Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-50094 State: PUBLISHED Published: 2025-06-18T11:02:32.591Z Last Updated: 2025-06-18T11:02:32.591Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: spmi: trace: fix stack-out-of-bound access in SPMI tracing functions trace_spmi_write_begin() and trace_spmi_read_end() both call memcpy() with a length of "len + 1". This leads to one extra byte being read beyond the end of the specified buffer. Fix this out-of-bound memory access by using a length of "len" instead. Here is a KASAN log showing the issue: BUG: KASAN: stack-out-of-bounds in trace_event_raw_event_spmi_read_end+0x1d0/0x234 Read of size 2 at addr ffffffc02
sue: BUG: KASAN: stack-out-of-bounds in trace_event_raw_event_spmi_read_end+0x1d0/0x234 Read of size 2 at addr ffffffc0265b7540 by task thermal@2.0-ser/1314 ... Call trace: dump_backtrace+0x0/0x3e8 show_stack+0x2c/0x3c dump_stack_lvl+0xdc/0x11c print_address_description+0x74/0x384 kasan_report+0x188/0x268 kasan_check_range+0x270/0x2b0 memcpy+0x90/0xe8 trace_event_raw_event_spmi_read_end+0x1d0/0x234 spmi_read_cmd+0x294/0x3ac spmi_ext_register_readl+0x84/0x9c regmap_spmi_ext_read+0x144/0x1b0 [regmap_spmi] _regmap_raw_read+0x40c/0x754 regmap_raw_read+0x3a0/0x514 regmap_bulk_read+0x418/0x494 adc5_gen3_poll_wait_hs+0xe8/0x1e0 [qcom_spmi_adc5_gen3] ... __arm64_sys_read+0x4c/0x60 invoke_syscall+0x8
ad+0x418/0x494 adc5_gen3_poll_wait_hs+0xe8/0x1e0 [qcom_spmi_adc5_gen3] ... __arm64_sys_read+0x4c/0x60 invoke_syscall+0x80/0x218 el0_svc_common+0xec/0x1c8 ... addr ffffffc0265b7540 is located in stack of task thermal@2.0-ser/1314 at offset 32 in frame: adc5_gen3_poll_wait_hs+0x0/0x1e0 [qcom_spmi_adc5_gen3] this frame has 1 object: [32, 33) 'status' Memory state around the buggy address: ffffffc0265b7400: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 ffffffc0265b7480: 04 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 >ffffffc0265b7500: 00 00 00 00 f1 f1 f1 f1 01 f3 f3 f3 00 00 00 00 ^ ffffffc0265b7580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffffffc0265b7600: f1 f1 f1 f1 01 f2 07 f2 f2
0 00 00 ^ ffffffc0265b7580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffffffc0265b7600: f1 f1 f1 f1 01 f2 07 f2 f2 f2 01 f3 00 00 00 00 ================================================================== References: - https://git.kernel.org/stable/c/80f7c93e573ea9f524924bb529c2af8cb28b1c43 - https://git.kernel.org/stable/c/dc6033a7761254e5a5ba7df36b64db787a53313c - https://git.kernel.org/stable/c/ac730c72bddc889f5610d51d8a7abf425e08da1a - https://git.kernel.org/stable/c/37690cb8662cec672cacda19e6e4fd2ca7b13f0b - https://git.kernel.org/stable/c/dd02510fb43168310abfd0b9ccf49993a722fb91 - https://git.kernel.org/stable/c/1e0ca3d809c36ad3d1f542917718fc22ec6316e7 - https://git.kernel.org/stab
cf49993a722fb91 - https://git.kernel.org/stable/c/1e0ca3d809c36ad3d1f542917718fc22ec6316e7 - https://git.kernel.org/stable/c/bcc1b6b1ed3f42ed25858c1f1eb24a2f741db93f - https://git.kernel.org/stable/c/504090815c1ad3fd3fa34618b54d706727f8911c - https://git.kernel.org/stable/c/2af28b241eea816e6f7668d1954f15894b45d7e3
