Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-50123 State: PUBLISHED Published: 2025-06-18T11:02:51.743Z Last Updated: 2025-06-18T11:02:51.743Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: mt8173: Fix refcount leak in mt8173_rt5650_rt5676_dev_probe of_parse_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Fix missing of_node_put() in error paths. References: - https://git.kernel.org/stable/c/aa668f8e93199cda8fa1612eb49ff70f5ecd8c92 - https://git.kernel.org/stable/c/fab5eb31819a2693b0c3d6f3df6a0d193af9a089 - https://git.kernel.org/stable/c/d6d41f04640db0f946e2c3f7963bb2774
rg/stable/c/fab5eb31819a2693b0c3d6f3df6a0d193af9a089 - https://git.kernel.org/stable/c/d6d41f04640db0f946e2c3f7963bb2774afc7a0d - https://git.kernel.org/stable/c/aa1214ece37944e4dbbb5cfb1d02bf37e4d89b02 - https://git.kernel.org/stable/c/540c7b7385fb110740703888b4b2bbfa06c7f79c - https://git.kernel.org/stable/c/769399bce8825e1dcc5050dab78e15ab578baf4f - https://git.kernel.org/stable/c/58567ed2878f70e0ded242cb529fb4a7618ea9f8 - https://git.kernel.org/stable/c/ae4f11c1ed2d67192fdf3d89db719ee439827c11
CVE ID: CVE-2022-50124 State: PUBLISHED Published: 2025-06-18T11:02:52.451Z Last Updated: 2025-06-18T11:02:52.451Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ASoC: mt6797-mt6351: Fix refcount leak in mt6797_mt6351_dev_probe of_parse_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak. References: - https://git.kernel.org/stable/c/1042353bb67cd1c9109d7481ea182c7794336458 - https://git.kernel.org/stable/c/b488ceb2336905f071f80627bc8a7d657274e5de - https://git.kernel.org/stable/c/a0381a9f3e595988e83bac4c4dd1e45ed2b
/stable/c/b488ceb2336905f071f80627bc8a7d657274e5de - https://git.kernel.org/stable/c/a0381a9f3e595988e83bac4c4dd1e45ed2b3c744 - https://git.kernel.org/stable/c/7dee72b1bcecb26bfff8d6360f2169f8656dbaf6 - https://git.kernel.org/stable/c/67a28402a9e8c229c7588f214d81d52903ea06ea - https://git.kernel.org/stable/c/38dc6faef05f33b4c889be8b7d65878e465c1c4b - https://git.kernel.org/stable/c/7472eb8d7dd12b6b9b1a4f4527719cc9c7f5965f
CVE ID: CVE-2022-50125 State: PUBLISHED Published: 2025-06-18T11:02:53.046Z Last Updated: 2025-06-18T11:02:53.046Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ASoC: cros_ec_codec: Fix refcount leak in cros_ec_codec_platform_probe of_parse_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak. References: - https://git.kernel.org/stable/c/bae95c5aee1f67da6608ceaebfb744d900e5ffbf - https://git.kernel.org/stable/c/1065c385325845c88350c765cc6e449f46741984 - https://git.kernel.org/stable/c/b3e64b5562c077218295f2230fb5cf
l.org/stable/c/1065c385325845c88350c765cc6e449f46741984 - https://git.kernel.org/stable/c/b3e64b5562c077218295f2230fb5cf181193cb06 - https://git.kernel.org/stable/c/ca6c9244e6c9827a0b2fe8808c5e7b1ee8ab7104 - https://git.kernel.org/stable/c/0a034d93ee929a9ea89f3fa5f1d8492435b9ee6e
CVE ID: CVE-2022-50126 State: PUBLISHED Published: 2025-06-18T11:02:53.672Z Last Updated: 2025-06-18T11:02:53.672Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted Following process will fail assertion 'jh->b_frozen_data == NULL' in jbd2_journal_dirty_metadata(): jbd2_journal_commit_transaction unlink(dir/a) jh->b_transaction = trans1 jh->b_jlist = BJ_Metadata journal->j_running_transaction = NULL trans1->t_state = T_COMMIT unlink(dir/b) handle->h_trans = trans2 do_get_write_access jh->b_modified = 0 jh->b_frozen_data = frozen_buffer jh->b_next_transacti
