Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
write.c:1249 __do_sys_sendfile64 fs/read_write.c:1317 [inline] __se_sys_sendfile64 fs/read_write.c:1303 [inline] __x64_sys_sendfile64+0x10c/0x150 fs/read_write.c:1303 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd value changed: 0x0000000000000000 -> 0xffffea0004a1d288 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 18611 Comm: syz-executor.4 Not tainted 6.0.0-rc2-syzkaller-00248-ge022620b5d05-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://g
OS Google 07/22/2022 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/8527c9a6bf8e54fef0a8d3d7d8874a48c725c915 - https://git.kernel.org/stable/c/6730c48ed6b0cd939fc9b30b2d621ce0b89bea83 - https://git.kernel.org/stable/c/3261400639463a853ba2b3be8bd009c2a8089775
CVE ID: CVE-2022-48690 State: PUBLISHED Published: 2024-05-03T17:44:31.180Z Last Updated: 2025-05-04T08:21:08.464Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ice: Fix DMA mappings leak Fix leak, when user changes ring parameters. During reallocation of RX buffers, new DMA mappings are created for those buffers. New buffers with different RX ring count should substitute older ones, but those buffers were freed in ice_vsi_cfg_rxq and reallocated again with ice_alloc_rx_buf. kfree on rx_buf caused leak of already mapped DMA. Reallocate ZC with xdp_buf struct, when BPF program loads. Reallocate back to rx_buf, when BPF program
eady mapped DMA. Reallocate ZC with xdp_buf struct, when BPF program loads. Reallocate back to rx_buf, when BPF program unloads. If BPF program is loaded/unloaded and XSK pools are created, reallocate RX queues accordingly in XDP_SETUP_XSK_POOL handler. Steps for reproduction: while : do for ((i=0; i<=8160; i=i+32)) do ethtool -G enp130s0f0 rx $i tx $i sleep 0.5 ethtool -g enp130s0f0 done done Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/07f40e9f0ff342eb3e97d5c544783b7cb641689c - https://git.kernel.org/stable/c/7e753eb675f0523207b184558638ee2eed6c9ac2
CVE ID: CVE-2022-48691 State: PUBLISHED Published: 2024-05-03T15:03:28.996Z Last Updated: 2025-05-04T08:21:09.702Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: clean up hook list when offload flags check fails splice back the hook list so nft_chain_release_hook() has a chance to release the hooks. BUG: memory leak unreferenced object 0xffff88810180b100 (size 96): comm "syz-executor133", pid 3619, jiffies 4294945714 (age 12.690s) hex dump (first 32 bytes): 28 64 23 02 81 88 ff ff 28 64 23 02 81 88 ff ff (d#.....(d#..... 90 a8 aa 83 ff ff ff ff 00 00 b5 0f 81 88 ff ff ................ backtrace: [<ffffffff
3 02 81 88 ff ff (d#.....(d#..... 90 a8 aa 83 ff ff ff ff 00 00 b5 0f 81 88 ff ff ................ backtrace: [<ffffffff83a8c59b>] kmalloc include/linux/slab.h:600 [inline] [<ffffffff83a8c59b>] nft_netdev_hook_alloc+0x3b/0xc0 net/netfilter/nf_tables_api.c:1901 [<ffffffff83a9239a>] nft_chain_parse_netdev net/netfilter/nf_tables_api.c:1998 [inline] [<ffffffff83a9239a>] nft_chain_parse_hook+0x33a/0x530 net/netfilter/nf_tables_api.c:2073 [<ffffffff83a9b14b>] nf_tables_addchain.constprop.0+0x10b/0x950 net/netfilter/nf_tables_api.c:2218 [<ffffffff83a9c41b>] nf_tables_newchain+0xa8b/0xc60 net/netfilter/nf_tables_api.c:2593 [<ffffffff83a3d6a6>] nfnetlink_rcv_batch+0xa46/0xd20 net/netfilter/nfnetlink
