0cac7c5761d375277 - https://git.kernel.org/stable/c/dc7f225090c29a5f3b9419b1af32846a201555e7 - https://git.kernel.org/stable/c/c2a878095b5c6f04f90553a3c45872f990dab14e - https://git.kernel.org/stable/c/f59c74df82f6ac9d2ea4e01aa3ae7c6c4481652d - https://git.
5c6f04f90553a3c45872f990dab14e - https://git.kernel.org/stable/c/f59c74df82f6ac9d2ea4e01aa3ae7c6c4481652d - https://git.kernel.org/stable/c/00b4492686e0497fdb924a9d4c8f6f99377e176c
CVE ID: CVE-2022-50236 State: PUBLISHED Published: 2025-09-15T14:01:42.983Z Last Updated: 2025-09-16T08:02:00.873Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: iommu/mediatek: Fix crash on isr after kexec() If the system is rebooted via isr(), the IRQ handler might be triggered before the domain is initialized. Resulting on an invalid memory access error. Fix: [ 0.500930] Unable to handle kernel read from unreadable memory at virtual address 0000000000000070 [ 0.501166] Call trace: [ 0.501174] report_iommu_fault+0x28/0xfc [ 0.501180] mtk_iommu_isr+0x10c/0x1c0 [ joro: Fixed spelling in commit message ] References: - https://gi
ault+0x28/0xfc [ 0.501180] mtk_iommu_isr+0x10c/0x1c0 [ joro: Fixed spelling in commit message ] References: - https://git.kernel.org/stable/c/f13acee780cedb3e06a6dadf64d9104cccd2b9fc - https://git.kernel.org/stable/c/85cc8a187f2de7a91e2cea522e9406fa12999269 - https://git.kernel.org/stable/c/00ef8885a945c37551547d8ac8361cacd20c4e42
CVE ID: CVE-2022-50237 State: PUBLISHED Published: 2025-07-28T00:00:00.000Z Last Updated: 2025-07-28T13:56:12.178Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: dalek-cryptography Products: ed25519-dalek Problem Types: CWE-497 Description: The ed25519-dalek crate before 2 for Rust allows a double public key signing function oracle attack. The Keypair implementation leads to a simple computation for extracting a private key. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://rustsec.org/advisories/RUSTSEC-2022-0093.html - https://github.com/MystenLabs/ed25519-unsafe-libs - https://crates.io/crates/ed25519-dalek
CVE ID: CVE-2022-50238 State: PUBLISHED Published: 2025-09-08T00:00:00.000Z Last Updated: 2025-11-17T16:01:40.773Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Microsoft Products: Windows Problem Types: CWE-820 Description: The on-endpoint Microsoft vulnerable driver blocklist is not fully synchronized with the online Microsoft recommended driver block rules. Some entries present on the online list have been excluded from the on-endpoint blocklist longer than the expected periodic monthly Windows updates. It is possible to fully synchronize the driver blocklist using WDAC policies. NOTE: The vendor explains that Windows Update provides a smaller, compatibil
e the driver blocklist using WDAC policies. NOTE: The vendor explains that Windows Update provides a smaller, compatibility-focused driver blocklist for general users, while the full XML list is available for advanced users and organizations to customize at the risk of usability issues. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/wdormann/applywdac - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules
CVE ID: CVE-2022-50239 State: PUBLISHED Published: 2025-09-15T14:01:43.916Z Last Updated: 2025-09-15T14:01:43.916Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: cpufreq: qcom: fix writes in read-only memory region This commit fixes a kernel oops because of a write in some read-only memory: [ 9.068287] Unable to handle kernel write to read-only memory at virtual address ffff800009240ad8 ..snip.. [ 9.138790] Internal error: Oops: 9600004f [#1] PREEMPT SMP ..snip.. [ 9.269161] Call trace: [ 9.276271] __memcpy+0x5c/0x230 [ 9.278531] snprintf+0x58/0x80 [ 9.282002] qcom_cpufreq_msm8939_name_version+0xb4/0x190 [ 9.284869] qcom_cpufre