Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-50379 State: PUBLISHED Published: 2025-09-18T13:33:01.502Z Last Updated: 2025-09-18T13:33:01.502Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix race between quota enable and quota rescan ioctl When enabling quotas, at btrfs_quota_enable(), after committing the transaction, we change fs_info->quota_root to point to the quota root we created and set BTRFS_FS_QUOTA_ENABLED at fs_info->flags. Then we try to start the qgroup rescan worker, first by initializing it with a call to qgroup_rescan_init() - however if that fails we end up freeing the quota root but we leave fs_info->quota_root still pointing t
rescan_init() - however if that fails we end up freeing the quota root but we leave fs_info->quota_root still pointing to it, this can later result in a use-after-free somewhere else. We have previously set the flags BTRFS_FS_QUOTA_ENABLED and BTRFS_QGROUP_STATUS_FLAG_ON, so we can only fail with -EINPROGRESS at btrfs_quota_enable(), which is possible if someone already called the quota rescan ioctl, and therefore started the rescan worker. So fix this by ignoring an -EINPROGRESS and asserting we can't get any other error. References: - https://git.kernel.org/stable/c/c97f6d528c3f1c83a6b792a8a7928c236c80b8fe - https://git.kernel.org/stable/c/26b7c0ac49a3eea15559c9d84863736a6d1164b4 - https:/
d528c3f1c83a6b792a8a7928c236c80b8fe - https://git.kernel.org/stable/c/26b7c0ac49a3eea15559c9d84863736a6d1164b4 - https://git.kernel.org/stable/c/47b5ffe86332af95f0f52be0a63d4da7c2b37b55 - https://git.kernel.org/stable/c/4b996a3014ef014af8f97b60c35f5289210a4720 - https://git.kernel.org/stable/c/0efd9dfc00d677a1d0929319a6103cb2dfc41c22 - https://git.kernel.org/stable/c/6c22f86dd221eba0c7af645b1af73dcbc04ee27b - https://git.kernel.org/stable/c/331cd9461412e103d07595a10289de90004ac890
CVE ID: CVE-2022-50380 State: PUBLISHED Published: 2025-09-18T13:33:02.472Z Last Updated: 2025-10-10T16:06:16.681Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mm: /proc/pid/smaps_rollup: fix no vma's null-deref Commit 258f669e7e88 ("mm: /proc/pid/smaps_rollup: convert to single value seq_file") introduced a null-deref if there are no vma's in the task in show_smaps_rollup. References: - https://git.kernel.org/stable/c/dbe863bce7679c7f5ec0e993d834fe16c5e687b5 - https://git.kernel.org/stable/c/6bb8769326c46db3058780c0640dcc49d8187b24 - https://git.kernel.org/stable/c/a50ed2d28727ff605d95fb9a53be8ff94e8eaaf4 - https://git.kerne
3058780c0640dcc49d8187b24 - https://git.kernel.org/stable/c/a50ed2d28727ff605d95fb9a53be8ff94e8eaaf4 - https://git.kernel.org/stable/c/33fc9e26b7cb39f0d4219c875a2451802249c225 - https://git.kernel.org/stable/c/97898139ca9b81ba9322a585e07490983c53b55a - https://git.kernel.org/stable/c/c4c84f06285e48f80e9843d0775ad92714ffc35a
CVE ID: CVE-2022-50381 State: PUBLISHED Published: 2025-09-18T13:33:03.439Z Last Updated: 2025-09-18T13:33:03.439Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: md: fix a crash in mempool_free There's a crash in mempool_free when running the lvm test shell/lvchange-rebuild-raid.sh. The reason for the crash is this: * super_written calls atomic_dec_and_test(&mddev->pending_writes) and wake_up(&mddev->sb_wait). Then it calls rdev_dec_pending(rdev, mddev) and bio_put(bio). * so, the process that waited on sb_wait and that is woken up is racing with bio_put(bio). * if the process wins the race, it calls bioset_exit before bio_put(
