Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-49466 State: PUBLISHED Published: 2025-02-26T02:13:11.520Z Last Updated: 2025-10-01T19:46:46.752Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: regulator: scmi: Fix refcount leak in scmi_regulator_probe of_find_node_by_name() returns a node pointer with refcount incremented, we should use of_node_put() on it when done. Add missing of_node_put() to avoid refcount leak. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/9ebbfa73d69909b7c737f599fd4ebd42318fc881 - https://git.kernel.org/stable/c/299a002161c7bfb72e99ba45e5b660aecc344ea0 - https://git.kernel.org/stable/c
d42318fc881 - https://git.kernel.org/stable/c/299a002161c7bfb72e99ba45e5b660aecc344ea0 - https://git.kernel.org/stable/c/4a59c763ef9b68c711dc2fd2ef4a6648da5480ee - https://git.kernel.org/stable/c/68d6c8476fd4f448e70e0ab31ff972838ac41dae
CVE ID: CVE-2022-49467 State: PUBLISHED Published: 2025-02-26T02:13:12.022Z Last Updated: 2025-10-01T19:46:46.623Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm: msm: fix possible memory leak in mdp5_crtc_cursor_set() drm_gem_object_lookup will call drm_gem_object_get inside. So cursor_bo needs to be put when msm_gem_get_and_pin_iova fails. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/f8cd192752a1f613b14eee77783c6f0aebb49691 - https://git.kernel.org/stable/c/449374565f349d4233beec811d4286fdfe5de44b - https://git.kernel.org/stable/c/656aa3c51fc662064f17179b38ec3ce43af53bca
le/c/449374565f349d4233beec811d4286fdfe5de44b - https://git.kernel.org/stable/c/656aa3c51fc662064f17179b38ec3ce43af53bca - https://git.kernel.org/stable/c/33546183c16c7b9650682dc610bedd732d9c6919 - https://git.kernel.org/stable/c/d544880482a5558ec06393b1b3d5dc9275b7a32b - https://git.kernel.org/stable/c/d63ffe3fb3f8327ca21cf91b6a14a2961bc629b4 - https://git.kernel.org/stable/c/947a844bb3ebff0f4736d244d792ce129f6700d7
CVE ID: CVE-2022-49468 State: PUBLISHED Published: 2025-02-26T02:13:12.713Z Last Updated: 2025-10-01T19:46:46.482Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: thermal/core: Fix memory leak in __thermal_cooling_device_register() I got memory leak as follows when doing fault injection test: unreferenced object 0xffff888010080000 (size 264312): comm "182", pid 102533, jiffies 4296434960 (age 10.100s) hex dump (first 32 bytes): 00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00 .....N.......... ff ff ff ff ff ff ff ff 40 7f 1f b9 ff ff ff ff ........@....... backtrace: [<0000000038b2f4fc>] kmalloc_order_trace+0x1d/0x110 mm/slab_com
f ff 40 7f 1f b9 ff ff ff ff ........@....... backtrace: [<0000000038b2f4fc>] kmalloc_order_trace+0x1d/0x110 mm/slab_common.c:969 [<00000000ebcb8da5>] __kmalloc+0x373/0x420 include/linux/slab.h:510 [<0000000084137f13>] thermal_cooling_device_setup_sysfs+0x15d/0x2d0 include/linux/slab.h:586 [<00000000352b8755>] __thermal_cooling_device_register+0x332/0xa60 drivers/thermal/thermal_core.c:927 [<00000000fb9f331b>] devm_thermal_of_cooling_device_register+0x6b/0xf0 drivers/thermal/thermal_core.c:1041 [<000000009b8012d2>] max6650_probe.cold+0x557/0x6aa drivers/hwmon/max6650.c:211 [<00000000da0b7e04>] i2c_device_probe+0x472/0xac0 drivers/i2c/i2c-core-base.c:561 If device_register() fails, thermal_co
