Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-50519 State: PUBLISHED Published: 2025-10-07T15:19:13.844Z Last Updated: 2025-10-07T15:19:13.844Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: nilfs2: replace WARN_ONs by nilfs_error for checkpoint acquisition failure If creation or finalization of a checkpoint fails due to anomalies in the checkpoint metadata on disk, a kernel warning is generated. This patch replaces the WARN_ONs by nilfs_error, so that a kernel, booted with panic_on_warn, does not panic. A nilfs_error is appropriate here to handle the abnormal filesystem condition. This also replaces the detected error codes with an I/O error so that neith
to handle the abnormal filesystem condition. This also replaces the detected error codes with an I/O error so that neither of the internal error codes is returned to callers. References: - https://git.kernel.org/stable/c/b63026b5e13040cd5afa11769dd0d9e1504b031a - https://git.kernel.org/stable/c/ae16440c44ae2acda6d72aff9d74eccf8967dae5 - https://git.kernel.org/stable/c/bf98be80cbe3b4e6c86c36ed00457389aca3eb15 - https://git.kernel.org/stable/c/259c0f68168ac6a598db3486597b10e74d625db0 - https://git.kernel.org/stable/c/8a18fdc5ae8e6d7ac33c6ee0a2e5f9f1414ef412 - https://git.kernel.org/stable/c/c0c3d3d3ea41cb5228ee90568bb953f9a56c3227 - https://git.kernel.org/stable/c/090fcfb6edeb9367a915b2749e2bd
el.org/stable/c/c0c3d3d3ea41cb5228ee90568bb953f9a56c3227 - https://git.kernel.org/stable/c/090fcfb6edeb9367a915b2749e2bd1f8b48d8898 - https://git.kernel.org/stable/c/5c0776b5bc31de7cd28afb558fae37a20f33602e - https://git.kernel.org/stable/c/723ac751208f6d6540191689cfbf6c77135a7a1b
CVE ID: CVE-2022-50520 State: PUBLISHED Published: 2025-10-07T15:19:14.528Z Last Updated: 2025-10-07T15:19:14.528Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/radeon: Fix PCI device refcount leak in radeon_atrm_get_bios() As comment of pci_get_class() says, it returns a pci_device with its refcount increased and decreased the refcount for the input parameter @from if it is not NULL. If we break the loop in radeon_atrm_get_bios() with 'pdev' not NULL, we need to call pci_dev_put() to decrease the refcount. Add the missing pci_dev_put() to avoid refcount leak. References: - https://git.kernel.org/stable/c/6f28c7f67af4ef9bc
t. Add the missing pci_dev_put() to avoid refcount leak. References: - https://git.kernel.org/stable/c/6f28c7f67af4ef9bca580ab67ae2d4511797af56 - https://git.kernel.org/stable/c/e738f82e5b1311e8fb3d1409491a6fcce6418fbe - https://git.kernel.org/stable/c/1079df6acf56f99d86b0081a38c84701412cc90e - https://git.kernel.org/stable/c/470a77989037c3ab2b08bf2d026d2c0ddc35ff5b - https://git.kernel.org/stable/c/3991d98a8a07b71c02f3a39f77d6d9a7f575a5c4 - https://git.kernel.org/stable/c/88c6e0995c04b170563b5c894c50a3b2152e18c2 - https://git.kernel.org/stable/c/b9decada8749b606fd8b4f04a3d6c74f7983d7bc - https://git.kernel.org/stable/c/a6cffe54064a5f6c2162a85af3c16c6b453eac4e - https://git.kernel.org/stable
6c74f7983d7bc - https://git.kernel.org/stable/c/a6cffe54064a5f6c2162a85af3c16c6b453eac4e - https://git.kernel.org/stable/c/725a521a18734f65de05b8d353b5bd0d3ca4c37a
