Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
96c10a56037db006ba6769307a9731cf6073be - https://git.kernel.org/stable/c/e293263248f25c6b8aa1caf7c1103d40aa03311e - https://git.kernel.org/stable/c/c0539d5d474ee6fa4ebc41f927a0f98f81244f25 - https://git.kernel.org/stable/c/3485f197518061371568f842405159aa9e4df551 - https://git.kernel.org/stable/c/48f32b9a74e2ac8e854bb87bfefdbc745125a123 - https://git.kernel.org/stable/c/bd66877c0b3b42eed0ecee0bd2a2a505c1e54177 - https://git.kernel.org/stable/c/1ff9dd6e7071a561f803135c1d684b13c7a7d01d
CVE ID: CVE-2022-50319 State: PUBLISHED Published: 2025-09-15T14:48:52.017Z Last Updated: 2025-09-15T14:48:52.017Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: coresight: trbe: remove cpuhp instance node before remove cpuhp state cpuhp_state_add_instance() and cpuhp_state_remove_instance() should be used in pairs. Or there will lead to the warn on cpuhp_remove_multi_state() since the cpuhp_step list is not empty. The following is the error log with 'rmmod coresight-trbe': Error: Removing state 215 which has instances left. Call trace: __cpuhp_remove_state_cpuslocked+0x144/0x160 __cpuhp_remove_state+0xac/0x100 arm_trbe_device_
instances left. Call trace: __cpuhp_remove_state_cpuslocked+0x144/0x160 __cpuhp_remove_state+0xac/0x100 arm_trbe_device_remove+0x2c/0x60 [coresight_trbe] platform_remove+0x34/0x70 device_remove+0x54/0x90 device_release_driver_internal+0x1e4/0x250 driver_detach+0x5c/0xb0 bus_remove_driver+0x64/0xc0 driver_unregister+0x3c/0x70 platform_driver_unregister+0x20/0x30 arm_trbe_exit+0x1c/0x658 [coresight_trbe] __arm64_sys_delete_module+0x1ac/0x24c invoke_syscall+0x50/0x120 el0_svc_common.constprop.0+0x58/0x1a0 do_el0_svc+0x38/0xd0 el0_svc+0x2c/0xc0 el0t_64_sync_handler+0x1ac/0x1b0 el0t_64_sync+0x19c/0x1a0 ---[ end trace 0000000000000000 ]--- References: - https://git.kernel.org/stable/c/18b9202188a4
el0t_64_sync+0x19c/0x1a0 ---[ end trace 0000000000000000 ]--- References: - https://git.kernel.org/stable/c/18b9202188a4e59923834c60b5c82ea1da7d1811 - https://git.kernel.org/stable/c/2ea334960afcd49385840c7afd59fc5f8d3ce682 - https://git.kernel.org/stable/c/3c18888bc0b51835c74123b1e04d5df11543724c - https://git.kernel.org/stable/c/20ee8c223f792947378196307d8e707c9cdc2d61
CVE ID: CVE-2022-50320 State: PUBLISHED Published: 2025-09-15T14:48:53.475Z Last Updated: 2025-09-15T14:48:53.475Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ACPI: tables: FPDT: Don't call acpi_os_map_memory() on invalid phys address On a Packard Bell Dot SC (Intel Atom N2600 model) there is a FPDT table which contains invalid physical addresses, with high bits set which fall outside the range of the CPU-s supported physical address range. Calling acpi_os_map_memory() on such an invalid phys address leads to the below WARN_ON in ioremap triggering resulting in an oops/stacktrace. Add code to verify the physical address befo
