Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
== BUG: KASAN: use-after-free in hci_send_acl+0xaba/0xc50 Read of size 8 at addr ffff88800e404818 by task bluetoothd/142 CPU: 0 PID: 142 Comm: bluetoothd Not tainted 5.17.0-rc5-00006-gda4022eeac1a #7 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x45/0x59 print_address_description.constprop.0+0x1f/0x150 kasan_report.cold+0x7f/0x11b hci_send_acl+0xaba/0xc50 l2cap_do_send+0x23f/0x3d0 l2cap_chan_send+0xc06/0x2cc0 l2cap_sock_sendmsg+0x201/0x2b0 sock_sendmsg+0xdc/0x110 sock_write_iter+0x20f/0x370 do_iter_readv_writev+0x343/0x690 do_iter_write+0x132/0x640 vfs_writev+0x198/0x570 do_writev+0x202/0
ite_iter+0x20f/0x370 do_iter_readv_writev+0x343/0x690 do_iter_write+0x132/0x640 vfs_writev+0x198/0x570 do_writev+0x202/0x280 do_syscall_64+0x38/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae RSP: 002b:00007ffce8a099b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 Code: 0f 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 14 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 RDX: 0000000000000001 RSI: 00007ffce8a099e0 RDI: 0000000000000015 RAX: ffffffffffffffda RBX: 00007ffce8a099e0 RCX: 00007f788fc3cf77 R10: 00007ffce8af7080 R11: 0000000000000246 R12: 000055e4ccf75580 RBP: 0000000000000015 R08: 00000000000000
7f788fc3cf77 R10: 00007ffce8af7080 R11: 0000000000000246 R12: 000055e4ccf75580 RBP: 0000000000000015 R08: 0000000000000002 R09: 0000000000000001 </TASK> R13: 000055e4ccf754a0 R14: 000055e4ccf75cd0 R15: 000055e4ccf4a6b0 Allocated by task 45: kasan_save_stack+0x1e/0x40 __kasan_kmalloc+0x81/0xa0 hci_chan_create+0x9a/0x2f0 l2cap_conn_add.part.0+0x1a/0xdc0 l2cap_connect_cfm+0x236/0x1000 le_conn_complete_evt+0x15a7/0x1db0 hci_le_conn_complete_evt+0x226/0x2c0 hci_le_meta_evt+0x247/0x450 hci_event_packet+0x61b/0xe90 hci_rx_work+0x4d5/0xc50 process_one_work+0x8fb/0x15a0 worker_thread+0x576/0x1240 kthread+0x29d/0x340 ret_from_fork+0x1f/0x30 Freed by task 45: kasan_save_stack+0x1e/0x40 kasan_set_track+
d+0x576/0x1240 kthread+0x29d/0x340 ret_from_fork+0x1f/0x30 Freed by task 45: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 kasan_set_free_info+0x20/0x30 __kasan_slab_free+0xfb/0x130 kfree+0xac/0x350 hci_conn_cleanup+0x101/0x6a0 hci_conn_del+0x27e/0x6c0 hci_disconn_phylink_complete_evt+0xe0/0x120 hci_event_packet+0x812/0xe90 hci_rx_work+0x4d5/0xc50 process_one_work+0x8fb/0x15a0 worker_thread+0x576/0x1240 kthread+0x29d/0x340 ret_from_fork+0x1f/0x30 The buggy address belongs to the object at ffff88800c0f0500 The buggy address is located 24 bytes inside of which belongs to the cache kmalloc-128 of size 128 The buggy address belongs to the page: 128-byte region [ffff88800c0f0500, ffff88800
to the cache kmalloc-128 of size 128 The buggy address belongs to the page: 128-byte region [ffff88800c0f0500, ffff88800c0f0580) flags: 0x100000000000200(slab|node=0|zone=1) page:00000000fe45cd86 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xc0f0 raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 raw: 0100000000000200 ffffea00003a2c80 dead000000000004 ffff8880078418c0 page dumped because: kasan: bad access detected ffff88800c0f0400: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc Memory state around the buggy address: >ffff88800c0f0500: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88800c0f0480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff
