Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ffc0000000000 RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffffffff90e18120 RBP: 0000000000000008 R08: dffffc0000000000 R09: fffffbfff21c3025 R10: fffffbfff21c3025 R11: 0000000000000000 R12: ffffffff8d109840 R13: 0000000000001002 R14: 0000000000000001 R15: 0000000000000001 FS: 0000555556e08300(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fc74416f130 CR3: 0000000073d9e000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/9d06f489b9e901580159e21fdc29f73df7ed08dc -
iner: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/9d06f489b9e901580159e21fdc29f73df7ed08dc - https://git.kernel.org/stable/c/25206111512de994dfc914f5b2972a22aa904ef3
CVE ID: CVE-2022-48782 State: PUBLISHED Published: 2024-07-16T11:13:19.141Z Last Updated: 2025-05-04T08:23:02.500Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mctp: fix use after free Clang static analysis reports this problem route.c:425:4: warning: Use of memory after it is freed trace_mctp_key_acquire(key); ^~~~~~~~~~~~~~~~~~~~~~~~~~~ When mctp_key_add() fails, key is freed but then is later used in trace_mctp_key_acquire(). Add an else statement to use the key only when mctp_key_add() is successful. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/1
itional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/1dd3ecbec5f606b2a526c47925c8634b1a6bb81e - https://git.kernel.org/stable/c/7e5b6a5c8c44310784c88c1c198dde79f6402f7b
CVE ID: CVE-2022-48783 State: PUBLISHED Published: 2024-07-16T11:13:19.788Z Last Updated: 2025-05-04T08:23:03.694Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: dsa: lantiq_gswip: fix use after free in gswip_remove() of_node_put(priv->ds->slave_mii_bus->dev.of_node) should be done before mdiobus_free(priv->ds->slave_mii_bus). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/f48bd34137718042872d06f2c7332b3267a29165 - https://git.kernel.org/stable/c/df2495f329b08ac0d0d3e6334a01955ae839005e - https://git.kernel.org/stable/c/c61f599b8d33adfa256126a6695c7
el.org/stable/c/df2495f329b08ac0d0d3e6334a01955ae839005e - https://git.kernel.org/stable/c/c61f599b8d33adfa256126a6695c734c0de331cb - https://git.kernel.org/stable/c/8c6ae46150a453f8ae9a6cd49b45f354f478587d
CVE ID: CVE-2022-48784 State: PUBLISHED Published: 2024-07-16T11:13:20.462Z Last Updated: 2025-05-04T12:43:43.066Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: cfg80211: fix race in netlink owner interface destruction My previous fix here to fix the deadlock left a race where the exact same deadlock (see the original commit referenced below) can still happen if cfg80211_destroy_ifaces() already runs while nl80211_netlink_notify() is still marking some interfaces as nl_owner_dead. The race happens because we have two loops here - first we dev_close() all the netdevs, and then we destroy them. If we also have two netdevs (first
have two loops here - first we dev_close() all the netdevs, and then we destroy them. If we also have two netdevs (first one need only be a wdev though) then we can find one during the first iteration, close it, and go to the second iteration -- but then find two, and try to destroy also the one we didn't close yet. Fix this by only iterating once. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/241e633cb379c4f332fc1baf2abec95ec840cbeb - https://git.kernel.org/stable/c/c979f792a2baf6d0f3419587668a1a6eba46a3d2 - https://git.kernel.org/stable/c/f0a6fd1527067da537e9c48390237488719948ed
