Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
frame+0x44/0xae </TASK> Allocated by task 0: (stack is not available) The buggy address belongs to the object at ffff888011e33800 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 0 bytes to the right of 512-byte region [ffff888011e33800, ffff888011e33a00) The buggy address belongs to the physical page: page:0000000089cd4adb refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11e30 head:0000000089cd4adb order:2 compound_mapcount:0 compound_pincount:0 flags: 0x4000000000010200(slab|head|zone=1) raw: 4000000000010200 dead000000000100 dead000000000122 ffff888001041c80 raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 page dumped be
ead000000000122 ffff888001041c80 raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888011e33900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888011e33980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff888011e33a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff888011e33a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888011e33b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== Disabling lock debugging due to kernel taint References: - https://git.kernel.org/stable/c/9cf15ebb7dedfe2f
============ Disabling lock debugging due to kernel taint References: - https://git.kernel.org/stable/c/9cf15ebb7dedfe2f27120743b8ea8441c99ac73c - https://git.kernel.org/stable/c/c181acbd1a427859d5fda543b95fbae28f7f6068 - https://git.kernel.org/stable/c/d187ba5312307d51818beafaad87d28a7d939adf
CVE ID: CVE-2022-49558 State: PUBLISHED Published: 2025-02-26T02:14:04.575Z Last Updated: 2025-06-19T12:39:10.625Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: double hook unregistration in netns path __nft_release_hooks() is called from pre_netns exit path which unregisters the hooks, then the NETDEV_UNREGISTER event is triggered which unregisters the hooks again. [ 565.221461] WARNING: CPU: 18 PID: 193 at net/netfilter/core.c:495 __nf_unregister_net_hook+0x247/0x270 [...] [ 565.246890] CPU: 18 PID: 193 Comm: kworker/u64:1 Tainted: G E 5.18.0-rc7+ #27 [ 565.253682] Workqueue: netns cleanup_net [ 565.257
] CPU: 18 PID: 193 Comm: kworker/u64:1 Tainted: G E 5.18.0-rc7+ #27 [ 565.253682] Workqueue: netns cleanup_net [ 565.257059] RIP: 0010:__nf_unregister_net_hook+0x247/0x270 [...] [ 565.297120] Call Trace: [ 565.300900] <TASK> [ 565.304683] nf_tables_flowtable_event+0x16a/0x220 [nf_tables] [ 565.308518] raw_notifier_call_chain+0x63/0x80 [ 565.312386] unregister_netdevice_many+0x54f/0xb50 Unregister and destroy netdev hook from netns pre_exit via kfree_rcu so the NETDEV_UNREGISTER path see unregistered hooks. References: - https://git.kernel.org/stable/c/b09e6ccf0d12f9356e8e3508d3e3dce126298538 - https://git.kernel.org/stable/c/3fac8ce48fa9fd61ee9056d3ed48b2edefca8b82 - https://git.kernel.org/s
08d3e3dce126298538 - https://git.kernel.org/stable/c/3fac8ce48fa9fd61ee9056d3ed48b2edefca8b82 - https://git.kernel.org/stable/c/9c413a8c8bb49cc16796371805ecb260e885bb2b - https://git.kernel.org/stable/c/a3940dcf552f2393d1e8f263b386593f98abe829 - https://git.kernel.org/stable/c/86c0154f4c3a56c5db8b9dd09e3ce885382c2c19 - https://git.kernel.org/stable/c/f9a43007d3f7ba76d5e7f9421094f00f2ef202f8
CVE ID: CVE-2022-49559 State: PUBLISHED Published: 2025-02-26T02:14:05.059Z Last Updated: 2025-05-04T08:40:32.768Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Drop WARNs that assert a triple fault never "escapes" from L2 Remove WARNs that sanity check that KVM never lets a triple fault for L2 escape and incorrectly end up in L1. In normal operation, the sanity check is perfectly valid, but it incorrectly assumes that it's impossible for userspace to induce KVM_REQ_TRIPLE_FAULT without bouncing through KVM_RUN (which guarantees kvm_check_nested_state() will see and handle the triple fault). The WARN can currently be