t and that is woken up is racing with bio_put(bio). * if the process wins the race, it calls bioset_exit before bio_put(bio) is executed. * bio_put(bio) attempts to free a bio into a destroyed bio set - causing a crash in mempool_free. We fix this bug by moving bio_put before atomic_dec_and_test. We also move rdev_dec_pending before atomic_dec_and_test as suggested by Neil Brown. The function md_end_flush has a similar bug - we must call bio_put before we decrement the number of in-progress bios. BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 11557f0067 P4D 11557f0067 PUD 0 Oops: 0002
r write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 11557f0067 P4D 11557f0067 PUD 0 Oops: 0002 [#1] PREEMPT SMP CPU: 0 PID: 73 Comm: kworker/0:1 Not tainted 6.1.0-rc3 #5 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014 Workqueue: kdelayd flush_expired_bios [dm_delay] RIP: 0010:mempool_free+0x47/0x80 Code: 48 89 ef 5b 5d ff e0 f3 c3 48 89 f7 e8 32 45 3f 00 48 63 53 08 48 89 c6 3b 53 04 7d 2d 48 8b 43 10 8d 4a 01 48 89 df 89 4b 08 <48> 89 2c d0 e8 b0 45 3f 00 48 8d 7b 30 5b 5d 31 c9 ba 01 00 00 00 RSP: 0018:ffff88910036bda8 EFLAGS: 00010093 RAX: 0000000000000000 RBX: ffff8891037b65d8 RCX: 0000000000000001 RDX: 0000000000000000 RSI: 000000
da8 EFLAGS: 00010093 RAX: 0000000000000000 RBX: ffff8891037b65d8 RCX: 0000000000000001 RDX: 0000000000000000 RSI: 0000000000000202 RDI: ffff8891037b65d8 RBP: ffff8891447ba240 R08: 0000000000012908 R09: 00000000003d0900 R10: 0000000000000000 R11: 0000000000173544 R12: ffff889101a14000 R13: ffff8891562ac300 R14: ffff889102b41440 R15: ffffe8ffffa00d05 FS: 0000000000000000(0000) GS:ffff88942fa00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 0000001102e99000 CR4: 00000000000006b0 Call Trace: <TASK> clone_endio+0xf4/0x1c0 [dm_mod] clone_endio+0xf4/0x1c0 [dm_mod] __submit_bio+0x76/0x120 submit_bio_noacct_nocheck+0xb6/0x2a0 flush_expired_
1c0 [dm_mod] clone_endio+0xf4/0x1c0 [dm_mod] __submit_bio+0x76/0x120 submit_bio_noacct_nocheck+0xb6/0x2a0 flush_expired_bios+0x28/0x2f [dm_delay] process_one_work+0x1b4/0x300 worker_thread+0x45/0x3e0 ? rescuer_thread+0x380/0x380 kthread+0xc2/0x100 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x1f/0x30 </TASK> Modules linked in: brd dm_delay dm_raid dm_mod af_packet uvesafb cfbfillrect cfbimgblt cn cfbcopyarea fb font fbdev tun autofs4 binfmt_misc configfs ipv6 virtio_rng virtio_balloon rng_core virtio_net pcspkr net_failover failover qemu_fw_cfg button mousedev raid10 raid456 libcrc32c async_raid6_recov async_memcpy async_pq raid6_pq async_xor xor async_tx raid1 raid0 md_mod sd_mod t1
0 raid456 libcrc32c async_raid6_recov async_memcpy async_pq raid6_pq async_xor xor async_tx raid1 raid0 md_mod sd_mod t10_pi crc64_rocksoft crc64 virtio_scsi scsi_mod evdev psmouse bsg scsi_common [last unloaded: brd] CR2: 0000000000000000 ---[ end trace 0000000000000000 ]--- References: - https://git.kernel.org/stable/c/732cd66ec19a17f2b9183d7d5b7bdb9c39b0776e - https://git.kernel.org/stable/c/cf06b162f5b6337b688072a1a47941280b8f7110 - https://git.kernel.org/stable/c/b5be563b4356b3089b3245d024cae3f248ba7090 - https://git.kernel.org/stable/c/384ef33d37cefb2ac539d44597d03f06c9b8975c - https://git.kernel.org/stable/c/ae7793027766491c5f8635b12d15a5940d3b8698 - https://git.kernel.org/stable/c/91
