Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-49237 State: PUBLISHED Published: 2025-02-26T01:56:01.158Z Last Updated: 2025-10-01T19:47:02.979Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ath11k: add missing of_node_put() to avoid leak The node pointer is returned by of_find_node_by_type() or of_parse_phandle() with refcount incremented. Calling of_node_put() to aovid the refcount leak. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/7d51cb010b20d70b16dc6e4341bf29d6c5b32564 - https://git.kernel.org/stable/c/3d38faef0de1756994b3d95e47b2302842f729e2
CVE ID: CVE-2022-49238 State: PUBLISHED Published: 2025-02-26T01:56:01.716Z Last Updated: 2025-05-04T08:33:06.459Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ath11k: free peer for station when disconnect from AP for QCA6390/WCN6855 Commit b4a0f54156ac ("ath11k: move peer delete after vdev stop of station for QCA6390 and WCN6855") is to fix firmware crash by changing the WMI command sequence, but actually skip all the peer delete operation, then it lead commit 58595c9874c6 ("ath11k: Fixing dangling pointer issue upon peer delete failure") not take effect, and then happened a use-after-free warning from KASAN. because the pee
issue upon peer delete failure") not take effect, and then happened a use-after-free warning from KASAN. because the peer->sta is not set to NULL and then used later. Change to only skip the WMI_PEER_DELETE_CMDID for QCA6390/WCN6855. log of user-after-free: [ 534.888665] BUG: KASAN: use-after-free in ath11k_dp_rx_update_peer_stats+0x912/0xc10 [ath11k] [ 534.888696] Read of size 8 at addr ffff8881396bb1b8 by task rtcwake/2860 [ 534.888705] CPU: 4 PID: 2860 Comm: rtcwake Kdump: loaded Tainted: G W 5.15.0-wt-ath+ #523 [ 534.888712] Hardware name: Intel(R) Client Systems NUC8i7HVK/NUC8i7HVB, BIOS HNKBLi70.86A.0067.2021.0528.1339 05/28/2021 [ 534.888716] Call Trace: [ 534.888720] <IRQ> [ 534.8887
HVK/NUC8i7HVB, BIOS HNKBLi70.86A.0067.2021.0528.1339 05/28/2021 [ 534.888716] Call Trace: [ 534.888720] <IRQ> [ 534.888726] dump_stack_lvl+0x57/0x7d [ 534.888736] print_address_description.constprop.0+0x1f/0x170 [ 534.888745] ? ath11k_dp_rx_update_peer_stats+0x912/0xc10 [ath11k] [ 534.888771] kasan_report.cold+0x83/0xdf [ 534.888783] ? ath11k_dp_rx_update_peer_stats+0x912/0xc10 [ath11k] [ 534.888810] ath11k_dp_rx_update_peer_stats+0x912/0xc10 [ath11k] [ 534.888840] ath11k_dp_rx_process_mon_status+0x529/0xa70 [ath11k] [ 534.888874] ? ath11k_dp_rx_mon_status_bufs_replenish+0x3f0/0x3f0 [ath11k] [ 534.888897] ? check_prev_add+0x20f0/0x20f0 [ 534.888922] ? __lock_acquire+0xb72/0x1870 [ 534.888937
3f0/0x3f0 [ath11k] [ 534.888897] ? check_prev_add+0x20f0/0x20f0 [ 534.888922] ? __lock_acquire+0xb72/0x1870 [ 534.888937] ? find_held_lock+0x33/0x110 [ 534.888954] ath11k_dp_rx_process_mon_rings+0x297/0x520 [ath11k] [ 534.888981] ? rcu_read_unlock+0x40/0x40 [ 534.888990] ? ath11k_dp_rx_pdev_alloc+0xd90/0xd90 [ath11k] [ 534.889026] ath11k_dp_service_mon_ring+0x67/0xe0 [ath11k] [ 534.889053] ? ath11k_dp_rx_process_mon_rings+0x520/0x520 [ath11k] [ 534.889075] call_timer_fn+0x167/0x4a0 [ 534.889084] ? add_timer_on+0x3b0/0x3b0 [ 534.889103] ? lockdep_hardirqs_on_prepare.part.0+0x18c/0x370 [ 534.889117] __run_timers.part.0+0x539/0x8b0 [ 534.889123] ? ath11k_dp_rx_process_mon_rings+0x520/0x520 [ath