ough KVM_RUN (which guarantees kvm_check_nested_state() will see and handle the triple fault). The WARN can currently be triggered if userspace injects a machine check while L2 is active and CR4.MCE=0. And a future fix to allow save/restore of KVM_REQ_TRIPLE_FAULT, e.g. so that a synthesized triple fault isn't lost on migration, will make it trivially easy for userspace to trigger the WARN. Clearing KVM_REQ_TRIPLE_FAULT when forcibly leaving guest mode is tempting, but wrong, especially if/when the request is saved/restored, e.g. if userspace restores events (including a triple fault) and then restores nested state (which may forcibly leave guest mode). Ignoring the fact that KVM doesn't cur
iple fault) and then restores nested state (which may forcibly leave guest mode). Ignoring the fact that KVM doesn't currently provide the necessary APIs, it's userspace's responsibility to manage pending events during save/restore. ------------[ cut here ]------------ WARNING: CPU: 7 PID: 1399 at arch/x86/kvm/vmx/nested.c:4522 nested_vmx_vmexit+0x7fe/0xd90 [kvm_intel] Modules linked in: kvm_intel kvm irqbypass CPU: 7 PID: 1399 Comm: state_test Not tainted 5.17.0-rc3+ #808 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:nested_vmx_vmexit+0x7fe/0xd90 [kvm_intel] Call Trace: <TASK> vmx_leave_nested+0x30/0x40 [kvm_intel] vmx_set_nested_state+0xca/0x3e0 [kvm_i
0x7fe/0xd90 [kvm_intel] Call Trace: <TASK> vmx_leave_nested+0x30/0x40 [kvm_intel] vmx_set_nested_state+0xca/0x3e0 [kvm_intel] kvm_arch_vcpu_ioctl+0xf49/0x13e0 [kvm] kvm_vcpu_ioctl+0x4b9/0x660 [kvm] __x64_sys_ioctl+0x83/0xb0 do_syscall_64+0x3b/0xc0 entry_SYSCALL_64_after_hwframe+0x44/0xae </TASK> ---[ end trace 0000000000000000 ]--- References: - https://git.kernel.org/stable/c/8d3a2aa0976f57320ba89baf9d57fb158dd0cd0d - https://git.kernel.org/stable/c/f476a59d5c86c02a79eef893c6da86735f2977ac - https://git.kernel.org/stable/c/7de373c9b48229e428ecdb8fbde269c5a8617fd2 - https://git.kernel.org/stable/c/45846661d10422ce9e22da21f8277540b29eca22
CVE ID: CVE-2022-49560 State: PUBLISHED Published: 2025-02-26T02:14:05.548Z Last Updated: 2025-10-01T19:46:39.057Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: exfat: check if cluster num is valid Syzbot reported slab-out-of-bounds read in exfat_clear_bitmap. This was triggered by reproducer calling truncute with size 0, which causes the following trace: BUG: KASAN: slab-out-of-bounds in exfat_clear_bitmap+0x147/0x490 fs/exfat/balloc.c:174 Read of size 8 at addr ffff888115aa9508 by task syz-executor251/365 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack_lvl+0x1e2/0x24b lib/dump_stack.c:118 print_address_descr
all Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack_lvl+0x1e2/0x24b lib/dump_stack.c:118 print_address_description+0x81/0x3c0 mm/kasan/report.c:233 __kasan_report mm/kasan/report.c:419 [inline] kasan_report+0x1a4/0x1f0 mm/kasan/report.c:436 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report_generic.c:309 exfat_clear_bitmap+0x147/0x490 fs/exfat/balloc.c:174 exfat_free_cluster+0x25a/0x4a0 fs/exfat/fatent.c:181 __exfat_truncate+0x99e/0xe00 fs/exfat/file.c:217 exfat_truncate+0x11b/0x4f0 fs/exfat/file.c:243 exfat_setattr+0xa03/0xd40 fs/exfat/file.c:339 notify_change+0xb76/0xe10 fs/attr.c:336 do_truncate+0x1ea/0x2d0 fs/open.c:65 Move the is_valid_cluster() helper from fatent.c to a
ge+0xb76/0xe10 fs/attr.c:336 do_truncate+0x1ea/0x2d0 fs/open.c:65 Move the is_valid_cluster() helper from fatent.c to a common header to make it reusable in other *.c files. And add is_valid_cluster() to validate if cluster number is within valid range in exfat_clear_bitmap() and exfat_set_bitmap(). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/82f723b8a5adf497f9e34c702a30ca7298615654 - https://git.kernel.org/stable/c/c504167adc3248095a905fa0700a9693897cb5ed - https://git.kernel.org/stable/c/7c58b14b6f9cde9f69e7fa053ab73f6e013a7131 - https://git.kernel.org/stable/c/2193286402df2d9c53294f7a858d5e6fd7346e08 - https://git.kernel.org/stable/c/64