8b/0xc60 net/netfilter/nf_tables_api.c:2593 [<ffffffff83a3d6a6>] nfnetlink_rcv_batch+0xa46/0xd20 net/netfilter/nfnetlink.c:517 [<ffffffff83a3db79>] nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:638 [inline] [<ffffffff83a3db79>] nfnetlink_rcv+0x1f9/0x220 net/netfilter/nfnetlink.c:656 [<ffffffff83a13b17>] netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] [<ffffffff83a13b17>] netlink_unicast+0x397/0x4c0 net/netlink/af_netlink.c:1345 [<ffffffff83a13fd6>] netlink_sendmsg+0x396/0x710 net/netlink/af_netlink.c:1921 [<ffffffff83865ab6>] sock_sendmsg_nosec net/socket.c:714 [inline] [<ffffffff83865ab6>] sock_sendmsg+0x56/0x80 net/socket.c:734 [<ffffffff8386601c>] ____sys_sendmsg+0x36c/0
c:714 [inline] [<ffffffff83865ab6>] sock_sendmsg+0x56/0x80 net/socket.c:734 [<ffffffff8386601c>] ____sys_sendmsg+0x36c/0x390 net/socket.c:2482 [<ffffffff8386a918>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2536 [<ffffffff8386aaa8>] __sys_sendmsg+0x88/0x100 net/socket.c:2565 [<ffffffff845e5955>] do_syscall_x64 arch/x86/entry/common.c:50 [inline] [<ffffffff845e5955>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 [<ffffffff84800087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/910891a2a44cdc49efcc4fe7459c1085ba00d0f4 - https://git.kernel.org/stable/c/1ce55ec5cb7c573c983dffbe2
kernel.org/stable/c/910891a2a44cdc49efcc4fe7459c1085ba00d0f4 - https://git.kernel.org/stable/c/1ce55ec5cb7c573c983dffbe290b8d17caf1f157 - https://git.kernel.org/stable/c/94ed8eeb8d9aeb00e4f4e19b83a2e28b6442fbc5 - https://git.kernel.org/stable/c/77972a36ecc4db7fc7c68f0e80714263c5f03f65
CVE ID: CVE-2022-48692 State: PUBLISHED Published: 2024-05-03T15:05:31.107Z Last Updated: 2025-05-04T08:21:10.730Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: Set scmnd->result only when scmnd is not NULL This change fixes the following kernel NULL pointer dereference which is reproduced by blktests srp/007 occasionally. BUG: kernel NULL pointer dereference, address: 0000000000000170 PGD 0 P4D 0 Oops: 0002 [#1] PREEMPT SMP NOPTI CPU: 0 PID: 9 Comm: kworker/0:1H Kdump: loaded Not tainted 6.0.0-rc1+ #37 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.15.0-29-g6a62e0cb0dfe-prebuilt.qemu.org 04/01/2014 W
#37 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.15.0-29-g6a62e0cb0dfe-prebuilt.qemu.org 04/01/2014 Workqueue: 0x0 (kblockd) RIP: 0010:srp_recv_done+0x176/0x500 [ib_srp] Code: 00 4d 85 ff 0f 84 52 02 00 00 48 c7 82 80 02 00 00 00 00 00 00 4c 89 df 4c 89 14 24 e8 53 d3 4a f6 4c 8b 14 24 41 0f b6 42 13 <41> 89 87 70 01 00 00 41 0f b6 52 12 f6 c2 02 74 44 41 8b 42 1c b9 RSP: 0018:ffffaef7c0003e28 EFLAGS: 00000282 RAX: 0000000000000000 RBX: ffff9bc9486dea60 RCX: 0000000000000000 RDX: 0000000000000102 RSI: ffffffffb76bbd0e RDI: 00000000ffffffff RBP: ffff9bc980099a00 R08: 0000000000000001 R09: 0000000000000001 R10: ffff9bca53ef0000 R11: ffff9bc980099a10 R12: ffff9bc956e14000 R13
099a00 R08: 0000000000000001 R09: 0000000000000001 R10: ffff9bca53ef0000 R11: ffff9bc980099a10 R12: ffff9bc956e14000 R13: ffff9bc9836b9cb0 R14: ffff9bc9557b4480 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff9bc97ec00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000170 CR3: 0000000007e04000 CR4: 00000000000006f0 Call Trace: <IRQ> __ib_process_cq+0xb7/0x280 [ib_core] ib_poll_handler+0x2b/0x130 [ib_core] irq_poll_softirq+0x93/0x150 __do_softirq+0xee/0x4b8 irq_exit_rcu+0xf7/0x130 sysvec_apic_timer_interrupt+0x8e/0xc0 </IRQ> Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/
</IRQ> Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/f022576aa03c2385ea7f2b27ee5b331e43abf624 - https://git.kernel.org/stable/c/a8edd49c94b4b08019ed7d6dd794fca8078a4deb - https://git.kernel.org/stable/c/f2c70f56f762e5dc3b0d7dc438fbb137cb116413 - https://git.kernel.org/stable/c/12f35199a2c0551187edbf8eb01379f0598659fa