x18c/0x370 [ 534.889117] __run_timers.part.0+0x539/0x8b0 [ 534.889123] ? ath11k_dp_rx_process_mon_rings+0x520/0x520 [ath11k] [ 534.889157] ? call_timer_fn+0x4a0/0x4a0 [ 534.889164] ? mark_lock_irq+0x1c30/0x1c30 [ 534.889173] ? clockevents_program_event+0xdd/0x280 [ 534.889189] ? mark_held_locks+0xa5/0xe0 [ 534.889203] run_timer_softirq+0x97/0x180 [ 534.889213] __do_softirq+0x276/0x86a [ 534.889230] __irq_exit_rcu+0x11c/0x180 [ 534.889238] irq_exit_rcu+0x5/0x20 [ 534.889244] sysvec_apic_timer_interrupt+0x8e/0xc0 [ 534.889251] </IRQ> [ 534.889254] <TASK> [ 534.889259] asm_sysvec_apic_timer_interrupt+0x12/0x20 [ 534.889265] RIP: 0010:_raw_spin_unlock_irqrestore+0x38/0x70 [ 534.889271] Code: 74
vec_apic_timer_interrupt+0x12/0x20 [ 534.889265] RIP: 0010:_raw_spin_unlock_irqrestore+0x38/0x70 [ 534.889271] Code: 74 24 10 e8 ea c2 bf fd 48 89 ef e8 12 53 c0 fd 81 e3 00 02 00 00 75 25 9c 58 f6 c4 02 75 2d 48 85 db 74 01 fb bf 01 00 00 00 <e8> 13 a7 b5 fd 65 8b 05 cc d9 9c 5e 85 c0 74 0a 5b 5d c3 e8 a0 ee [ 534.889276] RSP: 0018:ffffc90002e5f880 EFLAGS: 00000206 [ 534.889284] RAX: 0000000000000006 RBX: 0000000000000200 RCX: ffffffff9f256f10 [ 534.889289] RDX: 0000000000000000 RSI: ffffffffa1c6e420 RDI: 0000000000000001 [ 534.889293] RBP: ffff8881095e6200 R08: 0000000000000001 R09: ffffffffa40d2b8f [ 534.889298] R10: fffffbfff481a571 R11: 0000000000000001 R12: ffff8881095e6e68 [ 534.88930
000001 R09: ffffffffa40d2b8f [ 534.889298] R10: fffffbfff481a571 R11: 0000000000000001 R12: ffff8881095e6e68 [ 534.889302] R13: ffffc90002e5f908 R14: 0000000000000246 R15: 0000000000000000 [ 534.889316] ? mark_lock+0xd0/0x14a0 [ 534.889332] klist_next+0x1d4/0x450 [ 534.889340] ? dpm_wait_for_subordinate+0x2d0/0x2d0 [ 534.889350] device_for_each_child+0xa8/0x140 [ 534.889360] ? device_remove_class_symlinks+0x1b0/0x1b0 [ 534.889370] ? __lock_release+0x4bd/0x9f0 [ 534.889378] ? dpm_suspend+0x26b/0x3f0 [ 534.889390] dpm_wait_for_subordinate+ ---truncated--- Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/400705c50bbf184794c885d1efad7fe9ccf1471a -
otes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/400705c50bbf184794c885d1efad7fe9ccf1471a - https://git.kernel.org/stable/c/212ad7cb7d7592669c067125949e0a8e31ce6a0b
CVE ID: CVE-2022-49239 State: PUBLISHED Published: 2025-02-26T01:56:02.220Z Last Updated: 2025-10-01T19:47:02.841Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: wcd934x: Add missing of_node_put() in wcd934x_codec_parse_data The device_node pointer is returned by of_parse_phandle() with refcount incremented. We should use of_node_put() on it when done. This is similar to commit 64b92de9603f ("ASoC: wcd9335: fix a leaked reference by adding missing of_node_put") Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/1f24716e38220fc9e52e208d20591d2bc9b7f020 - https://git.ker
P Vulnrichment: References: - https://git.kernel.org/stable/c/1f24716e38220fc9e52e208d20591d2bc9b7f020 - https://git.kernel.org/stable/c/2f44eca78cc6d4e1779eb95765ec79e433accab4 - https://git.kernel.org/stable/c/f3793eeb7b94a5eeed6f5c7a44bce403c6681a12 - https://git.kernel.org/stable/c/f8e89d84ea83c51ba3ba97ff154f7aa679326760 - https://git.kernel.org/stable/c/9531a631379169d57756b2411178c6238655df88
CVE ID: CVE-2022-49240 State: PUBLISHED Published: 2025-02-26T01:56:02.795Z Last Updated: 2025-10-01T19:47:02.684Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: mt8195: Fix error handling in mt8195_mt6359_rt1019_rt5682_dev_probe The device_node pointer is returned by of_parse_phandle() with refcount incremented. We should use of_node_put() on it when done. This function only calls of_node_put() in the regular path. And it will cause refcount leak in error path. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/c652f8f0875b569f8afa80b8cf9762828fd6187b - https://git.