CVE ID: CVE-2022-50521 State: PUBLISHED Published: 2025-10-07T15:19:15.213Z Last Updated: 2025-10-07T15:19:15.213Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mx[ds|mx]() The ACPI buffer memory (out.pointer) returned by wmi_evaluate_method() is not freed after the call, so it leads to memory leak. The method results in ACPI buffer is not used, so just pass NULL to wmi_evaluate_method() which fixes the memory leak. References: - https://git.kernel.org/stable/c/50ac517d6f5348b276f1f663799cf85dce521518 - https://git.kernel.org/stable/c/5b0f81b0808235967868e01336c976e840217108 -
/c/50ac517d6f5348b276f1f663799cf85dce521518 - https://git.kernel.org/stable/c/5b0f81b0808235967868e01336c976e840217108 - https://git.kernel.org/stable/c/14bb4bde3b7b2584734b13747b345caeeb41bea3 - https://git.kernel.org/stable/c/17cd8c46cbec4e6ad593fb9159928b8e7608c11a - https://git.kernel.org/stable/c/3cf81501356c9e898ad94b2369ffc805f83f7d7b - https://git.kernel.org/stable/c/379e7794c5e7485193d25d73614fbbd1e1387f6f - https://git.kernel.org/stable/c/87426ce3bd57ad414b6e2436434ef8128986a9a5 - https://git.kernel.org/stable/c/727cc0147f5066e359aca65cc6cc5e6d64cc15d8
CVE ID: CVE-2022-50522 State: PUBLISHED Published: 2025-10-07T15:19:15.923Z Last Updated: 2025-10-07T15:19:15.923Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mcb: mcb-parse: fix error handing in chameleon_parse_gdd() If mcb_device_register() returns error in chameleon_parse_gdd(), the refcount of bus and device name are leaked. Fix this by calling put_device() to give up the reference, so they can be released in mcb_release_dev() and kobject_cleanup(). References: - https://git.kernel.org/stable/c/891f606ae0765bc9ca99f5276735be4d338f0255 - https://git.kernel.org/stable/c/cf6e70c0ced50b52415ac0c88eba1fb09c500a5a - https://gi
e0765bc9ca99f5276735be4d338f0255 - https://git.kernel.org/stable/c/cf6e70c0ced50b52415ac0c88eba1fb09c500a5a - https://git.kernel.org/stable/c/fd85ece416fd7edb945203e59d4cd94952f77e7c - https://git.kernel.org/stable/c/110dc34c9fa33d37f55b394b1199ea6c0ad1ee84 - https://git.kernel.org/stable/c/7b289b791a59386dc23a00d3cf17a0db984b40d3 - https://git.kernel.org/stable/c/43bfc7c2402a22d3b4eb08c040f274ba2b76461a - https://git.kernel.org/stable/c/b948baa29394ec5f4e6ec28486e7d06a76caee91 - https://git.kernel.org/stable/c/4a9f1a8b3af287581ffb690d0e1593c681729ddb - https://git.kernel.org/stable/c/728ac3389296caf68638628c987aeae6c8851e2d
CVE ID: CVE-2022-50523 State: PUBLISHED Published: 2025-10-07T15:19:16.595Z Last Updated: 2025-10-07T15:19:16.595Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: clk: rockchip: Fix memory leak in rockchip_clk_register_pll() If clk_register() fails, @pll->rate_table may have allocated memory by kmemdup(), so it needs to be freed, otherwise will cause memory leak issue, this patch fixes it. References: - https://git.kernel.org/stable/c/20201c3a0a32f127fa4bdf379d6ac01c2978702d - https://git.kernel.org/stable/c/86e1e080ad14c5fb6c14a5f0eb530b1b38cbc968 - https://git.kernel.org/stable/c/f02c1d8dc8d880cbaaf9094b4f396fe868ee23ff - http
e1e080ad14c5fb6c14a5f0eb530b1b38cbc968 - https://git.kernel.org/stable/c/f02c1d8dc8d880cbaaf9094b4f396fe868ee23ff - https://git.kernel.org/stable/c/26b94635f1c84d7f6cb482179125cb17e59c90a5 - https://git.kernel.org/stable/c/f4d70c139d313948e02360304a6cbcd3a4f5deb5 - https://git.kernel.org/stable/c/5b0a1f1247cd42ac5e0d369f8dbb58762692edee - https://git.kernel.org/stable/c/dcd4ba068b194c6ef0071491aa3f12bec8c14d5b - https://git.kernel.org/stable/c/f2ffb8653ea85ae39ce44347751fcc4c3e41f6bb - https://git.kernel.org/stable/c/739a6a6bbdb793bd57938cb24aa5a6df89983546