013a7131 - https://git.kernel.org/stable/c/2193286402df2d9c53294f7a858d5e6fd7346e08 - https://git.kernel.org/stable/c/64ba4b15e5c045f8b746c6da5fc9be9a6b00b61d
CVE ID: CVE-2022-49561 State: PUBLISHED Published: 2025-02-26T02:14:06.030Z Last Updated: 2025-05-04T08:40:35.483Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: re-fetch conntrack after insertion In case the conntrack is clashing, insertion can free skb->_nfct and set skb->_nfct to the already-confirmed entry. This wasn't found before because the conntrack entry and the extension space used to free'd after an rcu grace period, plus the race needs events enabled to trigger. References: - https://git.kernel.org/stable/c/e97222b785e70e8973281666d709baad6523d8af - https://git.kernel.org/stable/c/92a999d1963ee
https://git.kernel.org/stable/c/e97222b785e70e8973281666d709baad6523d8af - https://git.kernel.org/stable/c/92a999d1963eed0df666284e20055136ceabd12f - https://git.kernel.org/stable/c/b16bb373988da3ceb0308381634117e18b6ec60d - https://git.kernel.org/stable/c/91a36ec160ec1a0c8f5352b772dffcbb0b6023e3 - https://git.kernel.org/stable/c/01989d7eebb61c99bd4b88ebc8e261bd2f02caed - https://git.kernel.org/stable/c/04f9e9104c969d8ce10a4a43634f641ed082092d - https://git.kernel.org/stable/c/04e4a11dc723c52db7a36dc58f0d69ce6426f8f0 - https://git.kernel.org/stable/c/56b14ecec97f39118bf85c9ac2438c5a949509ed
CVE ID: CVE-2022-49562 State: PUBLISHED Published: 2025-02-26T02:14:06.515Z Last Updated: 2025-05-04T08:40:41.692Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Use __try_cmpxchg_user() to update guest PTE A/D bits Use the recently introduced __try_cmpxchg_user() to update guest PTE A/D bits instead of mapping the PTE into kernel address space. The VM_PFNMAP path is broken as it assumes that vm_pgoff is the base pfn of the mapped VMA range, which is conceptually wrong as vm_pgoff is the offset relative to the file and has nothing to do with the pfn. The horrific hack worked for the original use case (backing guest me
ive to the file and has nothing to do with the pfn. The horrific hack worked for the original use case (backing guest memory with /dev/mem), but leads to accessing "random" pfns for pretty much any other VM_PFNMAP case. References: - https://git.kernel.org/stable/c/38b888911e8dc89b89d8147cfb1d2dbe6373bf78 - https://git.kernel.org/stable/c/8089e5e1d18402fb8152d6b6815450a36fffa9b0 - https://git.kernel.org/stable/c/f122dfe4476890d60b8c679128cd2259ec96a24c
CVE ID: CVE-2022-49563 State: PUBLISHED Published: 2025-02-26T02:23:10.252Z Last Updated: 2025-10-01T19:46:38.670Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: crypto: qat - add param check for RSA Reject requests with a source buffer that is bigger than the size of the key. This is to prevent a possible integer underflow that might happen when copying the source scatterlist into a linear buffer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/4d6d2adce08788b7667a6e58002682ea1bbf6a79 - https://git.kernel.org/stable/c/f993321e50ba7a8ba4f5b19939e1772a921a1c42 - https://git.kernel
667a6e58002682ea1bbf6a79 - https://git.kernel.org/stable/c/f993321e50ba7a8ba4f5b19939e1772a921a1c42 - https://git.kernel.org/stable/c/9714061423b8b24b8afb31b8eb4df977c63f19c4
CVE ID: CVE-2022-49564 State: PUBLISHED Published: 2025-02-26T02:23:10.733Z Last Updated: 2025-10-01T19:46:38.501Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: crypto: qat - add param check for DH Reject requests with a source buffer that is bigger than the size of the key. This is to prevent a possible integer underflow that might happen when copying the source scatterlist into a linear buffer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/e7f979ed51f96495328157df663c835b17db1e30 - https://git.kernel.org/stable/c/76c9216833e7c20a67c987cf89719a3f01666aaa - https://git.kernel.
