Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-49857 State: PUBLISHED Published: 2025-05-01T14:10:10.892Z Last Updated: 2025-10-01T16:05:57.004Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: marvell: prestera: fix memory leak in prestera_rxtx_switch_init() When prestera_sdma_switch_init() failed, the memory pointed to by sw->rxtx isn't released. Fix it. Only be compiled, not be tested. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/5333cf1b7f6861912aff6263978d4781f9858e47 - https://git.kernel.org/stable/c/409731df6310a33f4d0a3ef594d2410cdcd637f2 - https://git.kernel.org/stable/c/31e5084ac6876e52dbb0a1c
t.kernel.org/stable/c/409731df6310a33f4d0a3ef594d2410cdcd637f2 - https://git.kernel.org/stable/c/31e5084ac6876e52dbb0a1cc4fc18b6c79979f31 - https://git.kernel.org/stable/c/519b58bbfa825f042fcf80261cc18e1e35f85ffd
CVE ID: CVE-2022-49858 State: PUBLISHED Published: 2025-05-01T14:10:11.559Z Last Updated: 2025-05-04T08:47:02.160Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: Fix SQE threshold checking Current way of checking available SQE count which is based on HW updated SQB count could result in driver submitting an SQE even before CQE for the previously transmitted SQE at the same index is processed in NAPI resulting losing SKB pointers, hence a leak. Fix this by checking a consumer index which is updated once CQE is processed. References: - https://git.kernel.org/stable/c/015e3c0a3b16193aab23beefe4719484b9984c2d - https:
d once CQE is processed. References: - https://git.kernel.org/stable/c/015e3c0a3b16193aab23beefe4719484b9984c2d - https://git.kernel.org/stable/c/f0dfc4c88ef39be0ba736aa0ce6119263fc19aeb
CVE ID: CVE-2022-49859 State: PUBLISHED Published: 2025-05-01T14:10:13.204Z Last Updated: 2025-05-04T08:47:03.648Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: lapbether: fix issue of invalid opcode in lapbeth_open() If lapb_register() failed when lapb device goes to up for the first time, the NAPI is not disabled. As a result, the invalid opcode issue is reported when the lapb device goes to up for the second time. The stack info is as follows: [ 1958.311422][T11356] kernel BUG at net/core/dev.c:6442! [ 1958.312206][T11356] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 1958.315979][T11356] RIP: 0010:napi_enable+0x16a/0x
[ 1958.312206][T11356] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 1958.315979][T11356] RIP: 0010:napi_enable+0x16a/0x1f0 [ 1958.332310][T11356] Call Trace: [ 1958.332817][T11356] <TASK> [ 1958.336135][T11356] lapbeth_open+0x18/0x90 [ 1958.337446][T11356] __dev_open+0x258/0x490 [ 1958.341672][T11356] __dev_change_flags+0x4d4/0x6a0 [ 1958.345325][T11356] dev_change_flags+0x93/0x160 [ 1958.346027][T11356] devinet_ioctl+0x1276/0x1bf0 [ 1958.346738][T11356] inet_ioctl+0x1c8/0x2d0 [ 1958.349638][T11356] sock_ioctl+0x5d1/0x750 [ 1958.356059][T11356] __x64_sys_ioctl+0x3ec/0x1790 [ 1958.365594][T11356] do_syscall_64+0x35/0x80 [ 1958.366239][T11356] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 1958.3
[ 1958.365594][T11356] do_syscall_64+0x35/0x80 [ 1958.366239][T11356] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 1958.377381][T11356] </TASK> References: - https://git.kernel.org/stable/c/4689bd3a1b23a1bd917899e63b81bca2ccdfab45 - https://git.kernel.org/stable/c/ed4940050a7ce7fc2ccd51db580ef1ade64290b1 - https://git.kernel.org/stable/c/3faf7e14ec0c3462c2d747fa6793b8645d1391df
CVE ID: CVE-2022-49860 State: PUBLISHED Published: 2025-05-01T14:10:14.212Z Last Updated: 2025-10-01T16:05:45.423Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: k3-udma-glue: fix memory leak when register device fail If device_register() fails, it should call put_device() to give up reference, the name allocated in dev_set_name() can be freed in callback function kobject_cleanup(). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/1dd27541aa2b95bde71bddd43d73f9c16d73272c - https://git.kernel.org/stable/c/025eab5189fc7ee223ae9b4bc49d7df196543e53 - https://git.kernel.