CVE ID: CVE-2022-50524 State: PUBLISHED Published: 2025-10-07T15:19:17.251Z Last Updated: 2025-10-07T15:19:17.251Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: iommu/mediatek: Check return value after calling platform_get_resource() platform_get_resource() may return NULL pointer, we need check its return value to avoid null-ptr-deref in resource_size(). References: - https://git.kernel.org/stable/c/bfebf05883cdcf9ac983033987fae869bd59ca53 - https://git.kernel.org/stable/c/feca904412483b2e0a903dd1f2e2843afd445f8c - https://git.kernel.org/stable/c/73b6924cdebc899de9b719e1319aa86c6bed4acf
CVE ID: CVE-2022-50525 State: PUBLISHED Published: 2025-10-07T15:19:17.929Z Last Updated: 2025-10-07T15:19:17.929Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: iommu/fsl_pamu: Fix resource leak in fsl_pamu_probe() The fsl_pamu_probe() returns directly when create_csd() failed, leaving irq and memories unreleased. Fix by jumping to error if create_csd() returns error. References: - https://git.kernel.org/stable/c/c93983230562883e0b5f122040efbb3d478c36d4 - https://git.kernel.org/stable/c/a305d0e4d0ce3166e31d7dbcb4c98b09cad6d49a - https://git.kernel.org/stable/c/9fbccdf2fefa3944dd8ba8c6a808b387787f3917 - https://git.kernel.org/s
bcb4c98b09cad6d49a - https://git.kernel.org/stable/c/9fbccdf2fefa3944dd8ba8c6a808b387787f3917 - https://git.kernel.org/stable/c/17fd440594961c5e2ea0f58591bc1bdba0629c75 - https://git.kernel.org/stable/c/0d240ac0e4c35d3f64fc782c11433138c1bd016e - https://git.kernel.org/stable/c/e42b543d08052c3b223bcfb48f05cbaf0b767f86 - https://git.kernel.org/stable/c/9238b687fd62cde14c6e2e8576a40e4246de7ebe - https://git.kernel.org/stable/c/de7eb55009796687fc0a1670e0b944fa8ed54e9b - https://git.kernel.org/stable/c/73f5fc5f884ad0c5f7d57f66303af64f9f002526
CVE ID: CVE-2022-50526 State: PUBLISHED Published: 2025-10-07T15:19:18.586Z Last Updated: 2025-10-07T15:19:18.586Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/msm/dp: fix memory corruption with too many bridges Add the missing sanity check on the bridge counter to avoid corrupting data beyond the fixed-sized bridge array in case there are ever more than eight bridges. Patchwork: https://patchwork.freedesktop.org/patch/502664/ References: - https://git.kernel.org/stable/c/b312fcab461bd9484c61409007a6fe059f9c2074 - https://git.kernel.org/stable/c/74466e46e7543c7f74f1502181e9ba93f7521374
CVE ID: CVE-2022-50527 State: PUBLISHED Published: 2025-10-07T15:19:19.238Z Last Updated: 2025-10-07T15:19:19.238Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix size validation for non-exclusive domains (v4) Fix amdgpu_bo_validate_size() to check whether the TTM domain manager for the requested memory exists, else we get a kernel oops when dereferencing "man". v2: Make the patch standalone, i.e. not dependent on local patches. v3: Preserve old behaviour and just check that the manager pointer is not NULL. v4: Complain if GTT domain requested and it is uninitialized--most likely a bug. References: - https://git.