: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88800c0f0480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88800c0f0580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ---truncated--- Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/c41de54b0a963e59e4dd04c029a4a6d73f45ef9c - https://git.kernel.org/stable/c/643a6c26bd32e339d00ad97b8822b6db009e803c - https://git.kernel.org/stable/c/684e505406abaeabe0058e9776f9210bf2747953 - https://git.kernel.org/stable/c/3803d896ddd97c7c16689a5381c0960040727647 - https://git.kernel.org/stable/c/2cc803804ec9a296b3156855d6c8c4ca1c6b84be - https://git.kernel.org/stable/c/d404765dffdbd8dcd14758695d0c96
l.org/stable/c/2cc803804ec9a296b3156855d6c8c4ca1c6b84be - https://git.kernel.org/stable/c/d404765dffdbd8dcd14758695d0c96c52fb2e624 - https://git.kernel.org/stable/c/4da302b90b96c309987eb9b37c8547f939f042d2 - https://git.kernel.org/stable/c/b3c2ea1fd444b3bb7b82bfd2c3a45418f85c2502 - https://git.kernel.org/stable/c/f63d24baff787e13b723d86fe036f84bdbc35045
CVE ID: CVE-2022-49112 State: PUBLISHED Published: 2025-02-26T01:54:57.109Z Last Updated: 2025-05-04T08:30:08.471Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mt76: fix monitor mode crash with sdio driver mt7921s driver may receive frames with fragment buffers. If there is a CTS packet received in monitor mode, the payload is 10 bytes only and need 6 bytes header padding after RXD buffer. However, only RXD in the first linear buffer, if we pull buffer size RXD-size+6 bytes with skb_pull(), that would trigger "BUG_ON(skb->len < skb->data_len)" in __skb_pull(). To avoid the nonlinear buffer issue, enlarge the RXD size from 128
r "BUG_ON(skb->len < skb->data_len)" in __skb_pull(). To avoid the nonlinear buffer issue, enlarge the RXD size from 128 to 256 to make sure all MCU operation in linear buffer. [ 52.007562] kernel BUG at include/linux/skbuff.h:2313! [ 52.007578] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP [ 52.007987] pc : skb_pull+0x48/0x4c [ 52.008015] lr : mt7921_queue_rx_skb+0x494/0x890 [mt7921_common] [ 52.008361] Call trace: [ 52.008377] skb_pull+0x48/0x4c [ 52.008400] mt76s_net_worker+0x134/0x1b0 [mt76_sdio 35339a92c6eb7d4bbcc806a1d22f56365565135c] [ 52.008431] __mt76_worker_fn+0xe8/0x170 [mt76 ef716597d11a77150bc07e3fdd68eeb0f9b56917] [ 52.008449] kthread+0x148/0x3ac [ 52.008466] ret_from_fork+0x1
e8/0x170 [mt76 ef716597d11a77150bc07e3fdd68eeb0f9b56917] [ 52.008449] kthread+0x148/0x3ac [ 52.008466] ret_from_fork+0x10/0x30 References: - https://git.kernel.org/stable/c/13946d5a68efd11dd6af2f6ef4c908f6b00158a5 - https://git.kernel.org/stable/c/c37b4cab3d97ef64b206fca4d9daabd9aff7356e - https://git.kernel.org/stable/c/95e2af01669c7a3cb7a933cefa06361f9db15059 - https://git.kernel.org/stable/c/123bc712b1de0805f9d683687e17b1ec2aba0b68
CVE ID: CVE-2022-49113 State: PUBLISHED Published: 2025-02-26T01:54:57.663Z Last Updated: 2025-10-01T19:57:04.535Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: powerpc/secvar: fix refcount leak in format_show() Refcount leak will happen when format_show returns failure in multiple cases. Unified management of of_node_put can fix this problem. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/02222bf4f0a27f6eba66d1f597cdb5daadd51829 - https://git.kernel.org/stable/c/2a71e3ecd829a82013cf095c55068c61d991e885 - https://git.kernel.org/stable/c/c105ffb6b9744158e37e9f81f0f38861951d1c1f