CVE ID: CVE-2022-48785 State: PUBLISHED Published: 2024-07-16T11:13:21.118Z Last Updated: 2025-05-04T08:23:06.007Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: use rcu-safe version of ipv6_get_lladdr() Some time ago 8965779d2c0e ("ipv6,mcast: always hold idev->lock before mca_lock") switched ipv6_get_lladdr() to __ipv6_get_lladdr(), which is rcu-unsafe version. That was OK, because idev->lock was held for these codepaths. In 88e2ca308094 ("mld: convert ifmcaddr6 to RCU") these external locks were removed, so we probably need to restore the original rcu-safe call. Otherwise, we occasionally get a machine crashed/s
e removed, so we probably need to restore the original rcu-safe call. Otherwise, we occasionally get a machine crashed/stalled with the following in dmesg: [ 3405.966610][T230589] general protection fault, probably for non-canonical address 0xdead00000000008c: 0000 [#1] SMP NOPTI [ 3405.982083][T230589] CPU: 44 PID: 230589 Comm: kworker/44:3 Tainted: G O 5.15.19-cloudflare-2022.2.1 #1 [ 3405.998061][T230589] Hardware name: SUPA-COOL-SERV [ 3406.009552][T230589] Workqueue: mld mld_ifc_work [ 3406.017224][T230589] RIP: 0010:__ipv6_get_lladdr+0x34/0x60 [ 3406.025780][T230589] Code: 57 10 48 83 c7 08 48 89 e5 48 39 d7 74 3e 48 8d 82 38 ff ff ff eb 13 48 8b 90 d0 00 00 00 48 8d 82 38 ff ff ff 48
Code: 57 10 48 83 c7 08 48 89 e5 48 39 d7 74 3e 48 8d 82 38 ff ff ff eb 13 48 8b 90 d0 00 00 00 48 8d 82 38 ff ff ff 48 39 d7 74 22 <66> 83 78 32 20 77 1b 75 e4 89 ca 23 50 2c 75 dd 48 8b 50 08 48 8b [ 3406.055748][T230589] RSP: 0018:ffff94e4b3fc3d10 EFLAGS: 00010202 [ 3406.065617][T230589] RAX: dead00000000005a RBX: ffff94e4b3fc3d30 RCX: 0000000000000040 [ 3406.077477][T230589] RDX: dead000000000122 RSI: ffff94e4b3fc3d30 RDI: ffff8c3a31431008 [ 3406.089389][T230589] RBP: ffff94e4b3fc3d10 R08: 0000000000000000 R09: 0000000000000000 [ 3406.101445][T230589] R10: ffff8c3a31430000 R11: 000000000000000b R12: ffff8c2c37887100 [ 3406.113553][T230589] R13: ffff8c3a39537000 R14: 00000000000005dc R15:
000 R11: 000000000000000b R12: ffff8c2c37887100 [ 3406.113553][T230589] R13: ffff8c3a39537000 R14: 00000000000005dc R15: ffff8c3a31431000 [ 3406.125730][T230589] FS: 0000000000000000(0000) GS:ffff8c3b9fc80000(0000) knlGS:0000000000000000 [ 3406.138992][T230589] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 3406.149895][T230589] CR2: 00007f0dfea1db60 CR3: 000000387b5f2000 CR4: 0000000000350ee0 [ 3406.162421][T230589] Call Trace: [ 3406.170235][T230589] <TASK> [ 3406.177736][T230589] mld_newpack+0xfe/0x1a0 [ 3406.186686][T230589] add_grhead+0x87/0xa0 [ 3406.195498][T230589] add_grec+0x485/0x4e0 [ 3406.204310][T230589] ? newidle_balance+0x126/0x3f0 [ 3406.214024][T230589] mld_ifc_work+0x15
89] add_grec+0x485/0x4e0 [ 3406.204310][T230589] ? newidle_balance+0x126/0x3f0 [ 3406.214024][T230589] mld_ifc_work+0x15d/0x450 [ 3406.223279][T230589] process_one_work+0x1e6/0x380 [ 3406.232982][T230589] worker_thread+0x50/0x3a0 [ 3406.242371][T230589] ? rescuer_thread+0x360/0x360 [ 3406.252175][T230589] kthread+0x127/0x150 [ 3406.261197][T230589] ? set_kthread_struct+0x40/0x40 [ 3406.271287][T230589] ret_from_fork+0x22/0x30 [ 3406.280812][T230589] </TASK> [ 3406.288937][T230589] Modules linked in: ... [last unloaded: kheaders] [ 3406.476714][T230589] ---[ end trace 3525a7655f2f3b9e ]--- Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.ke
655f2f3b9e ]--- Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/3e11ef1903cf6c2fba35594b193a3570854d9e9e - https://git.kernel.org/stable/c/27f567c84f446048670376827e356f9c92033bf9 - https://git.kernel.org/stable/c/26394fc118d6115390bd5b3a0fb17096271da227