is not NULL. v4: Complain if GTT domain requested and it is uninitialized--most likely a bug. References: - https://git.kernel.org/stable/c/80546eef216854a7bd47e39e828f04b406c00599 - https://git.kernel.org/stable/c/8ba7c55e112f4ffd2a95b99be1cb1c891ef08ba1 - https://git.kernel.org/stable/c/7554886daa31eacc8e7fac9e15bbce67d10b8f1f
CVE ID: CVE-2022-50528 State: PUBLISHED Published: 2025-10-07T15:19:19.909Z Last Updated: 2025-10-07T15:19:19.909Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix memory leakage This patch fixes potential memory leakage and seg fault in _gpuvm_import_dmabuf() function References: - https://git.kernel.org/stable/c/8876793e56ec69b3be2a883b4bc440df3dbb1865 - https://git.kernel.org/stable/c/7356d8e367d0e025a568e369c4cf575722cac60f - https://git.kernel.org/stable/c/c65564790048fa416ccd26a8945c7ec0cf9ef0b7 - https://git.kernel.org/stable/c/75818afff631e1ea785a82c3e8bb82eb0dee539c
CVE ID: CVE-2022-50529 State: PUBLISHED Published: 2025-10-07T15:19:20.581Z Last Updated: 2025-10-07T15:19:20.581Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: test_firmware: fix memory leak in test_firmware_init() When misc_register() failed in test_firmware_init(), the memory pointed by test_fw_config->name is not released. The memory leak information is as follows: unreferenced object 0xffff88810a34cb00 (size 32): comm "insmod", pid 7952, jiffies 4294948236 (age 49.060s) hex dump (first 32 bytes): 74 65 73 74 2d 66 69 72 6d 77 61 72 65 2e 62 69 test-firmware.bi 6e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 n.............
3 74 2d 66 69 72 6d 77 61 72 65 2e 62 69 test-firmware.bi 6e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 n............... backtrace: [<ffffffff81b21fcb>] __kmalloc_node_track_caller+0x4b/0xc0 [<ffffffff81affb96>] kstrndup+0x46/0xc0 [<ffffffffa0403a49>] __test_firmware_config_init+0x29/0x380 [test_firmware] [<ffffffffa040f068>] 0xffffffffa040f068 [<ffffffff81002c41>] do_one_initcall+0x141/0x780 [<ffffffff816a72c3>] do_init_module+0x1c3/0x630 [<ffffffff816adb9e>] load_module+0x623e/0x76a0 [<ffffffff816af471>] __do_sys_finit_module+0x181/0x240 [<ffffffff89978f99>] do_syscall_64+0x39/0xb0 [<ffffffff89a0008b>] entry_SYSCALL_64_after_hwframe+0x63/0xcd References: - https://git.kernel.org/stable/c
64+0x39/0xb0 [<ffffffff89a0008b>] entry_SYSCALL_64_after_hwframe+0x63/0xcd References: - https://git.kernel.org/stable/c/ed5cbafaf7ce8b86f19998c00eb020c8d49b017f - https://git.kernel.org/stable/c/04dd47a2e169f2d4489636afa07ff0469aab49ab - https://git.kernel.org/stable/c/628de998a3abfffb3f9677d2fb39a1d5dcb32fdb - https://git.kernel.org/stable/c/0b5a89e8bce1ea43687742b4de8e216189ff94ac - https://git.kernel.org/stable/c/357379d504c0c8b0834e206ad8c49e4b3c98ed4d - https://git.kernel.org/stable/c/8d8c1d6a430f0aadb80036e2b1bc0a05f9fad247 - https://git.kernel.org/stable/c/6dd5fbd243f19f087dc79481acb7d69fb57fea2c - https://git.kernel.org/stable/c/7610615e8cdb3f6f5bbd9d8e7a5d8a63e3cabf2e
