Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-47645 State: PUBLISHED Published: 2025-02-26T01:54:14.651Z Last Updated: 2025-10-01T19:57:07.833Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: media: staging: media: zoran: calculate the right buffer number for zoran_reap_stat_com On the case tmp_dcim=1, the index of buffer is miscalculated. This generate a NULL pointer dereference later. So let's fix the calcul and add a check to prevent this to reappear. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/8dce4b265a5357731058f69645840dabc718c687 - https://git.kernel.org/stable/c/bafec1a6ba4b187a7fcdcfce0faebdc623
g/stable/c/8dce4b265a5357731058f69645840dabc718c687 - https://git.kernel.org/stable/c/bafec1a6ba4b187a7fcdcfce0faebdc623d4ef8e - https://git.kernel.org/stable/c/7e76f3ed7ab2ae026c6ef9cc23096a7554af8c52 - https://git.kernel.org/stable/c/20db2ed1e2f9fcd417fa67853e5154f0c2537d6c - https://git.kernel.org/stable/c/20811bbe685ca3eddd34b0c750860427d7030910 - https://git.kernel.org/stable/c/e3b86f4e558cea9eed71d894df2f19b10d60a207
CVE ID: CVE-2021-47646 State: PUBLISHED Published: 2025-02-26T01:54:15.122Z Last Updated: 2025-05-04T07:15:26.899Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Revert "Revert "block, bfq: honor already-setup queue merges"" A crash [1] happened to be triggered in conjunction with commit 2d52c58b9c9b ("block, bfq: honor already-setup queue merges"). The latter was then reverted by commit ebc69e897e17 ("Revert "block, bfq: honor already-setup queue merges""). Yet, the reverted commit was not the one introducing the bug. In fact, it actually triggered a UAF introduced by a different commit, and now fixed by commit d29bd41428cf ("
the bug. In fact, it actually triggered a UAF introduced by a different commit, and now fixed by commit d29bd41428cf ("block, bfq: reset last_bfqq_created on group change"). So, there is no point in keeping commit 2d52c58b9c9b ("block, bfq: honor already-setup queue merges") out. This commit restores it. [1] https://bugzilla.kernel.org/show_bug.cgi?id=214503 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/f990f0985eda59d4f29fc83fcf300c92b1225d39 - https://git.kernel.org/stable/c/931aff627469a75c77b9fd3823146d0575afffd6 - https://git.kernel.org/stable/c/cc051f497eac9d8a0d816cd4bffa3415f2724871 - https://git.kernel.org/stable/c/65d8a737452e88f2
ps://git.kernel.org/stable/c/cc051f497eac9d8a0d816cd4bffa3415f2724871 - https://git.kernel.org/stable/c/65d8a737452e88f251fe5d925371de6d606df613 - https://git.kernel.org/stable/c/abc2129e646af7b43025d90a071f83043f1ae76c - https://git.kernel.org/stable/c/4083925bd6dc89216d156474a8076feec904e607 - https://git.kernel.org/stable/c/15729ff8143f8135b03988a100a19e66d7cb7ecd
CVE ID: CVE-2021-47647 State: PUBLISHED Published: 2025-02-26T01:54:15.635Z Last Updated: 2025-05-04T07:15:28.292Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: clk: qcom: ipq8074: fix PCI-E clock oops Fix PCI-E clock related kernel oops that are caused by a missing clock parent. pcie0_rchng_clk_src has num_parents set to 2 but only one parent is actually set via parent_hws, it should also have "XO" defined. This will cause the kernel to panic on a NULL pointer in clk_core_get_parent_by_index(). So, to fix this utilize clk_parent_data to provide gcc_xo_gpll0 parent data. Since there is already an existing static const char * c