to the below WARN_ON in ioremap triggering resulting in an oops/stacktrace. Add code to verify the physical address before calling acpi_os_map_memory() to fix / avoid the oops. [ 1.226900] ioremap: invalid physical address 3001000000000000 [ 1.226949] ------------[ cut here ]------------ [ 1.226962] WARNING: CPU: 1 PID: 1 at arch/x86/mm/ioremap.c:200 __ioremap_caller.cold+0x43/0x5f [ 1.226996] Modules linked in: [ 1.227016] CPU: 1 PID: 1 Comm: swapper/0 Not tainted 6.0.0-rc3+ #490 [ 1.227029] Hardware name: Packard Bell dot s/SJE01_CT, BIOS V1.10 07/23/2013 [ 1.227038] RIP: 0010:__ioremap_caller.cold+0x43/0x5f [ 1.227054] Code: 96 00 00 e9 f8 af 24 ff 89 c6 48 c7 c7 d8 0c 84 99 e8 6a 96 00 0
0010:__ioremap_caller.cold+0x43/0x5f [ 1.227054] Code: 96 00 00 e9 f8 af 24 ff 89 c6 48 c7 c7 d8 0c 84 99 e8 6a 96 00 00 e9 76 af 24 ff 48 89 fe 48 c7 c7 a8 0c 84 99 e8 56 96 00 00 <0f> 0b e9 60 af 24 ff 48 8b 34 24 48 c7 c7 40 0d 84 99 e8 3f 96 00 [ 1.227067] RSP: 0000:ffffb18c40033d60 EFLAGS: 00010286 [ 1.227084] RAX: 0000000000000032 RBX: 3001000000000000 RCX: 0000000000000000 [ 1.227095] RDX: 0000000000000001 RSI: 00000000ffffdfff RDI: 00000000ffffffff [ 1.227105] RBP: 3001000000000000 R08: 0000000000000000 R09: ffffb18c40033c18 [ 1.227115] R10: 0000000000000003 R11: ffffffff99d62fe8 R12: 0000000000000008 [ 1.227124] R13: 0003001000000000 R14: 0000000000001000 R15: 3001000000000000 [ 1.
fffffff99d62fe8 R12: 0000000000000008 [ 1.227124] R13: 0003001000000000 R14: 0000000000001000 R15: 3001000000000000 [ 1.227135] FS: 0000000000000000(0000) GS:ffff913a3c080000(0000) knlGS:0000000000000000 [ 1.227146] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1.227156] CR2: 0000000000000000 CR3: 0000000018c26000 CR4: 00000000000006e0 [ 1.227167] Call Trace: [ 1.227176] <TASK> [ 1.227185] ? acpi_os_map_iomem+0x1c9/0x1e0 [ 1.227215] ? kmem_cache_alloc_trace+0x187/0x370 [ 1.227254] acpi_os_map_iomem+0x1c9/0x1e0 [ 1.227288] acpi_init_fpdt+0xa8/0x253 [ 1.227308] ? acpi_debugfs_init+0x1f/0x1f [ 1.227339] do_one_initcall+0x5a/0x300 [ 1.227406] ? rcu_read_lock_sched_held+0x3f/0x80 [ 1.227442]
bugfs_init+0x1f/0x1f [ 1.227339] do_one_initcall+0x5a/0x300 [ 1.227406] ? rcu_read_lock_sched_held+0x3f/0x80 [ 1.227442] kernel_init_freeable+0x28b/0x2cc [ 1.227512] ? rest_init+0x170/0x170 [ 1.227538] kernel_init+0x16/0x140 [ 1.227552] ret_from_fork+0x1f/0x30 [ 1.227639] </TASK> [ 1.227647] irq event stamp: 186819 [ 1.227656] hardirqs last enabled at (186825): [<ffffffff98184a6e>] __up_console_sem+0x5e/0x70 [ 1.227672] hardirqs last disabled at (186830): [<ffffffff98184a53>] __up_console_sem+0x43/0x70 [ 1.227686] softirqs last enabled at (186576): [<ffffffff980fbc9d>] __irq_exit_rcu+0xed/0x160 [ 1.227701] softirqs last disabled at (186569): [<ffffffff980fbc9d>] __irq_exit_rcu+0xed/0x160 [ 1
q_exit_rcu+0xed/0x160 [ 1.227701] softirqs last disabled at (186569): [<ffffffff980fbc9d>] __irq_exit_rcu+0xed/0x160 [ 1.227715] ---[ end trace 0000000000000000 ]--- References: - https://git.kernel.org/stable/c/30eca146c89d216dda95868ce00a2d35cf73d5a4 - https://git.kernel.org/stable/c/90bfc9ae875dfbed2e6089516520204cd431dba3 - https://git.kernel.org/stable/c/16046a716c8e1f447909bec9b478d58e6e25e513 - https://git.kernel.org/stable/c/211391bf04b3c74e250c566eeff9cf808156c693