e/c/2a71e3ecd829a82013cf095c55068c61d991e885 - https://git.kernel.org/stable/c/c105ffb6b9744158e37e9f81f0f38861951d1c1f - https://git.kernel.org/stable/c/d05e4265d33af60b39606c20c731e3e719bfe3d6 - https://git.kernel.org/stable/c/d601fd24e6964967f115f036a840f4f28488f63f
CVE ID: CVE-2022-49114 State: PUBLISHED Published: 2025-02-26T01:54:58.172Z Last Updated: 2025-05-21T08:44:06.430Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: scsi: libfc: Fix use after free in fc_exch_abts_resp() fc_exch_release(ep) will decrease the ep's reference count. When the reference count reaches zero, it is freed. But ep is still used in the following code, which will lead to a use after free. Return after the fc_exch_release() call to avoid use after free. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/4a131d4ea8b581ac9b01d3a72754db4848be3232 - https://git.kernel.o
nrichment: References: - https://git.kernel.org/stable/c/4a131d4ea8b581ac9b01d3a72754db4848be3232 - https://git.kernel.org/stable/c/499d198494e77b6533251b9b909baf5c101129cb - https://git.kernel.org/stable/c/6044ad64f41c87382cfeeca281573d1886d80cbe - https://git.kernel.org/stable/c/5cf2ce8967b0d98c8cfa4dc42ef4fcf080f5c836 - https://git.kernel.org/stable/c/1d7effe5fff9d28e45e18ac3a564067c7ddfe898 - https://git.kernel.org/stable/c/f581df412bc45c95176e3c808ee2839c05b2ab0c - https://git.kernel.org/stable/c/87909291762d08fdb60d19069d7a89b5b308d0ef - https://git.kernel.org/stable/c/412dd8299b02e4410fe77b8396953c1a8dde183a - https://git.kernel.org/stable/c/271add11994ba1a334859069367e04d2be2ebdd4
CVE ID: CVE-2022-49115 State: PUBLISHED Published: 2025-02-26T01:54:58.654Z Last Updated: 2025-10-01T19:57:04.226Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: Fix misused goto label Fix a misused goto label jump since that can result in a memory leak. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/7c657c0694ff690e361a13ce41c36b9dfb433ec8 - https://git.kernel.org/stable/c/dc9d33b2d8d09e6478e8ef817a81cf26930acc3e - https://git.kernel.org/stable/c/70236a0d2d62b081d52076de22d8d017d6cbe99f - https://git.kernel.org/stable/c/d3642fc64276b06446290f82fd45630aeaa4b007 -
c/70236a0d2d62b081d52076de22d8d017d6cbe99f - https://git.kernel.org/stable/c/d3642fc64276b06446290f82fd45630aeaa4b007 - https://git.kernel.org/stable/c/bf8d87c076f55b8b4dfdb6bc6c6b6dc0c2ccb487
CVE ID: CVE-2022-49116 State: PUBLISHED Published: 2025-02-26T01:54:59.129Z Last Updated: 2025-10-01T19:57:04.069Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: use memset avoid memory leaks Use memset to initialize structs to prevent memory leaks in l2cap_ecred_connect Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/9567d54e70ff58c2695c2cc2e53c86c67551d3e6 - https://git.kernel.org/stable/c/42b6a39f439b6f37cc2024d91ce547d83290ff78 - https://git.kernel.org/stable/c/e9e55acee9b7a737ec7f5161b94a78932a5514c8 - https://git.kernel.org/stable/c/d588c183a971b85c775ad66da563ee