CVE ID: CVE-2022-50095 State: PUBLISHED Published: 2025-06-18T11:02:33.221Z Last Updated: 2025-06-18T11:02:33.221Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Cleanup CPU timers before freeing them during exec Commit 55e8c8eb2c7b ("posix-cpu-timers: Store a reference to a pid not a task") started looking up tasks by PID when deleting a CPU timer. When a non-leader thread calls execve, it will switch PIDs with the leader process. Then, as it calls exit_itimers, posix_cpu_timer_del cannot find the task because the timer still points out to the old PID. That means that armed timers won't be disarmed, that is,
nd the task because the timer still points out to the old PID. That means that armed timers won't be disarmed, that is, they won't be removed from the timerqueue_list. exit_itimers will still release their memory, and when that list is later processed, it leads to a use-after-free. Clean up the timers from the de-threaded task before freeing them. This prevents a reported use-after-free. References: - https://git.kernel.org/stable/c/541840859ace9c2ccebc32fa9e376c7bd3def490 - https://git.kernel.org/stable/c/9e255ed238fc67058df87b0388ad6d4b2ef3a2bd - https://git.kernel.org/stable/c/e8cb6e8fd9890780f1bfcf5592889e1b879e779c - https://git.kernel.org/stable/c/b2fc1723eb65abb83e00d5f011de670296af0b
able/c/e8cb6e8fd9890780f1bfcf5592889e1b879e779c - https://git.kernel.org/stable/c/b2fc1723eb65abb83e00d5f011de670296af0b28 - https://git.kernel.org/stable/c/e362359ace6f87c201531872486ff295df306d13
CVE ID: CVE-2022-50096 State: PUBLISHED Published: 2025-06-18T11:02:33.958Z Last Updated: 2025-06-18T11:02:33.958Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: x86/kprobes: Update kcb status flag after singlestepping Fix kprobes to update kcb (kprobes control block) status flag to KPROBE_HIT_SSDONE even if the kp->post_handler is not set. This bug may cause a kernel panic if another INT3 user runs right after kprobes because kprobe_int3_handler() misunderstands the INT3 is kprobe's single stepping INT3. References: - https://git.kernel.org/stable/c/edc2ac7c7265b33660fa0190898966b49966b855 - https://git.kernel.org/stable/c/1cb
rences: - https://git.kernel.org/stable/c/edc2ac7c7265b33660fa0190898966b49966b855 - https://git.kernel.org/stable/c/1cbf3882cb372bbe752efd7c3045ca1c9ab40ac6 - https://git.kernel.org/stable/c/b9c3401f7cac6ae291a16784dadcd1bf116218fe - https://git.kernel.org/stable/c/663cdda2716b70751df9c7e60b81bd0850fdfe3c - https://git.kernel.org/stable/c/dec8784c9088b131a1523f582c2194cfc8107dc0
CVE ID: CVE-2022-50097 State: PUBLISHED Published: 2025-06-18T11:02:34.589Z Last Updated: 2025-06-18T11:02:34.589Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: video: fbdev: s3fb: Check the size of screen before memset_io() In the function s3fb_set_par(), the value of 'screen_size' is calculated by the user input. If the user provides the improper value, the value of 'screen_size' may larger than 'info->screen_size', which may cause the following bug: [ 54.083733] BUG: unable to handle page fault for address: ffffc90003000000 [ 54.083742] #PF: supervisor write access in kernel mode [ 54.083744] #PF: error_code(0x0002) - not-p
