Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-49709 State: PUBLISHED Published: 2025-02-26T02:24:26.817Z Last Updated: 2025-05-04T08:43:49.213Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: cfi: Fix __cfi_slowpath_diag RCU usage with cpuidle RCU_NONIDLE usage during __cfi_slowpath_diag can result in an invalid RCU state in the cpuidle code path: WARNING: CPU: 1 PID: 0 at kernel/rcu/tree.c:613 rcu_eqs_enter+0xe4/0x138 ... Call trace: rcu_eqs_enter+0xe4/0x138 rcu_idle_enter+0xa8/0x100 cpuidle_enter_state+0x154/0x3a8 cpuidle_enter+0x3c/0x58 do_idle.llvm.6590768638138871020+0x1f4/0x2ec cpu_startup_entry+0x28/0x2c secondary_start_kernel+0x1b8/0x220 __secondary
do_idle.llvm.6590768638138871020+0x1f4/0x2ec cpu_startup_entry+0x28/0x2c secondary_start_kernel+0x1b8/0x220 __secondary_switched+0x94/0x98 Instead, call rcu_irq_enter/exit to wake up RCU only when needed and disable interrupts for the entire CFI shadow/module check when we do. References: - https://git.kernel.org/stable/c/75f3a5fa2ad049c85ab5d5ee1ed9cfaa7e62c5ed - https://git.kernel.org/stable/c/ca3897f2ac02ceae5e6fa794f83c36f9885b93da - https://git.kernel.org/stable/c/57cd6d157eb479f0a8e820fd36b7240845c8a937
CVE ID: CVE-2022-49710 State: PUBLISHED Published: 2025-02-26T02:24:27.532Z Last Updated: 2025-05-04T08:43:50.278Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: dm mirror log: round up region bitmap size to BITS_PER_LONG The code in dm-log rounds up bitset_size to 32 bits. It then uses find_next_zero_bit_le on the allocated region. find_next_zero_bit_le accesses the bitmap using unsigned long pointers. So, on 64-bit architectures, it may access 4 bytes beyond the allocated size. Fix this bug by rounding up bitset_size to BITS_PER_LONG. This bug was found by running the lvm2 testsuite with kasan. References: - https://git.kerne
tset_size to BITS_PER_LONG. This bug was found by running the lvm2 testsuite with kasan. References: - https://git.kernel.org/stable/c/ae460312875159285cef5bf3dc654593f404a1ef - https://git.kernel.org/stable/c/ba751f0d25f07aa21ce9b85372a3792bf7969d13 - https://git.kernel.org/stable/c/0d2209b54f1de0c2f99cab246d4cf2cfe24aaaa9 - https://git.kernel.org/stable/c/9a02f3275acc628c0d956be771405ced79ac36df - https://git.kernel.org/stable/c/85e123c27d5cbc22cfdc01de1e2ca1d9003a02d0
CVE ID: CVE-2022-49711 State: PUBLISHED Published: 2025-02-26T02:24:28.224Z Last Updated: 2025-05-04T08:43:51.419Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove() In fsl_mc_bus_remove(), mc->root_mc_bus_dev->mc_io is passed to fsl_destroy_mc_io(). However, mc->root_mc_bus_dev is already freed in fsl_mc_device_remove(). Then reference to mc->root_mc_bus_dev->mc_io triggers KASAN use-after-free. To avoid the use-after-free, keep the reference to mc->root_mc_bus_dev->mc_io in a local variable and pass to fsl_destroy_mc_io(). This patch needs rework to apply to kernels
>root_mc_bus_dev->mc_io in a local variable and pass to fsl_destroy_mc_io(). This patch needs rework to apply to kernels older than v5.15. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/ccd1751092341ac120a961835211f9f2e3735963 - https://git.kernel.org/stable/c/161b68b0a728377aaa10a8e14c70e7734f3c9ff7 - https://git.kernel.org/stable/c/928ea98252ad75118950941683893cf904541da9
CVE ID: CVE-2022-49712 State: PUBLISHED Published: 2025-02-26T02:24:28.888Z Last Updated: 2025-10-01T19:36:45.147Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: usb: gadget: lpc32xx_udc: Fix refcount leak in lpc32xx_udc_probe of_parse_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak. of_node_put() will check NULL pointer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/d85e4e6284a91aa2d1ab004e9d84b9c09b4aa203 - https://git.kernel.org/stable/c/0ef6917c0524da5b88496