ADP Vulnrichment: References: - https://git.kernel.org/stable/c/c652f8f0875b569f8afa80b8cf9762828fd6187b - https://git.kernel.org/stable/c/c4b7174fe5bb875a09a78674a14a1589d1a672f3
CVE ID: CVE-2022-49241 State: PUBLISHED Published: 2025-02-26T01:56:03.303Z Last Updated: 2025-10-01T19:47:02.517Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ASoC: atmel: Fix error handling in sam9x5_wm8731_driver_probe The device_node pointer is returned by of_parse_phandle() with refcount incremented. We should use of_node_put() on it when done. This function only calls of_node_put() in the regular path. And it will cause refcount leak in error path. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/90ac679aa6a01841da90ec5a4aaa4b5e0badddf0 - https://git.kernel.org/stable/c/f5
erences: - https://git.kernel.org/stable/c/90ac679aa6a01841da90ec5a4aaa4b5e0badddf0 - https://git.kernel.org/stable/c/f589063b585ac6dd2081bde6c145411cf48d8d92 - https://git.kernel.org/stable/c/14228225091a0854b1de23e5b4fe8bdeeca9683b - https://git.kernel.org/stable/c/f43ad5dc43240289f4cf13c16cc506f4f7087931 - https://git.kernel.org/stable/c/740dc3e846537c3743da98bf106f376023fd085c
CVE ID: CVE-2022-49242 State: PUBLISHED Published: 2025-02-26T01:56:03.812Z Last Updated: 2025-10-01T19:47:02.248Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ASoC: mxs: Fix error handling in mxs_sgtl5000_probe This function only calls of_node_put() in the regular path. And it will cause refcount leak in error paths. For example, when codec_np is NULL, saif_np[0] and saif_np[1] are not NULL, it will cause leaks. of_node_put() will check if the node pointer is NULL, so we can call it directly to release the refcount of regular pointers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/st
refcount of regular pointers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/f16ad2c0e22687f80e5981c67374023f51c204b9 - https://git.kernel.org/stable/c/790d2628e3fcc819d8f5572eb5615113fb2e727a - https://git.kernel.org/stable/c/f8d38056bcd220ea6f0802a5586d1a12ebcce849 - https://git.kernel.org/stable/c/67e12f1cb2f97468c12b59e21975eaa0f332e7d2 - https://git.kernel.org/stable/c/86b6cf989437e694fd0a15782b5a513853a739e0 - https://git.kernel.org/stable/c/44acdaf7acb60054d872bed18ce0e7db8ce900ce - https://git.kernel.org/stable/c/d2923b48d99fe663cb93d8b481c93299fcd68656 - https://git.kernel.org/stable/c/8d880226c86f37624e2a5f3c6d92ac0ec3375f96 - https
23b48d99fe663cb93d8b481c93299fcd68656 - https://git.kernel.org/stable/c/8d880226c86f37624e2a5f3c6d92ac0ec3375f96 - https://git.kernel.org/stable/c/6ae0a4d8fec551ec581d620f0eb1fe31f755551c
CVE ID: CVE-2022-49243 State: PUBLISHED Published: 2025-02-26T01:56:04.304Z Last Updated: 2025-05-04T08:33:12.920Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ASoC: atmel: Add missing of_node_put() in at91sam9g20ek_audio_probe This node pointer is returned by of_parse_phandle() with refcount incremented in this function. Calling of_node_put() to avoid the refcount leak. References: - https://git.kernel.org/stable/c/81f266396237cea09a8c6322a6a78535f06ed345 - https://git.kernel.org/stable/c/f8b7b9a0594715ecfbe6f18db2328d992242654a - https://git.kernel.org/stable/c/b0c56a0071116a37c24df998166c22a7e4684626 - https://git.kernel.o
e6f18db2328d992242654a - https://git.kernel.org/stable/c/b0c56a0071116a37c24df998166c22a7e4684626 - https://git.kernel.org/stable/c/0325193cf40dc3a6e27d55a5b98680936deebcd0 - https://git.kernel.org/stable/c/662ee5ac6b451aa5a27b8eebd397f2f5c7f42cec - https://git.kernel.org/stable/c/a0bc36b247dcf4d21bf820bfc4bcbaf7f6cf19b5 - https://git.kernel.org/stable/c/32e6ceb05f36432811753852c674a301f944a24b - https://git.kernel.org/stable/c/4793a02deb31b71b3984abc67bf1011a03c13b18 - https://git.kernel.org/stable/c/f590797fa3c1bccdd19e55441592a23b46aef449