28157df663c835b17db1e30 - https://git.kernel.org/stable/c/76c9216833e7c20a67c987cf89719a3f01666aaa - https://git.kernel.org/stable/c/2acbb8771f6ac82422886e63832ee7a0f4b1635b
CVE ID: CVE-2022-49565 State: PUBLISHED Published: 2025-02-26T02:23:11.213Z Last Updated: 2025-05-04T08:40:45.536Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel/lbr: Fix unchecked MSR access error on HSW The fuzzer triggers the below trace. [ 7763.384369] unchecked MSR access error: WRMSR to 0x689 (tried to write 0x1fffffff8101349e) at rIP: 0xffffffff810704a4 (native_write_msr+0x4/0x20) [ 7763.397420] Call Trace: [ 7763.399881] <TASK> [ 7763.401994] intel_pmu_lbr_restore+0x9a/0x1f0 [ 7763.406363] intel_pmu_lbr_sched_task+0x91/0x1c0 [ 7763.410992] __perf_event_task_sched_in+0x1cd/0x240 On a machine with the LBR f
3] intel_pmu_lbr_sched_task+0x91/0x1c0 [ 7763.410992] __perf_event_task_sched_in+0x1cd/0x240 On a machine with the LBR format LBR_FORMAT_EIP_FLAGS2, when the TSX is disabled, a TSX quirk is required to access LBR from registers. The lbr_from_signext_quirk_needed() is introduced to determine whether the TSX quirk should be applied. However, the lbr_from_signext_quirk_needed() is invoked before the intel_pmu_lbr_init(), which parses the LBR format information. Without the correct LBR format information, the TSX quirk never be applied. Move the lbr_from_signext_quirk_needed() into the intel_pmu_lbr_init(). Checking x86_pmu.lbr_has_tsx in the lbr_from_signext_quirk_needed() is not required anymo
into the intel_pmu_lbr_init(). Checking x86_pmu.lbr_has_tsx in the lbr_from_signext_quirk_needed() is not required anymore. Both LBR_FORMAT_EIP_FLAGS2 and LBR_FORMAT_INFO have LBR_TSX flag, but only the LBR_FORMAT_EIP_FLAGS2 requirs the quirk. Update the comments accordingly. References: - https://git.kernel.org/stable/c/625bcd0685a1612225df83468c83412fc0edb3d7 - https://git.kernel.org/stable/c/b0380e13502adf7dd8be4c47d622c3522aae6c63
CVE ID: CVE-2022-49566 State: PUBLISHED Published: 2025-02-26T02:23:11.749Z Last Updated: 2025-10-01T19:46:38.296Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: crypto: qat - fix memory leak in RSA When an RSA key represented in form 2 (as defined in PKCS #1 V2.1) is used, some components of the private key persist even after the TFM is released. Replace the explicit calls to free the buffers in qat_rsa_exit_tfm() with a call to qat_rsa_clear_ctx() which frees all buffers referenced in the TFM context. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/a843925e0287eebb4aa808666bf22
onal Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/a843925e0287eebb4aa808666bf22c664dfe4c53 - https://git.kernel.org/stable/c/0f967fdc09955221a1951a279481b0bf4d359941 - https://git.kernel.org/stable/c/80a52e1ee7757b742f96bfb0d58f0c14eb6583d0
CVE ID: CVE-2022-49567 State: PUBLISHED Published: 2025-02-26T02:23:12.222Z Last Updated: 2025-10-01T19:46:37.965Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mm/mempolicy: fix uninit-value in mpol_rebind_policy() mpol_set_nodemask()(mm/mempolicy.c) does not set up nodemask when pol->mode is MPOL_LOCAL. Check pol->mode before access pol->w.cpuset_mems_allowed in mpol_rebind_policy()(mm/mempolicy.c). BUG: KMSAN: uninit-value in mpol_rebind_policy mm/mempolicy.c:352 [inline] BUG: KMSAN: uninit-value in mpol_rebind_task+0x2ac/0x2c0 mm/mempolicy.c:368 mpol_rebind_policy mm/mempolicy.c:352 [inline] mpol_rebind_task+0x2ac/0x2c0 mm