git.kernel.org/stable/c/d85e4e6284a91aa2d1ab004e9d84b9c09b4aa203 - https://git.kernel.org/stable/c/0ef6917c0524da5b88496b9706628ffef108b9bb - https://git.kernel.org/stable/c/2a598da14856ead80c726b38ba426c68637d9211 - https://git.kernel.org/stable/c/b75bddfcc18170ce8e3fb695a76ec2dec4ce0ea5 - https://git.kernel.org/stable/c/57901c658f77d9ea2e772f35cb38e47efb54c558 - https://git.kernel.org/stable/c/46da1e4a8b6329479433b2a4056941dfdd7f3efd - https://git.kernel.org/stable/c/727c82d003e0ec64411fd1257a9a57de4ad7a99a - https://git.kernel.org/stable/c/4757c9ade34178b351580133771f510b5ffcf9c8
CVE ID: CVE-2022-49713 State: PUBLISHED Published: 2025-02-26T02:24:29.566Z Last Updated: 2025-10-01T19:36:44.963Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: usb: dwc2: Fix memory leak in dwc2_hcd_init usb_create_hcd will alloc memory for hcd, and we should call usb_put_hcd to free it when platform_get_resource() fails to prevent memory leak. goto error2 label instead error1 to fix this. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/981ee40649e5fd9550f82db1fbb3bfab037da346 - https://git.kernel.org/stable/c/84e6d0af87e27bbc0db94f2e7323b34abe17b6e5 - https://git.kernel.org/st
1fbb3bfab037da346 - https://git.kernel.org/stable/c/84e6d0af87e27bbc0db94f2e7323b34abe17b6e5 - https://git.kernel.org/stable/c/6506aff2dc2f7059aa3d45ee2e8639b25e87090f - https://git.kernel.org/stable/c/a44a8a762f7fe9ad3c065813d058e835a6180cb2 - https://git.kernel.org/stable/c/701d8ec01e0f229d4db6f43d3d64ee479120cbeb - https://git.kernel.org/stable/c/52bfcedbfd5bf962dbdcb6e761f4d0dd3ba26dfd - https://git.kernel.org/stable/c/3755278f078460b021cd0384562977bf2039a57a
CVE ID: CVE-2022-49714 State: PUBLISHED Published: 2025-02-26T02:24:30.224Z Last Updated: 2025-10-01T20:17:05.977Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: irqchip/realtek-rtl: Fix refcount leak in map_interrupts of_find_node_by_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. This function doesn't call of_node_put() in error path. Call of_node_put() directly after of_property_read_u32() to cover both normal path and error path. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/e85b1b797de0e7a271b906291ce2824
al Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/e85b1b797de0e7a271b906291ce28245822820b8 - https://git.kernel.org/stable/c/f6d6223df0666fbc054e3a8c6ac14eb0af37c286 - https://git.kernel.org/stable/c/eff4780f83d0ae3e5b6c02ff5d999dc4c1c5c8ce
CVE ID: CVE-2022-49715 State: PUBLISHED Published: 2025-02-26T02:24:30.901Z Last Updated: 2025-10-01T19:36:44.846Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3: Fix refcount leak in gic_populate_ppi_partitions of_find_node_by_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/e824482e2c5edacc961b7dd30a92fd47606c3036 - https://git.kernel.org/stable/c/8d884c08eeb83142a7173cb46bcff0434ec42cf1 - https://gi
2c5edacc961b7dd30a92fd47606c3036 - https://git.kernel.org/stable/c/8d884c08eeb83142a7173cb46bcff0434ec42cf1 - https://git.kernel.org/stable/c/506a88a5bf261d76a5214c0338a320f2214c67ac - https://git.kernel.org/stable/c/cc5984cf270b69d03f9f4b27063e535036c659e9 - https://git.kernel.org/stable/c/c136c2924a59a399aa789858cfb320d481964fb7 - https://git.kernel.org/stable/c/fa1ad9d4cc47ca2470cd904ad4519f05d7e43a2b