CVE ID: CVE-2022-48786 State: PUBLISHED Published: 2024-07-16T11:43:43.677Z Last Updated: 2025-05-04T08:23:07.147Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: vsock: remove vsock from connected table when connect is interrupted by a signal vsock_connect() expects that the socket could already be in the TCP_ESTABLISHED state when the connecting task wakes up with a signal pending. If this happens the socket will be in the connected table, and it is not removed when the socket state is reset. In this situation it's common for the process to retry connect(), and if the connection is successful the socket will be added to the co
n it's common for the process to retry connect(), and if the connection is successful the socket will be added to the connected table a second time, corrupting the list. Prevent this by calling vsock_remove_connected() if a signal is received while waiting for a connection. This is harmless if the socket is not in the connected table, and if it is in the table then removing it will prevent list corruption from a double add. Note for backporting: this patch requires d5afa82c977e ("vsock: correct removal of socket from the list"), which is in all current stable trees except 4.9.y. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/s
.9.y. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/0bb88f3f7e8d506f3efe46d694964117e20efbfc - https://git.kernel.org/stable/c/e3b3939fd137aab6d00d54bee0ee9244b286a608 - https://git.kernel.org/stable/c/2910bcb9f67551a45397735e47b6d456eb8cd549 - https://git.kernel.org/stable/c/5f326fe2aef411a6575628f92bd861463ea91df7 - https://git.kernel.org/stable/c/87cd1bbd6677411e17369cd4b7389ab1e1fdba44 - https://git.kernel.org/stable/c/787468ee7a435777521d33399d012fd591ae2f94 - https://git.kernel.org/stable/c/addd62a8cb6fa90aa322365c62487da61f6baab8 - https://git.kernel.org/stable/c/b9208492fcaecff8f43915529ae34b3bcb03877c
CVE ID: CVE-2022-48787 State: PUBLISHED Published: 2024-07-16T11:43:44.349Z Last Updated: 2025-05-04T08:23:08.524Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: iwlwifi: fix use-after-free If no firmware was present at all (or, presumably, all of the firmware files failed to parse), we end up unbinding by calling device_release_driver(), which calls remove(), which then in iwlwifi calls iwl_drv_stop(), freeing the 'drv' struct. However the new code I added will still erroneously access it after it was freed. Set 'failure=false' in this case to avoid the access, all data was already freed anyway. Additional Analyst Notes: - CVE
Set 'failure=false' in this case to avoid the access, all data was already freed anyway. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/d3b98fe36f8a06ce654049540773256ab59cb53d - https://git.kernel.org/stable/c/7d6475179b85a83186ccce59cdc359d4f07d0bcb - https://git.kernel.org/stable/c/494de920d98f125b099f27a2d274850750aff957 - https://git.kernel.org/stable/c/008508c16af0087cda0394e1ac6f0493b01b6063 - https://git.kernel.org/stable/c/ddd46059f7d99119b62d44c519df7a79f2e6a515 - https://git.kernel.org/stable/c/9958b9cbb22145295ee1ffaea0904c383da2c05d - https://git.kernel.org/stable/c/bea2662e7818e15d7607d17d57912ac984275d9
ble/c/9958b9cbb22145295ee1ffaea0904c383da2c05d - https://git.kernel.org/stable/c/bea2662e7818e15d7607d17d57912ac984275d94
CVE ID: CVE-2022-48788 State: PUBLISHED Published: 2024-07-16T11:43:45.213Z Last Updated: 2025-05-04T08:23:09.577Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: fix possible use-after-free in transport error_recovery work While nvme_rdma_submit_async_event_work is checking the ctrl and queue state before preparing the AER command and scheduling io_work, in order to fully prevent a race where this check is not reliable the error recovery work must flush async_event_work before continuing to destroy the admin queue after setting the ctrl state to RESETTING such that there is no race .submit_async_event and the error r