: ffffc90003000000 [ 54.083742] #PF: supervisor write access in kernel mode [ 54.083744] #PF: error_code(0x0002) - not-present page [ 54.083760] RIP: 0010:memset_orig+0x33/0xb0 [ 54.083782] Call Trace: [ 54.083788] s3fb_set_par+0x1ec6/0x4040 [ 54.083806] fb_set_var+0x604/0xeb0 [ 54.083836] do_fb_ioctl+0x234/0x670 Fix the this by checking the value of 'screen_size' before memset_io(). References: - https://git.kernel.org/stable/c/574912261528589012b61f82d368256247c3a5a8 - https://git.kernel.org/stable/c/3c35a0dc2b4e7acf24c796043b64fa3eee799239 - https://git.kernel.org/stable/c/eacb50f1733660911827d7c3720f4c5425d0cdda - https://git.kernel.org/stable/c/5e0da18956d38e7106664dc1d06367b22f06edd3 -
/c/eacb50f1733660911827d7c3720f4c5425d0cdda - https://git.kernel.org/stable/c/5e0da18956d38e7106664dc1d06367b22f06edd3 - https://git.kernel.org/stable/c/ce50d94afcb8690813c5522f24cd38737657db81 - https://git.kernel.org/stable/c/52461d387cc8c8f8dc40320caa2e9e101f73e7ba - https://git.kernel.org/stable/c/e2d7cacc6a2a1d77e7e20a492daf458a12cf19e0 - https://git.kernel.org/stable/c/6ba592fa014f21f35a8ee8da4ca7b95a018f13e8
CVE ID: CVE-2022-50098 State: PUBLISHED Published: 2025-06-18T11:02:35.225Z Last Updated: 2025-06-18T11:02:35.225Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix crash due to stale SRB access around I/O timeouts Ensure SRB is returned during I/O timeout error escalation. If that is not possible fail the escalation path. Following crash stack was seen: BUG: unable to handle kernel paging request at 0000002f56aa90f8 IP: qla_chk_edif_rx_sa_delete_pending+0x14/0x30 [qla2xxx] Call Trace: ? qla2x00_status_entry+0x19f/0x1c50 [qla2xxx] ? qla2x00_start_sp+0x116/0x1170 [qla2xxx] ? dma_pool_alloc+0x1d6/0x210 ? mempool_a
0_status_entry+0x19f/0x1c50 [qla2xxx] ? qla2x00_start_sp+0x116/0x1170 [qla2xxx] ? dma_pool_alloc+0x1d6/0x210 ? mempool_alloc+0x54/0x130 ? qla24xx_process_response_queue+0x548/0x12b0 [qla2xxx] ? qla_do_work+0x2d/0x40 [qla2xxx] ? process_one_work+0x14c/0x390 References: - https://git.kernel.org/stable/c/b7bae3886a30d258b5b4fee26647043d68da3661 - https://git.kernel.org/stable/c/b70553175d0f94ebd73670bc16ade90bd7f7d76f - https://git.kernel.org/stable/c/7dcd49c42b14717dd668fd73b503d241fdf82439 - https://git.kernel.org/stable/c/c39587bc0abaf16593f7abcdf8aeec3c038c7d52
CVE ID: CVE-2022-50099 State: PUBLISHED Published: 2025-06-18T11:02:36.018Z Last Updated: 2025-06-18T11:02:36.018Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: video: fbdev: arkfb: Check the size of screen before memset_io() In the function arkfb_set_par(), the value of 'screen_size' is calculated by the user input. If the user provides the improper value, the value of 'screen_size' may larger than 'info->screen_size', which may cause the following bug: [ 659.399066] BUG: unable to handle page fault for address: ffffc90003000000 [ 659.399077] #PF: supervisor write access in kernel mode [ 659.399079] #PF: error_code(0x0002) -
ess: ffffc90003000000 [ 659.399077] #PF: supervisor write access in kernel mode [ 659.399079] #PF: error_code(0x0002) - not-present page [ 659.399094] RIP: 0010:memset_orig+0x33/0xb0 [ 659.399116] Call Trace: [ 659.399122] arkfb_set_par+0x143f/0x24c0 [ 659.399130] fb_set_var+0x604/0xeb0 [ 659.399161] do_fb_ioctl+0x234/0x670 [ 659.399189] fb_ioctl+0xdd/0x130 Fix the this by checking the value of 'screen_size' before memset_io(). References: - https://git.kernel.org/stable/c/4a20c5510aa2c031a096a58deb356e91609781c9 - https://git.kernel.org/stable/c/352305ea50d682b8e081d826da53caf9e744d7d0 - https://git.kernel.org/stable/c/53198b81930e567ad6b879812d88052a1e8ac79e - https://git.kernel.org/stable