[<00000000da0b7e04>] i2c_device_probe+0x472/0xac0 drivers/i2c/i2c-core-base.c:561 If device_register() fails, thermal_cooling_device_destroy_sysfs() need be called to free the memory allocated in thermal_cooling_device_setup_sysfs(). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/18530bedd221160823f63ccc20dd55c7a03edbcf - https://git.kernel.org/stable/c/21ccc58b671aea924f2481cf5c1cf0ebbfd3552d - https://git.kernel.org/stable/c/3802171f0b5b8b831f4ade5c827547cb323a5bb2 - https://git.kernel.org/stable/c/9abdf0c0184230f0cb5c6685aabf33dda89aa9fb - https://git.kernel.org/stable/c/98a160e898c0f4a979af9de3ab48b4b1d42d1dbb
CVE ID: CVE-2022-49469 State: PUBLISHED Published: 2025-02-26T02:13:13.387Z Last Updated: 2025-06-19T12:56:20.479Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix anon_dev leak in create_subvol() When btrfs_qgroup_inherit(), btrfs_alloc_tree_block, or btrfs_insert_root() fail in create_subvol(), we return without freeing anon_dev. Reorganize the error handling in create_subvol() to fix this. References: - https://git.kernel.org/stable/c/d887b3de318834f9aa637ecf79c6bc66cba7c69a - https://git.kernel.org/stable/c/7a875ad8706f0903a0e812e0dd701956ee9826ff - https://git.kernel.org/stable/c/2256e901f5bddc56e24089c96f27b77da9
g/stable/c/7a875ad8706f0903a0e812e0dd701956ee9826ff - https://git.kernel.org/stable/c/2256e901f5bddc56e24089c96f27b77da932dfcc
CVE ID: CVE-2022-49470 State: PUBLISHED Published: 2025-02-26T02:13:14.024Z Last Updated: 2025-05-04T08:38:25.391Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtksdio: fix use-after-free at btmtksdio_recv_event We should not access skb buffer data anymore after hci_recv_frame was called. [ 39.634809] BUG: KASAN: use-after-free in btmtksdio_recv_event+0x1b0 [ 39.634855] Read of size 1 at addr ffffff80cf28a60d by task kworker [ 39.634962] Call trace: [ 39.634974] dump_backtrace+0x0/0x3b8 [ 39.634999] show_stack+0x20/0x2c [ 39.635016] dump_stack_lvl+0x60/0x78 [ 39.635040] print_address_description+0x70/0x2f0 [ 39.6
999] show_stack+0x20/0x2c [ 39.635016] dump_stack_lvl+0x60/0x78 [ 39.635040] print_address_description+0x70/0x2f0 [ 39.635062] kasan_report+0x154/0x194 [ 39.635079] __asan_report_load1_noabort+0x44/0x50 [ 39.635099] btmtksdio_recv_event+0x1b0/0x1c4 [ 39.635129] btmtksdio_txrx_work+0x6cc/0xac4 [ 39.635157] process_one_work+0x560/0xc5c [ 39.635177] worker_thread+0x7ec/0xcc0 [ 39.635195] kthread+0x2d0/0x3d0 [ 39.635215] ret_from_fork+0x10/0x20 [ 39.635247] Allocated by task 0: [ 39.635260] (stack is not available) [ 39.635281] Freed by task 2392: [ 39.635295] kasan_save_stack+0x38/0x68 [ 39.635319] kasan_set_track+0x28/0x3c [ 39.635338] kasan_set_free_info+0x28/0x4c [ 39.635357] ____kasan_slab_
0x38/0x68 [ 39.635319] kasan_set_track+0x28/0x3c [ 39.635338] kasan_set_free_info+0x28/0x4c [ 39.635357] ____kasan_slab_free+0x104/0x150 [ 39.635374] __kasan_slab_free+0x18/0x28 [ 39.635391] slab_free_freelist_hook+0x114/0x248 [ 39.635410] kfree+0xf8/0x2b4 [ 39.635427] skb_free_head+0x58/0x98 [ 39.635447] skb_release_data+0x2f4/0x410 [ 39.635464] skb_release_all+0x50/0x60 [ 39.635481] kfree_skb+0xc8/0x25c [ 39.635498] hci_event_packet+0x894/0xca4 [bluetooth] [ 39.635721] hci_rx_work+0x1c8/0x68c [bluetooth] [ 39.635925] process_one_work+0x560/0xc5c [ 39.635951] worker_thread+0x7ec/0xcc0 [ 39.635970] kthread+0x2d0/0x3d0 [ 39.635990] ret_from_fork+0x10/0x20 [ 39.636021] The buggy address belong