c9b8975c - https://git.kernel.org/stable/c/ae7793027766491c5f8635b12d15a5940d3b8698 - https://git.kernel.org/stable/c/91bd504128a51776472445070e11a3b0f9348c90 - https://git.kernel.org/stable/c/842f222fc42a9239831e15b1fd49a51c546902cb - https://git.kernel.org/stable/c/97ce99984be12b9acb49ddce0f5d8ebb037adbb6 - https://git.kernel.org/stable/c/341097ee53573e06ab9fc675d96a052385b851fa
CVE ID: CVE-2022-50382 State: PUBLISHED Published: 2025-09-18T13:33:04.193Z Last Updated: 2025-09-18T13:33:04.193Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: padata: Always leave BHs disabled when running ->parallel() A deadlock can happen when an overloaded system runs ->parallel() in the context of the current task: padata_do_parallel ->parallel() pcrypt_aead_enc/dec padata_do_serial spin_lock(&reorder->lock) // BHs still enabled <interrupt> ... __do_softirq ... padata_do_serial spin_lock(&reorder->lock) It's a bug for BHs to be on in _do_serial as Steffen points out, so ensure they're off in the "current task" case like
It's a bug for BHs to be on in _do_serial as Steffen points out, so ensure they're off in the "current task" case like they are in padata_parallel_worker to avoid this situation. References: - https://git.kernel.org/stable/c/8e0681dd4eee029eb1d533d06993f7cb091efb73 - https://git.kernel.org/stable/c/17afa98bccec4f52203508b3f49b5f948c6fd6ac - https://git.kernel.org/stable/c/7337adb20fcc0aebb50eaff2bc5a8dd9a7c6743d - https://git.kernel.org/stable/c/6cfa9e60c0f88fdec6368e081ab968411cc706b1 - https://git.kernel.org/stable/c/34c3a47d20ae55b3600fed733bf96eafe9c500d5
CVE ID: CVE-2022-50383 State: PUBLISHED Published: 2025-09-18T13:33:04.969Z Last Updated: 2025-09-29T10:47:30.957Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: Can't set dst buffer to done when lat decode error Core thread will call v4l2_m2m_buf_done to set dst buffer done for lat architecture. If lat call v4l2_m2m_buf_done_and_job_finish to free dst buffer when lat decode error, core thread will access kernel NULL pointer dereference, then crash. References: - https://git.kernel.org/stable/c/eeb090420f3477eb5011586709409fc655c2b16c - https://git.kernel.org/stable/c/66d26ed30056e7d2da3e9c14125ffe6049a
/stable/c/eeb090420f3477eb5011586709409fc655c2b16c - https://git.kernel.org/stable/c/66d26ed30056e7d2da3e9c14125ffe6049a4f907 - https://git.kernel.org/stable/c/3568ecd3f3a6d133ab7feffbba34955c8c79bbc4
CVE ID: CVE-2022-50384 State: PUBLISHED Published: 2025-09-18T13:33:05.759Z Last Updated: 2025-09-18T13:33:05.759Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: staging: vme_user: Fix possible UAF in tsi148_dma_list_add Smatch report warning as follows: drivers/staging/vme_user/vme_tsi148.c:1757 tsi148_dma_list_add() warn: '&entry->list' not removed from list In tsi148_dma_list_add(), the error path "goto err_dma" will not remove entry->list from list->entries, but entry will be freed, then list traversal may cause UAF. Fix by removeing it from list->entries before free(). References: - https://git.kernel.org/stable/c/5cc4eea7