3caf9e744d7d0 - https://git.kernel.org/stable/c/53198b81930e567ad6b879812d88052a1e8ac79e - https://git.kernel.org/stable/c/09e733d6ac948e6fda4b16252e44ea46f98fc8b4 - https://git.kernel.org/stable/c/0701df594bc1d7ae55fed407fb65dd90a93f8a9c - https://git.kernel.org/stable/c/8bcb1a06e3091716b7cbebe0e91d1de9895068cd - https://git.kernel.org/stable/c/2ce61c39c2a0b8ec82f48e0f7136f0dac105ae75 - https://git.kernel.org/stable/c/96b550971c65d54d64728d8ba973487878a06454
CVE ID: CVE-2022-50100 State: PUBLISHED Published: 2025-06-18T11:02:36.629Z Last Updated: 2025-06-18T11:02:36.629Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: sched/core: Do not requeue task on CPU excluded from cpus_mask The following warning was triggered on a large machine early in boot on a distribution kernel but the same problem should also affect mainline. WARNING: CPU: 439 PID: 10 at ../kernel/workqueue.c:2231 process_one_work+0x4d/0x440 Call Trace: <TASK> rescuer_thread+0x1f6/0x360 kthread+0x156/0x180 ret_from_fork+0x22/0x30 </TASK> Commit c6e7bd7afaeb ("sched/core: Optimize ttwu() spinning on p->on_cpu") optimises
180 ret_from_fork+0x22/0x30 </TASK> Commit c6e7bd7afaeb ("sched/core: Optimize ttwu() spinning on p->on_cpu") optimises ttwu by queueing a task that is descheduling on the wakelist, but does not check if the task descheduling is still allowed to run on that CPU. In this warning, the problematic task is a workqueue rescue thread which checks if the rescue is for a per-cpu workqueue and running on the wrong CPU. While this is early in boot and it should be possible to create workers, the rescue thread may still used if the MAYDAY_INITIAL_TIMEOUT is reached or MAYDAY_INTERVAL and on a sufficiently large machine, the rescue thread is being used frequently. Tracing confirmed that the task should
and on a sufficiently large machine, the rescue thread is being used frequently. Tracing confirmed that the task should have migrated properly using the stopper thread to handle the migration. However, a parallel wakeup from udev running on another CPU that does not share CPU cache observes p->on_cpu and uses task_cpu(p), queues the task on the old CPU and triggers the warning. Check that the wakee task that is descheduling is still allowed to run on its current CPU and if not, wait for the descheduling to complete and select an allowed CPU. References: - https://git.kernel.org/stable/c/748d2e9585ae53cb6be48e84f93d2f082ae1d135 - https://git.kernel.org/stable/c/fde45283f4c8a91c367ea5f20f87036
.org/stable/c/748d2e9585ae53cb6be48e84f93d2f082ae1d135 - https://git.kernel.org/stable/c/fde45283f4c8a91c367ea5f20f87036468755121 - https://git.kernel.org/stable/c/302f7b0fc337746f41c69eb08522907f6a90c643 - https://git.kernel.org/stable/c/751d4cbc43879229dbc124afefe240b70fd29a85