CVE ID: CVE-2022-48693 State: PUBLISHED Published: 2024-05-03T15:05:46.868Z Last Updated: 2025-05-04T08:21:11.817Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: soc: brcmstb: pm-arm: Fix refcount leak and __iomem leak bugs In brcmstb_pm_probe(), there are two kinds of leak bugs: (1) we need to add of_node_put() when for_each__matching_node() breaks (2) we need to add iounmap() for each iomap in fail path Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/0284b4e6dec6088a41607aa3f42bf51edff01883 - https://git.kernel.org/stable/c/57b2897ec3ffe4cbe018446be6d04
el.org/stable/c/0284b4e6dec6088a41607aa3f42bf51edff01883 - https://git.kernel.org/stable/c/57b2897ec3ffe4cbe018446be6d04432919dca6b - https://git.kernel.org/stable/c/6dc0251638a4a1a998506dbd4627f8317e907558 - https://git.kernel.org/stable/c/43245c77d9efd8c9eb91bf225d07954dcf32204d - https://git.kernel.org/stable/c/653500b400d5576940b7429690f7197199ddcc82 - https://git.kernel.org/stable/c/1085f5080647f0c9f357c270a537869191f7f2a1
CVE ID: CVE-2022-48694 State: PUBLISHED Published: 2024-05-03T15:06:57.588Z Last Updated: 2025-05-04T08:21:13.137Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix drain SQ hang with no completion SW generated completions for outstanding WRs posted on SQ after QP is in error target the wrong CQ. This causes the ib_drain_sq to hang with no completion. Fix this to generate completions on the right CQ. [ 863.969340] INFO: task kworker/u52:2:671 blocked for more than 122 seconds. [ 863.979224] Not tainted 5.14.0-130.el9.x86_64 #1 [ 863.986588] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [
inted 5.14.0-130.el9.x86_64 #1 [ 863.986588] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 863.996997] task:kworker/u52:2 state:D stack: 0 pid: 671 ppid: 2 flags:0x00004000 [ 864.007272] Workqueue: xprtiod xprt_autoclose [sunrpc] [ 864.014056] Call Trace: [ 864.017575] __schedule+0x206/0x580 [ 864.022296] schedule+0x43/0xa0 [ 864.026736] schedule_timeout+0x115/0x150 [ 864.032185] __wait_for_common+0x93/0x1d0 [ 864.037717] ? usleep_range_state+0x90/0x90 [ 864.043368] __ib_drain_sq+0xf6/0x170 [ib_core] [ 864.049371] ? __rdma_block_iter_next+0x80/0x80 [ib_core] [ 864.056240] ib_drain_sq+0x66/0x70 [ib_core] [ 864.062003] rpcrdma_xprt_disconnect+0x82/0x3b0 [rpcrdma]
0x80 [ib_core] [ 864.056240] ib_drain_sq+0x66/0x70 [ib_core] [ 864.062003] rpcrdma_xprt_disconnect+0x82/0x3b0 [rpcrdma] [ 864.069365] ? xprt_prepare_transmit+0x5d/0xc0 [sunrpc] [ 864.076386] xprt_rdma_close+0xe/0x30 [rpcrdma] [ 864.082593] xprt_autoclose+0x52/0x100 [sunrpc] [ 864.088718] process_one_work+0x1e8/0x3c0 [ 864.094170] worker_thread+0x50/0x3b0 [ 864.099109] ? rescuer_thread+0x370/0x370 [ 864.104473] kthread+0x149/0x170 [ 864.109022] ? set_kthread_struct+0x40/0x40 [ 864.114713] ret_from_fork+0x22/0x30 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/14d148401c5202fec3a071e24785481d540b22c3 - https://git.kernel
m Container: References: - https://git.kernel.org/stable/c/14d148401c5202fec3a071e24785481d540b22c3 - https://git.kernel.org/stable/c/5becc531a3fa8da75158a8993f56cc3e0717716e - https://git.kernel.org/stable/c/ead54ced6321099978d30d62dc49c282a6e70574
CVE ID: CVE-2022-48695 State: PUBLISHED Published: 2024-05-03T17:44:55.829Z Last Updated: 2025-05-21T08:43:47.691Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Fix use-after-free warning Fix the following use-after-free warning which is observed during controller reset: refcount_t: underflow; use-after-free. WARNING: CPU: 23 PID: 5399 at lib/refcount.c:28 refcount_warn_saturate+0xa6/0xf0 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/b8fc9e91b931215110ba824d1a2983c5f60b6f82 - https://git.kernel.org/stable/c/d4959d09b76eb7a4146f5133962b88
