Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
happens because MSR[RI] is unset when entering RTAS but there is no valid reason to not set it here. RTAS is expected to be called with MSR[RI] as specified in PAPR+ section "7.2.1 Machine State": R1–7.2.1–9. If called with MSR[RI] equal to 1, then RTAS must protect its own critical regions from recursion by setting the MSR[RI] bit to 0 when in the critical regions. Fixing this by reviewing the way MSR is compute before calling RTAS. Now a hardcoded value meaning real ---truncated--- References: - https://git.kernel.org/stable/c/5ca40fcf0da0ce2b5bc44e7d8b036535955f2e3d - https://git.kernel.org/stable/c/5f4367448f6817c8a0e94dc9736ed84fa8eee4a3 - https://git.kernel.org/stable/c/c9c41f0273826a
ttps://git.kernel.org/stable/c/5f4367448f6817c8a0e94dc9736ed84fa8eee4a3 - https://git.kernel.org/stable/c/c9c41f0273826a13ac93124e66a4ff45df281ba0 - https://git.kernel.org/stable/c/b6b1c3ce06ca438eb24e0f45bf0e63ecad0369f5
CVE ID: CVE-2022-49441 State: PUBLISHED Published: 2025-02-26T02:12:54.649Z Last Updated: 2025-10-01T19:46:49.473Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: tty: fix deadlock caused by calling printk() under tty_port->lock pty_write() invokes kmalloc() which may invoke a normal printk() to print failure message. This can cause a deadlock in the scenario reported by syz-bot below: CPU0 CPU1 CPU2 ---- ---- ---- lock(console_owner); lock(&port_lock_key); lock(&port->lock); lock(&port_lock_key); lock(&port->lock); lock(console_owner); As commit dbdda842fe96 ("printk: Add console owner and waiter logic to load balance console w
ock); lock(console_owner); As commit dbdda842fe96 ("printk: Add console owner and waiter logic to load balance console writes") said, such deadlock can be prevented by using printk_deferred() in kmalloc() (which is invoked in the section guarded by the port->lock). But there are too many printk() on the kmalloc() path, and kmalloc() can be called from anywhere, so changing printk() to printk_deferred() is too complicated and inelegant. Therefore, this patch chooses to specify __GFP_NOWARN to kmalloc(), so that printk() will not be called, and this deadlock problem can be avoided. Syzbot reported the following lockdep error: ====================================================== WARNING: poss
oided. Syzbot reported the following lockdep error: ====================================================== WARNING: possible circular locking dependency detected 5.4.143-00237-g08ccc19a-dirty #10 Not tainted ------------------------------------------------------ syz-executor.4/29420 is trying to acquire lock: ffffffff8aedb2a0 (console_owner){....}-{0:0}, at: console_trylock_spinning kernel/printk/printk.c:1752 [inline] ffffffff8aedb2a0 (console_owner){....}-{0:0}, at: vprintk_emit+0x2ca/0x470 kernel/printk/printk.c:2023 but task is already holding lock: ffff8880119c9158 (&port->lock){-.-.}-{2:2}, at: pty_write+0xf4/0x1f0 drivers/tty/pty.c:120 which lock already depends on the new lock. the e
ort->lock){-.-.}-{2:2}, at: pty_write+0xf4/0x1f0 drivers/tty/pty.c:120 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 (&port->lock){-.-.}-{2:2}: __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x35/0x50 kernel/locking/spinlock.c:159 tty_port_tty_get drivers/tty/tty_port.c:288 [inline] <-- lock(&port->lock); tty_port_default_wakeup+0x1d/0xb0 drivers/tty/tty_port.c:47 serial8250_tx_chars+0x530/0xa80 drivers/tty/serial/8250/8250_port.c:1767 serial8250_handle_irq.part.0+0x31f/0x3d0 drivers/tty/serial/8250/8250_port.c:1854 serial8250_handle_irq drivers/tty/serial/8250/8250_port.c:1827 [inline] <--