+0x7ec/0xcc0 [ 39.635970] kthread+0x2d0/0x3d0 [ 39.635990] ret_from_fork+0x10/0x20 [ 39.636021] The buggy address belongs to the object at ffffff80cf28a600 which belongs to the cache kmalloc-512 of size 512 [ 39.636039] The buggy address is located 13 bytes inside of 512-byte region [ffffff80cf28a600, ffffff80cf28a800) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/b3cec8a42fcd11d05313c724f27e01b1db77522c - https://git.kernel.org/stable/c/02ba31e09a26e8cd4582ac8e6163d80284997727 - https://git.kernel.org/stable/c/01c6a899fa6be4f4cbf60c4f44f0f6691155415f - https://git.kernel.org/stable/c/0fab6361c4ba17d1b43a991bef4238a3c1754d35
CVE ID: CVE-2022-49471 State: PUBLISHED Published: 2025-02-26T02:13:14.657Z Last Updated: 2025-10-01T19:46:46.352Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: rtw89: cfo: check mac_id to avoid out-of-bounds Somehow, hardware reports incorrect mac_id and pollute memory. Check index before we access the array. UBSAN: array-index-out-of-bounds in rtw89/phy.c:2517:23 index 188 is out of range for type 's32 [64]' CPU: 1 PID: 51550 Comm: irq/35-rtw89_pc Tainted: G OE Call Trace: <IRQ> show_stack+0x52/0x58 dump_stack_lvl+0x4c/0x63 dump_stack+0x10/0x12 ubsan_epilogue+0x9/0x45 __ubsan_handle_out_of_bounds.cold+0x44/0x49 ? __alloc_skb
ack_lvl+0x4c/0x63 dump_stack+0x10/0x12 ubsan_epilogue+0x9/0x45 __ubsan_handle_out_of_bounds.cold+0x44/0x49 ? __alloc_skb+0x92/0x1d0 rtw89_phy_cfo_parse+0x44/0x7f [rtw89_core] rtw89_core_rx+0x261/0x871 [rtw89_core] ? __alloc_skb+0xee/0x1d0 rtw89_pci_napi_poll+0x3fa/0x4ea [rtw89_pci] __napi_poll+0x33/0x1a0 net_rx_action+0x126/0x260 ? __queue_work+0x217/0x4c0 __do_softirq+0xd9/0x315 ? disable_irq_nosync+0x10/0x10 do_softirq.part.0+0x6d/0x90 </IRQ> <TASK> __local_bh_enable_ip+0x62/0x70 rtw89_pci_interrupt_threadfn+0x182/0x1a6 [rtw89_pci] irq_thread_fn+0x28/0x60 irq_thread+0xc8/0x190 ? irq_thread_fn+0x60/0x60 kthread+0x16b/0x190 ? irq_thread_check_affinity+0xe0/0xe0 ? set_kthread_struct+0x50/0x50
0x190 ? irq_thread_fn+0x60/0x60 kthread+0x16b/0x190 ? irq_thread_check_affinity+0xe0/0xe0 ? set_kthread_struct+0x50/0x50 ret_from_fork+0x22/0x30 </TASK> Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/03ed236480aeec8c2fd327a1ea6d711364c495e3 - https://git.kernel.org/stable/c/c32fafe68298bb599e825c298e1d0ba30186f0a5 - https://git.kernel.org/stable/c/97df85871a5b187609d30fca6d85b912d9e02f29
CVE ID: CVE-2022-49472 State: PUBLISHED Published: 2025-02-26T02:13:15.337Z Last Updated: 2025-10-01T19:46:46.214Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: phy: micrel: Allow probing without .driver_data Currently, if the .probe element is present in the phy_driver structure and the .driver_data is not, a NULL pointer dereference happens. Allow passing .probe without .driver_data by inserting NULL checks for priv->type. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/7dcb404662839a4ed1a9703658fee979eb894ca4 - https://git.kernel.org/stable/c/91e720b32cba25fa58eaa4c88fe9