CVE ID: CVE-2022-49244 State: PUBLISHED Published: 2025-02-26T01:56:04.783Z Last Updated: 2025-05-04T08:33:14.176Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: mt8192-mt6359: Fix error handling in mt8192_mt6359_dev_probe The device_node pointer is returned by of_parse_phandle() with refcount incremented. We should use of_node_put() on it when done. This function only calls of_node_put() in the regular path. And it will cause refcount leak in error paths. Fix this by calling of_node_put() in error handling too. References: - https://git.kernel.org/stable/c/87e04a89c31e792eef62bcba6ebb77fd323d28a1 - https://git.
rror handling too. References: - https://git.kernel.org/stable/c/87e04a89c31e792eef62bcba6ebb77fd323d28a1 - https://git.kernel.org/stable/c/d5a38629f1aaf397fd471b27e49d55289ddc0656 - https://git.kernel.org/stable/c/1765787ec02e824f4f5e672cf269280a5da09d2f - https://git.kernel.org/stable/c/e45ac7831ff3e2934d58cce319c17c8ec763c95c
CVE ID: CVE-2022-49245 State: PUBLISHED Published: 2025-02-26T01:56:05.259Z Last Updated: 2025-05-04T08:33:15.504Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ASoC: rockchip: Fix PM usage reference of rockchip_i2s_tdm_resume pm_runtime_get_sync will increment pm usage counter even it failed. Forgetting to putting operation will result in reference leak here. We fix it by replacing it with pm_runtime_resume_and_get to keep usage counter balanced. References: - https://git.kernel.org/stable/c/4e5510219111607b1f1875ab3c3f0485ba3c381c - https://git.kernel.org/stable/c/5c1834aac759ddfd0f17c9f38db1b30adc8eb4e8 - https://git.kernel
1f1875ab3c3f0485ba3c381c - https://git.kernel.org/stable/c/5c1834aac759ddfd0f17c9f38db1b30adc8eb4e8 - https://git.kernel.org/stable/c/cc5d8ac95663a5813c696008bc524b794d471215
CVE ID: CVE-2022-49246 State: PUBLISHED Published: 2025-02-26T01:56:05.740Z Last Updated: 2025-05-04T08:33:16.716Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ASoC: atmel: Fix error handling in snd_proto_probe The device_node pointer is returned by of_parse_phandle() with refcount incremented. We should use of_node_put() on it when done. This function only calls of_node_put() in the regular path. And it will cause refcount leak in error paths. Fix this by calling of_node_put() in error handling too. References: - https://git.kernel.org/stable/c/f32ac9bf5e3f594ef9bfedb410aebc98cf784e69 - https://git.kernel.org/stable/c/0f5174
ces: - https://git.kernel.org/stable/c/f32ac9bf5e3f594ef9bfedb410aebc98cf784e69 - https://git.kernel.org/stable/c/0f517480d5888cd54487c5662ce4da95b30ad798 - https://git.kernel.org/stable/c/8fa969cd8485031294f91fc7184399000cae6355 - https://git.kernel.org/stable/c/b0bfaf0544d08d093d6211d7ef8816fb0b5b6c75
CVE ID: CVE-2022-49247 State: PUBLISHED Published: 2025-02-26T01:56:06.224Z Last Updated: 2025-05-04T08:33:17.999Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED If the callback 'start_streaming' fails, then all queued buffers in the driver should be returned with state 'VB2_BUF_STATE_QUEUED'. Currently, they are returned with 'VB2_BUF_STATE_ERROR' which is wrong. Fix this. This also fixes the warning: [ 65.583633] WARNING: CPU: 5 PID: 593 at drivers/media/common/videobuf2/videobuf2-core.c:1612 vb2_start_streaming+0xd4/0x160 [videobuf2_common] [ 65.