is utilize clk_parent_data to provide gcc_xo_gpll0 parent data. Since there is already an existing static const char * const gcc_xo_gpll0[] used to provide the same parents via parent_names convert those users to clk_parent_data as well. Without this earlycon is needed to even catch the OOPS as it will reset the board before serial is initialized with the following: [ 0.232279] Unable to handle kernel paging request at virtual address 0000a00000000000 [ 0.232322] Mem abort info: [ 0.239094] ESR = 0x96000004 [ 0.241778] EC = 0x25: DABT (current EL), IL = 32 bits [ 0.244908] SET = 0, FnV = 0 [ 0.250377] EA = 0, S1PTW = 0 [ 0.253236] FSC = 0x04: level 0 translation fault [ 0.256277] Data abort
SET = 0, FnV = 0 [ 0.250377] EA = 0, S1PTW = 0 [ 0.253236] FSC = 0x04: level 0 translation fault [ 0.256277] Data abort info: [ 0.261141] ISV = 0, ISS = 0x00000004 [ 0.264262] CM = 0, WnR = 0 [ 0.267820] [0000a00000000000] address between user and kernel address ranges [ 0.270954] Internal error: Oops: 96000004 [#1] SMP [ 0.278067] Modules linked in: [ 0.282751] CPU: 1 PID: 1 Comm: swapper/0 Not tainted 5.15.10 #0 [ 0.285882] Hardware name: Xiaomi AX3600 (DT) [ 0.292043] pstate: 20400005 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 0.296299] pc : clk_core_get_parent_by_index+0x68/0xec [ 0.303067] lr : __clk_register+0x1d8/0x820 [ 0.308273] sp : ffffffc01111b7d0 [ 0.312438] x29: ffffffc01
index+0x68/0xec [ 0.303067] lr : __clk_register+0x1d8/0x820 [ 0.308273] sp : ffffffc01111b7d0 [ 0.312438] x29: ffffffc01111b7d0 x28: 0000000000000000 x27: 0000000000000040 [ 0.315919] x26: 0000000000000002 x25: 0000000000000000 x24: ffffff8000308800 [ 0.323037] x23: ffffff8000308850 x22: ffffff8000308880 x21: ffffff8000308828 [ 0.330155] x20: 0000000000000028 x19: ffffff8000309700 x18: 0000000000000020 [ 0.337272] x17: 000000005cc86990 x16: 0000000000000004 x15: ffffff80001d9d0a [ 0.344391] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000006 [ 0.351508] x11: 0000000000000003 x10: 0101010101010101 x9 : 0000000000000000 [ 0.358626] x8 : 7f7f7f7f7f7f7f7f x7 : 6468626f5e626266 x6 :
000000000000003 x10: 0101010101010101 x9 : 0000000000000000 [ 0.358626] x8 : 7f7f7f7f7f7f7f7f x7 : 6468626f5e626266 x6 : 17000a3a403c1b06 [ 0.365744] x5 : 061b3c403a0a0017 x4 : 0000000000000000 x3 : 0000000000000001 [ 0.372863] x2 : 0000a00000000000 x1 : 0000000000000001 x0 : ffffff8000309700 [ 0.379982] Call trace: [ 0.387091] clk_core_get_parent_by_index+0x68/0xec [ 0.389351] __clk_register+0x1d8/0x820 [ 0.394210] devm_clk_hw_register+0x5c/0xe0 [ 0.398030] devm_clk_register_regmap+0x44/0x8c [ 0.402198] qcom_cc_really_probe+0x17c/0x1d0 [ 0.406711] qcom_cc_probe+0x34/0x44 [ 0.411224] gcc_ipq8074_probe+0x18/0x30 [ 0.414869] platform_probe+0x68/0xe0 [ 0.418776] really_probe.part.0+0x9c/0x30c [