71bddd43d73f9c16d73272c - https://git.kernel.org/stable/c/025eab5189fc7ee223ae9b4bc49d7df196543e53 - https://git.kernel.org/stable/c/ac2b9f34f02052709aea7b34bb2a165e1853eb41
CVE ID: CVE-2022-49861 State: PUBLISHED Published: 2025-05-01T14:10:14.897Z Last Updated: 2025-10-01T16:05:32.664Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: dmaengine: mv_xor_v2: Fix a resource leak in mv_xor_v2_remove() A clk_prepare_enable() call in the probe is not balanced by a corresponding clk_disable_unprepare() in the remove function. Add the missing call. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/04f2cc56d80a1ac058045a7835c5bfd910f17863 - https://git.kernel.org/stable/c/4b6641c3a2ba95ddcfecec263b4a5e572a4b0641 - https://git.kernel.org/stable/c/20479886b40c0ed4
ps://git.kernel.org/stable/c/4b6641c3a2ba95ddcfecec263b4a5e572a4b0641 - https://git.kernel.org/stable/c/20479886b40c0ed4864a5fc8490a1f6b70cccf1b - https://git.kernel.org/stable/c/1d84887327659c58a6637060ac8c50c3a952a163 - https://git.kernel.org/stable/c/0b7ee3d50f32d277bf024b4ddb4de54da43a3025 - https://git.kernel.org/stable/c/992e966caf57e00855edbd79f19d911809732a69 - https://git.kernel.org/stable/c/a1cb72e20a64a3c83f9b4ee993fbf97e4c1d7714 - https://git.kernel.org/stable/c/081195d17a0c4c636da2b869bd5809d42e8cbb13
CVE ID: CVE-2022-49862 State: PUBLISHED Published: 2025-05-01T14:10:15.742Z Last Updated: 2025-10-01T16:11:44.347Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: tipc: fix the msg->req tlv len check in tipc_nl_compat_name_table_dump_header This is a follow-up for commit 974cb0e3e7c9 ("tipc: fix uninit-value in tipc_nl_compat_name_table_dump") where it should have type casted sizeof(..) to int to work when TLV_GET_DATA_LEN() returns a negative value. syzbot reported a call trace because of it: BUG: KMSAN: uninit-value in ... tipc_nl_compat_name_table_dump+0x841/0xea0 net/tipc/netlink_compat.c:934 __tipc_nl_compat_dumpit+0xab2/0x
t-value in ... tipc_nl_compat_name_table_dump+0x841/0xea0 net/tipc/netlink_compat.c:934 __tipc_nl_compat_dumpit+0xab2/0x1320 net/tipc/netlink_compat.c:238 tipc_nl_compat_dumpit+0x991/0xb50 net/tipc/netlink_compat.c:321 tipc_nl_compat_recv+0xb6e/0x1640 net/tipc/netlink_compat.c:1324 genl_family_rcv_msg_doit net/netlink/genetlink.c:731 [inline] genl_family_rcv_msg net/netlink/genetlink.c:775 [inline] genl_rcv_msg+0x103f/0x1260 net/netlink/genetlink.c:792 netlink_rcv_skb+0x3a5/0x6c0 net/netlink/af_netlink.c:2501 genl_rcv+0x3c/0x50 net/netlink/genetlink.c:803 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0xf3b/0x1270 net/netlink/af_netlink.c:1345 netlink_sendmsg+0
rnel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0xf3b/0x1270 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x1288/0x1440 net/netlink/af_netlink.c:1921 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg net/socket.c:734 [inline] Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/082707d3df191bf5bb8801d43e4ce3dea39ca173 - https://git.kernel.org/stable/c/a0ead1d648df9c456baec832b494513ef405949a - https://git.kernel.org/stable/c/55a253a6753a603e80b95932ca971ba514aa6ce7 - https://git.kernel.org/stable/c/36769b9477491a7af6635863bd950309c1e1b96c - https://git.kernel.org/stable/c/f31dd158580940938f77514b87337a777520185a - https://git.k
