Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-49915 State: PUBLISHED Published: 2025-05-01T14:10:56.208Z Last Updated: 2025-10-01T16:00:35.098Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mISDN: fix possible memory leak in mISDN_register_device() Afer commit 1fa5ae857bb1 ("driver core: get rid of struct device's bus_id string array"), the name of device is allocated dynamically, add put_device() to give up the reference, so that the name can be freed in kobject_cleanup() when the refcount is 0. Set device class before put_device() to avoid null release() function WARN message in device_release(). Additional Analyst Notes: - CISA ADP Vulnrichment: Refere
void null release() function WARN message in device_release(). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/d1d1aede313eb2b9a84afd60ff6cfb7c33631e0e - https://git.kernel.org/stable/c/080aabfb29b2ee9cbb8894a1d039651943d3773e - https://git.kernel.org/stable/c/a636fc5a7cabd05699b5692ad838c2c7a3abec7b - https://git.kernel.org/stable/c/2ff6b669523d3b3d253a044fa9636a67d0694995 - https://git.kernel.org/stable/c/e77d213843e67b4373285712699b692f9c743f61 - https://git.kernel.org/stable/c/029d5b7688a2f3a86f2a3be5a6ba9cc968c80e41 - https://git.kernel.org/stable/c/0d4e91efcaee081e919b3c50e875ecbb84290e41 - https://git.kernel.org/stable/c/e7d1d4d9ac0dfa4
tps://git.kernel.org/stable/c/0d4e91efcaee081e919b3c50e875ecbb84290e41 - https://git.kernel.org/stable/c/e7d1d4d9ac0dfa40be4c2c8abd0731659869b297
CVE ID: CVE-2022-49916 State: PUBLISHED Published: 2025-05-01T14:10:56.851Z Last Updated: 2025-10-01T16:00:19.393Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: rose: Fix NULL pointer dereference in rose_send_frame() The syzkaller reported an issue: KASAN: null-ptr-deref in range [0x0000000000000380-0x0000000000000387] CPU: 0 PID: 4069 Comm: kworker/0:15 Not tainted 6.0.0-syzkaller-02734-g0326074ff465 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022 Workqueue: rcu_gp srcu_invoke_callbacks RIP: 0010:rose_send_frame+0x1dd/0x2f0 net/rose/rose_link.c:101 Call Trace: <IRQ> rose_transmit_c
p srcu_invoke_callbacks RIP: 0010:rose_send_frame+0x1dd/0x2f0 net/rose/rose_link.c:101 Call Trace: <IRQ> rose_transmit_clear_request+0x1d5/0x290 net/rose/rose_link.c:255 rose_rx_call_request+0x4c0/0x1bc0 net/rose/af_rose.c:1009 rose_loopback_timer+0x19e/0x590 net/rose/rose_loopback.c:111 call_timer_fn+0x1a0/0x6b0 kernel/time/timer.c:1474 expire_timers kernel/time/timer.c:1519 [inline] __run_timers.part.0+0x674/0xa80 kernel/time/timer.c:1790 __run_timers kernel/time/timer.c:1768 [inline] run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1803 __do_softirq+0x1d0/0x9c8 kernel/softirq.c:571 [...] </IRQ> It triggers NULL pointer dereference when 'neigh->dev->dev_addr' is called in the rose_send_fra
ftirq.c:571 [...] </IRQ> It triggers NULL pointer dereference when 'neigh->dev->dev_addr' is called in the rose_send_frame(). It's the first occurrence of the `neigh` is in rose_loopback_timer() as `rose_loopback_neigh', and the 'dev' in 'rose_loopback_neigh' is initialized sa nullptr. It had been fixed by commit 3b3fd068c56e3fbea30090859216a368398e39bf ("rose: Fix Null pointer dereference in rose_send_frame()") ever. But it's introduced by commit 3c53cd65dece47dd1f9d3a809f32e59d1d87b2b8 ("rose: check NULL rose_loopback_neigh->loopback") again. We fix it by add NULL check in rose_transmit_clear_request(). When the 'dev' in 'neigh' is NULL, we don't reply the request and just clear it. syzkal