CVE ID: CVE-2022-50530 State: PUBLISHED Published: 2025-10-07T15:19:21.259Z Last Updated: 2025-10-07T15:19:21.259Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: blk-mq: fix null pointer dereference in blk_mq_clear_rq_mapping() Our syzkaller report a null pointer dereference, root cause is following: __blk_mq_alloc_map_and_rqs set->tags[hctx_idx] = blk_mq_alloc_map_and_rqs blk_mq_alloc_map_and_rqs blk_mq_alloc_rqs // failed due to oom alloc_pages_node // set->tags[hctx_idx] is still NULL blk_mq_free_rqs drv_tags = set->tags[hctx_idx]; // null pointer dereference is triggered blk_mq_clear_rq_mapping(drv_tags, ...) This is becaus
gs = set->tags[hctx_idx]; // null pointer dereference is triggered blk_mq_clear_rq_mapping(drv_tags, ...) This is because commit 63064be150e4 ("blk-mq: Add blk_mq_alloc_map_and_rqs()") merged the two steps: 1) set->tags[hctx_idx] = blk_mq_alloc_rq_map() 2) blk_mq_alloc_rqs(..., set->tags[hctx_idx]) into one step: set->tags[hctx_idx] = blk_mq_alloc_map_and_rqs() Since tags is not initialized yet in this case, fix the problem by checking if tags is NULL pointer in blk_mq_clear_rq_mapping(). References: - https://git.kernel.org/stable/c/6a440e6d04431e774dc084abe88c106e2a474c1a - https://git.kernel.org/stable/c/76dd298094f484c6250ebd076fa53287477b2328
CVE ID: CVE-2022-50531 State: PUBLISHED Published: 2025-10-07T15:19:21.911Z Last Updated: 2025-10-07T15:19:21.911Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: tipc: fix an information leak in tipc_topsrv_kern_subscr Use a 8-byte write to initialize sub.usr_handle in tipc_topsrv_kern_subscr(), otherwise four bytes remain uninitialized when issuing setsockopt(..., SOL_TIPC, ...). This resulted in an infoleak reported by KMSAN when the packet was received: ===================================================== BUG: KMSAN: kernel-infoleak in copyout+0xbc/0x100 lib/iov_iter.c:169 instrument_copy_to_user ./include/linux/instrumente
BUG: KMSAN: kernel-infoleak in copyout+0xbc/0x100 lib/iov_iter.c:169 instrument_copy_to_user ./include/linux/instrumented.h:121 copyout+0xbc/0x100 lib/iov_iter.c:169 _copy_to_iter+0x5c0/0x20a0 lib/iov_iter.c:527 copy_to_iter ./include/linux/uio.h:176 simple_copy_to_iter+0x64/0xa0 net/core/datagram.c:513 __skb_datagram_iter+0x123/0xdc0 net/core/datagram.c:419 skb_copy_datagram_iter+0x58/0x200 net/core/datagram.c:527 skb_copy_datagram_msg ./include/linux/skbuff.h:3903 packet_recvmsg+0x521/0x1e70 net/packet/af_packet.c:3469 ____sys_recvmsg+0x2c4/0x810 net/socket.c:? ___sys_recvmsg+0x217/0x840 net/socket.c:2743 __sys_recvmsg net/socket.c:2773 __do_sys_recvmsg net/socket.c:2783 __se_sys_recvmsg n
vmsg+0x217/0x840 net/socket.c:2743 __sys_recvmsg net/socket.c:2773 __do_sys_recvmsg net/socket.c:2783 __se_sys_recvmsg net/socket.c:2780 __x64_sys_recvmsg+0x364/0x540 net/socket.c:2780 do_syscall_x64 arch/x86/entry/common.c:50 do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd arch/x86/entry/entry_64.S:120 ... Uninit was stored to memory at: tipc_sub_subscribe+0x42d/0xb50 net/tipc/subscr.c:156 tipc_conn_rcv_sub+0x246/0x620 net/tipc/topsrv.c:375 tipc_topsrv_kern_subscr+0x2e8/0x400 net/tipc/topsrv.c:579 tipc_group_create+0x4e7/0x7d0 net/tipc/group.c:190 tipc_sk_join+0x2a8/0x770 net/tipc/socket.c:3084 tipc_setsockopt+0xae5/0xe40 net/tipc/socket.c:3201 __