CVE ID: CVE-2022-50101 State: PUBLISHED Published: 2025-06-18T11:02:37.297Z Last Updated: 2025-06-18T11:02:37.297Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: video: fbdev: vt8623fb: Check the size of screen before memset_io() In the function vt8623fb_set_par(), the value of 'screen_size' is calculated by the user input. If the user provides the improper value, the value of 'screen_size' may larger than 'info->screen_size', which may cause the following bug: [ 583.339036] BUG: unable to handle page fault for address: ffffc90005000000 [ 583.339049] #PF: supervisor write access in kernel mode [ 583.339052] #PF: error_code(0x00
r address: ffffc90005000000 [ 583.339049] #PF: supervisor write access in kernel mode [ 583.339052] #PF: error_code(0x0002) - not-present page [ 583.339074] RIP: 0010:memset_orig+0x33/0xb0 [ 583.339110] Call Trace: [ 583.339118] vt8623fb_set_par+0x11cd/0x21e0 [ 583.339146] fb_set_var+0x604/0xeb0 [ 583.339181] do_fb_ioctl+0x234/0x670 [ 583.339209] fb_ioctl+0xdd/0x130 Fix the this by checking the value of 'screen_size' before memset_io(). References: - https://git.kernel.org/stable/c/73280a184aa2e1a625ce54ce761042955cc79cd0 - https://git.kernel.org/stable/c/52ad9bfeb8a0e62de30de6d39e8a49a72dd78150 - https://git.kernel.org/stable/c/d71528ccdc7ae8d7500d414091d27805c51407a2 - https://git.kernel.o
0de6d39e8a49a72dd78150 - https://git.kernel.org/stable/c/d71528ccdc7ae8d7500d414091d27805c51407a2 - https://git.kernel.org/stable/c/bd8269e57621e5b38cc0b4bd2fa02e85c9f2a441 - https://git.kernel.org/stable/c/4a3cef1eaced13ba9b55381d46bfad937a3dac2c - https://git.kernel.org/stable/c/b17caec5127bba6f90af92bcc85871df54548ac0 - https://git.kernel.org/stable/c/c7a3f41e4b133d4dd25bc996b69039b19a34d69d - https://git.kernel.org/stable/c/ec0754c60217248fa77cc9005d66b2b55200ac06
CVE ID: CVE-2022-50102 State: PUBLISHED Published: 2025-06-18T11:02:38.099Z Last Updated: 2025-06-18T11:02:38.099Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: video: fbdev: arkfb: Fix a divide-by-zero bug in ark_set_pixclock() Since the user can control the arguments of the ioctl() from the user space, under special arguments that may result in a divide-by-zero bug in: drivers/video/fbdev/arkfb.c:784: ark_set_pixclock(info, (hdiv * info->var.pixclock) / hmul); with hdiv=1, pixclock=1 and hmul=2 you end up with (1*1)/2 = (int) 0. and then in: drivers/video/fbdev/arkfb.c:504: rv = dac_set_freq(par->dac, 0, 1000000000 / pixcloc
ith (1*1)/2 = (int) 0. and then in: drivers/video/fbdev/arkfb.c:504: rv = dac_set_freq(par->dac, 0, 1000000000 / pixclock); we'll get a division-by-zero. The following log can reveal it: divide error: 0000 [#1] PREEMPT SMP KASAN PTI RIP: 0010:ark_set_pixclock drivers/video/fbdev/arkfb.c:504 [inline] RIP: 0010:arkfb_set_par+0x10fc/0x24c0 drivers/video/fbdev/arkfb.c:784 Call Trace: fb_set_var+0x604/0xeb0 drivers/video/fbdev/core/fbmem.c:1034 do_fb_ioctl+0x234/0x670 drivers/video/fbdev/core/fbmem.c:1110 fb_ioctl+0xdd/0x130 drivers/video/fbdev/core/fbmem.c:1189 Fix this by checking the argument of ark_set_pixclock() first. References: - https://git.kernel.org/stable/c/76b3f0a0b56e53a960a14624a0f
king the argument of ark_set_pixclock() first. References: - https://git.kernel.org/stable/c/76b3f0a0b56e53a960a14624a0f48b3d94b5e7e7 - https://git.kernel.org/stable/c/b9a66f23612b84617e04412169e155a4b92f632d - https://git.kernel.org/stable/c/a249e1b89ca25e1c34bdf96154e3f6224a91a9af - https://git.kernel.org/stable/c/0288fa799e273b08839037499d704dc7bdc13e9a - https://git.kernel.org/stable/c/236c1502520b7b08955467ec2e50b3232e34f1f9 - https://git.kernel.org/stable/c/9ebc5031958c1f3a2795e4533b4091d77c738d14 - https://git.kernel.org/stable/c/15661642511b2b192077684a89f42a8d95d54286 - https://git.kernel.org/stable/c/2f1c4523f7a3aaabe7e53d3ebd378292947e95c8