cause UAF. Fix by removeing it from list->entries before free(). References: - https://git.kernel.org/stable/c/5cc4eea715a3fcf4e516662f736dfee63979465f - https://git.kernel.org/stable/c/51c0ad3b7c5b01f9314758335a13f157b05fa56d - https://git.kernel.org/stable/c/e6b0adff99edf246ba1f8d464530a0438cb1cbda - https://git.kernel.org/stable/c/a45ba33d398a821147d7e5f16ead7eb125e331e2 - https://git.kernel.org/stable/c/5d2b286eb034af114f67d9967fc3fbc1829bb712 - https://git.kernel.org/stable/c/1f5661388f43df3ac106ce93e67d8d22b16a78ff - https://git.kernel.org/stable/c/cf138759a7e92c75cfc1b7ba705e4108fe330edf - https://git.kernel.org/stable/c/85db68fc901da52314ded80aace99f8b684c7815 - https://git.kernel.o
c1b7ba705e4108fe330edf - https://git.kernel.org/stable/c/85db68fc901da52314ded80aace99f8b684c7815 - https://git.kernel.org/stable/c/357057ee55d3c99a5de5abe8150f7bca04f8e53b
CVE ID: CVE-2022-50385 State: PUBLISHED Published: 2025-09-18T13:33:06.484Z Last Updated: 2025-09-18T13:33:06.484Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: NFS: Fix an Oops in nfs_d_automount() When mounting from a NFSv4 referral, path->dentry can end up being a negative dentry, so derive the struct nfs_server from the dentry itself instead. References: - https://git.kernel.org/stable/c/5458bc0f9df639d83471ca384152cc62dbee0aeb - https://git.kernel.org/stable/c/f12377abac15fb4e8698225ac386894f8ae63598 - https://git.kernel.org/stable/c/b6fd25d64b0de27991d6bd677f0adf69ad6ff07a - https://git.kernel.org/stable/c/6f3d56783fbed8
ttps://git.kernel.org/stable/c/b6fd25d64b0de27991d6bd677f0adf69ad6ff07a - https://git.kernel.org/stable/c/6f3d56783fbed861e483736a7001bdafd0dddd53 - https://git.kernel.org/stable/c/35e3b6ae84935d0d7ff76cbdaa83411b0ad5e471
CVE ID: CVE-2022-50386 State: PUBLISHED Published: 2025-09-18T13:33:07.191Z Last Updated: 2025-09-18T13:33:07.191Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix user-after-free This uses l2cap_chan_hold_unless_zero() after calling __l2cap_get_chan_blah() to prevent the following trace: Bluetooth: l2cap_core.c:static void l2cap_chan_destroy(struct kref *kref) Bluetooth: chan 0000000023c4974d Bluetooth: parent 00000000ae861c08 ================================================================== BUG: KASAN: use-after-free in __mutex_waiter_is_first kernel/locking/mutex.c:191 [inline] BUG: KASAN: use-after-free
=== BUG: KASAN: use-after-free in __mutex_waiter_is_first kernel/locking/mutex.c:191 [inline] BUG: KASAN: use-after-free in __mutex_lock_common kernel/locking/mutex.c:671 [inline] BUG: KASAN: use-after-free in __mutex_lock+0x278/0x400 kernel/locking/mutex.c:729 Read of size 8 at addr ffff888006a49b08 by task kworker/u3:2/389 References: - https://git.kernel.org/stable/c/11e40d6c0823f699d8ad501e48d1c3ae4be386cd - https://git.kernel.org/stable/c/843fc4e386dd84b806a7f07fb062d8c3a44e5364 - https://git.kernel.org/stable/c/d91fc2836562f299f34e361e089e9fe154da4f73 - https://git.kernel.org/stable/c/7d6f9cb24d2b2f6b6370eac074e2e6b1bafdad45 - https://git.kernel.org/stable/c/0c108cf3ad386e0084277093b55
rnel.org/stable/c/7d6f9cb24d2b2f6b6370eac074e2e6b1bafdad45 - https://git.kernel.org/stable/c/0c108cf3ad386e0084277093b55a351c49e0be27 - https://git.kernel.org/stable/c/d1e894f950ad48897d1a7cb05909ea29d8c3810e - https://git.kernel.org/stable/c/6ffde6e03085874ae22263ff4cef4869f797e84f - https://git.kernel.org/stable/c/15fc21695eb606bdc5d483b92118ee42610a952d - https://git.kernel.org/stable/c/35fcbc4243aad7e7d020b7c1dfb14bb888b20a4f