l.org/stable/c/b8fc9e91b931215110ba824d1a2983c5f60b6f82 - https://git.kernel.org/stable/c/d4959d09b76eb7a4146f5133962b88d3bddb63d6 - https://git.kernel.org/stable/c/82efb917eeb27454dc4c6fe26432fc8f6c75bc16 - https://git.kernel.org/stable/c/5682c94644fde72f72bded6580c38189ffc856b5 - https://git.kernel.org/stable/c/ea10a652ad2ae2cf3eced6f632a5c98f26727057 - https://git.kernel.org/stable/c/6229fa494a5949be209bc73afbc5d0a749c2e3c7 - https://git.kernel.org/stable/c/41acb064c4e013808bc7d5fc1b506fa449425b0b - https://git.kernel.org/stable/c/991df3dd5144f2e6b1c38b8d20ed3d4d21e20b34
CVE ID: CVE-2022-48696 State: PUBLISHED Published: 2024-05-03T15:09:48.280Z Last Updated: 2025-05-04T08:21:15.475Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: regmap: spi: Reserve space for register address/padding Currently the max_raw_read and max_raw_write limits in regmap_spi struct do not take into account the additional size of the transmitted register address and padding. This may result in exceeding the maximum permitted SPI message size, which could cause undefined behaviour, e.g. data corruption. Fix regmap_get_spi_bus() to properly adjust the above mentioned limits by reserving space for the register address/paddi
Fix regmap_get_spi_bus() to properly adjust the above mentioned limits by reserving space for the register address/padding as set in the regmap configuration. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/15ff1f17847c19174b260bd7dd0de33edcebd45e - https://git.kernel.org/stable/c/f5723cfc01932c7a8d5c78dbf7e067e537c91439
CVE ID: CVE-2022-48697 State: PUBLISHED Published: 2024-05-03T15:10:30.963Z Last Updated: 2025-05-04T08:21:16.522Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: nvmet: fix a use-after-free Fix the following use-after-free complaint triggered by blktests nvme/004: BUG: KASAN: user-memory-access in blk_mq_complete_request_remote+0xac/0x350 Read of size 4 at addr 0000607bd1835943 by task kworker/13:1/460 Workqueue: nvmet-wq nvme_loop_execute_work [nvme_loop] Call Trace: show_stack+0x52/0x58 dump_stack_lvl+0x49/0x5e print_report.cold+0x36/0x1e2 kasan_report+0xb9/0xf0 __asan_load4+0x6b/0x80 blk_mq_complete_request_remote+0xac/0x350
x5e print_report.cold+0x36/0x1e2 kasan_report+0xb9/0xf0 __asan_load4+0x6b/0x80 blk_mq_complete_request_remote+0xac/0x350 nvme_loop_queue_response+0x1df/0x275 [nvme_loop] __nvmet_req_complete+0x132/0x4f0 [nvmet] nvmet_req_complete+0x15/0x40 [nvmet] nvmet_execute_io_connect+0x18a/0x1f0 [nvmet] nvme_loop_execute_work+0x20/0x30 [nvme_loop] process_one_work+0x56e/0xa70 worker_thread+0x2d1/0x640 kthread+0x183/0x1c0 ret_from_fork+0x1f/0x30 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/17f121ca3ec6be0fb32d77c7f65362934a38cc8e - https://git.kernel.org/stable/c/8d66989b5f7bb28bba2f8e1e2ffc8bfef4a10717 - https://git.kernel.org/
7c7f65362934a38cc8e - https://git.kernel.org/stable/c/8d66989b5f7bb28bba2f8e1e2ffc8bfef4a10717 - https://git.kernel.org/stable/c/be01f1c988757b95f11f090a9f491365670a522b - https://git.kernel.org/stable/c/ebf46da50beb78066674354ad650606a467e33fa - https://git.kernel.org/stable/c/4484ce97a78171668c402e0c45db7f760aea8060 - https://git.kernel.org/stable/c/6a02a61e81c231cc5c680c5dbf8665275147ac52
