Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
17fe30ea38f0f3c916e2ae2b7f8cef84e - https://git.kernel.org/stable/c/8cbc3870ff356366842af3228dd8e7bc278e5edd - https://git.kernel.org/stable/c/585d22a5624ef2b540c337665c72fea8cd33db50 - https://git.kernel.org/stable/c/c0a4b454486b23bb4d94ce49f490830ecc354040 - https://git.kernel.org/stable/c/8e51a512c1079109bec4c80915e647692d583e79 - https://git.kernel.org/stable/c/3a50c917c67dd0bc39c14de4a8b75a1d50fdce66 - https://git.kernel.org/stable/c/b5c5b13cb45e2c88181308186b0001992cb41954
CVE ID: CVE-2022-50154 State: PUBLISHED Published: 2025-06-18T11:03:12.492Z Last Updated: 2025-06-18T11:03:12.492Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: PCI: mediatek-gen3: Fix refcount leak in mtk_pcie_init_irq_domains() of_get_child_by_name() returns a node pointer with refcount incremented, so we should use of_node_put() on it when we don't need it anymore. Add missing of_node_put() to avoid refcount leak. References: - https://git.kernel.org/stable/c/0675fe20da7fa69b1ba80c23470c1433a2356c03 - https://git.kernel.org/stable/c/2aa166c39d5a8221e6e22ab1a583656d4c8dc7f7 - https://git.kernel.org/stable/c/e593e22786edd9eca
s://git.kernel.org/stable/c/2aa166c39d5a8221e6e22ab1a583656d4c8dc7f7 - https://git.kernel.org/stable/c/e593e22786edd9eca058cf054d6a2e12c138da67 - https://git.kernel.org/stable/c/bf038503d5fe90189743124233fe7aeb0984e961
CVE ID: CVE-2022-50155 State: PUBLISHED Published: 2025-06-18T11:03:13.268Z Last Updated: 2025-06-18T11:03:13.268Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mtd: parsers: ofpart: Fix refcount leak in bcm4908_partitions_fw_offset of_find_node_by_path() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak. References: - https://git.kernel.org/stable/c/762475464982b15014f364ec0cf2a843407f5af1 - https://git.kernel.org/stable/c/3193c3a3f4fca65cb06d9d48d07fb96bc1f5b2bd - https://git.kernel.org/stable/c/01bc3840d943cf725dea6ca13
kernel.org/stable/c/3193c3a3f4fca65cb06d9d48d07fb96bc1f5b2bd - https://git.kernel.org/stable/c/01bc3840d943cf725dea6ca13e11ffda82bad49a - https://git.kernel.org/stable/c/e607879b0da18c451de5e91daf239cc2f2f8ff2d
CVE ID: CVE-2022-50156 State: PUBLISHED Published: 2025-06-18T11:03:13.913Z Last Updated: 2025-06-18T11:03:13.913Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: HID: cp2112: prevent a buffer overflow in cp2112_xfer() Smatch warnings: drivers/hid/hid-cp2112.c:793 cp2112_xfer() error: __memcpy() 'data->block[1]' too small (33 vs 255) drivers/hid/hid-cp2112.c:793 cp2112_xfer() error: __memcpy() 'buf' too small (64 vs 255) The 'read_length' variable is provided by 'data->block[0]' which comes from user and it(read_length) can take a value between 0-255. Add an upper bound to 'read_length' variable to prevent a buffer overflow in m
d_length) can take a value between 0-255. Add an upper bound to 'read_length' variable to prevent a buffer overflow in memcpy(). References: - https://git.kernel.org/stable/c/3af7d60e9a6c17d6d41c4341f8020511887d372d - https://git.kernel.org/stable/c/519ff31a6ddd87aa4905bd9bf3b92e8b88801614 - https://git.kernel.org/stable/c/ebda3d6b004bb6127a66a616524a2de152302ca7 - https://git.kernel.org/stable/c/8489a20ac481b08c0391608d81ed3796d373cfdf - https://git.kernel.org/stable/c/e7028944e61014ae915e7fb74963d3835f2f761a - https://git.kernel.org/stable/c/26e427ac85c2b8d0d108cc80b6de34d33e2780c4 - https://git.kernel.org/stable/c/381583845d19cb4bd21c8193449385f3fefa9caf