CVE ID: CVE-2022-50321 State: PUBLISHED Published: 2025-09-15T14:48:54.808Z Last Updated: 2025-09-15T14:48:54.808Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit() The brcmf_netdev_start_xmit() returns NETDEV_TX_OK without freeing skb in case of pskb_expand_head() fails, add dev_kfree_skb() to fix it. Compile tested only. References: - https://git.kernel.org/stable/c/4c55fdebc1c358de96bfab52ed309d58a3ba66ef - https://git.kernel.org/stable/c/e5d01e85cf46628647cd696cb72ba4659b18967f - https://git.kernel.org/stable/c/d869a189505224601e310c7769cb90b0e2f60b31 - htt
5d01e85cf46628647cd696cb72ba4659b18967f - https://git.kernel.org/stable/c/d869a189505224601e310c7769cb90b0e2f60b31 - https://git.kernel.org/stable/c/e08e6812efb6a8c676e733de0518594d1517e0d9 - https://git.kernel.org/stable/c/e8ef89e5b89ee041a94eecfb6c31fcc237f9168c - https://git.kernel.org/stable/c/7f159116d620615779adbf88a5d94713702216d8 - https://git.kernel.org/stable/c/3a4d18318f473e97d628f410215b3fac32d07aed - https://git.kernel.org/stable/c/212fde3fe76e962598ce1d47b97cc78afdfc71b3
CVE ID: CVE-2022-50322 State: PUBLISHED Published: 2025-09-15T14:48:55.905Z Last Updated: 2025-09-16T08:02:08.115Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: rtc: msc313: Fix function prototype mismatch in msc313_rtc_probe() With clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG), indirect call targets are validated against the expected function pointer prototype to make sure the call target is valid to help mitigate ROP attacks. If they are not identical, there is a failure at run time, which manifests as either a kernel panic or thread getting killed. msc313_rtc_probe() was passing clk_disable_unprepare() dire
manifests as either a kernel panic or thread getting killed. msc313_rtc_probe() was passing clk_disable_unprepare() directly, which did not have matching prototypes for devm_add_action_or_reset()'s callback argument. Refactor to use devm_clk_get_enabled() instead. This was found as a result of Clang's new -Wcast-function-type-strict flag, which is more sensitive than the simpler -Wcast-function-type, which only checks for type width mismatches. References: - https://git.kernel.org/stable/c/5affaaf3334c9274131dae889ed79ea0553d61b4 - https://git.kernel.org/stable/c/ba50fee6b41bcbafaeed3c51f90d37d1480ff9a0 - https://git.kernel.org/stable/c/21b8a1dd56a163825e5749b303858fb902ebf198
CVE ID: CVE-2022-50323 State: PUBLISHED Published: 2025-09-15T14:48:57.418Z Last Updated: 2025-09-15T14:48:57.418Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: do not sense pfmemalloc status in skb_append_pagefrags() skb_append_pagefrags() is used by af_unix and udp sendpage() implementation so far. In commit 326140063946 ("tcp: TX zerocopy should not sense pfmemalloc status") we explained why we should not sense pfmemalloc status for pages owned by user space. We should also use skb_fill_page_desc_noacc() in skb_append_pagefrags() to avoid following KCSAN report: BUG: KCSAN: data-race in lru_add_fn / skb_append_pagefrag
c() in skb_append_pagefrags() to avoid following KCSAN report: BUG: KCSAN: data-race in lru_add_fn / skb_append_pagefrags write to 0xffffea00058fc1c8 of 8 bytes by task 17319 on cpu 0: __list_add include/linux/list.h:73 [inline] list_add include/linux/list.h:88 [inline] lruvec_add_folio include/linux/mm_inline.h:323 [inline] lru_add_fn+0x327/0x410 mm/swap.c:228 folio_batch_move_lru+0x1e1/0x2a0 mm/swap.c:246 lru_add_drain_cpu+0x73/0x250 mm/swap.c:669 lru_add_drain+0x21/0x60 mm/swap.c:773 free_pages_and_swap_cache+0x16/0x70 mm/swap_state.c:311 tlb_batch_pages_flush mm/mmu_gather.c:59 [inline] tlb_flush_mmu_free mm/mmu_gather.c:256 [inline] tlb_flush_mmu+0x5b2/0x640 mm/mmu_gather.c:263 tlb_fini