3d0 drivers/tty/serial/8250/8250_port.c:1854 serial8250_handle_irq drivers/tty/serial/8250/8250_port.c:1827 [inline] <-- lock(&port_lock_key); serial8250_default_handle_irq+0xb2/0x220 drivers/tty/serial/8250/8250_port.c:1870 serial8250_interrupt+0xfd/0x200 drivers/tty/serial/8250/8250_core.c:126 __handle_irq_event_percpu+0x109/0xa50 kernel/irq/handle.c:156 [...] -> #1 (&port_lock_key){-.-.}-{2:2}: __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x35/0x50 kernel/locking/spinlock.c:159 serial8250_console_write+0x184/0xa40 drivers/tty/serial/8250/8250_port.c:3198 <-- lock(&port_lock_key); call_console_drivers kernel/printk/printk.c:1819 [inline] cons
ty/serial/8250/8250_port.c:3198 <-- lock(&port_lock_key); call_console_drivers kernel/printk/printk.c:1819 [inline] console_unlock+0x8cb/0xd00 kernel/printk/printk.c:2504 vprintk_emit+0x1b5/0x470 kernel/printk/printk.c:2024 <-- lock(console_owner); vprintk_func+0x8d/0x250 kernel/printk/printk_safe.c:394 printk+0xba/0xed kernel/printk/printk.c:2084 register_console+0x8b3/0xc10 kernel/printk/printk.c:2829 univ8250_console_init+0x3a/0x46 drivers/tty/serial/8250/8250_core.c:681 console_init+0x49d/0x6d3 kernel/printk/printk.c:2915 start_kernel+0x5e9/0x879 init/main.c:713 secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:241 -> #0 (console_owner){....}-{0:0}: [...] lock_acquire+0x127/0x340
ry_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:241 -> #0 (console_owner){....}-{0:0}: [...] lock_acquire+0x127/0x340 kernel/locking/lockdep.c:4734 console_trylock_spinning kernel/printk/printk.c:1773 ---truncated--- Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/4af21b12a60ed2d3642284f4f85b42d7dc6ac246 - https://git.kernel.org/stable/c/4c253caf9264d2aa47ee806a87986dd8eb91a5d9 - https://git.kernel.org/stable/c/04ee31678c128a6cc7bb057ea189a8624ba5a314 - https://git.kernel.org/stable/c/3219ac364ac3d8d30771612a6010f1e0b7fa0a28 - https://git.kernel.org/stable/c/9834b13e8b962caa28fbcf1f422dd82413da4ede - https://git.kernel.org/stable/c/18ca0d55e
8 - https://git.kernel.org/stable/c/9834b13e8b962caa28fbcf1f422dd82413da4ede - https://git.kernel.org/stable/c/18ca0d55e8639b911df8aae1b47598b13f9acded - https://git.kernel.org/stable/c/b3c974501d0c32258ae0e04e5cc3fb92383b40f6 - https://git.kernel.org/stable/c/0bcf44903ef4df742dcada86ccaedd25374ffb50 - https://git.kernel.org/stable/c/6b9dbedbe3499fef862c4dff5217cf91f34e43b3
CVE ID: CVE-2022-49442 State: PUBLISHED Published: 2025-02-26T02:12:55.291Z Last Updated: 2025-05-04T08:37:50.130Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drivers/base/node.c: fix compaction sysfs file leak Compaction sysfs file is created via compaction_register_node in register_node. But we forgot to remove it in unregister_node. Thus compaction sysfs file is leaked. Using compaction_unregister_node to fix this issue. References: - https://git.kernel.org/stable/c/39642b0feddb9c39faa6de469a94bfeb4dc0d3a9 - https://git.kernel.org/stable/c/606732650a2c88e66c59c22dd5464ea0d820250e - https://git.kernel.org/stable/c/f76ddc8f
a9 - https://git.kernel.org/stable/c/606732650a2c88e66c59c22dd5464ea0d820250e - https://git.kernel.org/stable/c/f76ddc8fcf6d81fe89bfa4d3efcbc4fe69a91d48 - https://git.kernel.org/stable/c/386e69e068177ee91cac27f2f0e6ebda1515f5ca - https://git.kernel.org/stable/c/d8a5bdc767f17281da648555cdbd286f98fd98ee - https://git.kernel.org/stable/c/b3fcf1f583b1a0946d9d9bfb7362c9c186801775 - https://git.kernel.org/stable/c/466134df7561aeb801baddf6666b512e0e1a1707 - https://git.kernel.org/stable/c/6905be93d1ab54f73718047536fec0ca488d5315 - https://git.kernel.org/stable/c/da63dc84befaa9e6079a0bc363ff0eaa975f9073
CVE ID: CVE-2022-49443 State: PUBLISHED Published: 2025-02-26T02:12:55.959Z Last Updated: 2025-10-01T19:46:49.208Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: list: fix a data-race around ep->rdllist ep_poll() first calls ep_events_available() with no lock held and checks if ep->rdllist is empty by list_empty_careful(), which reads rdllist->prev. Thus all accesses to it need some protection to avoid store/load-tearing. Note INIT_LIST_HEAD_RCU() already has the annotation for both prev and next. Commit bf3b9f6372c4 ("epoll: Add busy poll support to epoll with socket fds.") added the first lockless ep_events_available(), and c