CVE ID: CVE-2022-49716 State: PUBLISHED Published: 2025-02-26T02:24:31.586Z Last Updated: 2025-10-01T19:36:44.679Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3: Fix error handling in gic_populate_ppi_partitions of_get_child_by_name() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. When kcalloc fails, it missing of_node_put() and results in refcount leak. Fix this by goto out_put_node label. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/58e67c81e229351027d28c610638378606e33a08 - https://git.kernel.org/st
ment: References: - https://git.kernel.org/stable/c/58e67c81e229351027d28c610638378606e33a08 - https://git.kernel.org/stable/c/7c9dd9d23f26dabcfb14148b9acdfba540418b19 - https://git.kernel.org/stable/c/0b325d993995a321f6ab4e6c51f0504ec092bf5b - https://git.kernel.org/stable/c/c83c34c57798fc41faefcf078be78683db2f4beb - https://git.kernel.org/stable/c/ec8401a429ffee34ccf38cebf3443f8d5ae6cb0d
CVE ID: CVE-2022-49717 State: PUBLISHED Published: 2025-02-26T02:24:32.231Z Last Updated: 2025-10-01T19:36:44.494Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: irqchip/apple-aic: Fix refcount leak in build_fiq_affinity of_find_node_by_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/2dc14cebe5dc053434b507bb24e6821cb795050f - https://git.kernel.org/stable/c/b1ac803f47cb1615468f35cf1ccb553c52087301
CVE ID: CVE-2022-49718 State: PUBLISHED Published: 2025-02-26T02:24:32.873Z Last Updated: 2025-10-01T19:36:44.349Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: irqchip/apple-aic: Fix refcount leak in aic_of_ic_init of_get_child_by_name() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/6c0010d1dc67c89bcc857c46f542efe318f84ddc - https://git.kernel.org/stable/c/3d45670fab3c25a7452721e4588cc95c51cda134
CVE ID: CVE-2022-49719 State: PUBLISHED Published: 2025-02-26T02:24:33.532Z Last Updated: 2025-10-01T19:36:44.217Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: irqchip/gic/realview: Fix refcount leak in realview_gic_of_init of_find_matching_node_and_match() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/87da903ce632d5689bef66d56ee5dae700d82104 - https://git.kernel.org/stable/c/486f68f85085d9b16ae097679b1486dcb1b6eb69 - htt
7da903ce632d5689bef66d56ee5dae700d82104 - https://git.kernel.org/stable/c/486f68f85085d9b16ae097679b1486dcb1b6eb69 - https://git.kernel.org/stable/c/b634af84bc1edece4e63317b0ad95618dd3a8693 - https://git.kernel.org/stable/c/56526c3883fc7a1f5898b1d40a02c8b8685a5d92 - https://git.kernel.org/stable/c/e52a58b79f11755ea7e877015c4a1704303fa55f - https://git.kernel.org/stable/c/5d38720661a4b9c87705c206a6081177ffb8ec1d - https://git.kernel.org/stable/c/16b603cb8d34c2d917983918db1f88c8b831baaa - https://git.kernel.org/stable/c/f4b98e314888cc51486421bcf6d52852452ea48b
CVE ID: CVE-2022-49720 State: PUBLISHED Published: 2025-02-26T02:24:34.194Z Last Updated: 2025-10-01T19:36:44.080Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: block: Fix handling of offline queues in blk_mq_alloc_request_hctx() This patch prevents that test nvme/004 triggers the following: UBSAN: array-index-out-of-bounds in block/blk-mq.h:135:9 index 512 is out of range for type 'long unsigned int [512]' Call Trace: show_stack+0x52/0x58 dump_stack_lvl+0x49/0x5e dump_stack+0x10/0x12 ubsan_epilogue+0x9/0x3b __ubsan_handle_out_of_bounds.cold+0x44/0x49 blk_mq_alloc_request_hctx+0x304/0x310 __nvme_submit_sync_cmd+0x70/0x200 [nvm
__ubsan_handle_out_of_bounds.cold+0x44/0x49 blk_mq_alloc_request_hctx+0x304/0x310 __nvme_submit_sync_cmd+0x70/0x200 [nvme_core] nvmf_connect_io_queue+0x23e/0x2a0 [nvme_fabrics] nvme_loop_connect_io_queues+0x8d/0xb0 [nvme_loop] nvme_loop_create_ctrl+0x58e/0x7d0 [nvme_loop] nvmf_create_ctrl+0x1d7/0x4d0 [nvme_fabrics] nvmf_dev_write+0xae/0x111 [nvme_fabrics] vfs_write+0x144/0x560 ksys_write+0xb7/0x140 __x64_sys_write+0x42/0x50 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/7fa28a7c3d74933a4fc22d341b60927952f31c19 - https://git.kernel.org/stable/c/b5e65ef044d627effdc2599040b6d204e00
/stable/c/7fa28a7c3d74933a4fc22d341b60927952f31c19 - https://git.kernel.org/stable/c/b5e65ef044d627effdc2599040b6d204e003f955 - https://git.kernel.org/stable/c/b202a0bd2580ee5b0453772c46d464152fafff73 - https://git.kernel.org/stable/c/14dc7a18abbe4176f5626c13c333670da8e06aa1