0.411224] gcc_ipq8074_probe+0x18/0x30 [ 0.414869] platform_probe+0x68/0xe0 [ 0.418776] really_probe.part.0+0x9c/0x30c [ 0.422336] __driver_probe_device+0x98/0x144 [ 0.426329] driver_probe_device+0x44/0x11c [ 0.430842] __device_attach_driver+0xb4/0x120 [ 0.434836] bus_for_each_drv+0x68/0xb0 [ 0.439349] __device_attach+0xb0/0x170 [ 0.443081] device_initial_probe+0x14/0x20 [ 0.446901] bus_probe_device+0x9c/0xa4 [ 0.451067] device_add+0x35c/0x834 [ 0.454886] of_device_add+0x54/0x64 [ 0.458360] of_platform_device_create_pdata+0xc0/0x100 [ 0.462181] of_platform_bus_create+0x114/0x370 [ 0.467128] of_platform_bus_create+0x15c/0x370 [ 0.471641] of_platform_populate+0x50/0xcc [ 0.476155] of_platform_
0x370 [ 0.467128] of_platform_bus_create+0x15c/0x370 [ 0.471641] of_platform_populate+0x50/0xcc [ 0.476155] of_platform_default_populate_init+0xa8/0xc8 [ 0.480324] do_one_initcall+0x50/0x1b0 [ 0.485877] kernel_init_freeable+0x234/0x29c [ 0.489436] kernel_init+0x24/0x120 [ 0.493948] ret_from_fork+0x10/0x20 [ 0.497253] Code: d50323bf d65f03c0 f94002a2 b4000302 (f9400042) [ 0.501079] ---[ end trace 4ca7e1129da2abce ]--- References: - https://git.kernel.org/stable/c/8b89c9e68a01a19a1dd689a42aa65d545e931899 - https://git.kernel.org/stable/c/41e360fa73a4c2f5b78f5ded78a5375b08c206a5 - https://git.kernel.org/stable/c/d02b3d4a8c525068bc5cfb4341e0023d8eb82ace - https://git.kernel.org/stable/c/5a5576ad
a5 - https://git.kernel.org/stable/c/d02b3d4a8c525068bc5cfb4341e0023d8eb82ace - https://git.kernel.org/stable/c/5a5576ad405c3c89fc9afb245c4dcc3e412b0aa9 - https://git.kernel.org/stable/c/bf8f5182b8f59309809b41c1d1730ed9ca6134b1
CVE ID: CVE-2021-47648 State: PUBLISHED Published: 2025-02-26T01:54:16.100Z Last Updated: 2025-10-01T19:57:07.693Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix a memory leak in 'host1x_remove()' Add a missing 'host1x_channel_list_free()' call in the remove function, as already done in the error handling path of the probe function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/6bb107332db28a0e9256c2d36a0902b85307612c - https://git.kernel.org/stable/c/c06577a80485511b894cb688e881ef0bc2d1d296 - https://git.kernel.org/stable/c/5124a344983e1b9670dae7add0e4d00d589a
stable/c/c06577a80485511b894cb688e881ef0bc2d1d296 - https://git.kernel.org/stable/c/5124a344983e1b9670dae7add0e4d00d589aabcd - https://git.kernel.org/stable/c/fe1ce680560d4f0049ffa0c687de17567421c1ec - https://git.kernel.org/stable/c/025c6643a81564f066d8381b9e2f4603e0f8438f
CVE ID: CVE-2021-47649 State: PUBLISHED Published: 2025-02-26T01:54:16.574Z Last Updated: 2025-05-04T07:15:30.553Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: udmabuf: validate ubuf->pagecount Syzbot has reported GPF in sg_alloc_append_table_from_pages(). The problem was in ubuf->pages == ZERO_PTR. ubuf->pagecount is calculated from arguments passed from user-space. If user creates udmabuf with list.size == 0 then ubuf->pagecount will be also equal to zero; it causes kmalloc_array() to return ZERO_PTR. Fix it by validating ubuf->pagecount before passing it to kmalloc_array(). References: - https://git.kernel.org/stable/c/5d5
it by validating ubuf->pagecount before passing it to kmalloc_array(). References: - https://git.kernel.org/stable/c/5d50f851dd307c07ca5591297093f19967c834a9 - https://git.kernel.org/stable/c/b267a8118c2b171bf7d67b90ed64154eeab9fae0 - https://git.kernel.org/stable/c/811b667cefbea9cb7511a874b169d6a92907137e - https://git.kernel.org/stable/c/a3728d32fc61eb0fe283cb8ff60b2c8f751e2202 - https://git.kernel.org/stable/c/9e9b4a269f84d3230f2af84ff42322db676440d9 - https://git.kernel.org/stable/c/2b6dd600dd72573c23ea180b5b0b2f1813405882