n rose_transmit_clear_request(). When the 'dev' in 'neigh' is NULL, we don't reply the request and just clear it. syzkaller don't provide repro, and I provide a syz repro like: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={'rose0\x00', 0x201}) r1 = syz_init_net_socket$rose(0xb, 0x5, 0x0) bind$rose(r1, &(0x7f00000000c0)=@full={0xb, @dev, @null, 0x0, [@null, @null, @netrom, @netrom, @default, @null]}, 0x40) connect$rose(r1, &(0x7f0000000240)=@short={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x1, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}}, 0x1c) Additional Analyst Notes: - CISA
0xcc, 0xcc, 0xcc, 0x1}, 0x1, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}}, 0x1c) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/01b9c68c121847d05a4ccef68244dadf82bfa331 - https://git.kernel.org/stable/c/bbc03d74e641e824754443b908454ca9e203773e - https://git.kernel.org/stable/c/5b46adfbee1e429f33b10a88d6c00fa88f3d6c77 - https://git.kernel.org/stable/c/b13be5e852b03f376058027e462fad4230240891 - https://git.kernel.org/stable/c/f06186e5271b980bac03f5c97276ed0146ddc9b0 - https://git.kernel.org/stable/c/3e2129c67daca21043a26575108f6286c85e71f6 - https://git.kernel.org/stable/c/a601e5eded33bb88b8a42743db8fef3ad41dd97e - https://git.kernel.org/
575108f6286c85e71f6 - https://git.kernel.org/stable/c/a601e5eded33bb88b8a42743db8fef3ad41dd97e - https://git.kernel.org/stable/c/e97c089d7a49f67027395ddf70bf327eeac2611e
CVE ID: CVE-2022-49917 State: PUBLISHED Published: 2025-05-01T14:10:57.477Z Last Updated: 2025-05-04T08:48:39.357Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ipvs: fix WARNING in ip_vs_app_net_cleanup() During the initialization of ip_vs_app_net_init(), if file ip_vs_app fails to be created, the initialization is successful by default. Therefore, the ip_vs_app file doesn't be found during the remove in ip_vs_app_net_cleanup(). It will cause WRNING. The following is the stack information: name 'ip_vs_app' WARNING: CPU: 1 PID: 9 at fs/proc/generic.c:712 remove_proc_entry+0x389/0x460 Modules linked in: Workqueue: netns cleanup
ARNING: CPU: 1 PID: 9 at fs/proc/generic.c:712 remove_proc_entry+0x389/0x460 Modules linked in: Workqueue: netns cleanup_net RIP: 0010:remove_proc_entry+0x389/0x460 Call Trace: <TASK> ops_exit_list+0x125/0x170 cleanup_net+0x4ea/0xb00 process_one_work+0x9bf/0x1710 worker_thread+0x665/0x1080 kthread+0x2e4/0x3a0 ret_from_fork+0x1f/0x30 </TASK> References: - https://git.kernel.org/stable/c/adc76740ccd52e4a1d910767cd1223e134a7078b - https://git.kernel.org/stable/c/8457a00c981fe1a799ce34123908856b0f5973b8 - https://git.kernel.org/stable/c/2c8d81bdb2684d53d6cedad7410ba4cf9090e343 - https://git.kernel.org/stable/c/06d7596d18725f1a93cf817662d36050e5afb989 - https://git.kernel.org/stable/c/97f872b0093
- https://git.kernel.org/stable/c/06d7596d18725f1a93cf817662d36050e5afb989 - https://git.kernel.org/stable/c/97f872b00937f2689bff2dab4ad9ed259482840f - https://git.kernel.org/stable/c/5663ed63adb9619c98ab7479aa4606fa9b7a548c