91a7af6635863bd950309c1e1b96c - https://git.kernel.org/stable/c/f31dd158580940938f77514b87337a777520185a - https://git.kernel.org/stable/c/301caa06091af4d5cf056ac8249cbda4e6029c6a - https://git.kernel.org/stable/c/6cee2c60bd168279852ac7dbe54c2b70d1028644 - https://git.kernel.org/stable/c/1c075b192fe41030457cd4a5f7dea730412bca40
CVE ID: CVE-2022-49863 State: PUBLISHED Published: 2025-05-01T14:10:16.403Z Last Updated: 2025-10-01T16:11:28.153Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: can: af_can: fix NULL pointer dereference in can_rx_register() It causes NULL pointer dereference when testing as following: (a) use syscall(__NR_socket, 0x10ul, 3ul, 0) to create netlink socket. (b) use syscall(__NR_sendmsg, ...) to create bond link device and vxcan link device, and bind vxcan device to bond device (can also use ifenslave command to bind vxcan device to bond device). (c) use syscall(__NR_socket, 0x1dul, 3ul, 1) to create CAN socket. (d) use syscall(__
bind vxcan device to bond device). (c) use syscall(__NR_socket, 0x1dul, 3ul, 1) to create CAN socket. (d) use syscall(__NR_bind, ...) to bind the bond device to CAN socket. The bond device invokes the can-raw protocol registration interface to receive CAN packets. However, ml_priv is not allocated to the dev, dev_rcv_lists is assigned to NULL in can_rx_register(). In this case, it will occur the NULL pointer dereference issue. The following is the stack information: BUG: kernel NULL pointer dereference, address: 0000000000000008 PGD 122a4067 P4D 122a4067 PUD 1223c067 PMD 0 Oops: 0000 [#1] PREEMPT SMP RIP: 0010:can_rx_register+0x12d/0x1e0 Call Trace: <TASK> raw_enable_filters+0x8d/0x120 raw_e
Oops: 0000 [#1] PREEMPT SMP RIP: 0010:can_rx_register+0x12d/0x1e0 Call Trace: <TASK> raw_enable_filters+0x8d/0x120 raw_enable_allfilters+0x3b/0x130 raw_bind+0x118/0x4f0 __sys_bind+0x163/0x1a0 __x64_sys_bind+0x1e/0x30 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd </TASK> Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/afab4655750fcb3fca359bc7d7214e3d634cdf9c - https://git.kernel.org/stable/c/d68fa77ee3d03bad6fe84e89759ddf7005f9e9c6 - https://git.kernel.org/stable/c/261178a1c2623077d62e374a75c195e6c99a6f05 - https://git.kernel.org/stable/c/a8055677b054bc2bb78beb1080fdc2dc5158c2fe - https://git.kernel.org/stable/c/8aa59e3559494
https://git.kernel.org/stable/c/a8055677b054bc2bb78beb1080fdc2dc5158c2fe - https://git.kernel.org/stable/c/8aa59e355949442c408408c2d836e561794c40a1
CVE ID: CVE-2022-49864 State: PUBLISHED Published: 2025-05-01T14:10:17.061Z Last Updated: 2025-10-01T16:05:20.255Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix NULL pointer dereference in svm_migrate_to_ram() ./drivers/gpu/drm/amd/amdkfd/kfd_migrate.c:985:58-62: ERROR: p is NULL but dereferenced. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/3c1bb6187e566143f15dbf0367ae671584aead5b - https://git.kernel.org/stable/c/613d5a9a440828970f1543b962779401ac2c9c62 - https://git.kernel.org/stable/c/5b994354af3cab770bf13386469c5725713679af