CVE ID: CVE-2021-47650 State: PUBLISHED Published: 2025-02-26T01:54:17.052Z Last Updated: 2025-05-04T07:15:31.763Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ASoC: soc-compress: prevent the potentially use of null pointer There is one call trace that snd_soc_register_card() ->snd_soc_bind_card()->soc_init_pcm_runtime() ->snd_soc_dai_compress_new()->snd_soc_new_compress(). In the trace the 'codec_dai' transfers from card->dai_link, and we can see from the snd_soc_add_pcm_runtime() in snd_soc_bind_card() that, if value of card->dai_link->num_codecs is 0, then 'codec_dai' could be null pointer caused by index out of bound in '
t, if value of card->dai_link->num_codecs is 0, then 'codec_dai' could be null pointer caused by index out of bound in 'asoc_rtd_to_codec(rtd, 0)'. And snd_soc_register_card() is called by various platforms. Therefore, it is better to add the check in the case of misusing. And because 'cpu_dai' has already checked in soc_init_pcm_runtime(), there is no need to check again. Adding the check as follow, then if 'codec_dai' is null, snd_soc_new_compress() will not pass through the check 'if (playback + capture != 1)', avoiding the leftover use of 'codec_dai'. References: - https://git.kernel.org/stable/c/68a69ad8df959e5211ed4a8e120783b2d352ea74 - https://git.kernel.org/stable/c/4639c1d97f385f478
s://git.kernel.org/stable/c/68a69ad8df959e5211ed4a8e120783b2d352ea74 - https://git.kernel.org/stable/c/4639c1d97f385f4784f44d66a3da0672f4951ada - https://git.kernel.org/stable/c/fc237b8d624f4bcb0f21a532627ce4e3b3a85569 - https://git.kernel.org/stable/c/08af6da684b44097ea09f1d74d5858b837ed203b - https://git.kernel.org/stable/c/f69a75cb8a98c6c487d620442c68595726a69f60 - https://git.kernel.org/stable/c/de2c6f98817fa5decb9b7d3b3a8a3ab864c10588
CVE ID: CVE-2021-47651 State: PUBLISHED Published: 2025-02-26T01:54:17.551Z Last Updated: 2025-10-01T19:57:07.527Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: soc: qcom: rpmpd: Check for null return of devm_kcalloc Because of the possible failure of the allocation, data->domains might be NULL pointer and will cause the dereference of the NULL pointer later. Therefore, it might be better to check it and directly return -ENOMEM without releasing data manually if fails, because the comment of the devm_kmalloc() says "Memory allocated with this function is automatically freed on driver detach.". Additional Analyst Notes: - CISA
) says "Memory allocated with this function is automatically freed on driver detach.". Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/755dbc3d73789ac9f0017c729abf5e4b153bf799 - https://git.kernel.org/stable/c/b5d6eba71997b6d661935d2b15094ac7f9f6132d - https://git.kernel.org/stable/c/724376c30af5a57686b223dbcd6188e07d2a1de2 - https://git.kernel.org/stable/c/84b89fa877ad576e9ee8130f412cfd592f274508 - https://git.kernel.org/stable/c/31b5124d742969ea8bf7a1360596f548ca23e770 - https://git.kernel.org/stable/c/5a811126d38f9767a20cc271b34db7c8efc5a46c