f6372c4 ("epoll: Add busy poll support to epoll with socket fds.") added the first lockless ep_events_available(), and commit c5a282e9635e ("fs/epoll: reduce the scope of wq lock in epoll_wait()") made some ep_events_available() calls lockless and added single call under a lock, finally commit e59d3c64cba6 ("epoll: eliminate unnecessary lock for zero timeout") made the last ep_events_available() lockless. BUG: KCSAN: data-race in do_epoll_wait / do_epoll_wait write to 0xffff88810480c7d8 of 8 bytes by task 1802 on cpu 0: INIT_LIST_HEAD include/linux/list.h:38 [inline] list_splice_init include/linux/list.h:492 [inline] ep_start_scan fs/eventpoll.c:622 [inline] ep_send_events fs/eventpoll.c:165
plice_init include/linux/list.h:492 [inline] ep_start_scan fs/eventpoll.c:622 [inline] ep_send_events fs/eventpoll.c:1656 [inline] ep_poll fs/eventpoll.c:1806 [inline] do_epoll_wait+0x4eb/0xf40 fs/eventpoll.c:2234 do_epoll_pwait fs/eventpoll.c:2268 [inline] __do_sys_epoll_pwait fs/eventpoll.c:2281 [inline] __se_sys_epoll_pwait+0x12b/0x240 fs/eventpoll.c:2275 __x64_sys_epoll_pwait+0x74/0x80 fs/eventpoll.c:2275 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae read to 0xffff88810480c7d8 of 8 bytes by task 1799 on cpu 1: list_empty_careful include/linux/list.h:329 [inline] ep_events_available fs/eventpo
d8 of 8 bytes by task 1799 on cpu 1: list_empty_careful include/linux/list.h:329 [inline] ep_events_available fs/eventpoll.c:381 [inline] ep_poll fs/eventpoll.c:1797 [inline] do_epoll_wait+0x279/0xf40 fs/eventpoll.c:2234 do_epoll_pwait fs/eventpoll.c:2268 [inline] __do_sys_epoll_pwait fs/eventpoll.c:2281 [inline] __se_sys_epoll_pwait+0x12b/0x240 fs/eventpoll.c:2275 __x64_sys_epoll_pwait+0x74/0x80 fs/eventpoll.c:2275 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae value changed: 0xffff88810480c7d0 -> 0xffff888103c15098 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 1799 Comm: syz-fuzzer Ta
ffff88810480c7d0 -> 0xffff888103c15098 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 1799 Comm: syz-fuzzer Tainted: G W 5.17.0-rc7-syzkaller-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/5d5d993f16be15d124be7b8ec71b28ef7b7dc3af - https://git.kernel.org/stable/c/cb3e48f7a35033deb9455abe3932e63cb500b9eb - https://git.kernel.org/stable/c/e039c0b5985999b150594126225e1ee51df7b4c9 - https://git.kernel.org/stable/c/d679ae94fdd5d3ab00c35078f5af5f37e068b03d
CVE ID: CVE-2022-49444 State: PUBLISHED Published: 2025-02-26T02:12:56.606Z Last Updated: 2025-05-04T12:44:49.062Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: module: fix [e_shstrndx].sh_size=0 OOB access It is trivial to craft a module to trigger OOB access in this line: if (info->secstrings[strhdr->sh_size - 1] != '\0') { BUG: unable to handle page fault for address: ffffc90000aa0fff PGD 100000067 P4D 100000067 PUD 100066067 PMD 10436f067 PTE 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 7 PID: 1215 Comm: insmod Not tainted 5.18.0-rc5-00007-g9bf578647087-dirty #10 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0
Not tainted 5.18.0-rc5-00007-g9bf578647087-dirty #10 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-4.fc34 04/01/2014 RIP: 0010:load_module+0x19b/0x2391 [rebased patch onto modules-next] References: - https://git.kernel.org/stable/c/09cb6663618a74fe5572a4931ecbf098832e79ec - https://git.kernel.org/stable/c/921630e2e5124a04158129a8f22f4b425e61a858 - https://git.kernel.org/stable/c/45a76414b6d8b8b39c23fea53b9d20e831ae72a0 - https://git.kernel.org/stable/c/391e982bfa632b8315235d8be9c0a81374c6a19c
