Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
wap_page SWP_SYNCHRONOUS_IO path SWP_SYNCHRONOUS_IO path swap_readpage original data pte_lock map the original data swap_free swap_range_free bd_disk->fops->swap_slot_free_notify swap_readpage read zeroed data pte_unlock pte_lock if (!pte_same) goto out_nomap; pte_unlock return on next refault will see mapped data by CPU B The concern of the patch would increase memory consumption since it could keep wasted memory with compressed form in zram as well as uncompressed form in address space. However, most of cases of zram uses no readahead and do_swap_page is followed by swap_free so it will free the compressed form from in zram quickly. References: - https://git.kernel.org/stable/c/f86d55cf616
free so it will free the compressed form from in zram quickly. References: - https://git.kernel.org/stable/c/f86d55cf616199404c05f5b0c5c41b17351baa02 - https://git.kernel.org/stable/c/f098f8b9820fe3f2e41aefc4329dfe8a3859d1c1 - https://git.kernel.org/stable/c/20ed94f8181a25212e7404e44958e234f407624b - https://git.kernel.org/stable/c/12ba1d38115a101c45d8e0ca3aa1181fd148e57f - https://git.kernel.org/stable/c/afac4b88699a06c8b9369f9d759a1ec3c254b788 - https://git.kernel.org/stable/c/e914d8f00391520ecc4495dd0ca0124538ab7119
CVE ID: CVE-2022-49053 State: PUBLISHED Published: 2025-02-26T01:54:26.806Z Last Updated: 2025-05-21T08:44:03.988Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: scsi: target: tcmu: Fix possible page UAF tcmu_try_get_data_page() looks up pages under cmdr_lock, but it does not take refcount properly and just returns page pointer. When tcmu_try_get_data_page() returns, the returned page may have been freed by tcmu_blocks_release(). We need to get_page() under cmdr_lock to avoid concurrent tcmu_blocks_release(). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/d7c5d79e50be6e06b669141
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/d7c5d79e50be6e06b669141e3db1f977a0dd4e8e - https://git.kernel.org/stable/c/e3e0e067d5b34e4a68e3cc55f8eebc413f56f8ed - https://git.kernel.org/stable/c/fb7a5115422fbd6a4d505e8844f1ef5529f10489 - https://git.kernel.org/stable/c/aec36b98a1bbaa84bfd8299a306e4c12314af626 - https://git.kernel.org/stable/c/b7f3b5d70c834f49f7d87a2f2ed1c6284d9a0322 - https://git.kernel.org/stable/c/a9564d84ed9f6ee71017d062d0d2182154294a4b - https://git.kernel.org/stable/c/a6968f7a367f128d120447360734344d5a3d5336
CVE ID: CVE-2022-49054 State: PUBLISHED Published: 2025-02-26T01:54:27.286Z Last Updated: 2025-05-04T08:28:45.411Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Deactivate sysctl_record_panic_msg by default in isolated guests hv_panic_page might contain guest-sensitive information, do not dump it over to Hyper-V by default in isolated guests. While at it, update some comments in hyperv_{panic,die}_event(). References: - https://git.kernel.org/stable/c/1b576e81d31b56b248316b8ff816b1cc5c4407c7 - https://git.kernel.org/stable/c/6230bc50d6d21cae4c084766623d0a6d17958721 - https://git.kernel.org/stable/c/9f8b577f
c7 - https://git.kernel.org/stable/c/6230bc50d6d21cae4c084766623d0a6d17958721 - https://git.kernel.org/stable/c/9f8b577f7b43b2170628d6c537252785dcc2dcea
CVE ID: CVE-2022-49055 State: PUBLISHED Published: 2025-02-26T01:54:27.771Z Last Updated: 2025-10-01T19:57:06.838Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check for potential null return of kmalloc_array() As the kmalloc_array() may return null, the 'event_waiters[i].wait' would lead to null-pointer dereference. Therefore, it is better to check the return value of kmalloc_array() to avoid this confusion. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/32cf90a521dcc0f136db7ee5ba32bfe5f79e460e - https://git.kernel.org/stable/c/40bf32dbfef866c83a3e74800b81d79e52b6