CVE ID: CVE-2022-49721 State: PUBLISHED Published: 2025-02-26T02:24:34.685Z Last Updated: 2025-05-04T08:44:04.571Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: arm64: ftrace: consistently handle PLTs. Sometimes it is necessary to use a PLT entry to call an ftrace trampoline. This is handled by ftrace_make_call() and ftrace_make_nop(), with each having *almost* identical logic, but this is not handled by ftrace_modify_call() since its introduction in commit: 3b23e4991fb66f6d ("arm64: implement ftrace with regs") Due to this, if we ever were to call ftrace_modify_call() for a callsite which requires a PLT entry for a trampoline
s") Due to this, if we ever were to call ftrace_modify_call() for a callsite which requires a PLT entry for a trampoline, then either: a) If the old addr requires a trampoline, ftrace_modify_call() will use an out-of-range address to generate the 'old' branch instruction. This will result in warnings from aarch64_insn_gen_branch_imm() and ftrace_modify_code(), and no instructions will be modified. As ftrace_modify_call() will return an error, this will result in subsequent internal ftrace errors. b) If the old addr does not require a trampoline, but the new addr does, ftrace_modify_call() will use an out-of-range address to generate the 'new' branch instruction. This will result in warnings
e_modify_call() will use an out-of-range address to generate the 'new' branch instruction. This will result in warnings from aarch64_insn_gen_branch_imm(), and ftrace_modify_code() will replace the 'old' branch with a BRK. This will result in a kernel panic when this BRK is later executed. Practically speaking, case (a) is vastly more likely than case (b), and typically this will result in internal ftrace errors that don't necessarily affect the rest of the system. This can be demonstrated with an out-of-tree test module which triggers ftrace_modify_call(), e.g. | # insmod test_ftrace.ko | test_ftrace: Function test_function raw=0xffffb3749399201c, callsite=0xffffb37493992024 | branch_imm_co
test_ftrace.ko | test_ftrace: Function test_function raw=0xffffb3749399201c, callsite=0xffffb37493992024 | branch_imm_common: offset out of range | branch_imm_common: offset out of range | ------------[ ftrace bug ]------------ | ftrace failed to modify | [<ffffb37493992024>] test_function+0x8/0x38 [test_ftrace] | actual: 1d:00:00:94 | Updating ftrace call site to call a different ftrace function | ftrace record flags: e0000002 | (2) R | expected tramp: ffffb374ae42ed54 | ------------[ cut here ]------------ | WARNING: CPU: 0 PID: 165 at kernel/trace/ftrace.c:2085 ftrace_bug+0x280/0x2b0 | Modules linked in: test_ftrace(+) | CPU: 0 PID: 165 Comm: insmod Not tainted 5.19.0-rc2-00002-g4d9ead8b4
g+0x280/0x2b0 | Modules linked in: test_ftrace(+) | CPU: 0 PID: 165 Comm: insmod Not tainted 5.19.0-rc2-00002-g4d9ead8b45ce #13 | Hardware name: linux,dummy-virt (DT) | pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) | pc : ftrace_bug+0x280/0x2b0 | lr : ftrace_bug+0x280/0x2b0 | sp : ffff80000839ba00 | x29: ffff80000839ba00 x28: 0000000000000000 x27: ffff80000839bcf0 | x26: ffffb37493994180 x25: ffffb374b0991c28 x24: ffffb374b0d70000 | x23: 00000000ffffffea x22: ffffb374afcc33b0 x21: ffffb374b08f9cc8 | x20: ffff572b8462c000 x19: ffffb374b08f9000 x18: ffffffffffffffff | x17: 6c6c6163202c6331 x16: ffffb374ae5ad110 x15: ffffb374b0d51ee4 | x14: 0000000000000000 x13: 34356465323465