CVE ID: CVE-2022-49445 State: PUBLISHED Published: 2025-02-26T02:12:57.249Z Last Updated: 2025-10-01T19:46:48.911Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: pinctrl: renesas: core: Fix possible null-ptr-deref in sh_pfc_map_resources() It will cause null-ptr-deref when using 'res', if platform_get_resource() returns NULL, so move using 'res' after devm_ioremap_resource() that will check it to avoid null-ptr-deref. And use devm_platform_get_and_ioremap_resource() to simplify code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/f991879762392c19661af5b722578089a12b305f - https:
- CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/f991879762392c19661af5b722578089a12b305f - https://git.kernel.org/stable/c/5ed0519d425619b435150372cce2ffeec71581fa - https://git.kernel.org/stable/c/e3a1ad8fd0ac11f4fa1260c23b5db71a25473254 - https://git.kernel.org/stable/c/fb4f022b3ad1f3ff3cafdbc7d51896090ae17701 - https://git.kernel.org/stable/c/5376e3d904532e657fd7ca1a9b1ff3d351527b90
CVE ID: CVE-2022-49446 State: PUBLISHED Published: 2025-02-26T02:12:57.876Z Last Updated: 2025-10-01T19:46:48.781Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: nvdimm: Fix firmware activation deadlock scenarios Lockdep reports the following deadlock scenarios for CXL root device power-management, device_prepare(), operations, and device_shutdown() operations for 'nd_region' devices: Chain exists of: &nvdimm_region_key --> &nvdimm_bus->reconfig_mutex --> system_transition_mutex Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(system_transition_mutex); lock(&nvdimm_bus->reconfig_mutex); lock(system_transition_mutex);
o: CPU0 CPU1 ---- ---- lock(system_transition_mutex); lock(&nvdimm_bus->reconfig_mutex); lock(system_transition_mutex); lock(&nvdimm_region_key); Chain exists of: &cxl_nvdimm_bridge_key --> acpi_scan_lock --> &cxl_root_key Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&cxl_root_key); lock(acpi_scan_lock); lock(&cxl_root_key); lock(&cxl_nvdimm_bridge_key); These stem from holding nvdimm_bus_lock() over hibernate_quiet_exec() which walks the entire system device topology taking device_lock() along the way. The nvdimm_bus_lock() is protecting against unregistration, multiple simultaneous ops callers, and preventing activate_show() from racing activate_store(). For the first 2, the
n, multiple simultaneous ops callers, and preventing activate_show() from racing activate_store(). For the first 2, the lock is redundant. Unregistration already flushes all ops users, and sysfs already prevents multiple threads to be active in an ops handler at the same time. For the last userspace should already be waiting for its last activate_store() to complete, and does not need activate_show() to flush the write side, so this lock usage can be deleted in these attributes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/641649f31e20df630310f5c22f26c071acc676d4 - https://git.kernel.org/stable/c/2f97ebc58d5fc83ca1528cd553fa725472ab3ca8 - h
/641649f31e20df630310f5c22f26c071acc676d4 - https://git.kernel.org/stable/c/2f97ebc58d5fc83ca1528cd553fa725472ab3ca8 - https://git.kernel.org/stable/c/ceb924ee16b2c8e48dcac3d9ad6be01c40b5a228 - https://git.kernel.org/stable/c/2fd853fdb40afc052de338693df1372f2ead7be7 - https://git.kernel.org/stable/c/e6829d1bd3c4b58296ee9e412f7ed4d6cb390192
CVE ID: CVE-2022-49447 State: PUBLISHED Published: 2025-02-26T02:12:58.540Z Last Updated: 2025-10-01T19:46:48.646Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ARM: hisi: Add missing of_node_put after of_find_compatible_node of_find_compatible_node will increment the refcount of the returned device_node. Calling of_node_put() to avoid the refcount leak Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/46cb7868811d025c3d29c10d18b3422db1cf20d5 - https://git.kernel.org/stable/c/f8da78b2bae1f54746647a2bb44f8bd6025c57af - https://git.kernel.org/stable/c/dd4be8ecfb41a29e7c4e551b4e86615