stable/c/32cf90a521dcc0f136db7ee5ba32bfe5f79e460e - https://git.kernel.org/stable/c/40bf32dbfef866c83a3e74800b81d79e52b6d20b - https://git.kernel.org/stable/c/94869bb0de69a812f70231b0eb480bb2f7ae73a6 - https://git.kernel.org/stable/c/c7a268b33882d5feaafd29c1734456f41ba41396 - https://git.kernel.org/stable/c/1d7a5aae884ca727d41c7ed15d4c82fdb67c040c - https://git.kernel.org/stable/c/f2658d5966bcee8c3eb487875f459756d4f7cdfc - https://git.kernel.org/stable/c/0a692c625e373fef692ffbc7fc41f8a025f01cb7 - https://git.kernel.org/stable/c/ebbb7bb9e80305820dc2328a371c1b35679f2667
CVE ID: CVE-2022-49056 State: REJECTED Published: 2025-02-26T01:54:28.256Z Last Updated: 2025-05-20T13:54:51.614Z Description: No description available.
CVE ID: CVE-2022-49057 State: PUBLISHED Published: 2025-02-26T01:54:28.723Z Last Updated: 2025-05-04T08:28:49.558Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: block: null_blk: end timed out poll request When poll request is timed out, it is removed from the poll list, but not completed, so the request is leaked, and never get chance to complete. Fix the issue by ending it in timeout handler. References: - https://git.kernel.org/stable/c/407d09a22f3f685fd634aa5d05840c64b23bfebc - https://git.kernel.org/stable/c/3e3876d322aef82416ecc496a4d4a587e0fdf7a3
CVE ID: CVE-2022-49058 State: PUBLISHED Published: 2025-02-26T01:54:29.195Z Last Updated: 2025-10-01T19:57:06.701Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: cifs: potential buffer overflow in handling symlinks Smatch printed a warning: arch/x86/crypto/poly1305_glue.c:198 poly1305_update_arch() error: __memcpy() 'dctx->buf' too small (16 vs u32max) It's caused because Smatch marks 'link_len' as untrusted since it comes from sscanf(). Add a check to ensure that 'link_len' is not larger than the size of the 'link_str' buffer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/3e58
'link_str' buffer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/3e582749e742e662a8e9bb37cffac62dccaaa1e2 - https://git.kernel.org/stable/c/1316c28569a80ab3596eeab05bf5e01991e7e739 - https://git.kernel.org/stable/c/eb5f51756944735ac70cd8bb38637cc202e29c91 - https://git.kernel.org/stable/c/22d658c6c5affed10c8907e67160cef0b6c92186 - https://git.kernel.org/stable/c/4e166a41180be2f1e66bbb6d46448e80a9a5ec05 - https://git.kernel.org/stable/c/9901b07ba42b39266b34a888e48d7306fd707bee - https://git.kernel.org/stable/c/515e7ba11ef043d6febe69389949c8ef5f25e9d0 - https://git.kernel.org/stable/c/64c4a37ac04eeb43c42d272f6e6c8c12bfcf4304
CVE ID: CVE-2022-49059 State: PUBLISHED Published: 2025-02-26T01:54:29.819Z Last Updated: 2025-05-04T08:28:51.756Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: nfc: nci: add flush_workqueue to prevent uaf Our detector found a concurrent use-after-free bug when detaching an NCI device. The main reason for this bug is the unexpected scheduling between the used delayed mechanism (timer and workqueue). The race can be demonstrated below: Thread-1 Thread-2 | nci_dev_up() | nci_open_device() | __nci_request(nci_reset_req) | nci_send_cmd | queue_work(cmd_work) nci_unregister_device() | nci_close_device() | ... del_timer_sync(cmd_tim
set_req) | nci_send_cmd | queue_work(cmd_work) nci_unregister_device() | nci_close_device() | ... del_timer_sync(cmd_timer)[1] | ... | Worker nci_free_device() | nci_cmd_work() kfree(ndev)[3] | mod_timer(cmd_timer)[2] In short, the cleanup routine thought that the cmd_timer has already been detached by [1] but the mod_timer can re-attach the timer [2], even it is already released [3], resulting in UAF. This UAF is easy to trigger, crash trace by POC is like below [ 66.703713] ================================================================== [ 66.703974] BUG: KASAN: use-after-free in enqueue_timer+0x448/0x490 [ 66.703974] Write of size 8 at addr ffff888009fb7058 by task kworker/u4:1/33 [ 66.