PID: 593 at drivers/media/common/videobuf2/videobuf2-core.c:1612 vb2_start_streaming+0xd4/0x160 [videobuf2_common] [ 65.585027] Modules linked in: snd_usb_audio snd_hwdep snd_usbmidi_lib snd_rawmidi snd_soc_hdmi_codec dw_hdmi_i2s_audio saa7115 stk1160 videobuf2_vmalloc videobuf2_memops videobuf2_v4l2 videobuf2_common videodev mc crct10dif_ce panfrost snd_soc_simple_card snd_soc_audio_graph_card snd_soc_spdif_tx snd_soc_simple_card_utils gpu_sched phy_rockchip_pcie snd_soc_rockchip_i2s rockchipdrm analogix_dp dw_mipi_dsi dw_hdmi cec drm_kms_helper drm rtc_rk808 rockchip_saradc industrialio_triggered_buffer kfifo_buf rockchip_thermal pcie_rockchip_host ip_tables x_tables ipv6 [ 65.589383] CPU:
dc industrialio_triggered_buffer kfifo_buf rockchip_thermal pcie_rockchip_host ip_tables x_tables ipv6 [ 65.589383] CPU: 5 PID: 593 Comm: v4l2src0:src Tainted: G W 5.16.0-rc4-62408-g32447129cb30-dirty #14 [ 65.590293] Hardware name: Radxa ROCK Pi 4B (DT) [ 65.590696] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 65.591304] pc : vb2_start_streaming+0xd4/0x160 [videobuf2_common] [ 65.591850] lr : vb2_start_streaming+0x6c/0x160 [videobuf2_common] [ 65.592395] sp : ffff800012bc3ad0 [ 65.592685] x29: ffff800012bc3ad0 x28: 0000000000000000 x27: ffff800012bc3cd8 [ 65.593312] x26: 0000000000000000 x25: ffff00000d8a7800 x24: 0000000040045612 [ 65.593938] x23: ffff800011323000 x22:
8 [ 65.593312] x26: 0000000000000000 x25: ffff00000d8a7800 x24: 0000000040045612 [ 65.593938] x23: ffff800011323000 x22: ffff800012bc3cd8 x21: ffff00000908a8b0 [ 65.594562] x20: ffff00000908a8c8 x19: 00000000fffffff4 x18: ffffffffffffffff [ 65.595188] x17: 000000040044ffff x16: 00400034b5503510 x15: ffff800011323f78 [ 65.595813] x14: ffff000013163886 x13: ffff000013163885 x12: 00000000000002ce [ 65.596439] x11: 0000000000000028 x10: 0000000000000001 x9 : 0000000000000228 [ 65.597064] x8 : 0101010101010101 x7 : 7f7f7f7f7f7f7f7f x6 : fefefeff726c5e78 [ 65.597690] x5 : ffff800012bc3990 x4 : 0000000000000000 x3 : ffff000009a34880 [ 65.598315] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff
012bc3990 x4 : 0000000000000000 x3 : ffff000009a34880 [ 65.598315] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff000007cd99f0 [ 65.598940] Call trace: [ 65.599155] vb2_start_streaming+0xd4/0x160 [videobuf2_common] [ 65.599672] vb2_core_streamon+0x17c/0x1a8 [videobuf2_common] [ 65.600179] vb2_streamon+0x54/0x88 [videobuf2_v4l2] [ 65.600619] vb2_ioctl_streamon+0x54/0x60 [videobuf2_v4l2] [ 65.601103] v4l_streamon+0x3c/0x50 [videodev] [ 65.601521] __video_do_ioctl+0x1a4/0x428 [videodev] [ 65.601977] video_usercopy+0x320/0x828 [videodev] [ 65.602419] video_ioctl2+0x3c/0x58 [videodev] [ 65.602830] v4l2_ioctl+0x60/0x90 [videodev] [ 65.603227] __arm64_sys_ioctl+0xa8/0xe0 [ 65.603576] invoke_s