nel.org/stable/c/7dcb404662839a4ed1a9703658fee979eb894ca4 - https://git.kernel.org/stable/c/91e720b32cba25fa58eaa4c88fe957009cffe9f3 - https://git.kernel.org/stable/c/1e5fbfc2a6f384e3195446c14bbd3bc298eb88c2 - https://git.kernel.org/stable/c/abb5594ae2ba7b82cce85917cc6337ec5d774837 - https://git.kernel.org/stable/c/660dfa033ccc9afb032015b6dc76e846bba42cfb - https://git.kernel.org/stable/c/143878e18001c5a61fcc7ae5c5240323753bb641 - https://git.kernel.org/stable/c/bd219273b4e004a3f853da72e111fc8f81357501 - https://git.kernel.org/stable/c/f2ef6f7539c68c6bd6c32323d8845ee102b7c450
CVE ID: CVE-2022-49473 State: PUBLISHED Published: 2025-02-26T02:13:16.008Z Last Updated: 2025-10-01T19:46:46.069Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ASoC: ti: j721e-evm: Fix refcount leak in j721e_soc_probe_* of_parse_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when not needed anymore. Add missing of_node_put() to avoid refcount leak. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/510e879420b410d88c612aecc6ca15dc6fe77473 - https://git.kernel.org/stable/c/2a3966b950b37a6f10c5f9caee15b4cdcf5a7413 - https://git.kernel.o
612aecc6ca15dc6fe77473 - https://git.kernel.org/stable/c/2a3966b950b37a6f10c5f9caee15b4cdcf5a7413 - https://git.kernel.org/stable/c/d748ff8fbb3a5296bddd586445dc692b079cbe3d - https://git.kernel.org/stable/c/554df0f70bff1ace6d2df2fcaddbc9b7bd509de2 - https://git.kernel.org/stable/c/a34840c4eb3278a7c29c9c57a65ce7541c66f9f2
CVE ID: CVE-2022-49474 State: PUBLISHED Published: 2025-02-26T02:13:16.679Z Last Updated: 2025-05-04T12:44:51.218Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout Connecting the same socket twice consecutively in sco_sock_connect() could lead to a race condition where two sco_conn objects are created but only one is associated with the socket. If the socket is closed before the SCO connection is established, the timer associated with the dangling sco_conn object won't be canceled. As the sock object is being freed, the use-after-free problem happens when the
ngling sco_conn object won't be canceled. As the sock object is being freed, the use-after-free problem happens when the timer callback function sco_sock_timeout() accesses the socket. Here's the call trace: dump_stack+0x107/0x163 ? refcount_inc+0x1c/ print_address_description.constprop.0+0x1c/0x47e ? refcount_inc+0x1c/0x7b kasan_report+0x13a/0x173 ? refcount_inc+0x1c/0x7b check_memory_region+0x132/0x139 refcount_inc+0x1c/0x7b sco_sock_timeout+0xb2/0x1ba process_one_work+0x739/0xbd1 ? cancel_delayed_work+0x13f/0x13f ? __raw_spin_lock_init+0xf0/0xf0 ? to_kthread+0x59/0x85 worker_thread+0x593/0x70e kthread+0x346/0x35a ? drain_workqueue+0x31a/0x31a ? kthread_bind+0x4b/0x4b ret_from_fork+0x1f/0x
rker_thread+0x593/0x70e kthread+0x346/0x35a ? drain_workqueue+0x31a/0x31a ? kthread_bind+0x4b/0x4b ret_from_fork+0x1f/0x30 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/9de3dc09e56f8deacd2bdbf4cecb71e11a312405 - https://git.kernel.org/stable/c/7d61dbd7311ab978d8ddac1749a758de4de00374 - https://git.kernel.org/stable/c/390d82733a953c1fabf3de9c9618091a7a9c90a6 - https://git.kernel.org/stable/c/6f55fac0af3531cf60d11369454c41f5fc81ab3f - https://git.kernel.org/stable/c/36c644c63bfcaee2d3a426f45e89a9cd09799318 - https://git.kernel.org/stable/c/65d347cb39e2e6bd0c2a745ad7c928998ebb0162 - https://git.kernel.org/stable/c/537f619dea4e3fa8ed1f8f938abffe