er-free in enqueue_timer+0x448/0x490 [ 66.703974] Write of size 8 at addr ffff888009fb7058 by task kworker/u4:1/33 [ 66.703974] [ 66.703974] CPU: 1 PID: 33 Comm: kworker/u4:1 Not tainted 5.18.0-rc2 #5 [ 66.703974] Workqueue: nfc2_nci_cmd_wq nci_cmd_work [ 66.703974] Call Trace: [ 66.703974] <TASK> [ 66.703974] dump_stack_lvl+0x57/0x7d [ 66.703974] print_report.cold+0x5e/0x5db [ 66.703974] ? enqueue_timer+0x448/0x490 [ 66.703974] kasan_report+0xbe/0x1c0 [ 66.703974] ? enqueue_timer+0x448/0x490 [ 66.703974] enqueue_timer+0x448/0x490 [ 66.703974] __mod_timer+0x5e6/0xb80 [ 66.703974] ? mark_held_locks+0x9e/0xe0 [ 66.703974] ? try_to_del_timer_sync+0xf0/0xf0 [ 66.703974] ? lockdep_hardirqs_on_pre
03974] ? mark_held_locks+0x9e/0xe0 [ 66.703974] ? try_to_del_timer_sync+0xf0/0xf0 [ 66.703974] ? lockdep_hardirqs_on_prepare+0x17b/0x410 [ 66.703974] ? queue_work_on+0x61/0x80 [ 66.703974] ? lockdep_hardirqs_on+0xbf/0x130 [ 66.703974] process_one_work+0x8bb/0x1510 [ 66.703974] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 66.703974] ? pwq_dec_nr_in_flight+0x230/0x230 [ 66.703974] ? rwlock_bug.part.0+0x90/0x90 [ 66.703974] ? _raw_spin_lock_irq+0x41/0x50 [ 66.703974] worker_thread+0x575/0x1190 [ 66.703974] ? process_one_work+0x1510/0x1510 [ 66.703974] kthread+0x2a0/0x340 [ 66.703974] ? kthread_complete_and_exit+0x20/0x20 [ 66.703974] ret_from_fork+0x22/0x30 [ 66.703974] </TASK> [ 66.703974] [ 66
03974] ? kthread_complete_and_exit+0x20/0x20 [ 66.703974] ret_from_fork+0x22/0x30 [ 66.703974] </TASK> [ 66.703974] [ 66.703974] Allocated by task 267: [ 66.703974] kasan_save_stack+0x1e/0x40 [ 66.703974] __kasan_kmalloc+0x81/0xa0 [ 66.703974] nci_allocate_device+0xd3/0x390 [ 66.703974] nfcmrvl_nci_register_dev+0x183/0x2c0 [ 66.703974] nfcmrvl_nci_uart_open+0xf2/0x1dd [ 66.703974] nci_uart_tty_ioctl+0x2c3/0x4a0 [ 66.703974] tty_ioctl+0x764/0x1310 [ 66.703974] __x64_sys_ioctl+0x122/0x190 [ 66.703974] do_syscall_64+0x3b/0x90 [ 66.703974] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 66.703974] [ 66.703974] Freed by task 406: [ 66.703974] kasan_save_stack+0x1e/0x40 [ 66.703974] kasan_set_track+0x2
ae [ 66.703974] [ 66.703974] Freed by task 406: [ 66.703974] kasan_save_stack+0x1e/0x40 [ 66.703974] kasan_set_track+0x21/0x30 [ 66.703974] kasan_set_free_info+0x20/0x30 [ 66.703974] __kasan_slab_free+0x108/0x170 [ 66.703974] kfree+0xb0/0x330 [ 66.703974] nfcmrvl_nci_unregister_dev+0x90/0xd0 [ 66.703974] nci_uart_tty_close+0xdf/0x180 [ 66.703974] tty_ldisc_kill+0x73/0x110 [ 66.703974] tty_ldisc_hangup+0x281/0x5b0 [ 66.703974] __tty_hangup.part.0+0x431/0x890 [ 66.703974] tty_release+0x3a8/0xc80 [ 66.703974] __fput+0x1f0/0x8c0 [ 66.703974] task_work_run+0xc9/0x170 [ 66.703974] exit_to_user_mode_prepare+0x194/0x1a0 [ 66.703974] syscall_exit_to_user_mode+0x19/0x50 [ 66.703974] do_syscall_64+0x48