CVE ID: CVE-2022-50387 State: PUBLISHED Published: 2025-09-18T13:33:07.932Z Last Updated: 2025-09-18T13:33:07.932Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: hinic: fix the issue of CMDQ memory leaks When hinic_set_cmdq_depth() fails in hinic_init_cmdqs(), the cmdq memory is not released correctly. Fix it. References: - https://git.kernel.org/stable/c/6603843c80b16957f5d7d14d897faf13cef2b8b9 - https://git.kernel.org/stable/c/6016d96a6adf66d61655d85da02e1a4c1deccbd6 - https://git.kernel.org/stable/c/9145d512ddff76df88832b29575488199df544a1 - https://git.kernel.org/stable/c/363cc87767f6ddcfb9158ad2e2afa2f8d5c4b94e
CVE ID: CVE-2022-50388 State: PUBLISHED Published: 2025-09-18T13:33:08.612Z Last Updated: 2025-09-29T10:47:32.224Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: nvme: fix multipath crash caused by flush request when blktrace is enabled The flush request initialized by blk_kick_flush has NULL bio, and it may be dealt with nvme_end_req during io completion. When blktrace is enabled, nvme_trace_bio_complete with multipath activated trying to access NULL pointer bio from flush request results in the following crash: [ 2517.831677] BUG: kernel NULL pointer dereference, address: 000000000000001a [ 2517.835213] #PF: supervisor read a
sh: [ 2517.831677] BUG: kernel NULL pointer dereference, address: 000000000000001a [ 2517.835213] #PF: supervisor read access in kernel mode [ 2517.838724] #PF: error_code(0x0000) - not-present page [ 2517.842222] PGD 7b2d51067 P4D 0 [ 2517.845684] Oops: 0000 [#1] SMP NOPTI [ 2517.849125] CPU: 2 PID: 732 Comm: kworker/2:1H Kdump: loaded Tainted: G S 5.15.67-0.cl9.x86_64 #1 [ 2517.852723] Hardware name: XFUSION 2288H V6/BC13MBSBC, BIOS 1.13 07/27/2022 [ 2517.856358] Workqueue: nvme_tcp_wq nvme_tcp_io_work [nvme_tcp] [ 2517.859993] RIP: 0010:blk_add_trace_bio_complete+0x6/0x30 [ 2517.863628] Code: 1f 44 00 00 48 8b 46 08 31 c9 ba 04 00 10 00 48 8b 80 50 03 00 00 48 8b 78 50 e9 e5 fe ff ff 0f 1
0 [ 2517.863628] Code: 1f 44 00 00 48 8b 46 08 31 c9 ba 04 00 10 00 48 8b 80 50 03 00 00 48 8b 78 50 e9 e5 fe ff ff 0f 1f 44 00 00 41 54 49 89 f4 55 <0f> b6 7a 1a 48 89 d5 e8 3e 1c 2b 00 48 89 ee 4c 89 e7 5d 89 c1 ba [ 2517.871269] RSP: 0018:ff7f6a008d9dbcd0 EFLAGS: 00010286 [ 2517.875081] RAX: ff3d5b4be00b1d50 RBX: 0000000002040002 RCX: ff3d5b0a270f2000 [ 2517.878966] RDX: 0000000000000000 RSI: ff3d5b0b021fb9f8 RDI: 0000000000000000 [ 2517.882849] RBP: ff3d5b0b96a6fa00 R08: 0000000000000001 R09: 0000000000000000 [ 2517.886718] R10: 000000000000000c R11: 000000000000000c R12: ff3d5b0b021fb9f8 [ 2517.890575] R13: 0000000002000000 R14: ff3d5b0b021fb1b0 R15: 0000000000000018 [ 2517.894434] FS:
2: ff3d5b0b021fb9f8 [ 2517.890575] R13: 0000000002000000 R14: ff3d5b0b021fb1b0 R15: 0000000000000018 [ 2517.894434] FS: 0000000000000000(0000) GS:ff3d5b42bfc80000(0000) knlGS:0000000000000000 [ 2517.898299] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2517.902157] CR2: 000000000000001a CR3: 00000004f023e005 CR4: 0000000000771ee0 [ 2517.906053] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 2517.909930] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 2517.913761] PKRU: 55555554 [ 2517.917558] Call Trace: [ 2517.921294] <TASK> [ 2517.924982] nvme_complete_rq+0x1c3/0x1e0 [nvme_core] [ 2517.928715] nvme_tcp_recv_pdu+0x4d7/0x540 [nvme_tcp] [ 2517.932