.org/stable/c/f8da78b2bae1f54746647a2bb44f8bd6025c57af - https://git.kernel.org/stable/c/dd4be8ecfb41a29e7c4e551b4e866157ce4a3429 - https://git.kernel.org/stable/c/e109058165137ef42841abd989f080adfefa14fa - https://git.kernel.org/stable/c/21a3effe446dd6dc5eed7fe897c2f9b88c9a5d6d - https://git.kernel.org/stable/c/a3265a9440030068547a20dfee646666f3ca5278 - https://git.kernel.org/stable/c/cafaaae4bb9ce84a2791fa29bf6907a9466c3883 - https://git.kernel.org/stable/c/45d211668d33c49d73f5213e8c2b58468108647c - https://git.kernel.org/stable/c/9bc72e47d4630d58a840a66a869c56b29554cfe4
CVE ID: CVE-2022-49448 State: PUBLISHED Published: 2025-02-26T02:12:59.203Z Last Updated: 2025-10-01T19:46:48.526Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: soc: bcm: Check for NULL return of devm_kzalloc() As the potential failure of allocation, devm_kzalloc() may return NULL. Then the 'pd->pmb' and the follow lines of code may bring null pointer dereference. Therefore, it is better to check the return value of devm_kzalloc() to avoid this confusion. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/5650e103bfc70156001615861fb8aafb3947da6e - https://git.kernel.org/stable/c/36
erences: - https://git.kernel.org/stable/c/5650e103bfc70156001615861fb8aafb3947da6e - https://git.kernel.org/stable/c/36339ea7bae4943be01c8e9545e46e334591fecd - https://git.kernel.org/stable/c/b48b98743b568bb219152ba2e15af6ef0d3d8a9b - https://git.kernel.org/stable/c/b4bd2aafacce48db26b0a213d849818d940556dd
CVE ID: CVE-2022-49449 State: PUBLISHED Published: 2025-02-26T02:12:59.709Z Last Updated: 2025-10-01T19:46:48.379Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: pinctrl: renesas: rzn1: Fix possible null-ptr-deref in sh_pfc_map_resources() It will cause null-ptr-deref when using 'res', if platform_get_resource() returns NULL, so move using 'res' after devm_ioremap_resource() that will check it to avoid null-ptr-deref. And use devm_platform_get_and_ioremap_resource() to simplify code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/b646e0cfeb38bf5f1944fd548f1dfa9b129fa00c - https:
- CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/b646e0cfeb38bf5f1944fd548f1dfa9b129fa00c - https://git.kernel.org/stable/c/c16b59d445135c8026a04e388d8b2762feaa3b3b - https://git.kernel.org/stable/c/34c719b8fdfbd0c7c54cae56e6b0f16e9f8bf03e - https://git.kernel.org/stable/c/01f9e02e0f13df3fd291676dc80054e977be1601 - https://git.kernel.org/stable/c/2f661477c2bb8068194dbba9738d05219f111c6e
CVE ID: CVE-2022-49450 State: PUBLISHED Published: 2025-02-26T02:13:00.379Z Last Updated: 2025-10-01T19:46:48.225Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix listen() setting the bar too high for the prealloc rings AF_RXRPC's listen() handler lets you set the backlog up to 32 (if you bump up the sysctl), but whilst the preallocation circular buffers have 32 slots in them, one of them has to be a dead slot because we're using CIRC_CNT(). This means that listen(rxrpc_sock, 32) will cause an oops when the socket is closed because rxrpc_service_prealloc_one() allocated one too many calls and rxrpc_discard_prealloc()
hen the socket is closed because rxrpc_service_prealloc_one() allocated one too many calls and rxrpc_discard_prealloc() won't then be able to get rid of them because it'll think the ring is empty. rxrpc_release_calls_on_socket() then tries to abort them, but oopses because call->peer isn't yet set. Fix this by setting the maximum backlog to RXRPC_BACKLOG_MAX - 1 to match the ring capacity. BUG: kernel NULL pointer dereference, address: 0000000000000086 ... RIP: 0010:rxrpc_send_abort_packet+0x73/0x240 [rxrpc] Call Trace: <TASK> ? __wake_up_common_lock+0x7a/0x90 ? rxrpc_notify_socket+0x8e/0x140 [rxrpc] ? rxrpc_abort_call+0x4c/0x60 [rxrpc] rxrpc_release_calls_on_socket+0x107/0x1a0 [rxrpc] rxrpc