CVE ID: CVE-2022-50157 State: PUBLISHED Published: 2025-06-18T11:03:14.530Z Last Updated: 2025-06-18T11:03:14.530Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: PCI: microchip: Fix refcount leak in mc_pcie_init_irq_domains() of_get_next_child() returns a node pointer with refcount incremented, so we should use of_node_put() on it when we don't need it anymore. mc_pcie_init_irq_domains() only calls of_node_put() in the normal path, missing it in some error paths. Add missing of_node_put() to avoid refcount leak. References: - https://git.kernel.org/stable/c/c0ad5c7e68d10f6f8ffb0f4329e3c19404fbca58 - https://git.kernel.org/stabl
k. References: - https://git.kernel.org/stable/c/c0ad5c7e68d10f6f8ffb0f4329e3c19404fbca58 - https://git.kernel.org/stable/c/6cd5f93b5c6a66c68a91dbc604a78207252ecd43 - https://git.kernel.org/stable/c/880ece912b958a0c92cc0baa8e906fb9b49a4b53 - https://git.kernel.org/stable/c/f030304fdeb87ec8f1b518c73703214aec6cc24a
CVE ID: CVE-2022-50158 State: PUBLISHED Published: 2025-06-18T11:03:15.177Z Last Updated: 2025-06-18T11:03:15.177Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mtd: partitions: Fix refcount leak in parse_redboot_of of_get_child_by_name() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak. References: - https://git.kernel.org/stable/c/f3cc27198c5d78cdda60a55ae749f815cd1fe5eb - https://git.kernel.org/stable/c/55d0f7da66dec93c4d53d0886a1555618079a900 - https://git.kernel.org/stable/c/8ea607579d300b2f7fc997f3dd20949114565fcd -
/c/55d0f7da66dec93c4d53d0886a1555618079a900 - https://git.kernel.org/stable/c/8ea607579d300b2f7fc997f3dd20949114565fcd - https://git.kernel.org/stable/c/7ec48ac18d8f9e002ce9bfbad32741086739e499 - https://git.kernel.org/stable/c/e24af43d0cbe9f6aaa413c15ccce50bbbfd61e0e - https://git.kernel.org/stable/c/9f7e62815cf3cbbcb1b8cb21649fb4dfdb3aa016
CVE ID: CVE-2022-50159 State: PUBLISHED Published: 2025-06-18T11:03:15.826Z Last Updated: 2025-06-18T11:03:15.826Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: of: check previous kernel's ima-kexec-buffer against memory bounds Presently ima_get_kexec_buffer() doesn't check if the previous kernel's ima-kexec-buffer lies outside the addressable memory range. This can result in a kernel panic if the new kernel is booted with 'mem=X' arg and the ima-kexec-buffer was allocated beyond that range by the previous kernel. The panic is usually of the form below: $ sudo kexec --initrd initrd vmlinux --append='mem=16G' <snip> BUG: Unable
rnel. The panic is usually of the form below: $ sudo kexec --initrd initrd vmlinux --append='mem=16G' <snip> BUG: Unable to handle kernel data access on read at 0xc000c01fff7f0000 Faulting instruction address: 0xc000000000837974 Oops: Kernel access of bad area, sig: 11 [#1] <snip> NIP [c000000000837974] ima_restore_measurement_list+0x94/0x6c0 LR [c00000000083b55c] ima_load_kexec_buffer+0xac/0x160 Call Trace: [c00000000371fa80] [c00000000083b55c] ima_load_kexec_buffer+0xac/0x160 [c00000000371fb00] [c0000000020512c4] ima_init+0x80/0x108 [c00000000371fb70] [c0000000020514dc] init_ima+0x4c/0x120 [c00000000371fbf0] [c000000000012240] do_one_initcall+0x60/0x2c0 [c00000000371fcc0] [c000000002004ad0