CVE ID: CVE-2021-47652 State: PUBLISHED Published: 2025-02-26T01:54:18.089Z Last Updated: 2025-10-01T19:57:07.382Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: video: fbdev: smscufx: Fix null-ptr-deref in ufx_usb_probe() I got a null-ptr-deref report: BUG: kernel NULL pointer dereference, address: 0000000000000000 ... RIP: 0010:fb_destroy_modelist+0x38/0x100 ... Call Trace: ufx_usb_probe.cold+0x2b5/0xac1 [smscufx] usb_probe_interface+0x1aa/0x3c0 [usbcore] really_probe+0x167/0x460 ... ret_from_fork+0x1f/0x30 If fb_alloc_cmap() fails in ufx_usb_probe(), fb_destroy_modelist() will be called to destroy modelist in the error handl
If fb_alloc_cmap() fails in ufx_usb_probe(), fb_destroy_modelist() will be called to destroy modelist in the error handling path. But modelist has not been initialized yet, so it will result in null-ptr-deref. Initialize modelist before calling fb_alloc_cmap() to fix this bug. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/d1b6a1f0c23b7164250479bf92e2893291dca539 - https://git.kernel.org/stable/c/0fd28daec73525382e5c992db8743bf76e42cd5c - https://git.kernel.org/stable/c/dd3a6cc7385b89ec2303f39dfc3bafa4e24cec4b - https://git.kernel.org/stable/c/da8b269cc0a2526ebeaccbe2484c999eb0f822cf - https://git.kernel.org/stable/c/64ec3e678d76419f207b9cdd3
kernel.org/stable/c/da8b269cc0a2526ebeaccbe2484c999eb0f822cf - https://git.kernel.org/stable/c/64ec3e678d76419f207b9cdd338dda438ca10b1c - https://git.kernel.org/stable/c/c420b540db4b5d69de0a36d8b9d9a6a79a04f05a - https://git.kernel.org/stable/c/d396c651e2b508b6179bb678cc029f3becbf5170 - https://git.kernel.org/stable/c/9280ef235b05e8f19f8bc6d547b992f0a0ef398d - https://git.kernel.org/stable/c/1791f487f877a9e83d81c8677bd3e7b259e7cb27
CVE ID: CVE-2021-47653 State: PUBLISHED Published: 2025-02-26T01:54:18.596Z Last Updated: 2025-05-04T07:15:34.891Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: media: davinci: vpif: fix use-after-free on driver unbind The driver allocates and registers two platform device structures during probe, but the devices were never deregistered on driver unbind. This results in a use-after-free on driver unbind as the device structures were allocated using devres and would be freed by driver core when remove() returns. Fix this by adding the missing deregistration calls to the remove() callback and failing probe on registration errors
s. Fix this by adding the missing deregistration calls to the remove() callback and failing probe on registration errors. Note that the platform device structures must be freed using a proper release callback to avoid leaking associated resources like device names. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/6512c3c39cb6b573b791ce45365818a38b76afbe - https://git.kernel.org/stable/c/b5a3bb7f6f164eb6ee74ef4898dcd019b2063448 - https://git.kernel.org/stable/c/9ffc602e14d7b9f7e7cb2f67e18dfef9ef8af676 - https://git.kernel.org/stable/c/43acb728bbc40169d2e2425e84a80068270974be
CVE ID: CVE-2021-47654 State: PUBLISHED Published: 2025-02-26T01:54:19.083Z Last Updated: 2025-10-01T19:57:07.227Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: samples/landlock: Fix path_list memory leak Clang static analysis reports this error sandboxer.c:134:8: warning: Potential leak of memory pointed to by 'path_list' ret = 0; ^ path_list is allocated in parse_path() but never freed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/20fbf100f84b9aeb9c91421abe1927bc152bc32b - https://git.kernel.org/stable/c/49b0d8bf05809df5f87e5c03e26d74bdfdab4571 - https://git.kernel.org/stab