2517.924982] nvme_complete_rq+0x1c3/0x1e0 [nvme_core] [ 2517.928715] nvme_tcp_recv_pdu+0x4d7/0x540 [nvme_tcp] [ 2517.932442] nvme_tcp_recv_skb+0x4f/0x240 [nvme_tcp] [ 2517.936137] ? nvme_tcp_recv_pdu+0x540/0x540 [nvme_tcp] [ 2517.939830] tcp_read_sock+0x9c/0x260 [ 2517.943486] nvme_tcp_try_recv+0x65/0xa0 [nvme_tcp] [ 2517.947173] nvme_tcp_io_work+0x64/0x90 [nvme_tcp] [ 2517.950834] process_one_work+0x1e8/0x390 [ 2517.954473] worker_thread+0x53/0x3c0 [ 2517.958069] ? process_one_work+0x390/0x390 [ 2517.961655] kthread+0x10c/0x130 [ 2517.965211] ? set_kthread_struct+0x40/0x40 [ 2517.968760] ret_from_fork+0x1f/0x30 [ 2517.972285] </TASK> To avoid this situation, add a NULL check for req->bio be
[ 2517.968760] ret_from_fork+0x1f/0x30 [ 2517.972285] </TASK> To avoid this situation, add a NULL check for req->bio before calling trace_block_bio_complete. References: - https://git.kernel.org/stable/c/f13301a69ababa6c2236fb4f0393b7e914e7e1e0 - https://git.kernel.org/stable/c/4df413d46960f11c8c105238cfc3f5ff4c95c003 - https://git.kernel.org/stable/c/fcd2d199486033223e9b2a6a7f9a01dd0327eac3 - https://git.kernel.org/stable/c/183c2aaef40a91acbaae45c3824d6cde7bb62b10 - https://git.kernel.org/stable/c/3659fb5ac29a5e6102bebe494ac789fd47fb78f4
CVE ID: CVE-2022-50389 State: PUBLISHED Published: 2025-09-18T13:33:09.322Z Last Updated: 2025-09-18T13:33:09.322Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak In crb_acpi_add(), we get the TPM2 table to retrieve information like start method, and then assign them to the priv data, so the TPM2 table is not used after the init, should be freed, call acpi_put_table() to fix the memory leak. References: - https://git.kernel.org/stable/c/08fd965521d0e172d540cf945517810895fcb199 - https://git.kernel.org/stable/c/1af2232b13837ce0f3a082b9f43735b09aafc367 - https://git.
d0e172d540cf945517810895fcb199 - https://git.kernel.org/stable/c/1af2232b13837ce0f3a082b9f43735b09aafc367 - https://git.kernel.org/stable/c/927860dfa161ae8392a264197257dbdc52b26b0f - https://git.kernel.org/stable/c/0bd9b4be721c776f77adcaf34105dfca3007ddb9 - https://git.kernel.org/stable/c/986cd9a9b95423e35a2cbb8e9105aec0e0d7f337 - https://git.kernel.org/stable/c/2fcd3dc8b97a14f1672729c86b7041a1a89b052a - https://git.kernel.org/stable/c/b0785edaf649e5f04dc7f75533e810f4c00e4106 - https://git.kernel.org/stable/c/37e90c374dd11cf4919c51e847c6d6ced0abc555
CVE ID: CVE-2022-50390 State: PUBLISHED Published: 2025-09-18T13:33:10.073Z Last Updated: 2025-09-18T13:33:10.073Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/ttm: fix undefined behavior in bit shift for TTM_TT_FLAG_PRIV_POPULATED Shifting signed 32-bit value by 31 bits is undefined, so changing significant bit to unsigned. The UBSAN warning calltrace like below: UBSAN: shift-out-of-bounds in ./include/drm/ttm/ttm_tt.h:122:26 left shift of 1 by 31 places cannot be represented in type 'int' Call Trace: <TASK> dump_stack_lvl+0x7d/0xa5 dump_stack+0x15/0x1b ubsan_epilogue+0xe/0x4e __ubsan_handle_shift_out_of_bounds+0x1e7/0x2