CVE ID: CVE-2022-49865 State: PUBLISHED Published: 2025-05-01T14:10:17.673Z Last Updated: 2025-05-04T08:47:15.815Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network When copying a `struct ifaddrlblmsg` to the network, __ifal_reserved remained uninitialized, resulting in a 1-byte infoleak: BUG: KMSAN: kernel-network-infoleak in __netdev_start_xmit ./include/linux/netdevice.h:4841 __netdev_start_xmit ./include/linux/netdevice.h:4841 netdev_start_xmit ./include/linux/netdevice.h:4857 xmit_one net/core/dev.c:3590 dev_hard_start_xmit+0x1dc/0x800 net/core/dev.c:36
art_xmit ./include/linux/netdevice.h:4857 xmit_one net/core/dev.c:3590 dev_hard_start_xmit+0x1dc/0x800 net/core/dev.c:3606 __dev_queue_xmit+0x17e8/0x4350 net/core/dev.c:4256 dev_queue_xmit ./include/linux/netdevice.h:3009 __netlink_deliver_tap_skb net/netlink/af_netlink.c:307 __netlink_deliver_tap+0x728/0xad0 net/netlink/af_netlink.c:325 netlink_deliver_tap net/netlink/af_netlink.c:338 __netlink_sendskb net/netlink/af_netlink.c:1263 netlink_sendskb+0x1d9/0x200 net/netlink/af_netlink.c:1272 netlink_unicast+0x56d/0xf50 net/netlink/af_netlink.c:1360 nlmsg_unicast ./include/net/netlink.h:1061 rtnl_unicast+0x5a/0x80 net/core/rtnetlink.c:758 ip6addrlbl_get+0xfad/0x10f0 net/ipv6/addrlabel.c:628 rtn
/netlink.h:1061 rtnl_unicast+0x5a/0x80 net/core/rtnetlink.c:758 ip6addrlbl_get+0xfad/0x10f0 net/ipv6/addrlabel.c:628 rtnetlink_rcv_msg+0xb33/0x1570 net/core/rtnetlink.c:6082 ... Uninit was created at: slab_post_alloc_hook+0x118/0xb00 mm/slab.h:742 slab_alloc_node mm/slub.c:3398 __kmem_cache_alloc_node+0x4f2/0x930 mm/slub.c:3437 __do_kmalloc_node mm/slab_common.c:954 __kmalloc_node_track_caller+0x117/0x3d0 mm/slab_common.c:975 kmalloc_reserve net/core/skbuff.c:437 __alloc_skb+0x27a/0xab0 net/core/skbuff.c:509 alloc_skb ./include/linux/skbuff.h:1267 nlmsg_new ./include/net/netlink.h:964 ip6addrlbl_get+0x490/0x10f0 net/ipv6/addrlabel.c:608 rtnetlink_rcv_msg+0xb33/0x1570 net/core/rtnetlink.c:608
tlink.h:964 ip6addrlbl_get+0x490/0x10f0 net/ipv6/addrlabel.c:608 rtnetlink_rcv_msg+0xb33/0x1570 net/core/rtnetlink.c:6082 netlink_rcv_skb+0x299/0x550 net/netlink/af_netlink.c:2540 rtnetlink_rcv+0x26/0x30 net/core/rtnetlink.c:6109 netlink_unicast_kernel net/netlink/af_netlink.c:1319 netlink_unicast+0x9ab/0xf50 net/netlink/af_netlink.c:1345 netlink_sendmsg+0xebc/0x10f0 net/netlink/af_netlink.c:1921 ... This patch ensures that the reserved field is always initialized. References: - https://git.kernel.org/stable/c/568a47ff756f913e8b374c2af9d22cd2c772c744 - https://git.kernel.org/stable/c/0f85b7ae7c4b5d7b4bbf7ac653a733c181a8a2bf - https://git.kernel.org/stable/c/6d26d0587abccb9835382a0b53faa7b9b1