) handle->h_trans = trans2 do_get_write_access jh->b_modified = 0 jh->b_frozen_data = frozen_buffer jh->b_next_transaction = trans2 jbd2_journal_dirty_metadata is_handle_aborted is_journal_aborted // return false --> jbd2 abort <-- while (commit_transaction->t_buffers) if (is_journal_aborted) jbd2_journal_refile_buffer __jbd2_journal_refile_buffer WRITE_ONCE(jh->b_transaction, jh->b_next_transaction) WRITE_ONCE(jh->b_next_transaction, NULL) __jbd2_journal_file_buffer(jh, BJ_Reserved) J_ASSERT_JH(jh, jh->b_frozen_data == NULL) // assertion failure ! The reproducer (See detail in [Link]) reports: ------------[ cut here ]------------ kernel BUG at fs/jbd2/transaction.c:1629! invalid opcode: 000
l in [Link]) reports: ------------[ cut here ]------------ kernel BUG at fs/jbd2/transaction.c:1629! invalid opcode: 0000 [#1] PREEMPT SMP CPU: 2 PID: 584 Comm: unlink Tainted: G W 5.19.0-rc6-00115-g4a57a8400075-dirty #697 RIP: 0010:jbd2_journal_dirty_metadata+0x3c5/0x470 RSP: 0018:ffffc90000be7ce0 EFLAGS: 00010202 Call Trace: <TASK> __ext4_handle_dirty_metadata+0xa0/0x290 ext4_handle_dirty_dirblock+0x10c/0x1d0 ext4_delete_entry+0x104/0x200 __ext4_unlink+0x22b/0x360 ext4_unlink+0x275/0x390 vfs_unlink+0x20b/0x4c0 do_unlinkat+0x42f/0x4c0 __x64_sys_unlink+0x37/0x50 do_syscall_64+0x35/0x80 After journal aborting, __jbd2_journal_refile_buffer() is executed with holding @jh->b_state_lock, we can f
64+0x35/0x80 After journal aborting, __jbd2_journal_refile_buffer() is executed with holding @jh->b_state_lock, we can fix it by moving 'is_handle_aborted()' into the area protected by @jh->b_state_lock. References: - https://git.kernel.org/stable/c/0f61c6dc4b714be9d79cf0782ca02ba01c1b7ac3 - https://git.kernel.org/stable/c/6073389db83b903678a0920554fa19f5bdc51c48 - https://git.kernel.org/stable/c/fa5b65d39332fef7a11ae99cb1f0696012a61527 - https://git.kernel.org/stable/c/f7161d0da975adc234161cd0641d0e484f5ce375 - https://git.kernel.org/stable/c/e62f79827784f56499a50ea2e893c98317b5407b - https://git.kernel.org/stable/c/731c1662d838fe954c6759e3ee43229b0d928fe4 - https://git.kernel.org/stable/c/
8317b5407b - https://git.kernel.org/stable/c/731c1662d838fe954c6759e3ee43229b0d928fe4 - https://git.kernel.org/stable/c/ddd896792e1718cb84c96f3e618270589b6886dc - https://git.kernel.org/stable/c/4a734f0869f970b8a9b65062ea40b09a5da9dba8
CVE ID: CVE-2022-50127 State: PUBLISHED Published: 2025-06-18T11:02:54.332Z Last Updated: 2025-06-18T11:02:54.332Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix error unwind in rxe_create_qp() In the function rxe_create_qp(), rxe_qp_from_init() is called to initialize qp, internally things like the spin locks are not setup until rxe_qp_init_req(). If an error occures before this point then the unwind will call rxe_cleanup() and eventually to rxe_qp_do_cleanup()/rxe_cleanup_task() which will oops when trying to access the uninitialized spinlock. Move the spinlock initializations earlier before any failures. Refere
when trying to access the uninitialized spinlock. Move the spinlock initializations earlier before any failures. References: - https://git.kernel.org/stable/c/3c838ca6fbdb173102780d7bdf18f2f7d9e30979 - https://git.kernel.org/stable/c/1a63f24e724f677db1ab21251f4d0011ae0bb5b5 - https://git.kernel.org/stable/c/b348e204a53103f51070513a7494da7c62ecbdaa - https://git.kernel.org/stable/c/3ef491b26c720a87fcfbd78b7dc8eb83d9753fe6 - https://git.kernel.org/stable/c/2ceeb04252e621c0b128ecc8fedbca922d11adba - https://git.kernel.org/stable/c/db924bd8484c76558a4ac4c4b5aeb52e857f0341 - https://git.kernel.org/stable/c/f05b7cf02123aaf99db78abfe638efefdbe15555 - https://git.kernel.org/stable/c/fd5382c5805c4bc
tps://git.kernel.org/stable/c/f05b7cf02123aaf99db78abfe638efefdbe15555 - https://git.kernel.org/stable/c/fd5382c5805c4bcb50fd25b7246247d3f7114733
CVE ID: CVE-2022-50128 State: REJECTED Published: 2025-06-18T11:02:54.953Z Last Updated: 2025-06-18T14:02:34.964Z Description: No description available.