ebind_task+0x2ac/0x2c0 mm/mempolicy.c:368 mpol_rebind_policy mm/mempolicy.c:352 [inline] mpol_rebind_task+0x2ac/0x2c0 mm/mempolicy.c:368 cpuset_change_task_nodemask kernel/cgroup/cpuset.c:1711 [inline] cpuset_attach+0x787/0x15e0 kernel/cgroup/cpuset.c:2278 cgroup_migrate_execute+0x1023/0x1d20 kernel/cgroup/cgroup.c:2515 cgroup_migrate kernel/cgroup/cgroup.c:2771 [inline] cgroup_attach_task+0x540/0x8b0 kernel/cgroup/cgroup.c:2804 __cgroup1_procs_write+0x5cc/0x7a0 kernel/cgroup/cgroup-v1.c:520 cgroup1_tasks_write+0x94/0xb0 kernel/cgroup/cgroup-v1.c:539 cgroup_file_write+0x4c2/0x9e0 kernel/cgroup/cgroup.c:3852 kernfs_fop_write_iter+0x66a/0x9f0 fs/kernfs/file.c:296 call_write_iter include/linux/
/0x9e0 kernel/cgroup/cgroup.c:3852 kernfs_fop_write_iter+0x66a/0x9f0 fs/kernfs/file.c:296 call_write_iter include/linux/fs.h:2162 [inline] new_sync_write fs/read_write.c:503 [inline] vfs_write+0x1318/0x2030 fs/read_write.c:590 ksys_write+0x28b/0x510 fs/read_write.c:643 __do_sys_write fs/read_write.c:655 [inline] __se_sys_write fs/read_write.c:652 [inline] __x64_sys_write+0xdb/0x120 fs/read_write.c:652 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x44/0xae Uninit was created at: slab_post_alloc_hook mm/slab.h:524 [inline] slab_alloc_node mm/slub.c:3251 [inline] slab_alloc mm/slub.c:3259 [inline] kmem_cache
_alloc_hook mm/slab.h:524 [inline] slab_alloc_node mm/slub.c:3251 [inline] slab_alloc mm/slub.c:3259 [inline] kmem_cache_alloc+0x902/0x11c0 mm/slub.c:3264 mpol_new mm/mempolicy.c:293 [inline] do_set_mempolicy+0x421/0xb70 mm/mempolicy.c:853 kernel_set_mempolicy mm/mempolicy.c:1504 [inline] __do_sys_set_mempolicy mm/mempolicy.c:1510 [inline] __se_sys_set_mempolicy+0x44c/0xb60 mm/mempolicy.c:1507 __x64_sys_set_mempolicy+0xd8/0x110 mm/mempolicy.c:1507 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x44/0xae KMSAN: uninit-value in mpol_rebind_task (2) https://syzkaller.appspot.com/bug?id=d6eb90f952c2a5de9ea718a1
rame+0x44/0xae KMSAN: uninit-value in mpol_rebind_task (2) https://syzkaller.appspot.com/bug?id=d6eb90f952c2a5de9ea718a1b873c55cb13b59dc This patch seems to fix below bug too. KMSAN: uninit-value in mpol_rebind_mm (2) https://syzkaller.appspot.com/bug?id=f2fecd0d7013f54ec4162f60743a2b28df40926b The uninit-value is pol->w.cpuset_mems_allowed in mpol_rebind_policy(). When syzkaller reproducer runs to the beginning of mpol_new(), mpol_new() mm/mempolicy.c do_mbind() mm/mempolicy.c kernel_mbind() mm/mempolicy.c `mode` is 1(MPOL_PREFERRED), nodes_empty(*nodes) is `true` and `flags` is 0. Then mode = MPOL_LOCAL; ... policy->mode = mode; policy->flags = flags; will be executed. So in mpol_set_nodem
gs` is 0. Then mode = MPOL_LOCAL; ... policy->mode = mode; policy->flags = flags; will be executed. So in mpol_set_nodemask(), mpol_set_nodemask() mm/mempolicy.c do_mbind() kernel_mbind() pol->mode is 4 (MPOL_LOCAL), that `nodemask` in `pol` is not initialized, which will be accessed in mpol_rebind_policy(). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/5735845906fb1d90fe597f8b503fc0a857d475e3 - https://git.kernel.org/stable/c/aaa1c5d635a6fca2043513ffb5be169f9cd17d9e - https://git.kernel.org/stable/c/13d51565cec1aa432a6ab363edc2bbc53c6f49cb - https://git.kernel.org/stable/c/a1f8765f68bc9bf5744b365bb9f5e0b6db93edfe - https://git.kernel.org/st
3edc2bbc53c6f49cb - https://git.kernel.org/stable/c/a1f8765f68bc9bf5744b365bb9f5e0b6db93edfe - https://git.kernel.org/stable/c/ddb3f0b68863bd1c5f43177eea476bce316d4993 - https://git.kernel.org/stable/c/8c5429a04ccd8dbcc3c753dab2f4126774ec28d4 - https://git.kernel.org/stable/c/777e563f10e91e91130fe06bee85220d508e7b9b - https://git.kernel.org/stable/c/018160ad314d75b1409129b2247b614a9f35894c
