Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-49610 State: PUBLISHED Published: 2025-02-26T02:23:33.299Z Last Updated: 2025-05-04T08:41:44.644Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: KVM: VMX: Prevent RSB underflow before vmenter On VMX, there are some balanced returns between the time the guest's SPEC_CTRL value is written, and the vmenter. Balanced returns (matched by a preceding call) are usually ok, but it's at least theoretically possible an NMI with a deep call stack could empty the RSB before one of the returns. For maximum paranoia, don't allow *any* returns (balanced or otherwise) between the SPEC_CTRL write and the vmenter. [ bp: Fix 32-b
paranoia, don't allow *any* returns (balanced or otherwise) between the SPEC_CTRL write and the vmenter. [ bp: Fix 32-bit build. ] References: - https://git.kernel.org/stable/c/afd743f6dde87296c6f3414706964c491bb85862 - https://git.kernel.org/stable/c/07853adc29a058c5fd143c14e5ac528448a72ed9
CVE ID: CVE-2022-49611 State: PUBLISHED Published: 2025-02-26T02:23:33.779Z Last Updated: 2025-05-04T08:41:45.892Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: x86/speculation: Fill RSB on vmexit for IBRS Prevent RSB underflow/poisoning attacks with RSB. While at it, add a bunch of comments to attempt to document the current state of tribal knowledge about RSB attacks and what exactly is being mitigated. References: - https://git.kernel.org/stable/c/3d323b99ff5c8c57005184056d65f6af5b0479d8 - https://git.kernel.org/stable/c/f744b88dfc201bf8092833ec70b23c720188b527 - https://git.kernel.org/stable/c/17a9fc4a7b91f8599223631bb6ae6
el.org/stable/c/f744b88dfc201bf8092833ec70b23c720188b527 - https://git.kernel.org/stable/c/17a9fc4a7b91f8599223631bb6ae6416bc0de1c0 - https://git.kernel.org/stable/c/4d7f72b6e1bc630bec7e4cd51814bc2b092bf153 - https://git.kernel.org/stable/c/8d5cff499a6d740c91ff37963907e0e983c37f0f - https://git.kernel.org/stable/c/8c38306e2e9257af4af2819aa287a4711ff36329 - https://git.kernel.org/stable/c/9756bba28470722dacb79ffce554336dd1f6a6cd
CVE ID: CVE-2022-49612 State: PUBLISHED Published: 2025-02-26T02:23:34.263Z Last Updated: 2025-05-04T08:41:47.323Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: power: supply: core: Fix boundary conditions in interpolation The functions power_supply_temp2resist_simple and power_supply_ocv2cap_simple handle boundary conditions incorrectly. The change was introduced in a4585ba2050f460f749bbaf2b67bd56c41e30283 ("power: supply: core: Use library interpolation"). There are two issues: First, the lines "high = i - 1" and "high = i" in ocv2cap have the wrong order compared to temp2resist. As a consequence, ocv2cap sets high=-1 if ocv
1" and "high = i" in ocv2cap have the wrong order compared to temp2resist. As a consequence, ocv2cap sets high=-1 if ocv>table[0].ocv, which causes an out-of-bounds read. Second, the logic of temp2resist is also not correct. Consider the case table[] = {{20, 100}, {10, 80}, {0, 60}}. For temp=5, we expect a resistance of 70% by interpolation. However, temp2resist sets high=low=2 and returns 60. References: - https://git.kernel.org/stable/c/a762cee5d933fe4e2e1b773d60fc74fb8248d8c4 - https://git.kernel.org/stable/c/093d27bb6f2d1963f927ef59c9a2d37059175426
CVE ID: CVE-2022-49613 State: PUBLISHED Published: 2025-02-26T02:23:34.739Z Last Updated: 2025-05-04T08:41:48.842Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: serial: 8250: Fix PM usage_count for console handover When console is enabled, univ8250_console_setup() calls serial8250_console_setup() before .dev is set to uart_port. Therefore, it will not call pm_runtime_get_sync(). Later, when the actual driver is going to take over univ8250_console_exit() is called. As .dev is already set, serial8250_console_exit() makes pm_runtime_put_sync() call with usage count being zero triggering PM usage count warning (extra debug for uni