l.org/stable/c/65d347cb39e2e6bd0c2a745ad7c928998ebb0162 - https://git.kernel.org/stable/c/537f619dea4e3fa8ed1f8f938abffe3615794bcc - https://git.kernel.org/stable/c/99df16007f4bbf9abfc3478cb17d10f0d7f8906e - https://git.kernel.org/stable/c/7aa1e7d15f8a5b65f67bacb100d8fc033b21efa2
CVE ID: CVE-2022-49475 State: PUBLISHED Published: 2025-02-26T02:13:17.353Z Last Updated: 2025-10-01T19:46:45.953Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: spi: spi-fsl-qspi: check return value after calling platform_get_resource_byname() It will cause null-ptr-deref if platform_get_resource_byname() returns NULL, we need check the return value. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/560dcbe1c7a78f597f2167371ebdbe2bca3d0735 - https://git.kernel.org/stable/c/10f537219629769498ecb8515e096be213224c24 - https://git.kernel.org/stable/c/33dda87d04598ac5d9a849218a373443f7
g/stable/c/10f537219629769498ecb8515e096be213224c24 - https://git.kernel.org/stable/c/33dda87d04598ac5d9a849218a373443f7d3de66 - https://git.kernel.org/stable/c/9d9c84825c3ec359b165c762a424cfdefe87fdd7 - https://git.kernel.org/stable/c/a2b331ac11e1cac56f5b7d367e9f3c5796deaaed
CVE ID: CVE-2022-49476 State: PUBLISHED Published: 2025-02-26T02:13:18.013Z Last Updated: 2025-10-01T19:46:45.825Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mt76: mt7921: fix kernel crash at mt7921_pci_remove The crash log shown it is possible that mt7921_irq_handler is called while devm_free_irq is being handled so mt76_free_device need to be postponed until devm_free_irq is completed to solve the crash we free the mt76 device too early. [ 9299.339655] BUG: kernel NULL pointer dereference, address: 0000000000000008 [ 9299.339705] #PF: supervisor read access in kernel mode [ 9299.339735] #PF: error_code(0x0000) - not-prese
00000000008 [ 9299.339705] #PF: supervisor read access in kernel mode [ 9299.339735] #PF: error_code(0x0000) - not-present page [ 9299.339768] PGD 0 P4D 0 [ 9299.339786] Oops: 0000 [#1] SMP PTI [ 9299.339812] CPU: 1 PID: 1624 Comm: prepare-suspend Not tainted 5.15.14-1.fc32.qubes.x86_64 #1 [ 9299.339863] Hardware name: Xen HVM domU, BIOS 4.14.3 01/20/2022 [ 9299.339901] RIP: 0010:mt7921_irq_handler+0x1e/0x70 [mt7921e] [ 9299.340048] RSP: 0018:ffffa81b80c27cb0 EFLAGS: 00010082 [ 9299.340081] RAX: 0000000000000000 RBX: ffff98a4cb752020 RCX: ffffffffa96211c5 [ 9299.340123] RDX: 0000000000000000 RSI: 00000000000d4204 RDI: ffff98a4cb752020 [ 9299.340165] RBP: ffff98a4c28a62a4 R08: ffff98a4c37a96c
: 0000000000000000 RSI: 00000000000d4204 RDI: ffff98a4cb752020 [ 9299.340165] RBP: ffff98a4c28a62a4 R08: ffff98a4c37a96c0 R09: 0000000080150011 [ 9299.340207] R10: 0000000040000000 R11: 0000000000000000 R12: ffff98a4c4eaa080 [ 9299.340249] R13: ffff98a4c28a6360 R14: ffff98a4cb752020 R15: ffff98a4c28a6228 [ 9299.340297] FS: 00007260840d3740(0000) GS:ffff98a4ef700000(0000) knlGS:0000000000000000 [ 9299.340345] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 9299.340383] CR2: 0000000000000008 CR3: 0000000004c56001 CR4: 0000000000770ee0 [ 9299.340432] PKRU: 55555554 [ 9299.340449] Call Trace: [ 9299.340467] <TASK> [ 9299.340485] __free_irq+0x221/0x350 [ 9299.340527] free_irq+0x30/0x70 [ 9299.