her.c:59 [inline] tlb_flush_mmu_free mm/mmu_gather.c:256 [inline] tlb_flush_mmu+0x5b2/0x640 mm/mmu_gather.c:263 tlb_finish_mmu+0x86/0x100 mm/mmu_gather.c:363 exit_mmap+0x190/0x4d0 mm/mmap.c:3098 __mmput+0x27/0x1b0 kernel/fork.c:1185 mmput+0x3d/0x50 kernel/fork.c:1207 copy_process+0x19fc/0x2100 kernel/fork.c:2518 kernel_clone+0x166/0x550 kernel/fork.c:2671 __do_sys_clone kernel/fork.c:2812 [inline] __se_sys_clone kernel/fork.c:2796 [inline] __x64_sys_clone+0xc3/0xf0 kernel/fork.c:2796 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd read to 0xffffea00058fc1c8 of 8 bytes by task 17325 on cpu 1: page_i
ommon.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd read to 0xffffea00058fc1c8 of 8 bytes by task 17325 on cpu 1: page_is_pfmemalloc include/linux/mm.h:1817 [inline] __skb_fill_page_desc include/linux/skbuff.h:2432 [inline] skb_fill_page_desc include/linux/skbuff.h:2453 [inline] skb_append_pagefrags+0x210/0x600 net/core/skbuff.c:3974 unix_stream_sendpage+0x45e/0x990 net/unix/af_unix.c:2338 kernel_sendpage+0x184/0x300 net/socket.c:3561 sock_sendpage+0x5a/0x70 net/socket.c:1054 pipe_to_sendpage+0x128/0x160 fs/splice.c:361 splice_from_pipe_feed fs/splice.c:415 [inline] __splice_from_pipe+0x222/0x4d0 fs/splice.c:559 splice_from_pipe fs/splice.c:594 [inline] generic_splice_sendpage+0x89/0xc0 fs/s
e_from_pipe+0x222/0x4d0 fs/splice.c:559 splice_from_pipe fs/splice.c:594 [inline] generic_splice_sendpage+0x89/0xc0 fs/splice.c:743 do_splice_from fs/splice.c:764 [inline] direct_splice_actor+0x80/0xa0 fs/splice.c:931 splice_direct_to_actor+0x305/0x620 fs/splice.c:886 do_splice_direct+0xfb/0x180 fs/splice.c:974 do_sendfile+0x3bf/0x910 fs/read_write.c:1255 __do_sys_sendfile64 fs/read_write.c:1323 [inline] __se_sys_sendfile64 fs/read_write.c:1309 [inline] __x64_sys_sendfile64+0x10c/0x150 fs/read_write.c:1309 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd value changed: 0x0000000000000000 -> 0xffffea
b/0x70 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd value changed: 0x0000000000000000 -> 0xffffea00058fc188 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 17325 Comm: syz-executor.0 Not tainted 6.1.0-rc1-syzkaller-00158-g440b7895c990-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/11/2022 References: - https://git.kernel.org/stable/c/92b4c5c3fa810212da20088bcc6c0a77fc8607bd - https://git.kernel.org/stable/c/847a2859814b31392340a2b16604b25afaa92dcc - https://git.kernel.org/stable/c/228ebc41dfab5b5d34cd76835ddb0ca8ee12f513
CVE ID: CVE-2022-50324 State: PUBLISHED Published: 2025-09-15T14:49:18.426Z Last Updated: 2025-09-15T14:49:18.426Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mtd: maps: pxa2xx-flash: fix memory leak in probe Free 'info' upon remapping error to avoid a memory leak. [<miquel.raynal@bootlin.com>: Reword the commit log] References: - https://git.kernel.org/stable/c/cb3f35f44887a8486737fe88d58050f1df290758 - https://git.kernel.org/stable/c/e2324a0912ad26a0ea5baaf81aed0ca880804158 - https://git.kernel.org/stable/c/6fa9550ef3e13d7e9b2d4db6dd57292ccd072a90 - https://git.kernel.org/stable/c/cf9c4c25caad05c6b492cbba739a467511814279 -