nit_ima+0x4c/0x120 [c00000000371fbf0] [c000000000012240] do_one_initcall+0x60/0x2c0 [c00000000371fcc0] [c000000002004ad0] kernel_init_freeable+0x344/0x3ec [c00000000371fda0] [c0000000000128a4] kernel_init+0x34/0x1b0 [c00000000371fe10] [c00000000000ce64] ret_from_kernel_thread+0x5c/0x64 Instruction dump: f92100b8 f92100c0 90e10090 910100a0 4182050c 282a0017 3bc00000 40810330 7c0802a6 fb610198 7c9b2378 f80101d0 <a1240000> 2c090001 40820614 e9240010 ---[ end trace 0000000000000000 ]--- Fix this issue by checking returned PFN range of previous kernel's ima-kexec-buffer with page_is_ram() to ensure correct memory bounds. References: - https://git.kernel.org/stable/c/beb5bba5dd132650c073f815c685c6
e_is_ram() to ensure correct memory bounds. References: - https://git.kernel.org/stable/c/beb5bba5dd132650c073f815c685c60c3e5b783b - https://git.kernel.org/stable/c/dc3b8525f83ac6bbc885bb24bbb8a76f4622200e - https://git.kernel.org/stable/c/1b2263d6c86fca8f30e18231778393bfc287bb27 - https://git.kernel.org/stable/c/cbf9c4b9617b6767886a913705ca14b7600c77db
CVE ID: CVE-2022-50160 State: PUBLISHED Published: 2025-06-18T11:03:16.447Z Last Updated: 2025-06-18T11:03:16.447Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mtd: maps: Fix refcount leak in ap_flash_init of_find_matching_node() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak. References: - https://git.kernel.org/stable/c/995fb2874bb5696357846a91e59181c600e6aac8 - https://git.kernel.org/stable/c/d10855876a6f47add6ff621cef25cc0171dac162 - https://git.kernel.org/stable/c/80b1465b2ae81ebb59bbe62bcb7a7f7d4e9ece6f - https:/
5876a6f47add6ff621cef25cc0171dac162 - https://git.kernel.org/stable/c/80b1465b2ae81ebb59bbe62bcb7a7f7d4e9ece6f - https://git.kernel.org/stable/c/941ef6997f9db704fe4fd62fc01e420fdd5048b2 - https://git.kernel.org/stable/c/d5730780e9ea84e5476752a47c749036c6a74af5 - https://git.kernel.org/stable/c/a74322d4b897ddc268b340c4a397f6066c2f945d - https://git.kernel.org/stable/c/babd7b0124650ab71a6487e38588b8659b3aa2dc - https://git.kernel.org/stable/c/77087a04c8fd554134bddcb8a9ff87b21f357926
CVE ID: CVE-2022-50161 State: PUBLISHED Published: 2025-06-18T11:03:17.091Z Last Updated: 2025-06-18T11:03:17.091Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mtd: maps: Fix refcount leak in of_flash_probe_versatile of_find_matching_node_and_match() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak. References: - https://git.kernel.org/stable/c/3c8de6a838b7e0eb392754ac89dd66e698684342 - https://git.kernel.org/stable/c/79e57889aa0d92a6d769bad808fb105e7b6ea495 - https://git.kernel.org/stable/c/9124d51e01232a91da4034768a2a8
el.org/stable/c/79e57889aa0d92a6d769bad808fb105e7b6ea495 - https://git.kernel.org/stable/c/9124d51e01232a91da4034768a2a8d1688472179 - https://git.kernel.org/stable/c/52ae2b14f76ef2d490337ddc0037bc37125be7b8 - https://git.kernel.org/stable/c/4d67c8f74d804b20febf716ec96e9a475457ec60 - https://git.kernel.org/stable/c/5d5ddd8771fa9cabeb247fba5f6ab60d63f3fbce - https://git.kernel.org/stable/c/f516fbb63873ee23cba5b7c3d239677c30f13df8 - https://git.kernel.org/stable/c/33ec82a6d2b119938f26e5c8040ed5d92378eb54