40449] Call Trace: [ 9299.340467] <TASK> [ 9299.340485] __free_irq+0x221/0x350 [ 9299.340527] free_irq+0x30/0x70 [ 9299.340553] devm_free_irq+0x55/0x80 [ 9299.340579] mt7921_pci_remove+0x2f/0x40 [mt7921e] [ 9299.340616] pci_device_remove+0x3b/0xa0 [ 9299.340651] __device_release_driver+0x17a/0x240 [ 9299.340686] device_driver_detach+0x3c/0xa0 [ 9299.340714] unbind_store+0x113/0x130 [ 9299.340740] kernfs_fop_write_iter+0x124/0x1b0 [ 9299.340775] new_sync_write+0x15c/0x1f0 [ 9299.340806] vfs_write+0x1d2/0x270 [ 9299.340831] ksys_write+0x67/0xe0 [ 9299.340857] do_syscall_64+0x3b/0x90 [ 9299.340887] entry_SYSCALL_64_after_hwframe+0x44/0xae Additional Analyst Notes: - CISA ADP Vulnrichment: Refer
3b/0x90 [ 9299.340887] entry_SYSCALL_64_after_hwframe+0x44/0xae Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/09693f5b636fb3f6dd56fd943226fc1bbc600b51 - https://git.kernel.org/stable/c/677e669973bf5460705bc65033445ea9f6615999 - https://git.kernel.org/stable/c/ad483ed9dd5193a54293269c852a29051813b7bd
CVE ID: CVE-2022-49477 State: PUBLISHED Published: 2025-02-26T02:13:18.686Z Last Updated: 2025-10-01T19:46:45.685Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ASoC: samsung: Fix refcount leak in aries_audio_probe of_parse_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when done. If extcon_find_edev_by_node() fails, it doesn't call of_node_put() Calling of_node_put() after extcon_find_edev_by_node() to fix this. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/cacea459f95be22b3750f3b25b7a1c5897a68206 - https://git.kernel.org/stable/
References: - https://git.kernel.org/stable/c/cacea459f95be22b3750f3b25b7a1c5897a68206 - https://git.kernel.org/stable/c/85d899f396622d3034643bf89615a78f9be7c91a - https://git.kernel.org/stable/c/70130bde3457d28c02c76b6cacc5d40a72dd6e17 - https://git.kernel.org/stable/c/46d1b310a2d571811c4e08041ce287babb60b86a - https://git.kernel.org/stable/c/bf4a9b2467b775717d0e9034ad916888e19713a3
CVE ID: CVE-2022-49478 State: PUBLISHED Published: 2025-02-26T02:13:19.330Z Last Updated: 2025-10-01T19:46:45.541Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init Syzbot reported that -1 is used as array index. The problem was in missing validation check. hdw->unit_number is initialized with -1 and then if init table walk fails this value remains unchanged. Since code blindly uses this member for array indexing adding sanity check is the easiest fix for that. hdw->workpoll initialization moved upper to prevent warning in __flush_work. Additional Analyst Notes: -
t fix for that. hdw->workpoll initialization moved upper to prevent warning in __flush_work. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/4351bfe36aba9fa7dc9d68d498d25d41a0f45e67 - https://git.kernel.org/stable/c/2e004fe914b243db41fa96f9e583385f360ea58e - https://git.kernel.org/stable/c/a3660e06675bccec4bf149c7229ea1d491ba10d7 - https://git.kernel.org/stable/c/1310fc3538dcc375a2f46ef0a438512c2ca32827 - https://git.kernel.org/stable/c/a3304766d9384886e6d3092c776273526947a2e9 - https://git.kernel.org/stable/c/3309c2c574e13b21b44729f5bdbf21f60189b79a - https://git.kernel.org/stable/c/f99a8b1ec0eddc2931aeaa4f490277a15b39f511 - https://git.kerne