/c/6fa9550ef3e13d7e9b2d4db6dd57292ccd072a90 - https://git.kernel.org/stable/c/cf9c4c25caad05c6b492cbba739a467511814279 - https://git.kernel.org/stable/c/1d0c2b762dad2b8dd166e17c0e90b88b86a3284f - https://git.kernel.org/stable/c/f35981083cb3fc1ba6427c1543152c5e3f59d104 - https://git.kernel.org/stable/c/932baf593eb63dff40e40d7674f076fb7932cd5b - https://git.kernel.org/stable/c/a1b061cafdbcb1ff259731f30e2bdc1de64dcaba - https://git.kernel.org/stable/c/2399401feee27c639addc5b7e6ba519d3ca341bf
CVE ID: CVE-2022-50325 State: PUBLISHED Published: 2025-09-15T14:49:19.788Z Last Updated: 2025-09-15T14:49:19.788Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: avs: Fix potential RX buffer overflow If an event caused firmware to return invalid RX size for LARGE_CONFIG_GET, memcpy_fromio() could end up copying too many bytes. Fix by utilizing min_t(). References: - https://git.kernel.org/stable/c/ec1f0c12cb2e614c3fa8e9402f7ffcf82166078a - https://git.kernel.org/stable/c/0bad12fee5ae16ab439d97c66c4238f5f4cc7f68 - https://git.kernel.org/stable/c/23ae34e033b2c0e5e88237af82b163b296fd6aa9
CVE ID: CVE-2022-50326 State: PUBLISHED Published: 2025-09-15T14:49:24.523Z Last Updated: 2025-09-15T14:49:24.523Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: media: airspy: fix memory leak in airspy probe The commit ca9dc8d06ab6 ("media: airspy: respect the DMA coherency rules") moves variable buf from stack to heap, however, it only frees buf in the error handling code, missing deallocation in the success path. Fix this by freeing buf in the success path since this variable does not have any references in other code. References: - https://git.kernel.org/stable/c/f4285dd02b6b2ca3435b65fb62c053dd9408fd71 - https://git.kernel
other code. References: - https://git.kernel.org/stable/c/f4285dd02b6b2ca3435b65fb62c053dd9408fd71 - https://git.kernel.org/stable/c/23bc5eb55f8c9607965c20d9ddcc13cb1ae59568
CVE ID: CVE-2022-50327 State: PUBLISHED Published: 2025-09-15T14:49:26.711Z Last Updated: 2025-11-03T17:31:03.047Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value The return value of acpi_fetch_acpi_dev() could be NULL, which would cause a NULL pointer dereference to occur in acpi_device_hid(). [ rjw: Subject and changelog edits, added empty line after if () ] Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/8e8b5f12ee4ab6f5d252c9ca062a4ada9554e6d9 - https://git.kernel.org/stable/c/fdee7a0acc566c4194d40a501b8a1584e86cc
table/c/8e8b5f12ee4ab6f5d252c9ca062a4ada9554e6d9 - https://git.kernel.org/stable/c/fdee7a0acc566c4194d40a501b8a1584e86cc208 - https://git.kernel.org/stable/c/ad1190744da9d812da55b76f2afce750afb0a3bd - https://git.kernel.org/stable/c/2ecd629c788bbfb96be058edade2e934d3763eaf - https://git.kernel.org/stable/c/b85f0e292f73f353eea915499604fbf50c8238b4 - https://git.kernel.org/stable/c/2437513a814b3e93bd02879740a8a06e52e2cf7d