CVE ID: CVE-2022-50162 State: PUBLISHED Published: 2025-06-18T11:03:17.717Z Last Updated: 2025-06-18T11:03:17.717Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: Fix possible refcount leak in if_usb_probe() usb_get_dev will be called before lbs_get_firmware_async which means that usb_put_dev need to be called when lbs_get_firmware_async fails. References: - https://git.kernel.org/stable/c/61b2ec97487399c58ae2e34f250f4884e671799b - https://git.kernel.org/stable/c/4c8e2f9ce1428e44cb103035eeced7aeb6b80980 - https://git.kernel.org/stable/c/878e7f39803a9ab5bb9766956a7a04351d4bf99d - https://git.kernel.org/stable/c/97
b6b80980 - https://git.kernel.org/stable/c/878e7f39803a9ab5bb9766956a7a04351d4bf99d - https://git.kernel.org/stable/c/97e5d3e46a3a2100253a9717a4df98d68aeb10b8 - https://git.kernel.org/stable/c/d7365590d15bbd9008f424ef043d1778ffe29f42 - https://git.kernel.org/stable/c/00d0c4e59c0f8ad1f86874bb64b220394e687028 - https://git.kernel.org/stable/c/5b92f406a5199b6b01dc664b9226d824ae2835f0 - https://git.kernel.org/stable/c/6fd57e1d120bf13d4dc6c200a7cf914e6347a316
CVE ID: CVE-2022-50163 State: PUBLISHED Published: 2025-06-18T11:03:18.317Z Last Updated: 2025-06-18T11:03:18.317Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ax25: fix incorrect dev_tracker usage While investigating a separate rose issue [1], and enabling CONFIG_NET_DEV_REFCNT_TRACKER=y, Bernard reported an orthogonal ax25 issue [2] An ax25_dev can be used by one (or many) struct ax25_cb. We thus need different dev_tracker, one per struct ax25_cb. After this patch is applied, we are able to focus on rose. [1] https://lore.kernel.org/netdev/fb7544a1-f42e-9254-18cc-c9b071f4ca70@free.fr/ [2] [ 205.798723] reference already rel
[1] https://lore.kernel.org/netdev/fb7544a1-f42e-9254-18cc-c9b071f4ca70@free.fr/ [2] [ 205.798723] reference already released. [ 205.798732] allocated in: [ 205.798734] ax25_bind+0x1a2/0x230 [ax25] [ 205.798747] __sys_bind+0xea/0x110 [ 205.798753] __x64_sys_bind+0x18/0x20 [ 205.798758] do_syscall_64+0x5c/0x80 [ 205.798763] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 205.798768] freed in: [ 205.798770] ax25_release+0x115/0x370 [ax25] [ 205.798778] __sock_release+0x42/0xb0 [ 205.798782] sock_close+0x15/0x20 [ 205.798785] __fput+0x9f/0x260 [ 205.798789] ____fput+0xe/0x10 [ 205.798792] task_work_run+0x64/0xa0 [ 205.798798] exit_to_user_mode_prepare+0x18b/0x190 [ 205.798804] syscall_exit_to_user_m
798792] task_work_run+0x64/0xa0 [ 205.798798] exit_to_user_mode_prepare+0x18b/0x190 [ 205.798804] syscall_exit_to_user_mode+0x26/0x40 [ 205.798808] do_syscall_64+0x69/0x80 [ 205.798812] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 205.798827] ------------[ cut here ]------------ [ 205.798829] WARNING: CPU: 2 PID: 2605 at lib/ref_tracker.c:136 ref_tracker_free.cold+0x60/0x81 [ 205.798837] Modules linked in: rose netrom mkiss ax25 rfcomm cmac algif_hash algif_skcipher af_alg bnep snd_hda_codec_hdmi nls_iso8859_1 i915 rtw88_8821ce rtw88_8821c x86_pkg_temp_thermal rtw88_pci intel_powerclamp rtw88_core snd_hda_codec_realtek snd_hda_codec_generic ledtrig_audio coretemp snd_hda_intel kvm_intel snd_in