CVE ID: CVE-2022-49568 State: PUBLISHED Published: 2025-02-26T02:23:12.722Z Last Updated: 2025-10-01T19:46:37.824Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: KVM: Don't null dereference ops->destroy A KVM device cleanup happens in either of two callbacks: 1) destroy() which is called when the VM is being destroyed; 2) release() which is called when a device fd is closed. Most KVM devices use 1) but Book3s's interrupt controller KVM devices (XICS, XIVE, XIVE-native) use 2) as they need to close and reopen during the machine execution. The error handling in kvm_ioctl_create_device() assumes destroy() is always defined which l
uring the machine execution. The error handling in kvm_ioctl_create_device() assumes destroy() is always defined which leads to NULL dereference as discovered by Syzkaller. This adds a checks for destroy!=NULL and adds a missing release(). This is not changing kvm_destroy_devices() as devices with defined release() should have been removed from the KVM devices list by then. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/170465715a60cbb7876e6b961b21bd3225469da8 - https://git.kernel.org/stable/c/3616776bc51cd3262bb1be60cc01c72e0a1959cf - https://git.kernel.org/stable/c/e91665fbbf3ccb268b268a7d71a6513538d813ac - https://git.kernel.org/stable/c/d
e0a1959cf - https://git.kernel.org/stable/c/e91665fbbf3ccb268b268a7d71a6513538d813ac - https://git.kernel.org/stable/c/d4a5a79b780891c5cbdfdc6124d46fdf8d13dba1 - https://git.kernel.org/stable/c/e8bc2427018826e02add7b0ed0fc625a60390ae5
CVE ID: CVE-2022-49569 State: PUBLISHED Published: 2025-02-26T02:23:13.209Z Last Updated: 2025-10-01T19:46:37.670Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: spi: bcm2835: bcm2835_spi_handle_err(): fix NULL pointer deref for non DMA transfers In case a IRQ based transfer times out the bcm2835_spi_handle_err() function is called. Since commit 1513ceee70f2 ("spi: bcm2835: Drop dma_pending flag") the TX and RX DMA transfers are unconditionally canceled, leading to NULL pointer derefs if ctlr->dma_tx or ctlr->dma_rx are not set. Fix the NULL pointer deref by checking that ctlr->dma_tx and ctlr->dma_rx are valid pointers before
dma_rx are not set. Fix the NULL pointer deref by checking that ctlr->dma_tx and ctlr->dma_rx are valid pointers before accessing them. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/76668d2a2f367d25ff448e6d7087406af7d7bb2b - https://git.kernel.org/stable/c/684896e675edd8b669fd3e9f547c5038222d85bc - https://git.kernel.org/stable/c/58466e05390043d2805685c70f55f3f59711bdf2 - https://git.kernel.org/stable/c/49ffa473218012e765682343de2052eb4c1f06a7 - https://git.kernel.org/stable/c/4ceaa684459d414992acbefb4e4c31f2dfc50641
CVE ID: CVE-2022-49570 State: PUBLISHED Published: 2025-02-26T02:23:13.703Z Last Updated: 2025-10-01T19:46:37.532Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: gpio: gpio-xilinx: Fix integer overflow Current implementation is not able to configure more than 32 pins due to incorrect data type. So type casting with unsigned long to avoid it. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/e129e5486b981d324057e6986059f852658b0d00 - https://git.kernel.org/stable/c/6f16a5390640807dde420ee5ccbc4c95577aea6a - https://git.kernel.org/stable/c/32c094a09d5829ad9b02cdf667569aefa8de0ea6
CVE ID: CVE-2022-49571 State: PUBLISHED Published: 2025-02-26T02:23:14.182Z Last Updated: 2025-10-01T19:46:37.387Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: tcp: Fix data-races around sysctl_tcp_max_reordering. While reading sysctl_tcp_max_reordering, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/5e38cee24f19d19280c68f1ac8bf6790d607f60a - https://git.kernel.org/stable/c/50a1d3d097503a90cf84ebe120afcde37e9c33b3 - https://git.kernel.org/stable/c/064852663308c801861bd54789d81421fa4c2928 - https:/