CVE ID: CVE-2022-50129 State: PUBLISHED Published: 2025-06-18T11:02:55.576Z Last Updated: 2025-06-18T11:02:55.576Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: Fix a use-after-free Change the LIO port members inside struct srpt_port from regular members into pointers. Allocate the LIO port data structures from inside srpt_make_tport() and free these from inside srpt_make_tport(). Keep struct srpt_device as long as either an RDMA port or a LIO target port is associated with it. This patch decouples the lifetime of struct srpt_port (controlled by the RDMA core) and struct srpt_port_id (controlled by LIO). This patch
the lifetime of struct srpt_port (controlled by the RDMA core) and struct srpt_port_id (controlled by LIO). This patch fixes the following KASAN complaint: BUG: KASAN: use-after-free in srpt_enable_tpg+0x31/0x70 [ib_srpt] Read of size 8 at addr ffff888141cc34b8 by task check/5093 Call Trace: <TASK> show_stack+0x4e/0x53 dump_stack_lvl+0x51/0x66 print_address_description.constprop.0.cold+0xea/0x41e print_report.cold+0x90/0x205 kasan_report+0xb9/0xf0 __asan_load8+0x69/0x90 srpt_enable_tpg+0x31/0x70 [ib_srpt] target_fabric_tpg_base_enable_store+0xe2/0x140 [target_core_mod] configfs_write_iter+0x18b/0x210 new_sync_write+0x1f2/0x2f0 vfs_write+0x3e3/0x540 ksys_write+0xbb/0x140 __x64_sys_write+0x42
figfs_write_iter+0x18b/0x210 new_sync_write+0x1f2/0x2f0 vfs_write+0x3e3/0x540 ksys_write+0xbb/0x140 __x64_sys_write+0x42/0x50 do_syscall_64+0x34/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 </TASK> References: - https://git.kernel.org/stable/c/de95b52d9aabc979166aba81ccbe623aaf9c16a1 - https://git.kernel.org/stable/c/e60d7e2462bf57273563c4e00dbfa79ee973b9e2 - https://git.kernel.org/stable/c/4ee8c39968a648d58b273582d4b021044a41ee5e - https://git.kernel.org/stable/c/388326bb1c32fcd09371c1d494af71471ef3a04b - https://git.kernel.org/stable/c/b5605148e6ce36bb21020d49010b617693933128
CVE ID: CVE-2022-50130 State: PUBLISHED Published: 2025-06-18T11:02:56.209Z Last Updated: 2025-06-18T11:02:56.209Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: staging: fbtft: core: set smem_len before fb_deferred_io_init call The fbtft_framebuffer_alloc() calls fb_deferred_io_init() before initializing info->fix.smem_len. It is set to zero by the framebuffer_alloc() function. It will trigger a WARN_ON() at the start of fb_deferred_io_init() and the function will not do anything. References: - https://git.kernel.org/stable/c/4178bfa3fc9de556dfe248a6eabe29280f0ffda5 - https://git.kernel.org/stable/c/5185c319e8ea67657e0d3edd520
rnel.org/stable/c/4178bfa3fc9de556dfe248a6eabe29280f0ffda5 - https://git.kernel.org/stable/c/5185c319e8ea67657e0d3edd520a7276516c506a - https://git.kernel.org/stable/c/6ae6abe240306f878557d6eadd950a2e2561f59f - https://git.kernel.org/stable/c/81e878887ff82a7dd42f22951391069a5d520627