CVE ID: CVE-2022-48698 State: PUBLISHED Published: 2024-05-03T15:11:37.455Z Last Updated: 2025-05-21T08:43:48.793Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix memory leak when using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. Fix this up by properly calling dput(). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/58acd2ebae034db3bacf38708f508fbd12ae2e54 - https://git.kernel.org/stable/c/3a6279d243cb035eaaff1450980b40cf19748f05 - https://git.kernel
bacf38708f508fbd12ae2e54 - https://git.kernel.org/stable/c/3a6279d243cb035eaaff1450980b40cf19748f05 - https://git.kernel.org/stable/c/cbfac7fa491651c57926c99edeb7495c6c1aeac2
CVE ID: CVE-2022-48699 State: PUBLISHED Published: 2024-05-03T15:11:54.150Z Last Updated: 2025-05-21T08:43:50.164Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: sched/debug: fix dentry leak in update_sched_domain_debugfs Kuyo reports that the pattern of using debugfs_remove(debugfs_lookup()) leaks a dentry and with a hotplug stress test, the machine eventually runs out of memory. Fix this up by using the newly created debugfs_lookup_and_remove() call instead which properly handles the dentry reference counting logic. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.or
g logic. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/26e9a1ded8923510e5529fbb28390b22228700c2 - https://git.kernel.org/stable/c/0c32a93963e03c03e561d5a066eedad211880ba3 - https://git.kernel.org/stable/c/c2e406596571659451f4b95e37ddfd5a8ef1d0dc
CVE ID: CVE-2022-48700 State: REJECTED Published: 2024-05-03T15:12:16.246Z Last Updated: 2024-12-19T11:01:44.556Z Description: No description available.
CVE ID: CVE-2022-48701 State: PUBLISHED Published: 2024-05-03T15:12:34.160Z Last Updated: 2025-05-04T08:21:19.926Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface() There may be a bad USB audio device with a USB ID of (0x04fa, 0x4201) and the number of it's interfaces less than 4, an out-of-bounds read bug occurs when parsing the interface descriptor for this device. Fix this by checking the number of interfaces. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/b970518014f2f0f6c493
es: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/b970518014f2f0f6c493fb86c1e092b936899061 - https://git.kernel.org/stable/c/91904870370fd986c29719846ed76d559de43251 - https://git.kernel.org/stable/c/2a308e415d247a23d4d64c964c02e782eede2936 - https://git.kernel.org/stable/c/0492798bf8dfcc09c9337a1ba065da1d1ca68712 - https://git.kernel.org/stable/c/6123bec8480d23369e2ee0b2208611619f269faf - https://git.kernel.org/stable/c/98e8e67395cc6d0cdf3a771f86ea42d0ee6e59dd - https://git.kernel.org/stable/c/8293e61bbf908b18ff9935238d4fc2ad359e3fe0 - https://git.kernel.org/stable/c/e53f47f6c1a56d2af728909f1cb894da6b43d9bf
CVE ID: CVE-2022-48702 State: PUBLISHED Published: 2024-05-03T15:13:10.363Z Last Updated: 2025-05-04T08:21:21.127Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ALSA: emu10k1: Fix out of bounds access in snd_emu10k1_pcm_channel_alloc() The voice allocator sometimes begins allocating from near the end of the array and then wraps around, however snd_emu10k1_pcm_channel_alloc() accesses the newly allocated voices as if it never wrapped around. This results in out of bounds access if the first voice has a high enough index so that first_voice + requested_voice_count > NUM_G (64). The more voices are requested, the more likely it i