the admin queue after setting the ctrl state to RESETTING such that there is no race .submit_async_event and the error recovery handler itself changing the ctrl state. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/5593f72d1922403c11749532e3a0aa4cf61414e9 - https://git.kernel.org/stable/c/d411b2a5da68b8a130c23097014434ac140a2ace - https://git.kernel.org/stable/c/324f5bdc52ecb6a6dadb31a62823ef8c709d1439 - https://git.kernel.org/stable/c/646952b2210f19e584d2bf9eb5d092abdca2fcc1 - https://git.kernel.org/stable/c/ea86027ac467a055849c4945906f799e7f65ab99 - https://git.kernel.org/stable/c/b6bb1722f34bbdbabed27acdceaf585d300
/stable/c/ea86027ac467a055849c4945906f799e7f65ab99 - https://git.kernel.org/stable/c/b6bb1722f34bbdbabed27acdceaf585d300c5fd2
CVE ID: CVE-2022-48789 State: PUBLISHED Published: 2024-07-16T11:43:45.894Z Last Updated: 2025-07-11T17:19:02.549Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix possible use-after-free in transport error_recovery work While nvme_tcp_submit_async_event_work is checking the ctrl and queue state before preparing the AER command and scheduling io_work, in order to fully prevent a race where this check is not reliable the error recovery work must flush async_event_work before continuing to destroy the admin queue after setting the ctrl state to RESETTING such that there is no race .submit_async_event and the error rec
e admin queue after setting the ctrl state to RESETTING such that there is no race .submit_async_event and the error recovery handler itself changing the ctrl state. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/61a26ffd5ad3ece456d74c4c79f7b5e3f440a141 - https://git.kernel.org/stable/c/e192184cf8bce8dd55d619f5611a2eaba996fa05 - https://git.kernel.org/stable/c/5e42fca37ccc76f39f73732661bd47254cad5982 - https://git.kernel.org/stable/c/bb0d8fb35c4ff00a503c2c4dca4cce8d102a21c4 - https://git.kernel.org/stable/c/ff9fc7ebf5c06de1ef72a69f9b1ab40af8b07f9e
CVE ID: CVE-2022-48790 State: PUBLISHED Published: 2024-07-16T11:43:46.556Z Last Updated: 2025-05-04T08:23:11.613Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: nvme: fix a possible use-after-free in controller reset during load Unlike .queue_rq, in .submit_async_event drivers may not check the ctrl readiness for AER submission. This may lead to a use-after-free condition that was observed with nvme-tcp. The race condition may happen in the following scenario: 1. driver executes its reset_ctrl_work 2. -> nvme_stop_ctrl - flushes ctrl async_event_work 3. ctrl sends AEN which is received by the host, which in turn schedules AEN
_stop_ctrl - flushes ctrl async_event_work 3. ctrl sends AEN which is received by the host, which in turn schedules AEN handling 4. teardown admin queue (which releases the queue socket) 5. AEN processed, submits another AER, calling the driver to submit 6. driver attempts to send the cmd ==> use-after-free In order to fix that, add ctrl state check to validate the ctrl is actually able to accept the AER submission. This addresses the above race in controller resets because the driver during teardown should: 1. change ctrl state to RESETTING 2. flush async_event_work (as well as other async work elements) So after 1,2, any other AER command will find the ctrl state to be RESETTING and bail o
ll as other async work elements) So after 1,2, any other AER command will find the ctrl state to be RESETTING and bail out without submitting the AER. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/a25e460fbb0340488d119fb2e28fe3f829b7417e - https://git.kernel.org/stable/c/70356b756a58704e5c8818cb09da5854af87e765 - https://git.kernel.org/stable/c/0ead57ceb21bbf15963b4874c2ac67143455382f - https://git.kernel.org/stable/c/e043fb5a0336ee74614e26f0d9f36f1f5bb6d606 - https://git.kernel.org/stable/c/9e956a2596ae276124ef0d96829c013dd0faf861 - https://git.kernel.org/stable/c/0fa0f99fc84e41057cbdd2efbfe91c6b2f47dd9d