y_socket+0x8e/0x140 [rxrpc] ? rxrpc_abort_call+0x4c/0x60 [rxrpc] rxrpc_release_calls_on_socket+0x107/0x1a0 [rxrpc] rxrpc_release+0xc9/0x1c0 [rxrpc] __sock_release+0x37/0xa0 sock_close+0x11/0x20 __fput+0x89/0x240 task_work_run+0x59/0x90 do_exit+0x319/0xaa0 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/61fb38cfbb1d54d3dafd0c25752f684b3cd00b32 - https://git.kernel.org/stable/c/616f76498d5ddf26b997caf64a95cda3c8a55533 - https://git.kernel.org/stable/c/4a3a78b7918bdd723d8c7c9786522ca969bffcc4 - https://git.kernel.org/stable/c/91b34bf0409f43bb60453bab23c5beadd726d022 - https://git.kernel.org/stable/c/5b4826657d36c218e9f08e8d3223b0edce3de88f - http
b34bf0409f43bb60453bab23c5beadd726d022 - https://git.kernel.org/stable/c/5b4826657d36c218e9f08e8d3223b0edce3de88f - https://git.kernel.org/stable/c/b3a9b227d5e7467b8518160ff034ea22bb9de573 - https://git.kernel.org/stable/c/369de57492c4f1a42563c5a3bd365822ca3bfc79 - https://git.kernel.org/stable/c/e198f1930050e3115c80b67d9249f80f98a27c67 - https://git.kernel.org/stable/c/88e22159750b0d55793302eeed8ee603f5c1a95c
CVE ID: CVE-2022-49451 State: PUBLISHED Published: 2025-02-26T02:13:01.077Z Last Updated: 2025-10-01T19:46:48.095Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Fix list protocols enumeration in the base protocol While enumerating protocols implemented by the SCMI platform using BASE_DISCOVER_LIST_PROTOCOLS, the number of returned protocols is currently validated in an improper way since the check employs a sum between unsigned integers that could overflow and cause the check itself to be silently bypassed if the returned value 'loop_num_ret' is big enough. Fix the validation avoiding the addition. Addition
silently bypassed if the returned value 'loop_num_ret' is big enough. Fix the validation avoiding the addition. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/444a2d27fe9867d0da4b28fc45b793f32e099ab8 - https://git.kernel.org/stable/c/b0e4bafac8963c2d85ee18d3d01f393735acceec - https://git.kernel.org/stable/c/1052f22e127d0c34c3387bb389424ba1c61491ff - https://git.kernel.org/stable/c/98342148a8cd242855d7e257f298c966c96dba9f - https://git.kernel.org/stable/c/6e7978695f4a6cbd83616b5a702b77fa2087b247 - https://git.kernel.org/stable/c/2ccfcd7a09c826516edcfe464b05071961aada3f - https://git.kernel.org/stable/c/8009120e0354a67068e920eb10dce532391361d0
CVE ID: CVE-2022-49452 State: PUBLISHED Published: 2025-02-26T02:13:01.777Z Last Updated: 2025-05-04T08:38:02.933Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: dpaa2-eth: retrieve the virtual address before dma_unmap The TSO header was DMA unmapped before the virtual address was retrieved and then used to free the buffer. This meant that we were actually removing the DMA map and then trying to search for it to help in retrieving the virtual address. This lead to a invalid virtual address being used in the kfree call. Fix this by calling dpaa2_iova_to_virt() prior to the dma_unmap call. [ 487.231819] Unable to handle kernel pa
ree call. Fix this by calling dpaa2_iova_to_virt() prior to the dma_unmap call. [ 487.231819] Unable to handle kernel paging request at virtual address fffffd9807000008 (...) [ 487.354061] Hardware name: SolidRun LX2160A Honeycomb (DT) [ 487.359535] pstate: a0400005 (NzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 487.366485] pc : kfree+0xac/0x304 [ 487.369799] lr : kfree+0x204/0x304 [ 487.373191] sp : ffff80000c4eb120 [ 487.376493] x29: ffff80000c4eb120 x28: ffff662240c46400 x27: 0000000000000001 [ 487.383621] x26: 0000000000000001 x25: ffff662246da0cc0 x24: ffff66224af78000 [ 487.390748] x23: ffffad184f4ce008 x22: ffffad1850185000 x21: ffffad1838d13cec [ 487.397874] x20: ffff6601c0000000 x