CVE ID: CVE-2022-50131 State: PUBLISHED Published: 2025-06-18T11:02:56.796Z Last Updated: 2025-06-18T11:02:56.796Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: prevent a buffer overflow in mcp_smbus_write() Smatch Warning: drivers/hid/hid-mcp2221.c:388 mcp_smbus_write() error: __memcpy() '&mcp->txbuf[5]' too small (59 vs 255) drivers/hid/hid-mcp2221.c:388 mcp_smbus_write() error: __memcpy() 'buf' too small (34 vs 255) The 'len' variable can take a value between 0-255 as it can come from data->block[0] and it is user data. So add an bound check to prevent a buffer overflow in memcpy(). References: - https://git.k
lock[0] and it is user data. So add an bound check to prevent a buffer overflow in memcpy(). References: - https://git.kernel.org/stable/c/66c8e816f2f2ca4a61b406503bd10bad1b35f72f - https://git.kernel.org/stable/c/91443c669d280937968f0aa4edefa741cfe35314 - https://git.kernel.org/stable/c/6402116a7b5ec80fa40fd145a80c813019cd555f - https://git.kernel.org/stable/c/3c0f8a59f2cc8841ee6653399a77f4f3e6e9a270 - https://git.kernel.org/stable/c/62ac2473553a00229e67bdf3cb023b62cf7f5a9a
CVE ID: CVE-2022-50132 State: PUBLISHED Published: 2025-06-18T11:02:57.498Z Last Updated: 2025-06-18T11:02:57.498Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: change place of 'priv_ep' assignment in cdns3_gadget_ep_dequeue(), cdns3_gadget_ep_enable() If 'ep' is NULL, result of ep_to_cdns3_ep(ep) is invalid pointer and its dereference with priv_ep->cdns3_dev may cause panic. Found by Linux Verification Center (linuxtesting.org) with SVACE. References: - https://git.kernel.org/stable/c/7af83bb516d7aa4f96835288e4aeda21d7aa2a17 - https://git.kernel.org/stable/c/bfa0201468587072454dba7933e4a4a7be44467a - https://git.k
7aa4f96835288e4aeda21d7aa2a17 - https://git.kernel.org/stable/c/bfa0201468587072454dba7933e4a4a7be44467a - https://git.kernel.org/stable/c/d342203df9f2d0851b4acd9ed577d73d10eade77 - https://git.kernel.org/stable/c/eb82c0382285ee17a9966aaab27b8becb08eb1ac - https://git.kernel.org/stable/c/c3ffc9c4ca44bfe9562166793d133e1fb0630ea6
CVE ID: CVE-2022-50133 State: PUBLISHED Published: 2025-06-18T11:02:58.170Z Last Updated: 2025-06-18T11:02:58.170Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: usb: xhci_plat_remove: avoid NULL dereference Since commit 4736ebd7fcaff1eb8481c140ba494962847d6e0a ("usb: host: xhci-plat: omit shared hcd if either root hub has no ports") xhci->shared_hcd can be NULL, which causes the following Oops on reboot: [ 710.124450] systemd-shutdown[1]: Rebooting. [ 710.298861] xhci-hcd xhci-hcd.2.auto: remove, state 4 [ 710.304217] usb usb3: USB disconnect, device number 1 [ 710.317441] xhci-hcd xhci-hcd.2.auto: USB bus 3 deregistered [ 710
0.304217] usb usb3: USB disconnect, device number 1 [ 710.317441] xhci-hcd xhci-hcd.2.auto: USB bus 3 deregistered [ 710.323280] xhci-hcd xhci-hcd.2.auto: remove, state 1 [ 710.328401] usb usb2: USB disconnect, device number 1 [ 710.333515] usb 2-3: USB disconnect, device number 2 [ 710.467649] xhci-hcd xhci-hcd.2.auto: USB bus 2 deregistered [ 710.475450] Unable to handle kernel NULL pointer dereference at virtual address 00000000000003b8 [ 710.484425] Mem abort info: [ 710.487265] ESR = 0x0000000096000004 [ 710.491060] EC = 0x25: DABT (current EL), IL = 32 bits [ 710.496427] SET = 0, FnV = 0 [ 710.499525] EA = 0, S1PTW = 0 [ 710.502716] FSC = 0x04: level 0 translation fault [ 710.507648] D