1b44729f5bdbf21f60189b79a - https://git.kernel.org/stable/c/f99a8b1ec0eddc2931aeaa4f490277a15b39f511 - https://git.kernel.org/stable/c/24e807541e4a9263ed928e6ae3498de3ad43bd1e - https://git.kernel.org/stable/c/471bec68457aaf981add77b4f590d65dd7da1059
CVE ID: CVE-2022-49479 State: PUBLISHED Published: 2025-02-26T02:13:20.011Z Last Updated: 2025-05-04T08:38:37.058Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mt76: fix tx status related use-after-free race on station removal There is a small race window where ongoing tx activity can lead to a skb getting added to the status tracking idr after that idr has already been cleaned up, which will keep the wcid linked in the status poll list. Fix this by only adding status skbs if the wcid pointer is still assigned in dev->wcid, which gets cleared early by mt76_sta_pre_rcu_remove Additional Analyst Notes: - CISA ADP Vulnrichment:
ed in dev->wcid, which gets cleared early by mt76_sta_pre_rcu_remove Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/ef7f9f894cfd0b2e471206409a529af4a26ddd55 - https://git.kernel.org/stable/c/ddd426d72aca4054045a9bd3b80a4ce1d398f11f - https://git.kernel.org/stable/c/fcfe1b5e162bf473c1d47760962cec8523c00466
CVE ID: CVE-2022-49480 State: PUBLISHED Published: 2025-02-26T02:13:20.651Z Last Updated: 2025-10-01T19:46:45.396Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ASoC: imx-hdmi: Fix refcount leak in imx_hdmi_probe of_find_device_by_node() takes reference, we should use put_device() to release it. when devm_kzalloc() fails, it doesn't have a put_device(), it will cause refcount leak. Add missing put_device() to fix this. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/cf760e494ee5fa6bc2dc222f0098c741ad460801 - https://git.kernel.org/stable/c/8205a0114db10ec41bd2b748cdd7528632082ec
ble/c/cf760e494ee5fa6bc2dc222f0098c741ad460801 - https://git.kernel.org/stable/c/8205a0114db10ec41bd2b748cdd7528632082eca - https://git.kernel.org/stable/c/81b7edaabd44ba133006ad72056914eb36828d60 - https://git.kernel.org/stable/c/ed46731d8e86c8d65f5fc717671e1f1f6c3146d2
CVE ID: CVE-2022-49481 State: PUBLISHED Published: 2025-02-26T02:13:21.324Z Last Updated: 2025-10-01T19:46:45.230Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt of_node_get() returns a node with refcount incremented. Calling of_node_put() to drop the reference when not needed anymore. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/b74c0dd9179d21b7260260e075d597b23970100c - https://git.kernel.org/stable/c/6ca675f4abbc74bc991d154a1ecc8b384dc2aae4 - https://git.kernel.org/stable/c/984cfef0675ed7398814e14af2c532391
rg/stable/c/6ca675f4abbc74bc991d154a1ecc8b384dc2aae4 - https://git.kernel.org/stable/c/984cfef0675ed7398814e14af2c5323911723e1c - https://git.kernel.org/stable/c/0be5d9da5743b9825a95baec85a67500b2c1d362 - https://git.kernel.org/stable/c/9f564e29a51210a49df3d925117777c157a17d6d - https://git.kernel.org/stable/c/56ab0c01027492cd161c64148e1dc892c56887ad - https://git.kernel.org/stable/c/671be14fc31374b1a10a3abd93db6a8480838fc9 - https://git.kernel.org/stable/c/49d785baeb91568332197be356d138e5e59c7ddb - https://git.kernel.org/stable/c/afaa7b933ef00a2d3262f4d1252087613fb5c06d