l.org/stable/c/e9e55acee9b7a737ec7f5161b94a78932a5514c8 - https://git.kernel.org/stable/c/d588c183a971b85c775ad66da563ee6e8bc8158f - https://git.kernel.org/stable/c/d3715b2333e9a21692ba16ef8645eda584a9515d
CVE ID: CVE-2022-49117 State: PUBLISHED Published: 2025-02-26T01:54:59.617Z Last Updated: 2025-10-01T19:57:03.938Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mips: ralink: fix a refcount leak in ill_acc_of_setup() of_node_put(np) needs to be called when pdev == NULL. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/060a485df4ec1183d543317511cb4caa43468b5d - https://git.kernel.org/stable/c/142ae7d4f21524acfe073e5a3da5667aa85eb970 - https://git.kernel.org/stable/c/5fb47ca3490813d3884d8ad0b2ce511aa3537551 - https://git.kernel.org/stable/c/8d7f7ef7980f287ace1c15f2ac03d6754e12f071
e/c/5fb47ca3490813d3884d8ad0b2ce511aa3537551 - https://git.kernel.org/stable/c/8d7f7ef7980f287ace1c15f2ac03d6754e12f071 - https://git.kernel.org/stable/c/c74c755daed551b9aceb8388159180861474bdfe - https://git.kernel.org/stable/c/4a0a1436053b17e50b7c88858fb0824326641793
CVE ID: CVE-2022-49118 State: PUBLISHED Published: 2025-02-26T01:55:00.169Z Last Updated: 2025-05-04T08:30:16.543Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: scsi: hisi_sas: Free irq vectors in order for v3 HW If the driver probe fails to request the channel IRQ or fatal IRQ, the driver will free the IRQ vectors before freeing the IRQs in free_irq(), and this will cause a kernel BUG like this: ------------[ cut here ]------------ kernel BUG at drivers/pci/msi.c:369! Internal error: Oops - BUG: 0 [#1] PREEMPT SMP Call trace: free_msi_irqs+0x118/0x13c pci_disable_msi+0xfc/0x120 pci_free_irq_vectors+0x24/0x3c hisi_sas_v3_probe
PT SMP Call trace: free_msi_irqs+0x118/0x13c pci_disable_msi+0xfc/0x120 pci_free_irq_vectors+0x24/0x3c hisi_sas_v3_probe+0x360/0x9d0 [hisi_sas_v3_hw] local_pci_probe+0x44/0xb0 work_for_cpu_fn+0x20/0x34 process_one_work+0x1d0/0x340 worker_thread+0x2e0/0x460 kthread+0x180/0x190 ret_from_fork+0x10/0x20 ---[ end trace b88990335b610c11 ]--- So we use devm_add_action() to control the order in which we free the vectors. References: - https://git.kernel.org/stable/c/224903cc60d045576393c3b16907742f23e6c740 - https://git.kernel.org/stable/c/f05a0d8de2ea49af36821a20b0b501e20ced937e - https://git.kernel.org/stable/c/8b6eab9d683bae7f88dc894b8c851f866032301c - https://git.kernel.org/stable/c/b4cc04fa8f1f
https://git.kernel.org/stable/c/8b6eab9d683bae7f88dc894b8c851f866032301c - https://git.kernel.org/stable/c/b4cc04fa8f1fc3816c8494d77abab3f72b9d2292 - https://git.kernel.org/stable/c/554fb72ee34f4732c7f694f56c3c6e67790352a0
CVE ID: CVE-2022-49119 State: PUBLISHED Published: 2025-02-26T01:55:00.668Z Last Updated: 2025-10-01T19:57:03.803Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Fix memory leak in pm8001_chip_fw_flash_update_req() In pm8001_chip_fw_flash_update_build(), if pm8001_chip_fw_flash_update_build() fails, the struct fw_control_ex allocated must be freed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/d83574666bac4b1462e90df393fbed6c5f57d1a3 - https://git.kernel.org/stable/c/e5ecdb01952f230921aa8163d8d7f4c97c925ed8 - https://git.kernel.org/stable/c/fe5b8ea5583b5c3f6f68e06