CVE ID: CVE-2022-49918 State: PUBLISHED Published: 2025-05-01T14:10:58.128Z Last Updated: 2025-05-04T08:48:40.828Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ipvs: fix WARNING in __ip_vs_cleanup_batch() During the initialization of ip_vs_conn_net_init(), if file ip_vs_conn or ip_vs_conn_sync fails to be created, the initialization is successful by default. Therefore, the ip_vs_conn or ip_vs_conn_sync file doesn't be found during the remove. The following is the stack information: name 'ip_vs_conn_sync' WARNING: CPU: 3 PID: 9 at fs/proc/generic.c:712 remove_proc_entry+0x389/0x460 Modules linked in: Workqueue: netns cleanup_n
NING: CPU: 3 PID: 9 at fs/proc/generic.c:712 remove_proc_entry+0x389/0x460 Modules linked in: Workqueue: netns cleanup_net RIP: 0010:remove_proc_entry+0x389/0x460 Call Trace: <TASK> __ip_vs_cleanup_batch+0x7d/0x120 ops_exit_list+0x125/0x170 cleanup_net+0x4ea/0xb00 process_one_work+0x9bf/0x1710 worker_thread+0x665/0x1080 kthread+0x2e4/0x3a0 ret_from_fork+0x1f/0x30 </TASK> References: - https://git.kernel.org/stable/c/f08ee2aa24c076f81d84e26e213d8c6f4efd9f50 - https://git.kernel.org/stable/c/7effc4ce3d1434ce6ff286866585a6e905fdbfc1 - https://git.kernel.org/stable/c/931f56d59c854263b32075bfac56fdb3b1598d1b - https://git.kernel.org/stable/c/5ee2d6b726b0ce339e36569e5849692f4cf4595e - https://git.
854263b32075bfac56fdb3b1598d1b - https://git.kernel.org/stable/c/5ee2d6b726b0ce339e36569e5849692f4cf4595e - https://git.kernel.org/stable/c/e724220b826e008764309d2a1f55a9434a4e1530 - https://git.kernel.org/stable/c/3d00c6a0da8ddcf75213e004765e4a42acc71d5d
CVE ID: CVE-2022-49919 State: PUBLISHED Published: 2025-05-01T14:10:58.779Z Last Updated: 2025-10-01T15:59:42.758Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: release flow rule object from commit path No need to postpone this to the commit release path, since no packets are walking over this object, this is accessed from control plane only. This helped uncovered UAF triggered by races with the netlink notifier. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/74fd5839467054cd9c4d050614d3ee8788386171 - https://git.kernel.org/stable/c/b2d7a92aff0fbd93c29d2aa
t.kernel.org/stable/c/74fd5839467054cd9c4d050614d3ee8788386171 - https://git.kernel.org/stable/c/b2d7a92aff0fbd93c29d2aa6451fb99f050e2c4e - https://git.kernel.org/stable/c/6044791b7be707fd0e709f26e961a446424e5051 - https://git.kernel.org/stable/c/4ab6f96444e936f5e4a936d5c0bc948144bcded3 - https://git.kernel.org/stable/c/26b5934ff4194e13196bedcba373cd4915071d0e
CVE ID: CVE-2022-49920 State: PUBLISHED Published: 2025-05-01T14:10:59.436Z Last Updated: 2025-10-01T14:58:46.228Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: netlink notifier might race to release objects commit release path is invoked via call_rcu and it runs lockless to release the objects after rcu grace period. The netlink notifier handler might win race to remove objects that the transaction context is still referencing from the commit release path. Call rcu_barrier() to ensure pending rcu callbacks run to completion if the list of transactions to be destroyed is not empty. Additional Analyst Note