g/stable/c/0f85b7ae7c4b5d7b4bbf7ac653a733c181a8a2bf - https://git.kernel.org/stable/c/6d26d0587abccb9835382a0b53faa7b9b1cd83e3 - https://git.kernel.org/stable/c/58cd7fdc8c1e6c7873acc08f190069fed88d1c12 - https://git.kernel.org/stable/c/a033b86c7f7621fde31f0364af8986f43b44914f - https://git.kernel.org/stable/c/2acb2779b147decd300c117683d5a32ce61c75d6 - https://git.kernel.org/stable/c/49e92ba5ecd7d72ba369dde2ccff738edd028a47 - https://git.kernel.org/stable/c/c23fb2c82267638f9d206cb96bb93e1f93ad7828
CVE ID: CVE-2022-49866 State: PUBLISHED Published: 2025-05-01T14:10:18.294Z Last Updated: 2025-10-01T16:05:05.398Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: wwan: mhi: fix memory leak in mhi_mbim_dellink MHI driver registers network device without setting the needs_free_netdev flag, and does NOT call free_netdev() when unregisters network device, which causes a memory leak. This patch sets needs_free_netdev to true when registers network device, which makes netdev subsystem call free_netdev() automatically after unregister_netdevice(). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel
ically after unregister_netdevice(). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/2845bc9070cef0c651987487d84d4813d64675dd - https://git.kernel.org/stable/c/3cd3ffe952f78ec5dadf300cb58d4b38a0c0106d - https://git.kernel.org/stable/c/668205b9c9f94d5ed6ab00cce9a46a654c2b5d16
CVE ID: CVE-2022-49867 State: PUBLISHED Published: 2025-05-01T14:10:19.215Z Last Updated: 2025-10-01T16:04:38.269Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: wwan: iosm: fix memory leak in ipc_wwan_dellink IOSM driver registers network device without setting the needs_free_netdev flag, and does NOT call free_netdev() when unregisters network device, which causes a memory leak. This patch sets needs_free_netdev to true when registers network device, which makes netdev subsystem call free_netdev() automatically after unregister_netdevice(). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kern
atically after unregister_netdevice(). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/2ce2348c2858d723f7fe389dead9b43b08e0944e - https://git.kernel.org/stable/c/128514b51a5ba2c82f9e4a106f1c10423907618a - https://git.kernel.org/stable/c/f25caaca424703d5a0607310f0452f978f1f78d9
CVE ID: CVE-2022-49868 State: PUBLISHED Published: 2025-05-01T14:10:19.853Z Last Updated: 2025-05-04T08:47:19.742Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: phy: ralink: mt7621-pci: add sentinel to quirks table With mt7621 soc_dev_attr fixed to register the soc as a device, kernel will experience an oops in soc_device_match_attr This quirk test was introduced in the staging driver in commit 9445ccb3714c ("staging: mt7621-pci-phy: add quirks for 'E2' revision using 'soc_device_attribute'"). The staging driver was removed, and later re-added in commit d87da32372a0 ("phy: ralink: Add PHY driver for MT7621 PCIe PHY") for kerne
ver was removed, and later re-added in commit d87da32372a0 ("phy: ralink: Add PHY driver for MT7621 PCIe PHY") for kernel 5.11 References: - https://git.kernel.org/stable/c/500bcd3a99eae84412067c3b9e7ffba1c66e6383 - https://git.kernel.org/stable/c/d539cfd1202d66c2dcea383f1d96835ae72d5809 - https://git.kernel.org/stable/c/819b885cd886c193782891c4f51bbcab3de119a4