] exit_to_user_mode_prepare+0x194/0x1a0 [ 66.703974] syscall_exit_to_user_mode+0x19/0x50 [ 66.703974] do_syscall_64+0x48/0x90 [ 66.703974] entry_SYSCALL_64_after_hwframe+0x44/0x ---truncated--- Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/7d3232214ca4ea8f7d18df264c3b254aa8089d7f - https://git.kernel.org/stable/c/9d243aff5f7e6b04e907c617426bbdf26e996ac8 - https://git.kernel.org/stable/c/1a1748d0dd0f0a98535c6baeef671c8722107639 - https://git.kernel.org/stable/c/5c63ad2b0a267a524c12c88acb1ba9c2d109a801 - https://git.kernel.org/stable/c/67677050cecbe0edfdd81cd508415e9636ba7c65 - https://git.kernel.org/stable/c/9ded5ae40f4fe37fcc28f36d76bf45df20
g/stable/c/67677050cecbe0edfdd81cd508415e9636ba7c65 - https://git.kernel.org/stable/c/9ded5ae40f4fe37fcc28f36d76bf45df20be5432 - https://git.kernel.org/stable/c/edd4600120641e1714e30112e69a548cfb68e067 - https://git.kernel.org/stable/c/ef27324e2cb7bb24542d6cb2571740eefe6b00dc
CVE ID: CVE-2022-49060 State: PUBLISHED Published: 2025-02-26T01:54:30.482Z Last Updated: 2025-10-01T19:57:06.571Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net/smc: Fix NULL pointer dereference in smc_pnet_find_ib() dev_name() was called with dev.parent as argument but without to NULL-check it before. Solve this by checking the pointer before the call to dev_name(). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/a05f5e26cb8bb4d07e0595545fcad1bb406f0085 - https://git.kernel.org/stable/c/35b91e49bc80ca944a8679c3b139ddaf2f8eea0f - https://git.kernel.org/stable/c/3a523807f0145
https://git.kernel.org/stable/c/35b91e49bc80ca944a8679c3b139ddaf2f8eea0f - https://git.kernel.org/stable/c/3a523807f01455fe9a0c1a433f27cd4411ee400f - https://git.kernel.org/stable/c/22025513ced3d599ee8b24169141c95cf2467a4a - https://git.kernel.org/stable/c/d22f4f977236f97e01255a80bca2ea93a8094fc8
CVE ID: CVE-2022-49061 State: PUBLISHED Published: 2025-02-26T01:54:31.142Z Last Updated: 2025-10-01T19:57:06.427Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: ethernet: stmmac: fix altr_tse_pcs function when using a fixed-link When using a fixed-link, the altr_tse_pcs driver crashes due to null-pointer dereference as no phy_device is provided to tse_pcs_fix_mac_speed function. Fix this by adding a check for phy_dev before calling the tse_pcs_fix_mac_speed() function. Also clean up the tse_pcs_fix_mac_speed function a bit. There is no need to check for splitter_base and sgmii_adapter_base because the driver will fail if
peed function a bit. There is no need to check for splitter_base and sgmii_adapter_base because the driver will fail if these 2 variables are not derived from the device tree. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/7e59fdf9547c4f948d1d917ec7ffa5fb5ac53bdb - https://git.kernel.org/stable/c/08d5e3e954537931c8da7428034808d202e98299 - https://git.kernel.org/stable/c/62a48383ebe2e159fd68425dd3e16d4c6bd6599a - https://git.kernel.org/stable/c/6c020f05253df04c3480b586fe188a3582740049 - https://git.kernel.org/stable/c/a6aaa00324240967272b451bfa772547bd576ee6
CVE ID: CVE-2022-49062 State: PUBLISHED Published: 2025-02-26T01:54:31.788Z Last Updated: 2025-10-01T19:57:06.281Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: cachefiles: Fix KASAN slab-out-of-bounds in cachefiles_set_volume_xattr Use the actual length of volume coherency data when setting the xattr to avoid the following KASAN report. BUG: KASAN: slab-out-of-bounds in cachefiles_set_volume_xattr+0xa0/0x350 [cachefiles] Write of size 4 at addr ffff888101e02af4 by task kworker/6:0/1347 CPU: 6 PID: 1347 Comm: kworker/6:0 Kdump: loaded Not tainted 5.18.0-rc1-nfs-fscache-netfs+ #13 Hardware name: QEMU Standard PC (Q35 + ICH9, 20