ending rcu callbacks run to completion if the list of transactions to be destroyed is not empty. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/1ffe7100411a8b9015115ce124cd6c9c9da6f8e3 - https://git.kernel.org/stable/c/e40b7c44d19e327ad8b49a491ef1fa8dcc4566e0 - https://git.kernel.org/stable/c/d4bc8271db21ea9f1c86a1ca4d64999f184d4aae
CVE ID: CVE-2022-49921 State: PUBLISHED Published: 2025-05-01T14:11:00.309Z Last Updated: 2025-10-01T14:58:31.797Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: sched: Fix use after free in red_enqueue() We can't use "skb" again after passing it to qdisc_enqueue(). This is basically identical to commit 2f09707d0c97 ("sch_sfb: Also store skb len before calling child enqueue"). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/795afe0b9bb6c915f0299a8e309936519be01619 - https://git.kernel.org/stable/c/a238cdcf2bdc72207c74375fc8be13ee549ca9db - https://git.kernel.org/stable/c/e87
be01619 - https://git.kernel.org/stable/c/a238cdcf2bdc72207c74375fc8be13ee549ca9db - https://git.kernel.org/stable/c/e877f8fa49fbccc63cb2df2e9179bddc695b825a - https://git.kernel.org/stable/c/52e0429471976785c155bfbf51d80990c6cd46e2 - https://git.kernel.org/stable/c/5960b9081baca85cc7dcb14aec1de85999ea9d36 - https://git.kernel.org/stable/c/fc4b50adb400ee5ec527a04073174e8e73a139fa - https://git.kernel.org/stable/c/170e5317042c302777ed6d59fdb84af9b0219d4e - https://git.kernel.org/stable/c/8bdc2acd420c6f3dd1f1c78750ec989f02a1e2b9
CVE ID: CVE-2022-49922 State: PUBLISHED Published: 2025-05-01T14:11:01.010Z Last Updated: 2025-10-01T14:58:08.889Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: nfc: nfcmrvl: Fix potential memory leak in nfcmrvl_i2c_nci_send() nfcmrvl_i2c_nci_send() will be called by nfcmrvl_nci_send(), and skb should be freed in nfcmrvl_i2c_nci_send(). However, nfcmrvl_nci_send() will only free skb when i2c_master_send() return >=0, which means skb will memleak when i2c_master_send() failed. Free skb no matter whether i2c_master_send() succeeds. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/d
ster_send() succeeds. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/dd0ee55ead91fbb16889dbe7ff0b0f7c9e4e849d - https://git.kernel.org/stable/c/825656ae61e73ddc05f585e6258d284c87064b10 - https://git.kernel.org/stable/c/c8e7d4a1166f063703955f1b2e765a6db5bf1771 - https://git.kernel.org/stable/c/f30060efcf18883748a0541aa41acef183cd9c0e - https://git.kernel.org/stable/c/52438e734c1566f5e2bcd9a065d2d65e306c0555 - https://git.kernel.org/stable/c/5dfdac5e3f8db5f4445228c44f64091045644a3b - https://git.kernel.org/stable/c/92a1df9c6da20c02cf9872f8b025a66ddb307aeb - https://git.kernel.org/stable/c/93d904a734a74c54d945a9884b4962977f1176cd
CVE ID: CVE-2022-49923 State: PUBLISHED Published: 2025-05-01T14:11:02.652Z Last Updated: 2025-10-01T14:57:51.022Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: nfc: nxp-nci: Fix potential memory leak in nxp_nci_send() nxp_nci_send() will call nxp_nci_i2c_write(), and only free skb when nxp_nci_i2c_write() failed. However, even if the nxp_nci_i2c_write() run succeeds, the skb will not be freed in nxp_nci_i2c_write(). As the result, the skb will memleak. nxp_nci_send() should also free the skb when nxp_nci_i2c_write() succeeds. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/9ae2