e1927bc152bc32b - https://git.kernel.org/stable/c/49b0d8bf05809df5f87e5c03e26d74bdfdab4571 - https://git.kernel.org/stable/c/017196730299ccd6eed24bbfabed8af4ffd81530 - https://git.kernel.org/stable/c/66b513b7c64a7290c1fbb88e657f7cece992e131
CVE ID: CVE-2021-47655 State: PUBLISHED Published: 2025-02-26T01:54:19.584Z Last Updated: 2025-10-01T19:57:07.103Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: media: venus: vdec: fixed possible memory leak issue The venus_helper_alloc_dpb_bufs() implementation allows an early return on an error path when checking the id from ida_alloc_min() which would not release the earlier buffer allocation. Move the direct kfree() from the error checking of dma_alloc_attrs() to the common fail path to ensure that allocations are released on all error paths in this function. Addresses-Coverity: 1494120 ("Resource leak") Additional Analyst
tions are released on all error paths in this function. Addresses-Coverity: 1494120 ("Resource leak") Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/5cedfe8aaf1875a5305897107b7f298db4260019 - https://git.kernel.org/stable/c/55bccafc246b2e64763a155ec454470c07a54a6e - https://git.kernel.org/stable/c/5f89d05ba93df9c2cdfe493843f93288e55e99eb - https://git.kernel.org/stable/c/8403fdd775858a7bf04868d43daea0acbe49ddfc
CVE ID: CVE-2021-47656 State: PUBLISHED Published: 2025-02-26T01:54:20.069Z Last Updated: 2025-05-04T07:15:43.185Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: jffs2: fix use-after-free in jffs2_clear_xattr_subsystem When we mount a jffs2 image, assume that the first few blocks of the image are normal and contain at least one xattr-related inode, but the next block is abnormal. As a result, an error is returned in jffs2_scan_eraseblock(). jffs2_clear_xattr_subsystem() is then called in jffs2_build_filesystem() and then again in jffs2_do_fill_super(). Finally we can observe the following report: ===============================
() and then again in jffs2_do_fill_super(). Finally we can observe the following report: ================================================================== BUG: KASAN: use-after-free in jffs2_clear_xattr_subsystem+0x95/0x6ac Read of size 8 at addr ffff8881243384e0 by task mount/719 Call Trace: dump_stack+0x115/0x16b jffs2_clear_xattr_subsystem+0x95/0x6ac jffs2_do_fill_super+0x84f/0xc30 jffs2_fill_super+0x2ea/0x4c0 mtd_get_sb+0x254/0x400 mtd_get_sb_by_nr+0x4f/0xd0 get_tree_mtd+0x498/0x840 jffs2_get_tree+0x25/0x30 vfs_get_tree+0x8d/0x2e0 path_mount+0x50f/0x1e50 do_mount+0x107/0x130 __se_sys_mount+0x1c5/0x2f0 __x64_sys_mount+0xc7/0x160 do_syscall_64+0x45/0x70 entry_SYSCALL_64_after_hwframe+0x44
/0x130 __se_sys_mount+0x1c5/0x2f0 __x64_sys_mount+0xc7/0x160 do_syscall_64+0x45/0x70 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Allocated by task 719: kasan_save_stack+0x23/0x60 __kasan_kmalloc.constprop.0+0x10b/0x120 kasan_slab_alloc+0x12/0x20 kmem_cache_alloc+0x1c0/0x870 jffs2_alloc_xattr_ref+0x2f/0xa0 jffs2_scan_medium.cold+0x3713/0x4794 jffs2_do_mount_fs.cold+0xa7/0x2253 jffs2_do_fill_super+0x383/0xc30 jffs2_fill_super+0x2ea/0x4c0 [...] Freed by task 719: kmem_cache_free+0xcc/0x7b0 jffs2_free_xattr_ref+0x78/0x98 jffs2_clear_xattr_subsystem+0xa1/0x6ac jffs2_do_mount_fs.cold+0x5e6/0x2253 jffs2_do_fill_super+0x383/0xc30 jffs2_fill_super+0x2ea/0x4c0 [...] The buggy address belongs to the objec