ffffffff | x17: 6c6c6163202c6331 x16: ffffb374ae5ad110 x15: ffffb374b0d51ee4 | x14: 0000000000000000 x13: 3435646532346561 x12: 3437336266666666 | x11: 203a706d61727420 x10: 6465746365707865 x9 : ffffb374ae5149e8 | x8 : 336266666666203a x7 : 706d617274206465 x6 : 00000000fffff167 | x5 : ffff572bffbc4a08 x4 : 00000000fffff167 x3 : 0000000000000000 | x2 : 0000000000000000 x1 : ffff572b84461e00 x0 : 0000000000000022 | Call trace: | ftrace_bug+0x280/0x2b0 | ftrace_replace_code+0x98/0xa0 | ftrace_modify_all_code+0xe0/0x144 | arch_ftrace_update_code+0x14/0x20 | ftrace_startup+0xf8/0x1b0 | register_ftrace_function+0x38/0x90 | test_ftrace_init+0xd0/0x1000 [test_ftrace] | do_one_initcall+0x50/0x2b0 |
8/0x1b0 | register_ftrace_function+0x38/0x90 | test_ftrace_init+0xd0/0x1000 [test_ftrace] | do_one_initcall+0x50/0x2b0 | do_init_module+0x50/0x1f0 | load_module+0x17c8/0x1d64 | __do_sys_finit_module+0xa8/0x100 | __arm64_sys_finit_module+0x2c/0x3c | invoke_syscall+0x50/0x120 | el0_svc_common.constprop.0+0xdc/0x100 | do_el0_svc+0x3c/0xd0 | el0_svc+0x34/0xb0 | el0t_64_sync_handler+0xbc/0x140 | el0t_64_sync+0x18c/0x190 | ---[ end trace 0000000000000000 ]--- We can solve this by consistently determining whether to use a PLT entry for an address. Note that since (the earlier) commit: f1a54ae9 ---truncated--- References: - https://git.kernel.org/stable/c/bc28fde90937a920f7714ec4408269cac744f796 - h
mit: f1a54ae9 ---truncated--- References: - https://git.kernel.org/stable/c/bc28fde90937a920f7714ec4408269cac744f796 - https://git.kernel.org/stable/c/db73aa9466338ec821ed2a0b01721fe4d06876b1 - https://git.kernel.org/stable/c/dcecc96ed16f73417de5550f384e348c9d56f279 - https://git.kernel.org/stable/c/a6253579977e4c6f7818eeb05bf2bc65678a7187
CVE ID: CVE-2022-49722 State: PUBLISHED Published: 2025-02-26T02:24:35.357Z Last Updated: 2025-05-04T08:44:05.634Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ice: Fix memory corruption in VF driver Disable VF's RX/TX queues, when it's disabled. VF can have queues enabled, when it requests a reset. If PF driver assumes that VF is disabled, while VF still has queues configured, VF may unmap DMA resources. In such scenario device still can map packets to memory, which ends up silently corrupting it. Previously, VF driver could experience memory corruption, which lead to crash: [ 5119.170157] BUG: unable to handle kernel paging
y, VF driver could experience memory corruption, which lead to crash: [ 5119.170157] BUG: unable to handle kernel paging request at 00001b9780003237 [ 5119.170166] PGD 0 P4D 0 [ 5119.170173] Oops: 0002 [#1] PREEMPT_RT SMP PTI [ 5119.170181] CPU: 30 PID: 427592 Comm: kworker/u96:2 Kdump: loaded Tainted: G W I --------- - - 4.18.0-372.9.1.rt7.166.el8.x86_64 #1 [ 5119.170189] Hardware name: Dell Inc. PowerEdge R740/014X06, BIOS 2.3.10 08/15/2019 [ 5119.170193] Workqueue: iavf iavf_adminq_task [iavf] [ 5119.170219] RIP: 0010:__page_frag_cache_drain+0x5/0x30 [ 5119.170238] Code: 0f 0f b6 77 51 85 f6 74 07 31 d2 e9 05 df ff ff e9 90 fe ff ff 48 8b 05 49 db 33 01 eb b4 0f 1f 80 00 00 00 00 0f 1f 44
0f 0f b6 77 51 85 f6 74 07 31 d2 e9 05 df ff ff e9 90 fe ff ff 48 8b 05 49 db 33 01 eb b4 0f 1f 80 00 00 00 00 0f 1f 44 00 00 <f0> 29 77 34 74 01 c3 48 8b 07 f6 c4 80 74 0f 0f b6 77 51 85 f6 74 [ 5119.170244] RSP: 0018:ffffa43b0bdcfd78 EFLAGS: 00010282 [ 5119.170250] RAX: ffffffff896b3e40 RBX: ffff8fb282524000 RCX: 0000000000000002 [ 5119.170254] RDX: 0000000049000000 RSI: 0000000000000000 RDI: 00001b9780003203 [ 5119.170259] RBP: ffff8fb248217b00 R08: 0000000000000022 R09: 0000000000000009 [ 5119.170262] R10: 2b849d6300000000 R11: 0000000000000020 R12: 0000000000000000 [ 5119.170265] R13: 0000000000001000 R14: 0000000000000009 R15: 0000000000000000 [ 5119.170269] FS: 0000000000000000(0000)