_write() succeeds. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/9ae2c9a91ff068f4c3e392f47e8e26a1c9f85ebb - https://git.kernel.org/stable/c/3cba1f061bfe23fece2841129ca2862cdec29d5c - https://git.kernel.org/stable/c/3ecf0f4227029b2c42e036b10ff6e5d09e20821e - https://git.kernel.org/stable/c/7bf1ed6aff0f70434bd0cdd45495e83f1dffb551
CVE ID: CVE-2022-49924 State: PUBLISHED Published: 2025-05-01T14:11:03.328Z Last Updated: 2025-10-01T14:57:39.073Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: nfc: fdp: Fix potential memory leak in fdp_nci_send() fdp_nci_send() will call fdp_nci_i2c_write that will not free skb in the function. As a result, when fdp_nci_i2c_write() finished, the skb will memleak. fdp_nci_send() should free skb after fdp_nci_i2c_write() finished. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/e8c11ee2d07f7c4dfa2ac0ea8efc4f627e58ea57 - https://git.kernel.org/stable/c/44bc1868a4f542502ea2221fe5a
rnel.org/stable/c/e8c11ee2d07f7c4dfa2ac0ea8efc4f627e58ea57 - https://git.kernel.org/stable/c/44bc1868a4f542502ea2221fe5ad88ca66d1c6b6 - https://git.kernel.org/stable/c/1a7a898f8f7b56c0eaa2baf67a0c96235a30bc29 - https://git.kernel.org/stable/c/8e4aae6b8ca76afb1fb64dcb24be44ba814e7f8a
CVE ID: CVE-2022-49925 State: PUBLISHED Published: 2025-05-01T14:11:03.960Z Last Updated: 2025-10-01T14:57:17.421Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix null-ptr-deref in ib_core_cleanup() KASAN reported a null-ptr-deref error: KASAN: null-ptr-deref in range [0x0000000000000118-0x000000000000011f] CPU: 1 PID: 379 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) RIP: 0010:destroy_workqueue+0x2f/0x740 RSP: 0018:ffff888016137df8 EFLAGS: 00000202 ... Call Trace: ib_core_cleanup+0xa/0xa1 [ib_core] __do_sys_delete_module.constprop.0+0x34f/0x5b0 do_syscall_64+0x3a/0x90 entry_SYSCALL_64_after_hwframe+0x63/0
1 [ib_core] __do_sys_delete_module.constprop.0+0x34f/0x5b0 do_syscall_64+0x3a/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fa1a0d221b7 ... It is because the fail of roce_gid_mgmt_init() is ignored: ib_core_init() roce_gid_mgmt_init() gid_cache_wq = alloc_ordered_workqueue # fail ... ib_core_cleanup() roce_gid_mgmt_cleanup() destroy_workqueue(gid_cache_wq) # destroy an unallocated wq Fix this by catching the fail of roce_gid_mgmt_init() in ib_core_init(). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/af8fb5a0600e9ae29950e9422a032c3c22649ee5 - https://git.kernel.org/stable/c/d360e875c011a005628525bf290322058927e7dc - https://git.
0e9ae29950e9422a032c3c22649ee5 - https://git.kernel.org/stable/c/d360e875c011a005628525bf290322058927e7dc - https://git.kernel.org/stable/c/6b3d5dcb12347f3518308c2c9d2cf72453a3e1e5 - https://git.kernel.org/stable/c/ab817f75e5e0fa58d9be0825da6a7b7d8a1fa1d9 - https://git.kernel.org/stable/c/07c0d131cc0fe1f3981a42958fc52d573d303d89