8 [videodev] [ 65.602830] v4l2_ioctl+0x60/0x90 [videodev] [ 65.603227] __arm64_sys_ioctl+0xa8/0xe0 [ 65.603576] invoke_syscall+0x54/0x118 [ 65.603911] el0_svc_common.constprop.3+0x84/0x100 [ 65.604332] do_el0_svc+0x34/0xa0 [ 65.604625] el0_svc+0x1c/0x50 [ 65.604897] el0t_64_sync_handler+0x88/0xb0 [ 65.605264] el0t_64_sync+0x16c/0x170 [ 65.605587] ---[ end trace 578e0ba07742170d ]--- References: - https://git.kernel.org/stable/c/03054f22d5abd80ad89547512c2bfbfb2714d3ed - https://git.kernel.org/stable/c/f04a520a422222fc921bf035dc67414c500a286a - https://git.kernel.org/stable/c/3cc050df73e3d973f1870a8dc0e177e77670bc7f - https://git.kernel.org/stable/c/4d68603cc4382174bc1e7d532e10675c48c6b257 -
c/3cc050df73e3d973f1870a8dc0e177e77670bc7f - https://git.kernel.org/stable/c/4d68603cc4382174bc1e7d532e10675c48c6b257 - https://git.kernel.org/stable/c/a09e9882800fdfc5aab93f77c3f0132071d2191b - https://git.kernel.org/stable/c/2874122ca4ca74adec72d6d6bf8828228ec20f15 - https://git.kernel.org/stable/c/f66e6fd1488d26229f11d86616de1b658c70fa8a - https://git.kernel.org/stable/c/fbe04b49a54e31f4321d632270207f0e6304cd16
CVE ID: CVE-2022-49248 State: PUBLISHED Published: 2025-02-26T01:56:06.709Z Last Updated: 2025-05-04T08:33:19.120Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction AV/C deferred transaction was supported at a commit 00a7bb81c20f ("ALSA: firewire-lib: Add support for deferred transaction") while 'deferrable' flag can be uninitialized for non-control/notify AV/C transactions. UBSAN reports it: kernel: ================================================================================ kernel: UBSAN: invalid-load in /build/linux-aa0B4d/linux-5.15.0/sound/firewire/f
======================================= kernel: UBSAN: invalid-load in /build/linux-aa0B4d/linux-5.15.0/sound/firewire/fcp.c:363:9 kernel: load of value 158 is not a valid value for type '_Bool' kernel: CPU: 3 PID: 182227 Comm: irq/35-firewire Tainted: P OE 5.15.0-18-generic #18-Ubuntu kernel: Hardware name: Gigabyte Technology Co., Ltd. AX370-Gaming 5/AX370-Gaming 5, BIOS F42b 08/01/2019 kernel: Call Trace: kernel: <IRQ> kernel: show_stack+0x52/0x58 kernel: dump_stack_lvl+0x4a/0x5f kernel: dump_stack+0x10/0x12 kernel: ubsan_epilogue+0x9/0x45 kernel: __ubsan_handle_load_invalid_value.cold+0x44/0x49 kernel: fcp_response.part.0.cold+0x1a/0x2b [snd_firewire_lib] kernel: fcp_response+0x28/0x30 [
alid_value.cold+0x44/0x49 kernel: fcp_response.part.0.cold+0x1a/0x2b [snd_firewire_lib] kernel: fcp_response+0x28/0x30 [snd_firewire_lib] kernel: fw_core_handle_request+0x230/0x3d0 [firewire_core] kernel: handle_ar_packet+0x1d9/0x200 [firewire_ohci] kernel: ? handle_ar_packet+0x1d9/0x200 [firewire_ohci] kernel: ? transmit_complete_callback+0x9f/0x120 [firewire_core] kernel: ar_context_tasklet+0xa8/0x2e0 [firewire_ohci] kernel: tasklet_action_common.constprop.0+0xea/0xf0 kernel: tasklet_action+0x22/0x30 kernel: __do_softirq+0xd9/0x2e3 kernel: ? irq_finalize_oneshot.part.0+0xf0/0xf0 kernel: do_softirq+0x75/0xa0 kernel: </IRQ> kernel: <TASK> kernel: __local_bh_enable_ip+0x50/0x60 kernel: irq_fo