kworker/6:0 Kdump: loaded Not tainted 5.18.0-rc1-nfs-fscache-netfs+ #13 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-4.fc34 04/01/2014 Workqueue: events fscache_create_volume_work [fscache] Call Trace: <TASK> dump_stack_lvl+0x45/0x5a print_report.cold+0x5e/0x5db ? __lock_text_start+0x8/0x8 ? cachefiles_set_volume_xattr+0xa0/0x350 [cachefiles] kasan_report+0xab/0x120 ? cachefiles_set_volume_xattr+0xa0/0x350 [cachefiles] kasan_check_range+0xf5/0x1d0 memcpy+0x39/0x60 cachefiles_set_volume_xattr+0xa0/0x350 [cachefiles] cachefiles_acquire_volume+0x2be/0x500 [cachefiles] ? __cachefiles_free_volume+0x90/0x90 [cachefiles] fscache_create_volume_work+0x68/0x160 [fscache] process_on
cachefiles] ? __cachefiles_free_volume+0x90/0x90 [cachefiles] fscache_create_volume_work+0x68/0x160 [fscache] process_one_work+0x3b7/0x6a0 worker_thread+0x2c4/0x650 ? process_one_work+0x6a0/0x6a0 kthread+0x16c/0x1a0 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x22/0x30 </TASK> Allocated by task 1347: kasan_save_stack+0x1e/0x40 __kasan_kmalloc+0x81/0xa0 cachefiles_set_volume_xattr+0x76/0x350 [cachefiles] cachefiles_acquire_volume+0x2be/0x500 [cachefiles] fscache_create_volume_work+0x68/0x160 [fscache] process_one_work+0x3b7/0x6a0 worker_thread+0x2c4/0x650 kthread+0x16c/0x1a0 ret_from_fork+0x22/0x30 The buggy address belongs to the object at ffff888101e02af0 which belongs to the cache
6c/0x1a0 ret_from_fork+0x22/0x30 The buggy address belongs to the object at ffff888101e02af0 which belongs to the cache kmalloc-8 of size 8 The buggy address is located 4 bytes inside of 8-byte region [ffff888101e02af0, ffff888101e02af8) The buggy address belongs to the physical page: page:00000000a2292d70 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101e02 flags: 0x17ffffc0000200(slab|node=0|zone=2|lastcpupid=0x1fffff) raw: 0017ffffc0000200 0000000000000000 dead000000000001 ffff888100042280 raw: 0000000000000000 0000000080660066 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888101e02980: fc 00 f
0000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888101e02980: fc 00 fc fc fc fc 00 fc fc fc fc 00 fc fc fc fc ffff888101e02a00: 00 fc fc fc fc 00 fc fc fc fc 00 fc fc fc fc 00 >ffff888101e02a80: fc fc fc fc 00 fc fc fc fc 00 fc fc fc fc 04 fc ^ ffff888101e02b00: fc fc fc 00 fc fc fc fc 00 fc fc fc fc 00 fc fc ffff888101e02b80: fc fc 00 fc fc fc fc 00 fc fc fc fc 00 fc fc fc ================================================================== Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/09a5df1b88c8f126c8ff9938edf160edd4e92f42 - https://git.kernel.org/stable/c/7b2f6c306601240635c72caa61f682e74
rg/stable/c/09a5df1b88c8f126c8ff9938edf160edd4e92f42 - https://git.kernel.org/stable/c/7b2f6c306601240635c72caa61f682e74d4591b2