CVE ID: CVE-2022-48791 State: PUBLISHED Published: 2024-07-16T11:43:47.211Z Last Updated: 2025-05-04T08:23:12.651Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Fix use-after-free for aborted TMF sas_task Currently a use-after-free may occur if a TMF sas_task is aborted before we handle the IO completion in mpi_ssp_completion(). The abort occurs due to timeout. When the timeout occurs, the SAS_TASK_STATE_ABORTED flag is set and the sas_task is freed in pm8001_exec_internal_tmf_task(). However, if the I/O completion occurs later, the I/O completion still thinks that the sas_task is available. Fix this by clearing
f the I/O completion occurs later, the I/O completion still thinks that the sas_task is available. Fix this by clearing the ccb->task if the TMF times out - the I/O completion handler does nothing if this pointer is cleared. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/d872e7b5fe38f325f5206b6872746fa02c2b4819 - https://git.kernel.org/stable/c/3c334cdfd94945b8edb94022a0371a8665b17366 - https://git.kernel.org/stable/c/510b21442c3a2e3ecc071ba3e666b320e7acdd61 - https://git.kernel.org/stable/c/61f162aa4381845acbdc7f2be4dfb694d027c018
CVE ID: CVE-2022-48792 State: PUBLISHED Published: 2024-07-16T11:43:48.026Z Last Updated: 2025-05-04T08:23:13.683Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Fix use-after-free for aborted SSP/STP sas_task Currently a use-after-free may occur if a sas_task is aborted by the upper layer before we handle the I/O completion in mpi_ssp_completion() or mpi_sata_completion(). In this case, the following are the two steps in handling those I/O completions: - Call complete() to inform the upper layer handler of completion of the I/O. - Release driver resources associated with the sas_task in pm8001_ccb_task_free() cal
handler of completion of the I/O. - Release driver resources associated with the sas_task in pm8001_ccb_task_free() call. When complete() is called, the upper layer may free the sas_task. As such, we should not touch the associated sas_task afterwards, but we do so in the pm8001_ccb_task_free() call. Fix by swapping the complete() and pm8001_ccb_task_free() calls ordering. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/fe9ac3eaa2e387a5742b380b73a5a6bc237bf184 - https://git.kernel.org/stable/c/d9d93f32534a0a80a1c26bdb0746d90a7b19c2c2 - https://git.kernel.org/stable/c/f61f9fccb2cb4bb275674a79d638704db6bc2171 - https://
32534a0a80a1c26bdb0746d90a7b19c2c2 - https://git.kernel.org/stable/c/f61f9fccb2cb4bb275674a79d638704db6bc2171 - https://git.kernel.org/stable/c/df7abcaa1246e2537ab4016077b5443bb3c09378
CVE ID: CVE-2022-48793 State: PUBLISHED Published: 2024-07-16T11:43:48.749Z Last Updated: 2025-05-04T08:23:14.995Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: KVM: x86: nSVM: fix potential NULL derefernce on nested migration Turns out that due to review feedback and/or rebases I accidentally moved the call to nested_svm_load_cr3 to be too early, before the NPT is enabled, which is very wrong to do. KVM can't even access guest memory at that point as nested NPT is needed for that, and of course it won't initialize the walk_mmu, which is main issue the patch was addressing. Fix this for real. Additional Analyst Notes: - CVE Pr
ialize the walk_mmu, which is main issue the patch was addressing. Fix this for real. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/74b426bea4f7e3b081add2b88d4fba16d3af7ab6 - https://git.kernel.org/stable/c/352193edda48e08e8824a7ece09aec830a603cfe - https://git.kernel.org/stable/c/e1779c2714c3023e4629825762bcbc43a3b943df