CVE ID: CVE-2022-50328 State: PUBLISHED Published: 2025-09-15T14:49:30.483Z Last Updated: 2025-09-15T14:49:30.483Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: jbd2: fix potential use-after-free in jbd2_fc_wait_bufs In 'jbd2_fc_wait_bufs' use 'bh' after put buffer head reference count which may lead to use-after-free. So judge buffer if uptodate before put buffer head reference count. References: - https://git.kernel.org/stable/c/1d4d16daec2a6689b6d3fbfc7d2078643adc6619 - https://git.kernel.org/stable/c/d11d2ded293976a1a0d9d9471827a44dc9e3c63f - https://git.kernel.org/stable/c/2e6d9f381c1ed844531a577783fc352de7a44c8a - https:
2ded293976a1a0d9d9471827a44dc9e3c63f - https://git.kernel.org/stable/c/2e6d9f381c1ed844531a577783fc352de7a44c8a - https://git.kernel.org/stable/c/effd9b3c029ecdd853a11933dcf857f5a7ca8c3d - https://git.kernel.org/stable/c/243d1a5d505d0b0460c9af0ad56ed4a56ef0bebd
CVE ID: CVE-2022-50329 State: PUBLISHED Published: 2025-09-15T14:49:32.123Z Last Updated: 2025-09-15T14:49:32.123Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: block, bfq: fix uaf for bfqq in bfq_exit_icq_bfqq Commit 64dc8c732f5c ("block, bfq: fix possible uaf for 'bfqq->bic'") will access 'bic->bfqq' in bic_set_bfqq(), however, bfq_exit_icq_bfqq() can free bfqq first, and then call bic_set_bfqq(), which will cause uaf. Fix the problem by moving bfq_exit_bfqq() behind bic_set_bfqq(). References: - https://git.kernel.org/stable/c/1425f1bb5df5239021fd09ebc2a5e8070e705d36 - https://git.kernel.org/stable/c/7949b0df3dd9f4817ed4a4e
t.kernel.org/stable/c/1425f1bb5df5239021fd09ebc2a5e8070e705d36 - https://git.kernel.org/stable/c/7949b0df3dd9f4817ed4a4e989fa9ee81df6205f - https://git.kernel.org/stable/c/cfe5b38c37720313eff0dec5517442c7ab3c9a20 - https://git.kernel.org/stable/c/1ed959fef5b1c6f1a7a3fbea543698c30ebd6678 - https://git.kernel.org/stable/c/246cf66e300b76099b5dbd3fdd39e9a5dbc53f02
CVE ID: CVE-2022-50330 State: PUBLISHED Published: 2025-09-15T14:49:33.015Z Last Updated: 2025-09-15T14:49:33.015Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: crypto: cavium - prevent integer overflow loading firmware The "code_length" value comes from the firmware file. If your firmware is untrusted realistically there is probably very little you can do to protect yourself. Still we try to limit the damage as much as possible. Also Smatch marks any data read from the filesystem as untrusted and prints warnings if it not capped correctly. The "ntohl(ucode->code_length) * 2" multiplication can have an integer overflow. Refere
ings if it not capped correctly. The "ntohl(ucode->code_length) * 2" multiplication can have an integer overflow. References: - https://git.kernel.org/stable/c/c4d4c2afd08dfb3cd1c880d1811ede2568e81a6d - https://git.kernel.org/stable/c/90e483e7f20c32287d2a9da967e122938f52737a - https://git.kernel.org/stable/c/584561e94260268abe1c83e00d9c205565cb7bc5 - https://git.kernel.org/stable/c/3a720eb89026c5241b8c4abb33370dc6fb565eee - https://git.kernel.org/stable/c/172c8a24fc8312cf6b88d3c88469653fdcb1c127 - https://git.kernel.org/stable/c/371fa5129af53a79f6dddc90fe5bb0825cbe72a4 - https://git.kernel.org/stable/c/e29fd7a6852376d2cfb95ad5d6d3eeff93f815e9 - https://git.kernel.org/stable/c/2526d6bf27d1505
tps://git.kernel.org/stable/c/e29fd7a6852376d2cfb95ad5d6d3eeff93f815e9 - https://git.kernel.org/stable/c/2526d6bf27d15054bb0778b2f7bc6625fd934905