_powerclamp rtw88_core snd_hda_codec_realtek snd_hda_codec_generic ledtrig_audio coretemp snd_hda_intel kvm_intel snd_intel_dspcfg mac80211 snd_hda_codec kvm i2c_algo_bit drm_buddy drm_dp_helper btusb drm_kms_helper snd_hwdep btrtl snd_hda_core btbcm joydev crct10dif_pclmul btintel crc32_pclmul ghash_clmulni_intel mei_hdcp btmtk intel_rapl_msr aesni_intel bluetooth input_leds snd_pcm crypto_simd syscopyarea processor_thermal_device_pci_legacy sysfillrect cryptd intel_soc_dts_iosf snd_seq sysimgblt ecdh_generic fb_sys_fops rapl libarc4 processor_thermal_device intel_cstate processor_thermal_rfim cec snd_timer ecc snd_seq_device cfg80211 processor_thermal_mbox mei_me processor_thermal_rapl mei
rocessor_thermal_rfim cec snd_timer ecc snd_seq_device cfg80211 processor_thermal_mbox mei_me processor_thermal_rapl mei rc_core at24 snd intel_pch_thermal intel_rapl_common ttm soundcore int340x_thermal_zone video [ 205.798948] mac_hid acpi_pad sch_fq_codel ipmi_devintf ipmi_msghandler drm msr parport_pc ppdev lp parport ramoops pstore_blk reed_solomon pstore_zone efi_pstore ip_tables x_tables autofs4 hid_generic usbhid hid i2c_i801 i2c_smbus r8169 xhci_pci ahci libahci realtek lpc_ich xhci_pci_renesas [last unloaded: ax25] [ 205.798992] CPU: 2 PID: 2605 Comm: ax25ipd Not tainted 5.18.11-F6BVP #3 [ 205.798996] Hardware name: To be filled by O.E.M. To be filled by O.E.M./CK3, BIOS 5.011 09/1
tainted 5.18.11-F6BVP #3 [ 205.798996] Hardware name: To be filled by O.E.M. To be filled by O.E.M./CK3, BIOS 5.011 09/16/2020 [ 205.798999] RIP: 0010:ref_tracker_free.cold+0x60/0x81 [ 205.799005] Code: e8 d2 01 9b ff 83 7b 18 00 74 14 48 c7 c7 2f d7 ff 98 e8 10 6e fc ff 8b 7b 18 e8 b8 01 9b ff 4c 89 ee 4c 89 e7 e8 5d fd 07 00 <0f> 0b b8 ea ff ff ff e9 30 05 9b ff 41 0f b6 f7 48 c7 c7 a0 fa 4e [ 205.799008] RSP: 0018:ffffaf5281073958 EFLAGS: 00010286 [ 205.799011] RAX: 0000000080000000 RBX: ffff9a0bd687ebe0 RCX: 0000000000000000 [ 205.799014] RDX: 0000000000000001 RSI: 0000000000000282 RDI: 00000000ffffffff [ 205.799016] RBP: ffffaf5281073a10 R08: 0000000000000003 R09: fffffffffffd5618 [ 205
000000000282 RDI: 00000000ffffffff [ 205.799016] RBP: ffffaf5281073a10 R08: 0000000000000003 R09: fffffffffffd5618 [ 205.799019] R10: 0000000000ffff10 R11: 000000000000000f R12: ffff9a0bc53384d0 [ 205.799022] R13: 0000000000000282 R14: 00000000ae000001 R15: 0000000000000001 [ 205.799024] FS: 0000000000000000(0000) GS:ffff9a0d0f300000(0000) knlGS:0000000000000000 [ 205.799028] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 205.799031] CR2: 00007ff6b8311554 CR3: 000000001ac10004 CR4: 00000000001706e0 [ 205.799033] Call Trace: [ 205.799035] <TASK> [ 205.799038] ? ax25_dev_device_down+0xd9/ ---truncated--- References: - https://git.kernel.org/stable/c/d08e3d71e5942f77fbff7f3529ed7fc82fbb3dfa
device_down+0xd9/ ---truncated--- References: - https://git.kernel.org/stable/c/d08e3d71e5942f77fbff7f3529ed7fc82fbb3dfa - https://git.kernel.org/stable/c/4294df1374450912b2f64ee3cf575069fc784679 - https://git.kernel.org/stable/c/d7c4c9e075f8cc6d88d277bc24e5d99297f03c06
CVE ID: CVE-2022-50164 State: PUBLISHED Published: 2025-06-18T11:03:18.943Z Last Updated: 2025-06-18T11:03:18.943Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix double list_add at iwl_mvm_mac_wake_tx_queue After successfull station association, if station queues are disabled for some reason, the related lists are not emptied. So if some new element is added to the list in iwl_mvm_mac_wake_tx_queue, it can match with the old one and produce a BUG like this: [ 46.535263] list_add corruption. prev->next should be next (ffff94c1c318a360), but was 0000000000000000. (prev=ffff94c1d02d3388). [ 46.535283] -----