CVE ID: CVE-2022-50103 State: PUBLISHED Published: 2025-06-18T11:02:38.840Z Last Updated: 2025-06-18T11:02:38.840Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed With cgroup v2, the cpuset's cpus_allowed mask can be empty indicating that the cpuset will just use the effective CPUs of its parent. So cpuset_can_attach() can call task_can_attach() with an empty mask. This can lead to cpumask_any_and() returns nr_cpu_ids causing the call to dl_bw_of() to crash due to percpu value access of an out of bound CPU value. For example: [80468.182258] BUG: unable to handl
_of() to crash due to percpu value access of an out of bound CPU value. For example: [80468.182258] BUG: unable to handle page fault for address: ffffffff8b6648b0 : [80468.191019] RIP: 0010:dl_cpu_busy+0x30/0x2b0 : [80468.207946] Call Trace: [80468.208947] cpuset_can_attach+0xa0/0x140 [80468.209953] cgroup_migrate_execute+0x8c/0x490 [80468.210931] cgroup_update_dfl_csses+0x254/0x270 [80468.211898] cgroup_subtree_control_write+0x322/0x400 [80468.212854] kernfs_fop_write_iter+0x11c/0x1b0 [80468.213777] new_sync_write+0x11f/0x1b0 [80468.214689] vfs_write+0x1eb/0x280 [80468.215592] ksys_write+0x5f/0xe0 [80468.216463] do_syscall_64+0x5c/0x80 [80468.224287] entry_SYSCALL_64_after_hwframe+0x44/0xae
592] ksys_write+0x5f/0xe0 [80468.216463] do_syscall_64+0x5c/0x80 [80468.224287] entry_SYSCALL_64_after_hwframe+0x44/0xae Fix that by using effective_cpus instead. For cgroup v1, effective_cpus is the same as cpus_allowed. For v2, effective_cpus is the real cpumask to be used by tasks within the cpuset anyway. Also update task_can_attach()'s 2nd argument name to cs_effective_cpus to reflect the change. In addition, a check is added to task_can_attach() to guard against the possibility that cpumask_any_and() may return a value >= nr_cpu_ids. References: - https://git.kernel.org/stable/c/336626564b58071b8980a4e6a31a8f5d92705d9b - https://git.kernel.org/stable/c/147f66d22f58712dce7ccdd6a1f6cb3ee
rg/stable/c/336626564b58071b8980a4e6a31a8f5d92705d9b - https://git.kernel.org/stable/c/147f66d22f58712dce7ccdd6a1f6cb3ee8042df4 - https://git.kernel.org/stable/c/357f3f0e522a6ce1ce4a571cb780d9861d53bec7 - https://git.kernel.org/stable/c/f56607b44c9896e51678a7e8cdd3a5479f4b4548 - https://git.kernel.org/stable/c/b6e8d40d43ae4dec00c8fea2593eeea3114b8f44
CVE ID: CVE-2022-50104 State: PUBLISHED Published: 2025-06-18T11:02:39.443Z Last Updated: 2025-06-18T11:02:39.443Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: powerpc/xive: Fix refcount leak in xive_get_max_prio of_find_node_by_path() returns a node pointer with refcount incremented, we should use of_node_put() on it when done. Add missing of_node_put() to avoid refcount leak. References: - https://git.kernel.org/stable/c/5ed9709d262bf026b2ff64979fbfe0f496287588 - https://git.kernel.org/stable/c/f658d5b528ce97a68efbb64ee54f6fe0909b189a - https://git.kernel.org/stable/c/d99733ad47a6c990b52e136608455643bfa708f2 - https://git.k