ough index so that first_voice + requested_voice_count > NUM_G (64). The more voices are requested, the more likely it is for this to occur. This was initially discovered using PipeWire, however it can be reproduced by calling aplay multiple times with 16 channels: aplay -r 48000 -D plughw:CARD=Live,DEV=3 -c 16 /dev/zero UBSAN: array-index-out-of-bounds in sound/pci/emu10k1/emupcm.c:127:40 index 65 is out of range for type 'snd_emu10k1_voice [64]' CPU: 1 PID: 31977 Comm: aplay Tainted: G W IOE 6.0.0-rc2-emu10k1+ #7 Hardware name: ASUSTEK COMPUTER INC P5W DH Deluxe/P5W DH Deluxe, BIOS 3002 07/22/2010 Call Trace: <TASK> dump_stack_lvl+0x49/0x63 dump_stack+0x10/0x16 ubsan_epilogue+0x9/0x3f __ub
luxe, BIOS 3002 07/22/2010 Call Trace: <TASK> dump_stack_lvl+0x49/0x63 dump_stack+0x10/0x16 ubsan_epilogue+0x9/0x3f __ubsan_handle_out_of_bounds.cold+0x44/0x49 snd_emu10k1_playback_hw_params+0x3bc/0x420 [snd_emu10k1] snd_pcm_hw_params+0x29f/0x600 [snd_pcm] snd_pcm_common_ioctl+0x188/0x1410 [snd_pcm] ? exit_to_user_mode_prepare+0x35/0x170 ? do_syscall_64+0x69/0x90 ? syscall_exit_to_user_mode+0x26/0x50 ? do_syscall_64+0x69/0x90 ? exit_to_user_mode_prepare+0x35/0x170 snd_pcm_ioctl+0x27/0x40 [snd_pcm] __x64_sys_ioctl+0x95/0xd0 do_syscall_64+0x5c/0x90 ? do_syscall_64+0x69/0x90 ? do_syscall_64+0x69/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd Additional Analyst Notes: - CISA ADP Vulnrichment: - C
do_syscall_64+0x69/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/637c5310acb48fffcc5657568db3f3e9bc719bfa - https://git.kernel.org/stable/c/6b0e260ac3cf289e38446552461caa65e6dab275 - https://git.kernel.org/stable/c/88aac6684cf8bc885cca15463cb4407e91f28ff7 - https://git.kernel.org/stable/c/45321a7d02b7cf9b3f97e3987fc1e4d649b82da2 - https://git.kernel.org/stable/c/39a90720f3abe96625d1224e7a7463410875de4c - https://git.kernel.org/stable/c/45814a53514e10a8014906c882e0d0d38df39cc1 - https://git.kernel.org/stable/c/4204a01ffce97cae1d59edc5848f02be5b2b9178 - https://git.kernel.
14906c882e0d0d38df39cc1 - https://git.kernel.org/stable/c/4204a01ffce97cae1d59edc5848f02be5b2b9178 - https://git.kernel.org/stable/c/d29f59051d3a07b81281b2df2b8c9dfe4716067f
CVE ID: CVE-2022-48703 State: PUBLISHED Published: 2024-05-03T15:14:07.390Z Last Updated: 2025-07-17T16:55:26.052Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: thermal/int340x_thermal: handle data_vault when the value is ZERO_SIZE_PTR In some case, the GDDV returns a package with a buffer which has zero length. It causes that kmemdup() returns ZERO_SIZE_PTR (0x10). Then the data_vault_read() got NULL point dereference problem when accessing the 0x10 value in data_vault. [ 71.024560] BUG: kernel NULL pointer dereference, address: 0000000000000010 This patch uses ZERO_OR_NULL_PTR() for checking ZERO_SIZE_PTR or NULL value in da
dereference, address: 0000000000000010 This patch uses ZERO_OR_NULL_PTR() for checking ZERO_SIZE_PTR or NULL value in data_vault. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/39d5137085a6c37ace4680ee4d24020a4a03e7dc - https://git.kernel.org/stable/c/dae42083b045a4ddf71c57cf350cb2412b5915c2 - https://git.kernel.org/stable/c/7931e28098a4c1a2a6802510b0cbe57546d2049d
CVE ID: CVE-2022-48704 State: PUBLISHED Published: 2024-05-03T17:45:51.299Z Last Updated: 2025-05-04T08:21:23.459Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/radeon: add a force flush to delay work when radeon Although radeon card fence and wait for gpu to finish processing current batch rings, there is still a corner case that radeon lockup work queue may not be fully flushed, and meanwhile the radeon_suspend_kms() function has called pci_set_power_state() to put device in D3hot state. Per PCI spec rev 4.0 on 5.3.1.4.1 D3hot State. > Configuration and Message requests are the only TLPs accepted by a Function in > the D