CVE ID: CVE-2022-49869 State: PUBLISHED Published: 2025-05-01T14:10:20.501Z Last Updated: 2025-10-01T16:04:15.531Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix possible crash in bnxt_hwrm_set_coal() During the error recovery sequence, the rtnl_lock is not held for the entire duration and some datastructures may be freed during the sequence. Check for the BNXT_STATE_OPEN flag instead of netif_running() to ensure that the device is fully operational before proceeding to reconfigure the coalescing settings. This will fix a possible crash like this: BUG: unable to handle kernel NULL pointer dereference at 00000000000
settings. This will fix a possible crash like this: BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 PGD 0 P4D 0 Oops: 0000 [#1] SMP NOPTI CPU: 10 PID: 181276 Comm: ethtool Kdump: loaded Tainted: G IOE --------- - - 4.18.0-348.el8.x86_64 #1 Hardware name: Dell Inc. PowerEdge R740/0F9N89, BIOS 2.3.10 08/15/2019 RIP: 0010:bnxt_hwrm_set_coal+0x1fb/0x2a0 [bnxt_en] Code: c2 66 83 4e 22 08 66 89 46 1c e8 10 cb 00 00 41 83 c6 01 44 39 b3 68 01 00 00 0f 8e a3 00 00 00 48 8b 93 c8 00 00 00 49 63 c6 <48> 8b 2c c2 48 8b 85 b8 02 00 00 48 85 c0 74 2e 48 8b 74 24 08 f6 RSP: 0018:ffffb11c8dcaba50 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff8d168a8b0ac0 RCX: 00000000000000c5 RD
4 08 f6 RSP: 0018:ffffb11c8dcaba50 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff8d168a8b0ac0 RCX: 00000000000000c5 RDX: 0000000000000000 RSI: ffff8d162f72c000 RDI: ffff8d168a8b0b28 RBP: 0000000000000000 R08: b6e1f68a12e9a7eb R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000037 R12: ffff8d168a8b109c R13: ffff8d168a8b10aa R14: 0000000000000000 R15: ffffffffc01ac4e0 FS: 00007f3852e4c740(0000) GS:ffff8d24c0080000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000041b3ee003 CR4: 00000000007706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 000000000000
00000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: ethnl_set_coalesce+0x3ce/0x4c0 genl_family_rcv_msg_doit.isra.15+0x10f/0x150 genl_family_rcv_msg+0xb3/0x160 ? coalesce_fill_reply+0x480/0x480 genl_rcv_msg+0x47/0x90 ? genl_family_rcv_msg+0x160/0x160 netlink_rcv_skb+0x4c/0x120 genl_rcv+0x24/0x40 netlink_unicast+0x196/0x230 netlink_sendmsg+0x204/0x3d0 sock_sendmsg+0x4c/0x50 __sys_sendto+0xee/0x160 ? syscall_trace_enter+0x1d3/0x2c0 ? __audit_syscall_exit+0x249/0x2a0 __x64_sys_sendto+0x24/0x30 do_syscall_64+0x5b/0x1a0 entry_SYSCALL_64_after_hwframe+0x65/0xca RIP: 0033:0x7f38524163bb Additional Ana
ndto+0x24/0x30 do_syscall_64+0x5b/0x1a0 entry_SYSCALL_64_after_hwframe+0x65/0xca RIP: 0033:0x7f38524163bb Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/a5a05fbef4a0dfe45fe03b2f1d02ba23aebf5384 - https://git.kernel.org/stable/c/38147073c96dce8c7e142ce0e5f305a420a729ba - https://git.kernel.org/stable/c/ac257c43fa615d22180916074feed803b8bb8cb0 - https://git.kernel.org/stable/c/7781e32984cde65549bedc3201537e253297c98d - https://git.kernel.org/stable/c/6d81ea3765dfa6c8a20822613c81edad1c4a16a0