CVE ID: CVE-2022-49063 State: PUBLISHED Published: 2025-02-26T01:54:32.460Z Last Updated: 2025-11-03T17:31:01.995Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ice: arfs: fix use-after-free when freeing @rx_cpu_rmap The CI testing bots triggered the following splat: [ 718.203054] BUG: KASAN: use-after-free in free_irq_cpu_rmap+0x53/0x80 [ 718.206349] Read of size 4 at addr ffff8881bd127e00 by task sh/20834 [ 718.212852] CPU: 28 PID: 20834 Comm: sh Kdump: loaded Tainted: G S W IOE 5.17.0-rc8_nextqueue-devqueue-02643-g23f3121aca93 #1 [ 718.219695] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0012.0
e-02643-g23f3121aca93 #1 [ 718.219695] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0012.070720200218 07/07/2020 [ 718.223418] Call Trace: [ 718.227139] [ 718.230783] dump_stack_lvl+0x33/0x42 [ 718.234431] print_address_description.constprop.9+0x21/0x170 [ 718.238177] ? free_irq_cpu_rmap+0x53/0x80 [ 718.241885] ? free_irq_cpu_rmap+0x53/0x80 [ 718.245539] kasan_report.cold.18+0x7f/0x11b [ 718.249197] ? free_irq_cpu_rmap+0x53/0x80 [ 718.252852] free_irq_cpu_rmap+0x53/0x80 [ 718.256471] ice_free_cpu_rx_rmap.part.11+0x37/0x50 [ice] [ 718.260174] ice_remove_arfs+0x5f/0x70 [ice] [ 718.263810] ice_rebuild_arfs+0x3b/0x70 [ice] [ 718.267419] ice_rebuild+0x39c/0xb60 [ice]
e_remove_arfs+0x5f/0x70 [ice] [ 718.263810] ice_rebuild_arfs+0x3b/0x70 [ice] [ 718.267419] ice_rebuild+0x39c/0xb60 [ice] [ 718.270974] ? asm_sysvec_apic_timer_interrupt+0x12/0x20 [ 718.274472] ? ice_init_phy_user_cfg+0x360/0x360 [ice] [ 718.278033] ? delay_tsc+0x4a/0xb0 [ 718.281513] ? preempt_count_sub+0x14/0xc0 [ 718.284984] ? delay_tsc+0x8f/0xb0 [ 718.288463] ice_do_reset+0x92/0xf0 [ice] [ 718.292014] ice_pci_err_resume+0x91/0xf0 [ice] [ 718.295561] pci_reset_function+0x53/0x80 <...> [ 718.393035] Allocated by task 690: [ 718.433497] Freed by task 20834: [ 718.495688] Last potentially related work creation: [ 718.568966] The buggy address belongs to the object at ffff8881bd127e00 which be
st potentially related work creation: [ 718.568966] The buggy address belongs to the object at ffff8881bd127e00 which belongs to the cache kmalloc-96 of size 96 [ 718.574085] The buggy address is located 0 bytes inside of 96-byte region [ffff8881bd127e00, ffff8881bd127e60) [ 718.579265] The buggy address belongs to the page: [ 718.598905] Memory state around the buggy address: [ 718.601809] ffff8881bd127d00: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 718.604796] ffff8881bd127d80: 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc [ 718.607794] >ffff8881bd127e00: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 718.610811] ^ [ 718.613819] ffff8881bd127e80: 00 00 00 00 00 00 00 00 00 00 0
b fb fb fb fb fb fb fb fb fb fc fc fc fc [ 718.610811] ^ [ 718.613819] ffff8881bd127e80: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 718.617107] ffff8881bd127f00: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc This is due to that free_irq_cpu_rmap() is always being called *after* (devm_)free_irq() and thus it tries to work with IRQ descs already freed. For example, on device reset the driver frees the rmap right before allocating a new one (the splat above). Make rmap creation and freeing function symmetrical with {request,free}_irq() calls i.e. do that on ifup/ifdown instead of device probe/remove/resume. These operations can be performed independently from the actual device aRFS con