CVE ID: CVE-2022-49926 State: PUBLISHED Published: 2025-05-01T14:11:04.691Z Last Updated: 2025-10-01T14:56:58.099Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: dsa: Fix possible memory leaks in dsa_loop_init() kmemleak reported memory leaks in dsa_loop_init(): kmemleak: 12 new suspected memory leaks unreferenced object 0xffff8880138ce000 (size 2048): comm "modprobe", pid 390, jiffies 4295040478 (age 238.976s) backtrace: [<000000006a94f1d5>] kmalloc_trace+0x26/0x60 [<00000000a9c44622>] phy_device_create+0x5d/0x970 [<00000000d0ee2afc>] get_phy_device+0xf3/0x2b0 [<00000000dca0c71f>] __fixed_phy_register.part.0+0x92/0x4e0 [<
0x5d/0x970 [<00000000d0ee2afc>] get_phy_device+0xf3/0x2b0 [<00000000dca0c71f>] __fixed_phy_register.part.0+0x92/0x4e0 [<000000008a834798>] fixed_phy_register+0x84/0xb0 [<0000000055223fcb>] dsa_loop_init+0xa9/0x116 [dsa_loop] ... There are two reasons for memleak in dsa_loop_init(). First, fixed_phy_register() create and register phy_device: fixed_phy_register() get_phy_device() phy_device_create() # freed by phy_device_free() phy_device_register() # freed by phy_device_remove() But fixed_phy_unregister() only calls phy_device_remove(). So the memory allocated in phy_device_create() is leaked. Second, when mdio_driver_register() fail in dsa_loop_init(), it just returns and there is no cleanup
create() is leaked. Second, when mdio_driver_register() fail in dsa_loop_init(), it just returns and there is no cleanup for phydevs. Fix the problems by catching the error of mdio_driver_register() in dsa_loop_init(), then calling both fixed_phy_unregister() and phy_device_free() to release phydevs. Also add a function for phydevs cleanup to avoid duplacate. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/935b4beb724946a37cebf97191592d4879d3a3a3 - https://git.kernel.org/stable/c/d593e1ede655b74c42e4e4fe285ea64aee96fb5c - https://git.kernel.org/stable/c/bbc5d7b46a729bfcbb5544f6612b7a67dd4f4d6f - https://git.kernel.org/stable/c/37a098fc9b42bd7f
ps://git.kernel.org/stable/c/bbc5d7b46a729bfcbb5544f6612b7a67dd4f4d6f - https://git.kernel.org/stable/c/37a098fc9b42bd7fce66764866aa514639667b6e - https://git.kernel.org/stable/c/9f555b1584fc2d5d16ee3c4d9438e93ac7c502c7 - https://git.kernel.org/stable/c/4d2024b138d9f7b02ae13ee997fd3a71e9e46254 - https://git.kernel.org/stable/c/633efc8b3dc96f56f5a57f2a49764853a2fa3f50
CVE ID: CVE-2022-49927 State: PUBLISHED Published: 2025-05-01T14:11:05.404Z Last Updated: 2025-10-01T14:56:45.495Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: nfs4: Fix kmemleak when allocate slot failed If one of the slot allocate failed, should cleanup all the other allocated slots, otherwise, the allocated slots will leak: unreferenced object 0xffff8881115aa100 (size 64): comm ""mount.nfs"", pid 679, jiffies 4294744957 (age 115.037s) hex dump (first 32 bytes): 00 cc 19 73 81 88 ff ff 00 a0 5a 11 81 88 ff ff ...s......Z..... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<000000007a4c434a>] nf
ff ...s......Z..... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<000000007a4c434a>] nfs4_find_or_create_slot+0x8e/0x130 [<000000005472a39c>] nfs4_realloc_slot_table+0x23f/0x270 [<00000000cd8ca0eb>] nfs40_init_client+0x4a/0x90 [<00000000128486db>] nfs4_init_client+0xce/0x270 [<000000008d2cacad>] nfs4_set_client+0x1a2/0x2b0 [<000000000e593b52>] nfs4_create_server+0x300/0x5f0 [<00000000e4425dd2>] nfs4_try_get_tree+0x65/0x110 [<00000000d3a6176f>] vfs_get_tree+0x41/0xf0 [<0000000016b5ad4c>] path_mount+0x9b3/0xdd0 [<00000000494cae71>] __x64_sys_mount+0x190/0x1d0 [<000000005d56bdec>] do_syscall_64+0x35/0x80 [<00000000687c9ae4>] entry_SYSCALL_64_after_hwframe+0x46/0