it() makes pm_runtime_put_sync() call with usage count being zero triggering PM usage count warning (extra debug for univ8250_console_setup(), univ8250_console_exit(), and serial8250_register_ports()): [ 0.068987] univ8250_console_setup ttyS0 nodev [ 0.499670] printk: console [ttyS0] enabled [ 0.717955] printk: console [ttyS0] printing thread started [ 1.960163] serial8250_register_ports assigned dev for ttyS0 [ 1.976830] printk: console [ttyS0] disabled [ 1.976888] printk: console [ttyS0] printing thread stopped [ 1.977073] univ8250_console_exit ttyS0 usage:0 [ 1.977075] serial8250 serial8250: Runtime PM usage count underflow! [ 1.977429] dw-apb-uart.6: ttyS0 at MMIO 0x4010006000 (irq = 33,
erial8250 serial8250: Runtime PM usage count underflow! [ 1.977429] dw-apb-uart.6: ttyS0 at MMIO 0x4010006000 (irq = 33, base_baud = 115200) is a 16550A [ 1.977812] univ8250_console_setup ttyS0 usage:2 [ 1.978167] printk: console [ttyS0] printing thread started [ 1.978203] printk: console [ttyS0] enabled To fix the issue, call pm_runtime_get_sync() in serial8250_register_ports() as soon as .dev is set for an uart_port if it has console enabled. This problem became apparent only recently because 82586a721595 ("PM: runtime: Avoid device usage count underflows") added the warning printout. I confirmed this problem also occurs with v5.18 (w/o the warning printout, obviously). References: - https
ing printout. I confirmed this problem also occurs with v5.18 (w/o the warning printout, obviously). References: - https://git.kernel.org/stable/c/d9cb6fabc90102f9e61fe35bd0160db88f4f53b4 - https://git.kernel.org/stable/c/190ce5cdc55d1b66ea582ac2be6fd5a72e3cc486 - https://git.kernel.org/stable/c/5df66302f03f87ae8953785a882d78e911f00c55 - https://git.kernel.org/stable/c/f9b11229b79c0fb2100b5bb4628a101b1d37fbf6
CVE ID: CVE-2022-49614 State: REJECTED Published: 2025-02-26T02:23:35.226Z Last Updated: 2025-03-06T15:31:33.810Z Description: No description available.
CVE ID: CVE-2022-49615 State: PUBLISHED Published: 2025-02-26T02:23:35.696Z Last Updated: 2025-10-01T19:36:51.191Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ASoC: rt711-sdca: fix kernel NULL pointer dereference when IO error The initial settings will be written before the codec probe function. But, the rt711->component doesn't be assigned yet. If IO error happened during initial settings operations, it will cause the kernel panic. This patch changed component->dev to slave->dev to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/269be8b2907378adf72d7347cfa43ef
al Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/269be8b2907378adf72d7347cfa43ef230351a06 - https://git.kernel.org/stable/c/7bb71133cae88d3003a3490b97864af76533072b - https://git.kernel.org/stable/c/1df793d479bef546569fc2e409ff8bb3f0fb8e99
CVE ID: CVE-2022-49616 State: PUBLISHED Published: 2025-02-26T02:23:36.180Z Last Updated: 2025-05-04T08:41:51.624Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ASoC: rt7*-sdw: harden jack_detect_handler Realtek headset codec drivers typically check if the card is instantiated before proceeding with the jack detection. The rt700, rt711 and rt711-sdca are however missing a check on the card pointer, which can lead to NULL dereferences encountered in driver bind/unbind tests. References: - https://git.kernel.org/stable/c/07a606e1389a63b61cb8cd591026f30529117573 - https://git.kernel.org/stable/c/1d75b73ec6d6b705cca528b36d8315e43e
g/stable/c/07a606e1389a63b61cb8cd591026f30529117573 - https://git.kernel.org/stable/c/1d75b73ec6d6b705cca528b36d8315e43e8d7fa5 - https://git.kernel.org/stable/c/0484271ab0ce50649329fa9dc23c50853c5b26a4