t/tipc/group.c:190 tipc_sk_join+0x2a8/0x770 net/tipc/socket.c:3084 tipc_setsockopt+0xae5/0xe40 net/tipc/socket.c:3201 __sys_setsockopt+0x87f/0xdc0 net/socket.c:2252 __do_sys_setsockopt net/socket.c:2263 __se_sys_setsockopt net/socket.c:2260 __x64_sys_setsockopt+0xe0/0x160 net/socket.c:2260 do_syscall_x64 arch/x86/entry/common.c:50 do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd arch/x86/entry/entry_64.S:120 Local variable sub created at: tipc_topsrv_kern_subscr+0x57/0x400 net/tipc/topsrv.c:562 tipc_group_create+0x4e7/0x7d0 net/tipc/group.c:190 Bytes 84-87 of 88 are uninitialized Memory access of size 88 starts at ffff88801ed57cd0 Data copied to use
c/group.c:190 Bytes 84-87 of 88 are uninitialized Memory access of size 88 starts at ffff88801ed57cd0 Data copied to user address 0000000020000400 ... ===================================================== References: - https://git.kernel.org/stable/c/3d1b83ff7b6575a4e41283203e6b2e25ea700cd7 - https://git.kernel.org/stable/c/567f8de358b61015dcfb8878a1f06c5369a45f54 - https://git.kernel.org/stable/c/e558e148938442dd49628cd7ef61c360832bef31 - https://git.kernel.org/stable/c/dbc01c0a4e202a7e925dad1d4b7c1d6eb0c81154 - https://git.kernel.org/stable/c/fef70f978bc289642501d88d2a3f5e841bd31a67 - https://git.kernel.org/stable/c/777ecaabd614d47c482a5c9031579e66da13989a
CVE ID: CVE-2022-50532 State: PUBLISHED Published: 2025-10-07T15:19:22.581Z Last Updated: 2025-10-07T15:19:22.581Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add() In mpt3sas_transport_port_add(), if sas_rphy_add() returns error, sas_rphy_free() needs be called to free the resource allocated in sas_end_device_alloc(). Otherwise a kernel crash will happen: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000108 CPU: 45 PID: 37020 Comm: bash Kdump: loaded Tainted: G W 6.1.0-rc1+ #189 pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DI
CPU: 45 PID: 37020 Comm: bash Kdump: loaded Tainted: G W 6.1.0-rc1+ #189 pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : device_del+0x54/0x3d0 lr : device_del+0x37c/0x3d0 Call trace: device_del+0x54/0x3d0 attribute_container_class_device_del+0x28/0x38 transport_remove_classdev+0x6c/0x80 attribute_container_device_trigger+0x108/0x110 transport_remove_device+0x28/0x38 sas_rphy_remove+0x50/0x78 [scsi_transport_sas] sas_port_delete+0x30/0x148 [scsi_transport_sas] do_sas_phy_delete+0x78/0x80 [scsi_transport_sas] device_for_each_child+0x68/0xb0 sas_remove_children+0x30/0x50 [scsi_transport_sas] sas_rphy_remove+0x38/0x78 [scsi_transport_sas] sas_port_delete+0x30/0x148 [scsi_tr
ildren+0x30/0x50 [scsi_transport_sas] sas_rphy_remove+0x38/0x78 [scsi_transport_sas] sas_port_delete+0x30/0x148 [scsi_transport_sas] do_sas_phy_delete+0x78/0x80 [scsi_transport_sas] device_for_each_child+0x68/0xb0 sas_remove_children+0x30/0x50 [scsi_transport_sas] sas_remove_host+0x20/0x38 [scsi_transport_sas] scsih_remove+0xd8/0x420 [mpt3sas] Because transport_add_device() is not called when sas_rphy_add() fails, the device is not added. When sas_rphy_remove() is subsequently called to remove the device in the remove() path, a NULL pointer dereference happens. References: - https://git.kernel.org/stable/c/d60000cb1195a464080b0efb4949daf7594e0020 - https://git.kernel.org/stable/c/ce1a69cc850