5119.170265] R13: 0000000000001000 R14: 0000000000000009 R15: 0000000000000000 [ 5119.170269] FS: 0000000000000000(0000) GS:ffff8fb1201c0000(0000) knlGS:0000000000000000 [ 5119.170274] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 5119.170279] CR2: 00001b9780003237 CR3: 00000008f3e1a003 CR4: 00000000007726e0 [ 5119.170283] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 5119.170286] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 5119.170290] PKRU: 55555554 [ 5119.170292] Call Trace: [ 5119.170298] iavf_clean_rx_ring+0xad/0x110 [iavf] [ 5119.170324] iavf_free_rx_resources+0xe/0x50 [iavf] [ 5119.170342] iavf_free_all_rx_resources.part.51+0x30/0x40
iavf] [ 5119.170324] iavf_free_rx_resources+0xe/0x50 [iavf] [ 5119.170342] iavf_free_all_rx_resources.part.51+0x30/0x40 [iavf] [ 5119.170358] iavf_virtchnl_completion+0xd8a/0x15b0 [iavf] [ 5119.170377] ? iavf_clean_arq_element+0x210/0x280 [iavf] [ 5119.170397] iavf_adminq_task+0x126/0x2e0 [iavf] [ 5119.170416] process_one_work+0x18f/0x420 [ 5119.170429] worker_thread+0x30/0x370 [ 5119.170437] ? process_one_work+0x420/0x420 [ 5119.170445] kthread+0x151/0x170 [ 5119.170452] ? set_kthread_struct+0x40/0x40 [ 5119.170460] ret_from_fork+0x35/0x40 [ 5119.170477] Modules linked in: iavf sctp ip6_udp_tunnel udp_tunnel mlx4_en mlx4_core nfp tls vhost_net vhost vhost_iotlb tap tun xt_CHECKSUM ipt_MASQU
iavf sctp ip6_udp_tunnel udp_tunnel mlx4_en mlx4_core nfp tls vhost_net vhost vhost_iotlb tap tun xt_CHECKSUM ipt_MASQUERADE xt_conntrack ipt_REJECT nf_reject_ipv4 nft_compat nft_counter nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables nfnetlink bridge stp llc rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache sunrpc intel_rapl_msr iTCO_wdt iTCO_vendor_support dell_smbios wmi_bmof dell_wmi_descriptor dcdbas kvm_intel kvm irqbypass intel_rapl_common isst_if_common skx_edac irdma nfit libnvdimm x86_pkg_temp_thermal i40e intel_powerclamp coretemp crct10dif_pclmul crc32_pclmul ghash_clmulni_intel ib_uverbs rapl ipmi_ssif intel_cstate intel_uncore mei
rclamp coretemp crct10dif_pclmul crc32_pclmul ghash_clmulni_intel ib_uverbs rapl ipmi_ssif intel_cstate intel_uncore mei_me pcspkr acpi_ipmi ib_core mei lpc_ich i2c_i801 ipmi_si ipmi_devintf wmi ipmi_msghandler acpi_power_meter xfs libcrc32c sd_mod t10_pi sg mgag200 drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops ice ahci drm libahci crc32c_intel libata tg3 megaraid_sas [ 5119.170613] i2c_algo_bit dm_mirror dm_region_hash dm_log dm_mod fuse [last unloaded: iavf] [ 5119.170627] CR2: 00001b9780003237 References: - https://git.kernel.org/stable/c/1bb8253b1dd44cf004e12c333acc6f25ee286cf3 - https://git.kernel.org/stable/c/efe41860008e57fb6b69855b4b93fdf34bc42798
CVE ID: CVE-2022-49723 State: PUBLISHED Published: 2025-02-26T02:24:36.049Z Last Updated: 2025-05-04T08:44:06.699Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/i915/reset: Fix error_state_read ptr + offset use Fix our pointer offset usage in error_state_read when there is no i915_gpu_coredump but buf offset is non-zero. This fixes a kernel page fault can happen when multiple tests are running concurrently in a loop and one is producing engine resets and consuming the i915 error_state dump while the other is forcing full GT resets. (takes a while to trigger). The dmesg call trace: [ 5590.803000] BUG: unable to handle page