CVE ID: CVE-2022-49617 State: PUBLISHED Published: 2025-02-26T02:23:36.654Z Last Updated: 2025-05-04T08:41:52.791Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: sof_sdw: handle errors on card registration If the card registration fails, typically because of deferred probes, the device properties added for headset codecs are not removed, which leads to kernel oopses in driver bind/unbind tests. We already clean-up the device properties when the card is removed, this code can be moved as a helper and called upon card registration errors. References: - https://git.kernel.org/stable/c/f2556ce6b35ae0fc72000a4daa21ded12
nd called upon card registration errors. References: - https://git.kernel.org/stable/c/f2556ce6b35ae0fc72000a4daa21ded12665e2f2 - https://git.kernel.org/stable/c/09bca0ffc95c50369f1345d80ecfaca51864126f - https://git.kernel.org/stable/c/fe154c4ff376bc31041c6441958a08243df09c99
CVE ID: CVE-2022-49618 State: PUBLISHED Published: 2025-02-26T02:23:37.185Z Last Updated: 2025-10-01T19:36:51.076Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: pinctrl: aspeed: Fix potential NULL dereference in aspeed_pinmux_set_mux() pdesc could be null but still dereference pdesc->name and it will lead to a null pointer access. So we move a null check before dereference. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/ef1e38532f4b2f0f3b460e938a2e7076c3bed5ee - https://git.kernel.org/stable/c/3cb392b64304a05bf647e2e44efacd9a1f3c3c6a - https://git.kernel.org/stable/c/e162a24f1d
- https://git.kernel.org/stable/c/3cb392b64304a05bf647e2e44efacd9a1f3c3c6a - https://git.kernel.org/stable/c/e162a24f1dd06c0dcae71f2565c9f3da2827b98e - https://git.kernel.org/stable/c/84a85d3fef2e75b1fe9fc2af6f5267122555a1ed
CVE ID: CVE-2022-49619 State: PUBLISHED Published: 2025-02-26T02:23:37.879Z Last Updated: 2025-10-01T19:36:50.948Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: sfp: fix memory leak in sfp_probe() sfp_probe() allocates a memory chunk from sfp with sfp_alloc(). When devm_add_action() fails, sfp is not freed, which leads to a memory leak. We should use devm_add_action_or_reset() instead of devm_add_action(). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/9ec5a97f327a89031fce6cfc3e95543c53936638 - https://git.kernel.org/stable/c/1545bc727625ea6e8decd717e5d1e8cc704ccf8f - http
c5a97f327a89031fce6cfc3e95543c53936638 - https://git.kernel.org/stable/c/1545bc727625ea6e8decd717e5d1e8cc704ccf8f - https://git.kernel.org/stable/c/ede990cfc42775bd0141e21f37ee365dcaeeb50f - https://git.kernel.org/stable/c/67dc32542a1fb7790d0853cf4a5cf859ac6a2002 - https://git.kernel.org/stable/c/204543581a2f26bb3b997a304c0bd06926ba7f15 - https://git.kernel.org/stable/c/f22ddc8a5278d7fb6369a0aeb0d8775a0aefaaee - https://git.kernel.org/stable/c/0a18d802d65cf662644fd1d369c86d84a5630652
CVE ID: CVE-2022-49620 State: PUBLISHED Published: 2025-02-26T02:23:38.369Z Last Updated: 2025-10-01T19:36:50.833Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: tipc: fix possible refcount leak in tipc_sk_create() Free sk in case tipc_sk_insert() fails. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/638fa20b618b2bbcf86da71231624cc82121a036 - https://git.kernel.org/stable/c/7bc9e7f70bc57d8f02ffea2a42094281effb15ef - https://git.kernel.org/stable/c/ef488669b2652bde5b6ee5a409a5b048a2a50db4 - https://git.kernel.org/stable/c/4919d82f7041157a421ca9bf39a78551d5ad8a1b - https://gi
b2652bde5b6ee5a409a5b048a2a50db4 - https://git.kernel.org/stable/c/4919d82f7041157a421ca9bf39a78551d5ad8a1b - https://git.kernel.org/stable/c/efa78f2ae363428525fb4981bb63c555ee79f3c7 - https://git.kernel.org/stable/c/833ecd0eae76eadf81d6d747bb5bc992d1151867 - https://git.kernel.org/stable/c/3b2957fc09fe1ac7f07f40dd50dd5f93e3f3a7a2 - https://git.kernel.org/stable/c/00aff3590fc0a73bddd3b743863c14e76fd35c0c