CVE ID: CVE-2022-48794 State: PUBLISHED Published: 2024-07-16T11:43:49.434Z Last Updated: 2025-05-04T08:23:16.214Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: ieee802154: at86rf230: Stop leaking skb's Upon error the ieee802154_xmit_complete() helper is not called. Only ieee802154_wake_queue() is called manually. In the Tx case we then leak the skb structure. Free the skb structure upon error before returning when appropriate. As the 'is_tx = 0' cannot be moved in the complete handler because of a possible race between the delay in switching to STATE_RX_AACK_ON and a new interrupt, we introduce an intermediate 'was_tx' b
ble race between the delay in switching to STATE_RX_AACK_ON and a new interrupt, we introduce an intermediate 'was_tx' boolean just for this purpose. There is no Fixes tag applying here, many changes have been made on this area and the issue kind of always existed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/d2a1eaf51b7d4412319adb6acef114ba472d1692 - https://git.kernel.org/stable/c/af649e5c95f56df64363bc46f6746b87819f9c0d - https://git.kernel.org/stable/c/6312f6a53fd3ea38125dcaca5e3c9aa7d8a60cf7 - https://git.kernel.org/stable/c/455ef08d6e5473526fa6763f75a93f7198206966 - https://git.kernel.org/stable/c/0fd484644c68
https://git.kernel.org/stable/c/455ef08d6e5473526fa6763f75a93f7198206966 - https://git.kernel.org/stable/c/0fd484644c68897c490a3307bfcc8bf767df5a43 - https://git.kernel.org/stable/c/23b2a25382400168427ea278f3d8bf4ecfd333bf - https://git.kernel.org/stable/c/1c72f04d52b7200bb83426a9bed378668271ea4a - https://git.kernel.org/stable/c/e5ce576d45bf72fd0e3dc37eff897bfcc488f6a9
CVE ID: CVE-2022-48795 State: PUBLISHED Published: 2024-07-16T11:43:50.129Z Last Updated: 2025-05-04T08:23:17.551Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: parisc: Fix data TLB miss in sba_unmap_sg Rolf Eike Beer reported the following bug: [1274934.746891] Bad Address (null pointer deref?): Code=15 (Data TLB miss fault) at addr 0000004140000018 [1274934.746891] CPU: 3 PID: 5549 Comm: cmake Not tainted 5.15.4-gentoo-parisc64 #4 [1274934.746891] Hardware name: 9000/785/C8000 [1274934.746891] [1274934.746891] YZrvWESTHLNXBCVMcbcbcbcbOGFRQPDI [1274934.746891] PSW: 00001000000001001111111000001110 Not tainted [1274934.746891]
91] YZrvWESTHLNXBCVMcbcbcbcbOGFRQPDI [1274934.746891] PSW: 00001000000001001111111000001110 Not tainted [1274934.746891] r00-03 000000ff0804fe0e 0000000040bc9bc0 00000000406760e4 0000004140000000 [1274934.746891] r04-07 0000000040b693c0 0000004140000000 000000004a2b08b0 0000000000000001 [1274934.746891] r08-11 0000000041f98810 0000000000000000 000000004a0a7000 0000000000000001 [1274934.746891] r12-15 0000000040bddbc0 0000000040c0cbc0 0000000040bddbc0 0000000040bddbc0 [1274934.746891] r16-19 0000000040bde3c0 0000000040bddbc0 0000000040bde3c0 0000000000000007 [1274934.746891] r20-23 0000000000000006 000000004a368950 0000000000000000 0000000000000001 [1274934.746891] r24-27 0000000000001fff 000
r20-23 0000000000000006 000000004a368950 0000000000000000 0000000000000001 [1274934.746891] r24-27 0000000000001fff 000000000800000e 000000004a1710f0 0000000040b693c0 [1274934.746891] r28-31 0000000000000001 0000000041f988b0 0000000041f98840 000000004a171118 [1274934.746891] sr00-03 00000000066e5800 0000000000000000 0000000000000000 00000000066e5800 [1274934.746891] sr04-07 0000000000000000 0000000000000000 0000000000000000 0000000000000000 [1274934.746891] [1274934.746891] IASQ: 0000000000000000 0000000000000000 IAOQ: 00000000406760e8 00000000406760ec [1274934.746891] IIR: 48780030 ISR: 0000000000000000 IOR: 0000004140000018 [1274934.746891] CPU: 3 CR30: 00000040e3a9c000 CR31: ffffffffffff