n instead of device probe/remove/resume. These operations can be performed independently from the actual device aRFS configuration. Also, make sure ice_vsi_free_irq() clears IRQ affinity notifiers only when aRFS is disabled -- otherwise, CPU rmap sets and clears its own and they must not be touched manually. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/ba2f6ec28733fb6b24ed086e676df3df4c138f3f - https://git.kernel.org/stable/c/618df75f2e30c7838a3e010ca32cd4893ec9fe33 - https://git.kernel.org/stable/c/d08d2fb6d99d82da1c63aba5c0d1c6f237e150f3 - https://git.kernel.org/stable/c/d7442f512b71fc63a99c8a801422dde4fbbf9f93
CVE ID: CVE-2022-49064 State: PUBLISHED Published: 2025-02-26T01:54:33.164Z Last Updated: 2025-05-04T08:28:57.648Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: cachefiles: unmark inode in use in error path Unmark inode in use if error encountered. If the in-use flag leakage occurs in cachefiles_open_file(), Cachefiles will complain "Inode already in use" when later another cookie with the same index key is looked up. If the in-use flag leakage occurs in cachefiles_create_tmpfile(), though the "Inode already in use" warning won't be triggered, fix the leakage anyway. References: - https://git.kernel.org/stable/c/b2055abafd3d4e
in use" warning won't be triggered, fix the leakage anyway. References: - https://git.kernel.org/stable/c/b2055abafd3d4ee0376fb3eed5cae866316995a1 - https://git.kernel.org/stable/c/ea5dc046127e857a7873ae55fd57c866e9e86fb2
CVE ID: CVE-2022-49065 State: PUBLISHED Published: 2025-02-26T01:54:33.881Z Last Updated: 2025-10-01T19:57:06.151Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix the svc_deferred_event trace class Fix a NULL deref crash that occurs when an svc_rqst is deferred while the sunrpc tracing subsystem is enabled. svc_revisit() sets dr->xprt to NULL, so it can't be relied upon in the tracepoint to provide the remote's address. Unfortunately we can't revert the "svc_deferred_class" hunk in commit ece200ddd54b ("sunrpc: Save remote presentation address in svc_xprt for trace events") because there is now a specific check of ev
4b ("sunrpc: Save remote presentation address in svc_xprt for trace events") because there is now a specific check of event format specifiers for unsafe dereferences. The warning that check emits is: event svc_defer_recv has unsafe dereference of argument 1 A "%pISpc" format specifier with a "struct sockaddr *" is indeed flagged by this check. Instead, take the brute-force approach used by the svcrdma_qp_error tracepoint. Convert the dr::addr field into a presentation address in the TP_fast_assign() arm of the trace event, and store that as a string. This fix can be backported to -stable kernels. In the meantime, commit c6ced22997ad ("tracing: Update print fmt check to handle new __get_socka