CVE ID: CVE-2022-49621 State: PUBLISHED Published: 2025-02-26T02:23:38.850Z Last Updated: 2025-10-01T19:36:50.700Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: cpufreq: pmac32-cpufreq: Fix refcount leak bug In pmac_cpufreq_init_MacRISC3(), we need to add corresponding of_node_put() for the three node pointers whose refcount have been incremented by of_find_node_by_name(). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/4f242486bf46d314b2e3838cc64b56f008a3c4d7 - https://git.kernel.org/stable/c/37c16fc2cb13a13f3c0193bfc6f2edef7d7df7d7 - https://git.kernel.org/stable/c/4585890ab2d
- https://git.kernel.org/stable/c/37c16fc2cb13a13f3c0193bfc6f2edef7d7df7d7 - https://git.kernel.org/stable/c/4585890ab2dbf455d80e254d3d859d4c1e357920 - https://git.kernel.org/stable/c/8dda30f81c751b01cd71f2cfaeef26ad4393b1d1 - https://git.kernel.org/stable/c/3ea9dbf7c2f436952bca331c6f5d72f75aca224e - https://git.kernel.org/stable/c/57289b6601fe78c09921599b042a0b430fb420ec - https://git.kernel.org/stable/c/4513018d0bd739097570d26a7760551cba3deb56 - https://git.kernel.org/stable/c/ccd7567d4b6cf187fdfa55f003a9e461ee629e36
CVE ID: CVE-2022-49622 State: PUBLISHED Published: 2025-02-26T02:23:39.341Z Last Updated: 2025-05-04T08:41:59.185Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: avoid skb access on nf_stolen When verdict is NF_STOLEN, the skb might have been freed. When tracing is enabled, this can result in a use-after-free: 1. access to skb->nf_trace 2. access to skb->mark 3. computation of trace id 4. dump of packet payload To avoid 1, keep a cached copy of skb->nf_trace in the trace state struct. Refresh this copy whenever verdict is != STOLEN. Avoid 2 by skipping skb->mark access if verdict is STOLEN. 3 is avoided by
resh this copy whenever verdict is != STOLEN. Avoid 2 by skipping skb->mark access if verdict is STOLEN. 3 is avoided by precomputing the trace id. Only dump the packet when verdict is not "STOLEN". Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/0016d5d46d7440729a3132f61a8da3bf7f84e2ba - https://git.kernel.org/stable/c/e34b9ed96ce3b06c79bf884009b16961ca478f87
CVE ID: CVE-2022-49623 State: PUBLISHED Published: 2025-02-26T02:23:39.834Z Last Updated: 2025-10-01T19:36:50.564Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: powerpc/xive/spapr: correct bitmap allocation size kasan detects access beyond the end of the xibm->bitmap allocation: BUG: KASAN: slab-out-of-bounds in _find_first_zero_bit+0x40/0x140 Read of size 8 at addr c00000001d1d0118 by task swapper/0/1 CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.19.0-rc2-00001-g90df023b36dd #28 Call Trace: [c00000001d98f770] [c0000000012baab8] dump_stack_lvl+0xac/0x108 (unreliable) [c00000001d98f7b0] [c00000000068faac] print_report+0x37c/0x710
[c0000000012baab8] dump_stack_lvl+0xac/0x108 (unreliable) [c00000001d98f7b0] [c00000000068faac] print_report+0x37c/0x710 [c00000001d98f880] [c0000000006902c0] kasan_report+0x110/0x354 [c00000001d98f950] [c000000000692324] __asan_load8+0xa4/0xe0 [c00000001d98f970] [c0000000011c6ed0] _find_first_zero_bit+0x40/0x140 [c00000001d98f9b0] [c0000000000dbfbc] xive_spapr_get_ipi+0xcc/0x260 [c00000001d98fa70] [c0000000000d6d28] xive_setup_cpu_ipi+0x1e8/0x450 [c00000001d98fb30] [c000000004032a20] pSeries_smp_probe+0x5c/0x118 [c00000001d98fb60] [c000000004018b44] smp_prepare_cpus+0x944/0x9ac [c00000001d98fc90] [c000000004009f9c] kernel_init_freeable+0x2d4/0x640 [c00000001d98fd90] [c0000000000131e8] kerne
0x9ac [c00000001d98fc90] [c000000004009f9c] kernel_init_freeable+0x2d4/0x640 [c00000001d98fd90] [c0000000000131e8] kernel_init+0x28/0x1d0 [c00000001d98fe10] [c00000000000cd54] ret_from_kernel_thread+0x5c/0x64 Allocated by task 0: kasan_save_stack+0x34/0x70 __kasan_kmalloc+0xb4/0xf0 __kmalloc+0x268/0x540 xive_spapr_init+0x4d0/0x77c pseries_init_irq+0x40/0x27c init_IRQ+0x44/0x84 start_kernel+0x2a4/0x538 start_here_common+0x1c/0x20 The buggy address belongs to the object at c00000001d1d0118 which belongs to the cache kmalloc-8 of size 8 The buggy address is located 0 bytes inside of 8-byte region [c00000001d1d0118, c00000001d1d0120) The buggy address belongs to the physical page: page:c00c00000