- https://git.kernel.org/stable/c/d60000cb1195a464080b0efb4949daf7594e0020 - https://git.kernel.org/stable/c/ce1a69cc85006b494353911b35171da195d79e25 - https://git.kernel.org/stable/c/6a92129c8f999ff5b122c100ce7f625eb3e98c4b - https://git.kernel.org/stable/c/6f6768e2fc8638fabdd8802c2ef693d7aef01db1 - https://git.kernel.org/stable/c/d17bca3ddfe507874cb826d32721552da12e741f - https://git.kernel.org/stable/c/78316e9dfc24906dd474630928ed1d3c562b568e
CVE ID: CVE-2022-50533 State: PUBLISHED Published: 2025-10-07T15:19:23.277Z Last Updated: 2025-10-07T15:19:23.277Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: mlme: fix null-ptr deref on failed assoc If association to an AP without a link 0 fails, then we crash in tracing because it assumes that either ap_mld_addr or link 0 BSS is valid, since we clear sdata->vif.valid_links and then don't add the ap_mld_addr to the struct. Since we clear also sdata->vif.cfg.ap_addr, keep a local copy of it and assign it earlier, before clearing valid_links, to fix this. References: - https://git.kernel.org/stable/c/c695dfba8
and assign it earlier, before clearing valid_links, to fix this. References: - https://git.kernel.org/stable/c/c695dfba8dfb82dc7ace4f22be088916cbf621ca - https://git.kernel.org/stable/c/bb7743955a929e44b308cc3f63f8cc03873c1bee - https://git.kernel.org/stable/c/78a6a43aaf87180ec7425a2a90468e1b4d09a1ec
CVE ID: CVE-2022-50534 State: PUBLISHED Published: 2025-10-07T15:19:23.958Z Last Updated: 2025-10-07T15:19:23.958Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: dm thin: Use last transaction's pmd->root when commit failed Recently we found a softlock up problem in dm thin pool btree lookup code due to corrupted metadata: Kernel panic - not syncing: softlockup: hung tasks CPU: 7 PID: 2669225 Comm: kworker/u16:3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) Workqueue: dm-thin do_worker [dm_thin_pool] Call Trace: <IRQ> dump_stack+0x9c/0xd3 panic+0x35d/0x6b9 watchdog_timer_fn.cold+0x16/0x25 __run_hrtimer+0xa2/0x2d0 </IRQ>
ll Trace: <IRQ> dump_stack+0x9c/0xd3 panic+0x35d/0x6b9 watchdog_timer_fn.cold+0x16/0x25 __run_hrtimer+0xa2/0x2d0 </IRQ> RIP: 0010:__relink_lru+0x102/0x220 [dm_bufio] __bufio_new+0x11f/0x4f0 [dm_bufio] new_read+0xa3/0x1e0 [dm_bufio] dm_bm_read_lock+0x33/0xd0 [dm_persistent_data] ro_step+0x63/0x100 [dm_persistent_data] btree_lookup_raw.constprop.0+0x44/0x220 [dm_persistent_data] dm_btree_lookup+0x16f/0x210 [dm_persistent_data] dm_thin_find_block+0x12c/0x210 [dm_thin_pool] __process_bio_read_only+0xc5/0x400 [dm_thin_pool] process_thin_deferred_bios+0x1a4/0x4a0 [dm_thin_pool] process_one_work+0x3c5/0x730 Following process may generate a broken btree mixed with fresh and stale btree nodes, which
rocess_one_work+0x3c5/0x730 Following process may generate a broken btree mixed with fresh and stale btree nodes, which could get dm thin trapped in an infinite loop while looking up data block: Transaction 1: pmd->root = A, A->B->C // One path in btree pmd->root = X, X->Y->Z // Copy-up Transaction 2: X,Z is updated on disk, Y write failed. // Commit failed, dm thin becomes read-only. process_bio_read_only dm_thin_find_block __find_block dm_btree_lookup(pmd->root) The pmd->root points to a broken btree, Y may contain stale node pointing to any block, for example X, which gets dm thin trapped into a dead loop while looking up Z. Fix this by setting pmd->root in __open_metadata(), so that dm t