t.kernel.org/stable/c/e5ecdb01952f230921aa8163d8d7f4c97c925ed8 - https://git.kernel.org/stable/c/fe5b8ea5583b5c3f6f68e06acba50387edf3b5d5 - https://git.kernel.org/stable/c/a25ed5f21f94f9ae4bcc8dd747e978668890c921 - https://git.kernel.org/stable/c/f792a3629f4c4aa4c3703d66b43ce1edcc3ec09a
CVE ID: CVE-2022-49120 State: PUBLISHED Published: 2025-02-26T01:55:01.159Z Last Updated: 2025-05-04T08:30:19.293Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Fix task leak in pm8001_send_abort_all() In pm8001_send_abort_all(), make sure to free the allocated sas task if pm8001_tag_alloc() or pm8001_mpi_build_cmd() fail. References: - https://git.kernel.org/stable/c/2051044d7901f1a9d7be95d0d32e53b88e9548f7 - https://git.kernel.org/stable/c/2290dcad6f65864dec518fb2d5fb45f67d684150 - https://git.kernel.org/stable/c/146cae06d2682d7563732544be334e8e6d3862b8 - https://git.kernel.org/stable/c/34c79d16ee69cb53288c202b
.kernel.org/stable/c/146cae06d2682d7563732544be334e8e6d3862b8 - https://git.kernel.org/stable/c/34c79d16ee69cb53288c202bb1ab0ba0130d9674 - https://git.kernel.org/stable/c/f90a74892f3acf0cdec5844e90fc8686ca13e7d7
CVE ID: CVE-2022-49121 State: PUBLISHED Published: 2025-02-26T01:55:01.671Z Last Updated: 2025-05-04T08:30:20.626Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Fix tag leaks on error In pm8001_chip_set_dev_state_req(), pm8001_chip_fw_flash_update_req(), pm80xx_chip_phy_ctl_req() and pm8001_chip_reg_dev_req() add missing calls to pm8001_tag_free() to free the allocated tag when pm8001_mpi_build_cmd() fails. Similarly, in pm8001_exec_internal_task_abort(), if the chip ->task_abort method fails, the tag allocated for the abort request task must be freed. Add the missing call to pm8001_tag_free(). References: - http
he tag allocated for the abort request task must be freed. Add the missing call to pm8001_tag_free(). References: - https://git.kernel.org/stable/c/a0bb65eadbf942024226241d9d99fed17168940b - https://git.kernel.org/stable/c/43c617eefab7077d69f5989ad3e2a273da1d728b - https://git.kernel.org/stable/c/bdc74815f1c39905054b7d47399e0260b201b14d - https://git.kernel.org/stable/c/9cc72bcc1c096ed42c91646f130d4b4191580a4c - https://git.kernel.org/stable/c/4c8f04b1905cd4b776d0b720463c091545478ef7
CVE ID: CVE-2022-49122 State: PUBLISHED Published: 2025-02-26T01:55:02.161Z Last Updated: 2025-05-04T08:30:21.824Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: dm ioctl: prevent potential spectre v1 gadget It appears like cmd could be a Spectre v1 gadget as it's supplied by a user and used as an array index. Prevent the contents of kernel memory from being leaked to userspace via speculative execution by using array_index_nospec. References: - https://git.kernel.org/stable/c/76c94651005f58885facf9c973007f5ea01ab01f - https://git.kernel.org/stable/c/58880025e3362024f6d8ea01cb0c7a5df6c84ba6 - https://git.kernel.org/stable/c/7ae
01ab01f - https://git.kernel.org/stable/c/58880025e3362024f6d8ea01cb0c7a5df6c84ba6 - https://git.kernel.org/stable/c/7ae2c5b89da3cfaf856df880af27d3bb32a74b3d - https://git.kernel.org/stable/c/0320bac5801b31407200227173205d017488f140 - https://git.kernel.org/stable/c/71c8df33fd777c7628f6fbc09b14e84806c55914 - https://git.kernel.org/stable/c/02cc46f397eb3691c56affbd5073e54f7a82ac32 - https://git.kernel.org/stable/c/44e6cb3ab177faae840bb2c1ebda9a2539876184 - https://git.kernel.org/stable/c/dd86064417de828ff2102ddc6049c829bf7585b4 - https://git.kernel.org/stable/c/cd9c88da171a62c4b0f1c70e50c75845969fbc18