ide of 8-byte region [c00000001d1d0118, c00000001d1d0120) The buggy address belongs to the physical page: page:c00c000000074740 refcount:1 mapcount:0 mapping:0000000000000000 index:0xc00000001d1d0558 pfn:0x1d1d flags: 0x7ffff000000200(slab|node=0|zone=0|lastcpupid=0x7ffff) raw: 007ffff000000200 c00000001d0003c8 c00000001d0003c8 c00000001d010480 raw: c00000001d1d0558 0000000001e1000a 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: c00000001d1d0000: fc 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc c00000001d1d0080: fc fc 00 fc fc fc fc fc fc fc fc fc fc fc fc fc >c00000001d1d0100: fc fc fc 02 fc fc fc fc fc fc fc fc fc fc
01d1d0080: fc fc 00 fc fc fc fc fc fc fc fc fc fc fc fc fc >c00000001d1d0100: fc fc fc 02 fc fc fc fc fc fc fc fc fc fc fc fc ^ c00000001d1d0180: fc fc fc fc 04 fc fc fc fc fc fc fc fc fc fc fc c00000001d1d0200: fc fc fc fc fc 04 fc fc fc fc fc fc fc fc fc fc This happens because the allocation uses the wrong unit (bits) when it should pass (BITS_TO_LONGS(count) * sizeof(long)) or equivalent. With small numbers of bits, the allocated object can be smaller than sizeof(long), which results in invalid accesses. Use bitmap_zalloc() to allocate and initialize the irq bitmap, paired with bitmap_free() for consistency. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.ker
red with bitmap_free() for consistency. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/10f2cd373e65bcd3be8f3cdc71c330c25763dfd8 - https://git.kernel.org/stable/c/99d1c36bddd93919072b5a51a89297bbb5ad6a6f - https://git.kernel.org/stable/c/19fc5bb93c6bbdce8292b4d7eed04e2fa118d2fe
CVE ID: CVE-2022-49624 State: PUBLISHED Published: 2025-02-26T02:23:40.311Z Last Updated: 2025-05-04T12:44:59.574Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: atlantic: remove aq_nic_deinit() when resume aq_nic_deinit() has been called while suspending, so we don't have to call it again on resume. Actually, call it again leads to another hang issue when resuming from S3. Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992345] Call Trace: Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992346] <TASK> Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992348] aq_nic_deinit+0xb4/0xd0 [atlantic] Jul 8 03:09:44 u
<TASK> Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992348] aq_nic_deinit+0xb4/0xd0 [atlantic] Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992356] aq_pm_thaw+0x7f/0x100 [atlantic] Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992362] pci_pm_resume+0x5c/0x90 Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992366] ? pci_pm_thaw+0x80/0x80 Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992368] dpm_run_callback+0x4e/0x120 Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992371] device_resume+0xad/0x200 Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992373] async_resume+0x1e/0x40 Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992374] async_run_en
kernel: [ 5910.992373] async_resume+0x1e/0x40 Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992374] async_run_entry_fn+0x33/0x120 Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992377] process_one_work+0x220/0x3c0 Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992380] worker_thread+0x4d/0x3f0 Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992382] ? process_one_work+0x3c0/0x3c0 Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992384] kthread+0x12a/0x150 Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992386] ? set_kthread_struct+0x40/0x40 Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992387] ret_from_fork+0x22/0x30 Jul 8 03:09:44 u-Precision-7865-Towe