TASK> dump_stack_lvl+0x7d/0xa5 dump_stack+0x15/0x1b ubsan_epilogue+0xe/0x4e __ubsan_handle_shift_out_of_bounds+0x1e7/0x20c ttm_bo_move_memcpy+0x3b4/0x460 [ttm] bo_driver_move+0x32/0x40 [drm_vram_helper] ttm_bo_handle_move_mem+0x118/0x200 [ttm] ttm_bo_validate+0xfa/0x220 [ttm] drm_gem_vram_pin_locked+0x70/0x1b0 [drm_vram_helper] drm_gem_vram_pin+0x48/0xb0 [drm_vram_helper] drm_gem_vram_plane_helper_prepare_fb+0x53/0xe0 [drm_vram_helper] drm_gem_vram_simple_display_pipe_prepare_fb+0x26/0x30 [drm_vram_helper] drm_simple_kms_plane_prepare_fb+0x4d/0xe0 [drm_kms_helper] drm_atomic_helper_prepare_planes+0xda/0x210 [drm_kms_helper] drm_atomic_helper_commit+0xc3/0x1e0 [drm_kms_helper] drm_atomic_comm
c_helper_prepare_planes+0xda/0x210 [drm_kms_helper] drm_atomic_helper_commit+0xc3/0x1e0 [drm_kms_helper] drm_atomic_commit+0x9c/0x160 [drm] drm_client_modeset_commit_atomic+0x33a/0x380 [drm] drm_client_modeset_commit_locked+0x77/0x220 [drm] drm_client_modeset_commit+0x31/0x60 [drm] __drm_fb_helper_restore_fbdev_mode_unlocked+0xa7/0x170 [drm_kms_helper] drm_fb_helper_set_par+0x51/0x90 [drm_kms_helper] fbcon_init+0x316/0x790 visual_init+0x113/0x1d0 do_bind_con_driver+0x2a3/0x5c0 do_take_over_console+0xa9/0x270 do_fbcon_takeover+0xa1/0x170 do_fb_registered+0x2a8/0x340 fbcon_fb_registered+0x47/0xe0 register_framebuffer+0x294/0x4a0 __drm_fb_helper_initial_config_and_unlock+0x43c/0x880 [drm_kms_he
_registered+0x47/0xe0 register_framebuffer+0x294/0x4a0 __drm_fb_helper_initial_config_and_unlock+0x43c/0x880 [drm_kms_helper] drm_fb_helper_initial_config+0x52/0x80 [drm_kms_helper] drm_fbdev_client_hotplug+0x156/0x1b0 [drm_kms_helper] drm_fbdev_generic_setup+0xfc/0x290 [drm_kms_helper] bochs_pci_probe+0x6ca/0x772 [bochs] local_pci_probe+0x4d/0xb0 pci_device_probe+0x119/0x320 really_probe+0x181/0x550 __driver_probe_device+0xc6/0x220 driver_probe_device+0x32/0x100 __driver_attach+0x195/0x200 bus_for_each_dev+0xbb/0x120 driver_attach+0x27/0x30 bus_add_driver+0x22e/0x2f0 driver_register+0xa9/0x190 __pci_register_driver+0x90/0xa0 bochs_pci_driver_init+0x52/0x1000 [bochs] do_one_initcall+0x76/0x4
r_register+0xa9/0x190 __pci_register_driver+0x90/0xa0 bochs_pci_driver_init+0x52/0x1000 [bochs] do_one_initcall+0x76/0x430 do_init_module+0x61/0x28a load_module+0x1f82/0x2e50 __do_sys_finit_module+0xf8/0x190 __x64_sys_finit_module+0x23/0x30 do_syscall_64+0x58/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd </TASK> References: - https://git.kernel.org/stable/c/2ff0309b73d86e8591881ac035af06e01c112e89 - https://git.kernel.org/stable/c/6528971fdce0dfc0a28fec42c151a1eccdabadf5 - https://git.kernel.org/stable/c/387659939c00156f8d6bab0fbc55b4eaf2b6bc5b
CVE ID: CVE-2022-50391 State: PUBLISHED Published: 2025-09-18T13:33:10.768Z Last Updated: 2025-09-18T13:33:10.768Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mm/mempolicy: fix memory leak in set_mempolicy_home_node system call When encountering any vma in the range with policy other than MPOL_BIND or MPOL_PREFERRED_MANY, an error is returned without issuing a mpol_put on the policy just allocated with mpol_dup(). This allows arbitrary users to leak kernel memory. References: - https://git.kernel.org/stable/c/4ca0eb6b2f3add8c5daefb726ce57dc95d103d33 - https://git.kernel.org/stable/c/0ce4cc6d269ddc448a825955b495f662f5d9e153 -
/c/4ca0eb6b2f3add8c5daefb726ce57dc95d103d33 - https://git.kernel.org/stable/c/0ce4cc6d269ddc448a825955b495f662f5d9e153 - https://git.kernel.org/stable/c/38ce7c9bdfc228c14d7621ba36d3eebedd9d4f76