f0/0xf0 kernel: do_softirq+0x75/0xa0 kernel: </IRQ> kernel: <TASK> kernel: __local_bh_enable_ip+0x50/0x60 kernel: irq_forced_thread_fn+0x7e/0x90 kernel: irq_thread+0xba/0x190 kernel: ? irq_thread_fn+0x60/0x60 kernel: kthread+0x11e/0x140 kernel: ? irq_thread_check_affinity+0xf0/0xf0 kernel: ? set_kthread_struct+0x50/0x50 kernel: ret_from_fork+0x22/0x30 kernel: </TASK> kernel: ================================================================================ This commit fixes the bug. The bug has no disadvantage for the non- control/notify AV/C transactions since the flag has an effect for AV/C response with INTERIM (0x0f) status which is not used for the transactions in AV/C general specificati
n effect for AV/C response with INTERIM (0x0f) status which is not used for the transactions in AV/C general specification. References: - https://git.kernel.org/stable/c/99582e4b19f367fa95bdd150b3034d7ce8113342 - https://git.kernel.org/stable/c/b2b65c9013dc28836d82e25d0f0c94d794a14aba - https://git.kernel.org/stable/c/60e5d391805d70458a01998de00d0c28cba40bf3 - https://git.kernel.org/stable/c/7025f40690a235a118c87674cfb93072694aa66d - https://git.kernel.org/stable/c/7e6f5786621df060f8296f074efd275eaf20361a - https://git.kernel.org/stable/c/eab74c41612083bd627b60da650e19234e4f1051 - https://git.kernel.org/stable/c/d07e4bbaff6fbba6f70c04b092ea7d9afcdf392e - https://git.kernel.org/stable/c/39d2c
f1051 - https://git.kernel.org/stable/c/d07e4bbaff6fbba6f70c04b092ea7d9afcdf392e - https://git.kernel.org/stable/c/39d2c4a33dc1b4402cec68a3c8f82c6588b6edce - https://git.kernel.org/stable/c/bf0cd60b7e33cf221fbe1114e4acb2c828b0af0d
CVE ID: CVE-2022-49249 State: PUBLISHED Published: 2025-02-26T01:56:07.215Z Last Updated: 2025-05-04T08:33:20.386Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: wc938x: fix accessing array out of bounds for enum type Accessing enums using integer would result in array out of bounds access on platforms like aarch64 where sizeof(long) is 8 compared to enum size which is 4 bytes. Fix this by using enumerated items instead of integers. References: - https://git.kernel.org/stable/c/adafea71b49ec4dbc44e0b84ec6eb602004a7a08 - https://git.kernel.org/stable/c/f03c0c94186d5876857132d97e28f20cdc100bdc - https://git.kernel.o
4e0b84ec6eb602004a7a08 - https://git.kernel.org/stable/c/f03c0c94186d5876857132d97e28f20cdc100bdc - https://git.kernel.org/stable/c/d09aee1b1da196be11ed86dd4897f228f2487613 - https://git.kernel.org/stable/c/cc587b7c8fbbe128f6bd0dad025a0caea5e6d164