CVE ID: CVE-2022-49123 State: PUBLISHED Published: 2025-02-26T01:55:02.697Z Last Updated: 2025-10-01T19:57:03.659Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ath11k: Fix frames flush failure caused by deadlock We are seeing below warnings: kernel: [25393.301506] ath11k_pci 0000:01:00.0: failed to flush mgmt transmit queue 0 kernel: [25398.421509] ath11k_pci 0000:01:00.0: failed to flush mgmt transmit queue 0 kernel: [25398.421831] ath11k_pci 0000:01:00.0: dropping mgmt frame for vdev 0, is_started 0 this means ath11k fails to flush mgmt. frames because wmi_mgmt_tx_work has no chance to run in 5 seconds. By setting /proc/sys
eans ath11k fails to flush mgmt. frames because wmi_mgmt_tx_work has no chance to run in 5 seconds. By setting /proc/sys/kernel/hung_task_timeout_secs to 20 and increasing ATH11K_FLUSH_TIMEOUT to 50 we get below warnings: kernel: [ 120.763160] INFO: task wpa_supplicant:924 blocked for more than 20 seconds. kernel: [ 120.763169] Not tainted 5.10.90 #12 kernel: [ 120.763177] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. kernel: [ 120.763186] task:wpa_supplicant state:D stack: 0 pid: 924 ppid: 1 flags:0x000043a0 kernel: [ 120.763201] Call Trace: kernel: [ 120.763214] __schedule+0x785/0x12fa kernel: [ 120.763224] ? lockdep_hardirqs_on_prepare+0xe2/0x1bb kernel: [ 120.
nel: [ 120.763214] __schedule+0x785/0x12fa kernel: [ 120.763224] ? lockdep_hardirqs_on_prepare+0xe2/0x1bb kernel: [ 120.763242] schedule+0x7e/0xa1 kernel: [ 120.763253] schedule_timeout+0x98/0xfe kernel: [ 120.763266] ? run_local_timers+0x4a/0x4a kernel: [ 120.763291] ath11k_mac_flush_tx_complete+0x197/0x2b1 [ath11k 13c3a9bf37790f4ac8103b3decf7ab4008ac314a] kernel: [ 120.763306] ? init_wait_entry+0x2e/0x2e kernel: [ 120.763343] __ieee80211_flush_queues+0x167/0x21f [mac80211 335da900954f1c5ea7f1613d92088ce83342042c] kernel: [ 120.763378] __ieee80211_recalc_idle+0x105/0x125 [mac80211 335da900954f1c5ea7f1613d92088ce83342042c] kernel: [ 120.763411] ieee80211_recalc_idle+0x14/0x27 [mac80211 335da
mac80211 335da900954f1c5ea7f1613d92088ce83342042c] kernel: [ 120.763411] ieee80211_recalc_idle+0x14/0x27 [mac80211 335da900954f1c5ea7f1613d92088ce83342042c] kernel: [ 120.763441] ieee80211_free_chanctx+0x77/0xa2 [mac80211 335da900954f1c5ea7f1613d92088ce83342042c] kernel: [ 120.763473] __ieee80211_vif_release_channel+0x100/0x131 [mac80211 335da900954f1c5ea7f1613d92088ce83342042c] kernel: [ 120.763540] ieee80211_vif_release_channel+0x66/0x81 [mac80211 335da900954f1c5ea7f1613d92088ce83342042c] kernel: [ 120.763572] ieee80211_destroy_auth_data+0xa3/0xe6 [mac80211 335da900954f1c5ea7f1613d92088ce83342042c] kernel: [ 120.763612] ieee80211_mgd_deauth+0x178/0x29b [mac80211 335da900954f1c5ea7f1613d920