27] SET = 0, FnV = 0 [ 710.499525] EA = 0, S1PTW = 0 [ 710.502716] FSC = 0x04: level 0 translation fault [ 710.507648] Data abort info: [ 710.510577] ISV = 0, ISS = 0x00000004 [ 710.514462] CM = 0, WnR = 0 [ 710.517480] user pgtable: 4k pages, 48-bit VAs, pgdp=00000008b0050000 [ 710.523976] [00000000000003b8] pgd=0000000000000000, p4d=0000000000000000 [ 710.530961] Internal error: Oops: 96000004 [#1] PREEMPT SMP [ 710.536551] Modules linked in: rfkill input_leds snd_soc_simple_card snd_soc_simple_card_utils snd_soc_nau8822 designware_i2s snd_soc_core dw_hdmi_ahb_audio snd_pcm_dmaengine arm_ccn panfrost ac97_bus gpu_sched snd_pcm at24 fuse configfs sdhci_of_dwcmshc sdhci_pltfm sdhci nvme led_
cm_dmaengine arm_ccn panfrost ac97_bus gpu_sched snd_pcm at24 fuse configfs sdhci_of_dwcmshc sdhci_pltfm sdhci nvme led_class mmc_core nvme_core bt1_pvt polynomial tp_serio snd_seq_midi snd_seq_midi_event snd_seq snd_timer snd_rawmidi snd_seq_device snd soundcore efivarfs ipv6 [ 710.575286] CPU: 7 PID: 1 Comm: systemd-shutdow Not tainted 5.19.0-rc7-00043-gfd8619f4fd54 #1 [ 710.583822] Hardware name: T-Platforms TF307-MB/BM1BM1-A, BIOS 5.6 07/06/2022 [ 710.590972] pstate: 40000005 (nZcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 710.597949] pc : usb_remove_hcd+0x34/0x1e4 [ 710.602067] lr : xhci_plat_remove+0x74/0x140 [ 710.606351] sp : ffff800009f3b7c0 [ 710.609674] x29: ffff800009f3b7c0 x28:
10.602067] lr : xhci_plat_remove+0x74/0x140 [ 710.606351] sp : ffff800009f3b7c0 [ 710.609674] x29: ffff800009f3b7c0 x28: ffff000800960040 x27: 0000000000000000 [ 710.616833] x26: ffff800008dc22a0 x25: 0000000000000000 x24: 0000000000000000 [ 710.623992] x23: 0000000000000000 x22: ffff000805465810 x21: ffff000805465800 [ 710.631149] x20: ffff000800f80000 x19: 0000000000000000 x18: ffffffffffffffff [ 710.638307] x17: ffff000805096000 x16: ffff00080633b800 x15: ffff000806537a1c [ 710.645465] x14: 0000000000000001 x13: 0000000000000000 x12: ffff00080378d6f0 [ 710.652621] x11: ffff00080041a900 x10: ffff800009b204e8 x9 : ffff8000088abaa4 [ 710.659779] x8 : ffff000800960040 x7 : ffff800009409000 x6
fff00080041a900 x10: ffff800009b204e8 x9 : ffff8000088abaa4 [ 710.659779] x8 : ffff000800960040 x7 : ffff800009409000 x6 : 0000000000000001 [ 710.666936] x5 : ffff800009241000 x4 : ffff800009241440 x3 : 0000000000000000 [ 710.674094] x2 : ffff000800960040 x1 : ffff000800960040 x0 : 0000000000000000 [ 710.681251] Call trace: [ 710.683704] usb_remove_hcd+0x34/0x1e4 [ 710.687467] xhci_plat_remove+0x74/0x140 [ 710.691400] platform_remove+0x34/0x70 [ 710.695165] device_remove+0x54/0x90 [ 710.698753] device_release_driver_internal+0x200/0x270 [ 710.703992] device_release_driver+0x24/0x30 [ 710.708273] bus_remove_device+0xe0/0x16c [ 710.712293] device_del+0x178/0x390 [ 710.715797] platform_device_d