ount+0x190/0x1d0 [<000000005d56bdec>] do_syscall_64+0x35/0x80 [<00000000687c9ae4>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/84b5cb476903003ae9ca88f32b57ff0eaefa6d4c - https://git.kernel.org/stable/c/aae35a0c8a775fa4afa6a4e7dab3f936f1f89bbb - https://git.kernel.org/stable/c/86ce0e93cf6fb4d0c447323ac66577c642628b9d - https://git.kernel.org/stable/c/925cb538bd5851154602818dc80bf4b4d924c127 - https://git.kernel.org/stable/c/45aea4fbf61e205649c29200726b9f45c1718a67 - https://git.kernel.org/stable/c/24641993a7dce6b1628645f4e1d97ca06c9f765d - https://git.kernel.org/stable/c/db333ae981fb8843c383aa7dbf62c
el.org/stable/c/24641993a7dce6b1628645f4e1d97ca06c9f765d - https://git.kernel.org/stable/c/db333ae981fb8843c383aa7dbf62cc682597d401 - https://git.kernel.org/stable/c/7e8436728e22181c3f12a5dbabd35ed3a8b8c593
CVE ID: CVE-2022-49928 State: PUBLISHED Published: 2025-05-01T14:11:06.068Z Last Updated: 2025-10-01T14:56:34.636Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix null-ptr-deref when xps sysfs alloc failed There is a null-ptr-deref when xps sysfs alloc failed: BUG: KASAN: null-ptr-deref in sysfs_do_create_link_sd+0x40/0xd0 Read of size 8 at addr 0000000000000030 by task gssproxy/457 CPU: 5 PID: 457 Comm: gssproxy Not tainted 6.0.0-09040-g02357b27ee03 #9 Call Trace: <TASK> dump_stack_lvl+0x34/0x44 kasan_report+0xa3/0x120 sysfs_do_create_link_sd+0x40/0xd0 rpc_sysfs_client_setup+0x161/0x1b0 rpc_new_client+0x3fc/0x6e0 rp
san_report+0xa3/0x120 sysfs_do_create_link_sd+0x40/0xd0 rpc_sysfs_client_setup+0x161/0x1b0 rpc_new_client+0x3fc/0x6e0 rpc_create_xprt+0x71/0x220 rpc_create+0x1d4/0x350 gssp_rpc_create+0xc3/0x160 set_gssp_clnt+0xbc/0x140 write_gssp+0x116/0x1a0 proc_reg_write+0xd6/0x130 vfs_write+0x177/0x690 ksys_write+0xb9/0x150 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 When the xprt_switch sysfs alloc failed, should not add xprt and switch sysfs to it, otherwise, maybe null-ptr-deref; also initialize the 'xps_sysfs' to NULL to avoid oops when destroy it. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/d59722d088a9d86ce6d9d39979e5d1d669d2
alyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/d59722d088a9d86ce6d9d39979e5d1d669d249f7 - https://git.kernel.org/stable/c/7b189b0aa8dab14b49c31c65af8a982e96e25b62 - https://git.kernel.org/stable/c/cbdeaee94a415800c65a8c3fa04d9664a8b8fb3a
CVE ID: CVE-2022-49929 State: PUBLISHED Published: 2025-05-01T14:11:06.721Z Last Updated: 2025-05-04T08:48:59.667Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix mr leak in RESPST_ERR_RNR rxe_recheck_mr() will increase mr's ref_cnt, so we should call rxe_put(mr) to drop mr's ref_cnt in RESPST_ERR_RNR to avoid below warning: WARNING: CPU: 0 PID: 4156 at drivers/infiniband/sw/rxe/rxe_pool.c:259 __rxe_cleanup+0x1df/0x240 [rdma_rxe] ... Call Trace: rxe_dereg_mr+0x4c/0x60 [rdma_rxe] ib_dereg_mr_user+0xa8/0x200 [ib_core] ib_mr_pool_destroy+0x77/0xb0 [ib_core] nvme_rdma_destroy_queue_ib+0x89/0x240 [nvme_rdma] nvme_rdma_f