CVE ID: CVE-2022-50331 State: PUBLISHED Published: 2025-09-15T14:49:41.415Z Last Updated: 2025-09-15T14:49:41.415Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wwan_hwsim: fix possible memory leak in wwan_hwsim_dev_new() Inject fault while probing module, if device_register() fails, but the refcount of kobject is not decreased to 0, the name allocated in dev_set_name() is leaked. Fix this by calling put_device(), so that name can be freed in callback function kobject_cleanup(). unreferenced object 0xffff88810152ad20 (size 8): comm "modprobe", pid 252, jiffies 4294849206 (age 22.713s) hex dump (first 8 bytes): 68 77 73 69 6d 3
0152ad20 (size 8): comm "modprobe", pid 252, jiffies 4294849206 (age 22.713s) hex dump (first 8 bytes): 68 77 73 69 6d 30 00 ff hwsim0.. backtrace: [<000000009c3504ed>] __kmalloc_node_track_caller+0x44/0x1b0 [<00000000c0228a5e>] kvasprintf+0xb5/0x140 [<00000000cff8c21f>] kvasprintf_const+0x55/0x180 [<0000000055a1e073>] kobject_set_name_vargs+0x56/0x150 [<000000000a80b139>] dev_set_name+0xab/0xe0 References: - https://git.kernel.org/stable/c/50c31fa952309536c6e4461ff815ddccc8dff9d5 - https://git.kernel.org/stable/c/d87973314aba6de80a49f4271dd9be4ddc08e729 - https://git.kernel.org/stable/c/258ad2fe5ede773625adfda88b173f4123e59f45
CVE ID: CVE-2022-50332 State: PUBLISHED Published: 2025-09-15T14:49:42.733Z Last Updated: 2025-09-15T14:49:42.733Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: video/aperture: Call sysfb_disable() before removing PCI devices Call sysfb_disable() from aperture_remove_conflicting_pci_devices() before removing PCI devices. Without, simpledrm can still bind to simple-framebuffer devices after the hardware driver has taken over the hardware. Both drivers interfere with each other and results are undefined. Reported modesetting errors [1] are shown below. ---- snap ---- rcu: INFO: rcu_sched detected expedited stalls on CPUs/tasks:
ed modesetting errors [1] are shown below. ---- snap ---- rcu: INFO: rcu_sched detected expedited stalls on CPUs/tasks: { 13-.... } 7 jiffies s: 165 root: 0x2000/. rcu: blocking rcu_node structures (internal RCU debug): Task dump for CPU 13: task:X state:R running task stack: 0 pid: 4242 ppid: 4228 flags:0x00000008 Call Trace: <TASK> ? commit_tail+0xd7/0x130 ? drm_atomic_helper_commit+0x126/0x150 ? drm_atomic_commit+0xa4/0xe0 ? drm_plane_get_damage_clips.cold+0x1c/0x1c ? drm_atomic_helper_dirtyfb+0x19e/0x280 ? drm_mode_dirtyfb_ioctl+0x10f/0x1e0 ? drm_mode_getfb2_ioctl+0x2d0/0x2d0 ? drm_ioctl_kernel+0xc4/0x150 ? drm_ioctl+0x246/0x3f0 ? drm_mode_getfb2_ioctl+0x2d0/0x2d0 ? __x64_sys_ioctl+0x91/
/0x2d0 ? drm_ioctl_kernel+0xc4/0x150 ? drm_ioctl+0x246/0x3f0 ? drm_mode_getfb2_ioctl+0x2d0/0x2d0 ? __x64_sys_ioctl+0x91/0xd0 ? do_syscall_64+0x60/0xd0 ? entry_SYSCALL_64_after_hwframe+0x4b/0xb5 </TASK> ... rcu: INFO: rcu_sched detected expedited stalls on CPUs/tasks: { 13-.... } 30 jiffies s: 169 root: 0x2000/. rcu: blocking rcu_node structures (internal RCU debug): Task dump for CPU 13: task:X state:R running task stack: 0 pid: 4242 ppid: 4228 flags:0x0000400e Call Trace: <TASK> ? memcpy_toio+0x76/0xc0 ? memcpy_toio+0x1b/0xc0 ? drm_fb_memcpy_toio+0x76/0xb0 ? drm_fb_blit_toio+0x75/0x2b0 ? simpledrm_simple_display_pipe_update+0x132/0x150 ? drm_atomic_helper_commit_planes+0xb6/0x230 ? drm_atom