x24/0x30 [ 710.708273] bus_remove_device+0xe0/0x16c [ 710.712293] device_del+0x178/0x390 [ 710.715797] platform_device_del.part.0+0x24/0x90 [ 710.720514] platform_device_unregister+0x30/0x50 [ 710.725232] dwc3_host_exit+0x20/0x30 [ 710.728907] dwc3_remove+0x174/0x1b0 [ 710.732494] platform_remove+0x34/0x70 [ 710.736254] device_remove+0x54/0x90 [ 710.739840] device_release_driver_internal+0x200/0x270 [ 710.745078] device_release_driver+0x24/0x30 [ 710.749359] bus_remove_device+0xe0/0x16c [ 710.753380] device_del+0x178/0x390 [ 710.756881] platform_device_del.part ---truncated--- References: - https://git.kernel.org/stable/c/371a8af4f26e06b4d51d893b4436f520b48d07fd - https://git.kernel.org/stab
--- References: - https://git.kernel.org/stable/c/371a8af4f26e06b4d51d893b4436f520b48d07fd - https://git.kernel.org/stable/c/d7de14d74d6551f0d097430f9893ce82ad17e5b8
CVE ID: CVE-2022-50134 State: PUBLISHED Published: 2025-06-18T11:02:58.820Z Last Updated: 2025-06-18T11:02:58.820Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: fix potential memory leak in setup_base_ctxt() setup_base_ctxt() allocates a memory chunk for uctxt->groups with hfi1_alloc_ctxt_rcv_groups(). When init_user_ctxt() fails, uctxt->groups is not released, which will lead to a memory leak. We should release the uctxt->groups with hfi1_free_ctxt_rcv_groups() when init_user_ctxt() fails. References: - https://git.kernel.org/stable/c/fc4de8009fd6c2ca51986c6757efa964040e7d02 - https://git.kernel.org/stable/c/90ef48
ces: - https://git.kernel.org/stable/c/fc4de8009fd6c2ca51986c6757efa964040e7d02 - https://git.kernel.org/stable/c/90ef48a718f88935d4af53d7dadd1ceafe103ce6 - https://git.kernel.org/stable/c/2f90813f1c21c3d780585390af961bd17c8515ae - https://git.kernel.org/stable/c/a85c7dd1edadcdeca24e603a6618153a3bcc81ca - https://git.kernel.org/stable/c/e25b828553aecb3185a8d8d0c4f9b4e133fb5db6 - https://git.kernel.org/stable/c/1750be1e9f18787cf717c24dbc5fa029fc372a22 - https://git.kernel.org/stable/c/a9055dfe437efae77e28e57205437c878a03ccb7 - https://git.kernel.org/stable/c/aa2a1df3a2c85f855af7d54466ac10bd48645d63
CVE ID: CVE-2022-50135 State: PUBLISHED Published: 2025-06-18T11:02:59.440Z Last Updated: 2025-06-18T11:02:59.440Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix BUG: KASAN: null-ptr-deref in rxe_qp_do_cleanup The function rxe_create_qp calls rxe_qp_from_init. If some error occurs, the error handler of function rxe_qp_from_init will set both scq and rcq to NULL. Then rxe_create_qp calls rxe_put to handle qp. In the end, rxe_qp_do_cleanup is called by rxe_put. rxe_qp_do_cleanup directly accesses scq and rcq before checking them. This will cause null-ptr-deref error. The call graph is as below: rxe_create_qp { ... r
cq and rcq before checking them. This will cause null-ptr-deref error. The call graph is as below: rxe_create_qp { ... rxe_qp_from_init { ... err1: ... qp->rcq = NULL; <---rcq is set to NULL qp->scq = NULL; <---scq is set to NULL ... } qp_init: rxe_put{ ... rxe_qp_do_cleanup { ... atomic_dec(&qp->scq->num_wq); <--- scq is accessed ... atomic_dec(&qp->rcq->num_wq); <--- rcq is accessed } } References: - https://git.kernel.org/stable/c/8598b9d0a364c1663c96fc0fab9df0d36c809aea - https://git.kernel.org/stable/c/37da51efe6eaa0560f46803c8c436a48a2084da7