CVE ID: CVE-2022-49870 State: PUBLISHED Published: 2025-05-01T14:10:21.134Z Last Updated: 2025-05-04T08:47:22.346Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: capabilities: fix undefined behavior in bit shift for CAP_TO_MASK Shifting signed 32-bit value by 31 bits is undefined, so changing significant bit to unsigned. The UBSAN warning calltrace like below: UBSAN: shift-out-of-bounds in security/commoncap.c:1252:2 left shift of 1 by 31 places cannot be represented in type 'int' Call Trace: <TASK> dump_stack_lvl+0x7d/0xa5 dump_stack+0x15/0x1b ubsan_epilogue+0xe/0x4e __ubsan_handle_shift_out_of_bounds+0x1e7/0x20c cap_task_prct
_lvl+0x7d/0xa5 dump_stack+0x15/0x1b ubsan_epilogue+0xe/0x4e __ubsan_handle_shift_out_of_bounds+0x1e7/0x20c cap_task_prctl+0x561/0x6f0 security_task_prctl+0x5a/0xb0 __x64_sys_prctl+0x61/0x8f0 do_syscall_64+0x58/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd </TASK> References: - https://git.kernel.org/stable/c/5b79fa628e2ab789e629a83cd211ef9b4c1a593e - https://git.kernel.org/stable/c/65b0bc7a0690861812ade523d19f82688ab819dc - https://git.kernel.org/stable/c/dbaab08c8677d598244d21afb7818e44e1c5d826 - https://git.kernel.org/stable/c/5661f111a1616ac105ec8cec81bff99b60f847ac - https://git.kernel.org/stable/c/fcbd2b336834bd24e1d9454ad5737856470c10d7 - https://git.kernel.org/stable/c/151dc8087b5609e
tps://git.kernel.org/stable/c/fcbd2b336834bd24e1d9454ad5737856470c10d7 - https://git.kernel.org/stable/c/151dc8087b5609e53b069c068e3f3ee100efa586 - https://git.kernel.org/stable/c/27bdb134c043ff32c459d98f16550d0ffa0b3c34 - https://git.kernel.org/stable/c/46653972e3ea64f79e7f8ae3aa41a4d3fdb70a13
CVE ID: CVE-2022-49871 State: PUBLISHED Published: 2025-05-01T14:10:21.760Z Last Updated: 2025-10-01T16:03:58.029Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: tun: Fix memory leaks of napi_get_frags kmemleak reports after running test_progs: unreferenced object 0xffff8881b1672dc0 (size 232): comm "test_progs", pid 394388, jiffies 4354712116 (age 841.975s) hex dump (first 32 bytes): e0 84 d7 a8 81 88 ff ff 80 2c 67 b1 81 88 ff ff .........,g..... 00 40 c5 9b 81 88 ff ff 00 00 00 00 00 00 00 00 .@.............. backtrace: [<00000000c8f01748>] napi_skb_cache_get+0xd4/0x150 [<0000000041c7fc09>] __napi_build_skb+0x15/0x50 [<
....... backtrace: [<00000000c8f01748>] napi_skb_cache_get+0xd4/0x150 [<0000000041c7fc09>] __napi_build_skb+0x15/0x50 [<00000000431c7079>] __napi_alloc_skb+0x26e/0x540 [<000000003ecfa30e>] napi_get_frags+0x59/0x140 [<0000000099b2199e>] tun_get_user+0x183d/0x3bb0 [tun] [<000000008a5adef0>] tun_chr_write_iter+0xc0/0x1b1 [tun] [<0000000049993ff4>] do_iter_readv_writev+0x19f/0x320 [<000000008f338ea2>] do_iter_write+0x135/0x630 [<000000008a3377a4>] vfs_writev+0x12e/0x440 [<00000000a6b5639a>] do_writev+0x104/0x280 [<00000000ccf065d8>] do_syscall_64+0x3b/0x90 [<00000000d776e329>] entry_SYSCALL_64_after_hwframe+0x63/0xcd The issue occurs in the following scenarios: tun_get_user() napi_gro_frags() na