ion. prev->next should be next (ffff94c1c318a360), but was 0000000000000000. (prev=ffff94c1d02d3388). [ 46.535283] ------------[ cut here ]------------ [ 46.535284] kernel BUG at lib/list_debug.c:26! [ 46.535290] invalid opcode: 0000 [#1] PREEMPT SMP PTI [ 46.585304] CPU: 0 PID: 623 Comm: wpa_supplicant Not tainted 5.19.0-rc3+ #1 [ 46.592380] Hardware name: Dell Inc. Inspiron 660s/0478VN , BIOS A07 08/24/2012 [ 46.600336] RIP: 0010:__list_add_valid.cold+0x3d/0x3f [ 46.605475] Code: f2 4c 89 c1 48 89 fe 48 c7 c7 c8 40 67 93 e8 20 cc fd ff 0f 0b 48 89 d1 4c 89 c6 4c 89 ca 48 c7 c7 70 40 67 93 e8 09 cc fd ff <0f> 0b 48 89 fe 48 c7 c7 00 41 67 93 e8 f8 cb fd ff 0f 0b 48 89 d1 [ 46.624469] RSP: 0
c7 c7 70 40 67 93 e8 09 cc fd ff <0f> 0b 48 89 fe 48 c7 c7 00 41 67 93 e8 f8 cb fd ff 0f 0b 48 89 d1 [ 46.624469] RSP: 0018:ffffb20800ab76d8 EFLAGS: 00010286 [ 46.629854] RAX: 0000000000000075 RBX: ffff94c1c318a0e0 RCX: 0000000000000000 [ 46.637105] RDX: 0000000000000201 RSI: ffffffff9365e100 RDI: 00000000ffffffff [ 46.644356] RBP: ffff94c1c5f43370 R08: 0000000000000075 R09: 3064316334396666 [ 46.651607] R10: 3364323064316334 R11: 39666666663d7665 R12: ffff94c1c5f43388 [ 46.658857] R13: ffff94c1d02d3388 R14: ffff94c1c318a360 R15: ffff94c1cf2289c0 [ 46.666108] FS: 00007f65634ff7c0(0000) GS:ffff94c1da200000(0000) knlGS:0000000000000000 [ 46.674331] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050
4ff7c0(0000) GS:ffff94c1da200000(0000) knlGS:0000000000000000 [ 46.674331] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 46.680170] CR2: 00007f7dfe984460 CR3: 000000010e894003 CR4: 00000000000606f0 [ 46.687422] Call Trace: [ 46.689906] <TASK> [ 46.691950] iwl_mvm_mac_wake_tx_queue+0xec/0x15c [iwlmvm] [ 46.697601] ieee80211_queue_skb+0x4b3/0x720 [mac80211] [ 46.702973] ? sta_info_get+0x46/0x60 [mac80211] [ 46.707703] ieee80211_tx+0xad/0x110 [mac80211] [ 46.712355] __ieee80211_tx_skb_tid_band+0x71/0x90 [mac80211] ... In order to avoid this problem, we must also remove the related lists when station queues are disabled. References: - https://git.kernel.org/stable/c/5cca5f714fe6cedd2df9d845
e related lists when station queues are disabled. References: - https://git.kernel.org/stable/c/5cca5f714fe6cedd2df9d8451ad8df21e6464f62 - https://git.kernel.org/stable/c/38d71acc15a2e72806b516380af0adb3830d4639 - https://git.kernel.org/stable/c/4a40af2b0b9517fca7ae2a030c9c0a16836303c0 - https://git.kernel.org/stable/c/ff068c25bf90d26f0aee1751553f18076b797e8d - https://git.kernel.org/stable/c/182d3c1385f44ba7c508bf5b1292a7fe96ad4e9e - https://git.kernel.org/stable/c/14a3aacf517a9de725dd3219dbbcf741e31763c4
CVE ID: CVE-2022-50165 State: PUBLISHED Published: 2025-06-18T11:03:19.539Z Last Updated: 2025-06-18T11:03:19.539Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: wil6210: debugfs: fix uninitialized variable use in `wil_write_file_wmi()` Commit 7a4836560a61 changes simple_write_to_buffer() with memdup_user() but it forgets to change the value to be returned that came from simple_write_to_buffer() call. It results in the following warning: warning: variable 'rc' is uninitialized when used here [-Wuninitialized] return rc; ^~ Remove rc variable and just return the passed in length if the memdup_user() succeeds. References: -