e97a68efbb64ee54f6fe0909b189a - https://git.kernel.org/stable/c/d99733ad47a6c990b52e136608455643bfa708f2 - https://git.kernel.org/stable/c/6d1e53f7f181a11a8a343def1e0d0209905b7c64 - https://git.kernel.org/stable/c/ea494e8a9852abd0ba60f69b254ce0d7c38449e2 - https://git.kernel.org/stable/c/2e18b869a8d574cfe9ee64df9c3d0a7ac7ed07a8 - https://git.kernel.org/stable/c/79b8eae24b7ee157bda07695d802be8576983fa8 - https://git.kernel.org/stable/c/255b650cbec6849443ce2e0cdd187fd5e61c218c
CVE ID: CVE-2022-50105 State: PUBLISHED Published: 2025-06-18T11:02:40.080Z Last Updated: 2025-06-18T11:02:40.080Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: powerpc/spufs: Fix refcount leak in spufs_init_isolated_loader of_find_node_by_path() returns remote device nodepointer with refcount incremented, we should use of_node_put() on it when done. Add missing of_node_put() to avoid refcount leak. References: - https://git.kernel.org/stable/c/43584490ee6c8a104797444af6bf89d0dafe95c0 - https://git.kernel.org/stable/c/d0cb99948c5f6d8fe56f6e69b8dd0a05ee5f9cec - https://git.kernel.org/stable/c/14329d29a048dc35aac2374fb3d588d8190
/stable/c/d0cb99948c5f6d8fe56f6e69b8dd0a05ee5f9cec - https://git.kernel.org/stable/c/14329d29a048dc35aac2374fb3d588d8190095a2 - https://git.kernel.org/stable/c/85aff6a9b7b7ec4e5c319f7946c9864c8d5e3d4a - https://git.kernel.org/stable/c/69e9fa07b229badab808980e984a9fe824116f00 - https://git.kernel.org/stable/c/0aa5de2547b7ccf0a31bc740d12f829fae243112 - https://git.kernel.org/stable/c/4288eb035ba4ddb53245e9365c919bb51ac00c2c - https://git.kernel.org/stable/c/6ac059dacffa8ab2f7798f20e4bd3333890c541c
CVE ID: CVE-2022-50106 State: PUBLISHED Published: 2025-06-18T11:02:40.748Z Last Updated: 2025-06-18T11:02:40.748Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: powerpc/cell/axon_msi: Fix refcount leak in setup_msi_msg_address of_get_next_parent() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() in the error path to avoid refcount leak. References: - https://git.kernel.org/stable/c/6263ec8032c411b8ef6b7f00198cb18c855ee6cb - https://git.kernel.org/stable/c/51cf876b11fb6ca06f69e9d1de58f892d1522e9d - https://git.kernel.org/stable/c/f388643657cd5a0
tps://git.kernel.org/stable/c/51cf876b11fb6ca06f69e9d1de58f892d1522e9d - https://git.kernel.org/stable/c/f388643657cd5a04dc47a68d85321876c5b4c208 - https://git.kernel.org/stable/c/00dc7cbbb558955ff410fd392cc9b0366eb06df0 - https://git.kernel.org/stable/c/5eaa93caa63abf382b319dbe2f032232026740c2 - https://git.kernel.org/stable/c/02ed44125d7a7238999750ca126b60f8dd7a88b1 - https://git.kernel.org/stable/c/af41cff4ada533b1cf40de6c468ba164fd32c22d - https://git.kernel.org/stable/c/df5d4b616ee76abc97e5bd348e22659c2b095b1c
CVE ID: CVE-2022-50107 State: PUBLISHED Published: 2025-06-18T11:02:41.395Z Last Updated: 2025-06-18T11:02:41.395Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: cifs: Fix memory leak when using fscache If we hit the 'index == next_cached' case, we leak a refcount on the struct page. Fix this by using readahead_folio() which takes care of the refcount for you. References: - https://git.kernel.org/stable/c/7105b4047481bc2950fb767cff328d8b75292c0f - https://git.kernel.org/stable/c/ae497726cd090673a4d20ac725ccc2de8067a7a5 - https://git.kernel.org/stable/c/c6f62f81b488d00afaa86bae26c6ce9ab12c709e