5ea7f1613d92088ce83342042c] kernel: [ 120.763612] ieee80211_mgd_deauth+0x178/0x29b [mac80211 335da900954f1c5ea7f1613d92088ce83342042c] kernel: [ 120.763654] cfg80211_mlme_deauth+0x1a8/0x22c [cfg80211 8945aa5bc2af5f6972336665d8ad6f9c191ad5be] kernel: [ 120.763697] nl80211_deauthenticate+0xfa/0x123 [cfg80211 8945aa5bc2af5f6972336665d8ad6f9c191ad5be] kernel: [ 120.763715] genl_rcv_msg+0x392/0x3c2 kernel: [ 120.763750] ? nl80211_associate+0x432/0x432 [cfg80211 8945aa5bc2af5f6972336665d8ad6f9c191ad5be] kernel: [ 120.763782] ? nl80211_associate+0x432/0x432 [cfg80211 8945aa5bc2af5f6972336665d8ad6f9c191ad5be] kernel: [ 120.763802] ? genl_rcv+0x36/0x36 kernel: [ 120.763814] netlink_rcv_skb+0x89/0xf7
f6972336665d8ad6f9c191ad5be] kernel: [ 120.763802] ? genl_rcv+0x36/0x36 kernel: [ 120.763814] netlink_rcv_skb+0x89/0xf7 kernel: [ 120.763829] genl_rcv+0x28/0x36 kernel: [ 120.763840] netlink_unicast+0x179/0x24b kernel: [ 120.763854] netlink_sendmsg+0x393/0x401 kernel: [ 120.763872] sock_sendmsg+0x72/0x76 kernel: [ 120.763886] ____sys_sendmsg+0x170/0x1e6 kernel: [ 120.763897] ? copy_msghdr_from_user+0x7a/0xa2 kernel: [ 120.763914] ___sys_sendmsg+0x95/0xd1 kernel: [ 120.763940] __sys_sendmsg+0x85/0xbf kernel: [ 120.763956] do_syscall_64+0x43/0x55 kernel: [ 120.763966] entry_SYSCALL_64_after_hwframe+0x44/0xa9 kernel: [ 120.763977] RIP: 0033:0x79089f3fcc83 kernel: [ 120.763986] RSP: 002b:00007ff
YSCALL_64_after_hwframe+0x44/0xa9 kernel: [ 120.763977] RIP: 0033:0x79089f3fcc83 kernel: [ 120.763986] RSP: 002b:00007ffe604f0508 EFLAGS: 00000246 ORIG_RAX: 000000000000002e kernel: [ 120.763997] RAX: ffffffffffffffda RBX: 000059b40e987690 RCX: 000079089f3fcc83 kernel: [ 120.764006] RDX: 0000000000000000 RSI: 00007ffe604f0558 RDI: 0000000000000009 kernel: [ 120.764014] RBP: 00007ffe604f0540 R08: 0000000000000004 R09: 0000000000400000 kernel: [ 120.764023] R10: 00007ffe604f0638 R11: 0000000000000246 R12: 000059b40ea04980 kernel: [ 120.764032] R13: 00007ffe604 ---truncated--- Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/33e723dc054edfc94da90e
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/33e723dc054edfc94da90eecca3b72cb424ce4a3 - https://git.kernel.org/stable/c/261b07519518bd14cb168b287b17e1d195f8d0c8
CVE ID: CVE-2022-49124 State: PUBLISHED Published: 2025-02-26T01:55:03.188Z Last Updated: 2025-05-04T08:30:25.044Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: x86/mce: Work around an erratum on fast string copy instructions A rare kernel panic scenario can happen when the following conditions are met due to an erratum on fast string copy instructions: 1) An uncorrected error. 2) That error must be in first cache line of a page. 3) Kernel must execute page_copy from the page immediately before that page. The fast string copy instructions ("REP; MOVS*") could consume an uncorrectable memory error in the cache line _right after
fast string copy instructions ("REP; MOVS*") could consume an uncorrectable memory error in the cache line _right after_ the desired region to copy and raise an MCE. Bit 0 of MSR_IA32_MISC_ENABLE can be cleared to disable fast string copy and will avoid such spurious machine checks. However, that is less preferable due to the permanent performance impact. Considering memory poison is rare, it's desirable to keep fast string copy enabled until an MCE is seen. Intel has confirmed the following: 1. The CPU erratum of fast string copy only applies to Skylake, Cascade Lake and Cooper Lake generations. Directly return from the MCE handler: 2. Will result in complete execution of the "REP; MOVS*"