ized] return rc; ^~ Remove rc variable and just return the passed in length if the memdup_user() succeeds. References: - https://git.kernel.org/stable/c/b13c84e877d7a3095bacb14665db304b2c00e95f - https://git.kernel.org/stable/c/c9fde3a44da566d8929070ab6bda4f0dfa9955d0 - https://git.kernel.org/stable/c/52b11a48cf073e0aab923ae809a765d756cecf13 - https://git.kernel.org/stable/c/6c5fee83bdbeffe8d607d1ab125122a75f40bd1a - https://git.kernel.org/stable/c/689e5caf63e99e15d2f485ec297c1bf9243e0e28 - https://git.kernel.org/stable/c/d4742c886043b69d2d058bfde3998ef333b66595 - https://git.kernel.org/stable/c/409bd72e544fdf4809ea0dac337bb5a1f11a25a9 - https://git.kernel.org/stable/c/d578e0af3a003736f6c440
it.kernel.org/stable/c/409bd72e544fdf4809ea0dac337bb5a1f11a25a9 - https://git.kernel.org/stable/c/d578e0af3a003736f6c440188b156483d451b329
CVE ID: CVE-2022-50166 State: PUBLISHED Published: 2025-06-18T11:03:20.323Z Last Updated: 2025-06-18T11:03:20.323Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: When HCI work queue is drained, only queue chained work The HCI command, event, and data packet processing workqueue is drained to avoid deadlock in commit 76727c02c1e1 ("Bluetooth: Call drain_workqueue() before resetting state"). There is another delayed work, which will queue command to this drained workqueue. Which results in the following error report: Bluetooth: hci2: command 0x040f tx timeout WARNING: CPU: 1 PID: 18374 at kernel/workqueue.c:1438 __queu
ng error report: Bluetooth: hci2: command 0x040f tx timeout WARNING: CPU: 1 PID: 18374 at kernel/workqueue.c:1438 __queue_work+0xdad/0x1140 Workqueue: events hci_cmd_timeout RIP: 0010:__queue_work+0xdad/0x1140 RSP: 0000:ffffc90002cffc60 EFLAGS: 00010093 RAX: 0000000000000000 RBX: ffff8880b9d3ec00 RCX: 0000000000000000 RDX: ffff888024ba0000 RSI: ffffffff814e048d RDI: ffff8880b9d3ec08 RBP: 0000000000000008 R08: 0000000000000000 R09: 00000000b9d39700 R10: ffffffff814f73c6 R11: 0000000000000000 R12: ffff88807cce4c60 R13: 0000000000000000 R14: ffff8880796d8800 R15: ffff8880796d8800 FS: 0000000000000000(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 00000000
800 FS: 0000000000000000(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000c0174b4000 CR3: 000000007cae9000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ? queue_work_on+0xcb/0x110 ? lockdep_hardirqs_off+0x90/0xd0 queue_work_on+0xee/0x110 process_one_work+0x996/0x1610 ? pwq_dec_nr_in_flight+0x2a0/0x2a0 ? rwlock_bug.part.0+0x90/0x90 ? _raw_spin_lock_irq+0x41/0x50 worker_thread+0x665/0x1080 ? process_one_work+0x1610/0x1610 kthread+0x2e9/0x3a0 ? kthread_complete_and_exit+0x40/0x40 ret_from_fork+0x1f/0x30 <
080 ? process_one_work+0x1610/0x1610 kthread+0x2e9/0x3a0 ? kthread_complete_and_exit+0x40/0x40 ret_from_fork+0x1f/0x30 </TASK> To fix this, we can add a new HCI_DRAIN_WQ flag, and don't queue the timeout workqueue while command workqueue is draining. References: - https://git.kernel.org/stable/c/4bf367fa1fefabdf14938d0ac9ed60020389112e - https://git.kernel.org/stable/c/3b382555706558f5c0587862b6dc03e96a252bba - https://git.kernel.org/stable/c/877afadad2dce8aae1f2aad8ce47e072d4f6165e