CVE ID: CVE-2022-50136 State: PUBLISHED Published: 2025-06-18T11:03:00.289Z Last Updated: 2025-06-18T11:03:00.289Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix duplicated reported IW_CM_EVENT_CONNECT_REPLY event If siw_recv_mpa_rr returns -EAGAIN, it means that the MPA reply hasn't been received completely, and should not report IW_CM_EVENT_CONNECT_REPLY in this case. This may trigger a call trace in iw_cm. A simple way to trigger this: server: ib_send_lat client: ib_send_lat -R <server_ip> The call trace looks like this: kernel BUG at drivers/infiniband/core/iwcm.c:894! invalid opcode: 0000 [#1] PREEMPT SMP NOP
call trace looks like this: kernel BUG at drivers/infiniband/core/iwcm.c:894! invalid opcode: 0000 [#1] PREEMPT SMP NOPTI <...> Workqueue: iw_cm_wq cm_work_handler [iw_cm] Call Trace: <TASK> cm_work_handler+0x1dd/0x370 [iw_cm] process_one_work+0x1e2/0x3b0 worker_thread+0x49/0x2e0 ? rescuer_thread+0x370/0x370 kthread+0xe5/0x110 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x1f/0x30 </TASK> References: - https://git.kernel.org/stable/c/11edf0bba15ea9df49478affec7974f351bb2f6e - https://git.kernel.org/stable/c/9ade92ddaf2347fb34298c02080caaa3cdd7c27b - https://git.kernel.org/stable/c/f6e26e1a5f600b760dc32135d3fac846eabe09e7 - https://git.kernel.org/stable/c/0066246d2d7e2619f3ecf3cf07333
el.org/stable/c/f6e26e1a5f600b760dc32135d3fac846eabe09e7 - https://git.kernel.org/stable/c/0066246d2d7e2619f3ecf3cf07333c59e6e7d84d - https://git.kernel.org/stable/c/1434de50a5d9dab91c8ce031bc23b3e2178379c5 - https://git.kernel.org/stable/c/3056fc6c32e613b760422b94c7617ac9a24a4721
CVE ID: CVE-2022-50137 State: PUBLISHED Published: 2025-06-18T11:03:00.899Z Last Updated: 2025-06-18T11:03:00.899Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix a window for use-after-free During a destroy CQ an interrupt may cause processing of a CQE after CQ resources are freed by irdma_cq_free_rsrc(). Fix this by moving the call to irdma_cq_free_rsrc() after the irdma_sc_cleanup_ceqes(), which is called under the cq_lock. References: - https://git.kernel.org/stable/c/92520864ef9f912f38b403d172a0ded020683d55 - https://git.kernel.org/stable/c/0abf2eef80295923b819ce89ff9edc1fe61be17c - https://git.kernel.org/st
172a0ded020683d55 - https://git.kernel.org/stable/c/0abf2eef80295923b819ce89ff9edc1fe61be17c - https://git.kernel.org/stable/c/350ac793a03c8a30a3f2b27fc282cd1c67070763 - https://git.kernel.org/stable/c/8ecef7890b3aea78c8bbb501a4b5b8134367b821
CVE ID: CVE-2022-50138 State: PUBLISHED Published: 2025-06-18T11:03:01.557Z Last Updated: 2025-06-18T11:03:01.557Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: RDMA/qedr: Fix potential memory leak in __qedr_alloc_mr() __qedr_alloc_mr() allocates a memory chunk for "mr->info.pbl_table" with init_mr_info(). When rdma_alloc_tid() and rdma_register_tid() fail, "mr" is released while "mr->info.pbl_table" is not released, which will lead to a memory leak. We should release the "mr->info.pbl_table" with qedr_free_pbl() when error occurs to fix the memory leak. References: - https://git.kernel.org/stable/c/79ce50dddaf28b5c57911ecc80a