d+0x5e6/0x2253 jffs2_do_fill_super+0x383/0xc30 jffs2_fill_super+0x2ea/0x4c0 [...] The buggy address belongs to the object at ffff8881243384b8 which belongs to the cache jffs2_xattr_ref of size 48 The buggy address is located 40 bytes inside of 48-byte region [ffff8881243384b8, ffff8881243384e8) [...] ================================================================== The triggering of the BUG is shown in the following stack: ----------------------------------------------------------- jffs2_fill_super jffs2_do_fill_super jffs2_do_mount_fs jffs2_build_filesystem jffs2_scan_medium jffs2_scan_eraseblock <--- ERROR jffs2_clear_xattr_subsystem <--- free jffs2_clear_xattr_subsystem <--- free again -
ium jffs2_scan_eraseblock <--- ERROR jffs2_clear_xattr_subsystem <--- free jffs2_clear_xattr_subsystem <--- free again ----------------------------------------------------------- An error is returned in jffs2_do_mount_fs(). If the error is returned by jffs2_sum_init(), the jffs2_clear_xattr_subsystem() does not need to be executed. If the error is returned by jffs2_build_filesystem(), the jffs2_clear_xattr_subsystem() also does not need to be executed again. So move jffs2_clear_xattr_subsystem() from 'out_inohash' to 'out_root' to fix this UAF problem. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/9150cb625b46f68d524f4cfd491f1aafc23e10a9 - h
tes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/9150cb625b46f68d524f4cfd491f1aafc23e10a9 - https://git.kernel.org/stable/c/3bd2454162ec6bbb5503233c804fce6e4b6dcec5 - https://git.kernel.org/stable/c/c3b07c875fa8f906f932976460fd14798596f101 - https://git.kernel.org/stable/c/30bf7244acf32f19cb722c39f7bc1c2a9f300422 - https://git.kernel.org/stable/c/7bb7428dd73991bf4b3a7a61b493ca50046c2b13 - https://git.kernel.org/stable/c/7a75740206af5f17e9f3efa384211cba70213da1 - https://git.kernel.org/stable/c/22327bd7988f21de3a53c1373f3b81542bfe1f44 - https://git.kernel.org/stable/c/8c0f024f29e055840a5a89fe23b96ae3f921afed - https://git.kernel.org/stable/c/4c7c44ee1650677fbe89d86e
.kernel.org/stable/c/8c0f024f29e055840a5a89fe23b96ae3f921afed - https://git.kernel.org/stable/c/4c7c44ee1650677fbe89d86edbad9497b7679b5c
CVE ID: CVE-2021-47657 State: PUBLISHED Published: 2025-02-26T01:54:20.727Z Last Updated: 2025-10-01T19:57:06.969Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/virtio: Ensure that objs is not NULL in virtio_gpu_array_put_free() If virtio_gpu_object_shmem_init() fails (e.g. due to fault injection, as it happened in the bug report by syzbot), virtio_gpu_array_put_free() could be called with objs equal to NULL. Ensure that objs is not NULL in virtio_gpu_array_put_free(), or otherwise return from the function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/b094fece3810c71ceee6
n. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/b094fece3810c71ceee6f0921676cb65d4e68c5a - https://git.kernel.org/stable/c/ac92b474eeeed75b8660374ba1d129a121c09da8 - https://git.kernel.org/stable/c/abc9ad36df16e27ac1c665085157f1a082d39bac - https://git.kernel.org/stable/c/6b79f96f4a23846516e5e6e4dd37fc06f43a60dd