ul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992387] ret_from_fork+0x22/0x30 Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992391] </TASK> Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992392] ---[ end trace 1ec8c79604ed5e0d ]--- Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992394] PM: dpm_run_callback(): pci_pm_resume+0x0/0x90 returns -110 Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992397] atlantic 0000:02:00.0: PM: failed to resume async: error -110 References: - https://git.kernel.org/stable/c/c2978d0124f26e453ed30fda6a37f62d8c7f19cb - https://git.kernel.org/stable/c/58c90993933e7a76305519bc70da8c0cd2907c1f - https://git.kernel.org/stable/c/702419db7
b - https://git.kernel.org/stable/c/58c90993933e7a76305519bc70da8c0cd2907c1f - https://git.kernel.org/stable/c/702419db7ded2e3686fbc05040b61d7428d611d5 - https://git.kernel.org/stable/c/2e15c51fefaffaf9f72255eaef4fada05055e4c5
CVE ID: CVE-2022-49625 State: PUBLISHED Published: 2025-02-26T02:23:40.786Z Last Updated: 2025-05-04T08:42:04.336Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: sfc: fix kernel panic when creating VF When creating VFs a kernel panic can happen when calling to efx_ef10_try_update_nic_stats_vf. When releasing a DMA coherent buffer, sometimes, I don't know in what specific circumstances, it has to unmap memory with vunmap. It is disallowed to do that in IRQ context or with BH disabled. Otherwise, we hit this line in vunmap, causing the crash: BUG_ON(in_interrupt()); This patch reenables BH to release the buffer. Log messages when
e in vunmap, causing the crash: BUG_ON(in_interrupt()); This patch reenables BH to release the buffer. Log messages when the bug is hit: kernel BUG at mm/vmalloc.c:2727! invalid opcode: 0000 [#1] PREEMPT SMP NOPTI CPU: 6 PID: 1462 Comm: NetworkManager Kdump: loaded Tainted: G I --------- --- 5.14.0-119.el9.x86_64 #1 Hardware name: Dell Inc. PowerEdge R740/06WXJT, BIOS 2.8.2 08/27/2020 RIP: 0010:vunmap+0x2e/0x30 ...skip... Call Trace: __iommu_dma_free+0x96/0x100 efx_nic_free_buffer+0x2b/0x40 [sfc] efx_ef10_try_update_nic_stats_vf+0x14a/0x1c0 [sfc] efx_ef10_update_stats_vf+0x18/0x40 [sfc] efx_start_all+0x15e/0x1d0 [sfc] efx_net_open+0x5a/0xe0 [sfc] __dev_open+0xe7/0x1a0 __dev_change_flags+0x1d
18/0x40 [sfc] efx_start_all+0x15e/0x1d0 [sfc] efx_net_open+0x5a/0xe0 [sfc] __dev_open+0xe7/0x1a0 __dev_change_flags+0x1d7/0x240 dev_change_flags+0x21/0x60 ...skip... References: - https://git.kernel.org/stable/c/d9840212a9c00507347c703f4fdeda16400407e0 - https://git.kernel.org/stable/c/b9072305270579a9d6afc9b926166231e5b1a7c8 - https://git.kernel.org/stable/c/82bcb730f856086f033e6c04082eb4503d4c2fa4 - https://git.kernel.org/stable/c/da346adcf5573fd8663cabfdfe8371009629a906 - https://git.kernel.org/stable/c/b82e4ad58a7fb72456503958a93060f87896e629 - https://git.kernel.org/stable/c/68e5f32f0de9594629ff9e599294d9801c6187de - https://git.kernel.org/stable/c/16662524ec5da801fb78a1afcaf6e782f1cf10
able/c/68e5f32f0de9594629ff9e599294d9801c6187de - https://git.kernel.org/stable/c/16662524ec5da801fb78a1afcaf6e782f1cf103a - https://git.kernel.org/stable/c/ada74c5539eba06cf8b47d068f92e0b3963a9a6e
CVE ID: CVE-2022-49626 State: PUBLISHED Published: 2025-02-26T02:23:41.274Z Last Updated: 2025-05-04T08:42:05.577Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: sfc: fix use after free when disabling sriov Use after free is detected by kfence when disabling sriov. What was read after being freed was vf->pci_dev: it was freed from pci_disable_sriov and later read in efx_ef10_sriov_free_vf_vports, called from efx_ef10_sriov_free_vf_vswitching. Set the pointer to NULL at release time to not trying to read it later. Reproducer and dmesg log (note that kfence doesn't detect it every time): $ echo 1 > /sys/class/net/enp65s0f0np0/dev