Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
Then, when table1 is removed, the rule will not be removed as its linked to a chain in table2. When expressions in the rule are processed or removed, that will lead to a use-after-free. When looking for chains by ID, use the table that was used for the lookup by name, and only return chains belonging to that same table. References: - https://git.kernel.org/stable/c/9e7dcb88ec8e85e4a8ad0ea494ea2f90f32d2583 - https://git.kernel.org/stable/c/91501513016903077f91033fa5d2aa26cac399b2 - https://git.kernel.org/stable/c/0f49613a213d918af790c1276f79da741968de11 - https://git.kernel.org/stable/c/58e863f64ee3d0879297e5e53b646e4b91e59620 - https://git.kernel.org/stable/c/95f466d22364a33d183509629d08798
.org/stable/c/58e863f64ee3d0879297e5e53b646e4b91e59620 - https://git.kernel.org/stable/c/95f466d22364a33d183509629d0879885b4f547e
CVE ID: CVE-2022-50213 State: PUBLISHED Published: 2025-06-18T11:03:50.958Z Last Updated: 2025-06-18T11:03:50.958Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: do not allow SET_ID to refer to another table When doing lookups for sets on the same batch by using its ID, a set from a different table can be used. Then, when the table is removed, a reference to the set may be kept after the set is freed, leading to a potential use-after-free. When looking for sets by ID, use the table that was used for the lookup by name, and only return sets belonging to that same table. This fixes CVE-2022-2586, also report
as used for the lookup by name, and only return sets belonging to that same table. This fixes CVE-2022-2586, also reported as ZDI-CAN-17470. References: - https://git.kernel.org/stable/c/77d3b5038b7462318f5183e2ad704b01d57215a2 - https://git.kernel.org/stable/c/fab2f61cc3b0e441b1749f017cfee75f9bbaded7 - https://git.kernel.org/stable/c/1a4b18b1ff11ba26f9a852019d674fde9d1d1cff - https://git.kernel.org/stable/c/faafd9286f1355c76fe9ac3021c280297213330e - https://git.kernel.org/stable/c/f4fa03410f7c5f5bd8f90e9c11e9a8c4b526ff6f - https://git.kernel.org/stable/c/0d07039397527361850c554c192e749cfc879ea9 - https://git.kernel.org/stable/c/470ee20e069a6d05ae549f7d0ef2bdbcee6a81b2
CVE ID: CVE-2022-50214 State: PUBLISHED Published: 2025-06-18T11:03:51.561Z Last Updated: 2025-06-18T11:03:51.561Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: coresight: Clear the connection field properly coresight devices track their connections (output connections) and hold a reference to the fwnode. When a device goes away, we walk through the devices on the coresight bus and make sure that the references are dropped. This happens both ways: a) For all output connections from the device, drop the reference to the target device via coresight_release_platform_data() b) Iterate over all the devices on the coresight bus and
nce to the target device via coresight_release_platform_data() b) Iterate over all the devices on the coresight bus and drop the reference to fwnode if *this* device is the target of the output connection, via coresight_remove_conns()->coresight_remove_match(). However, the coresight_remove_match() doesn't clear the fwnode field, after dropping the reference, this causes use-after-free and additional refcount drops on the fwnode. e.g., if we have two devices, A and B, with a connection, A -> B. If we remove B first, B would clear the reference on B, from A via coresight_remove_match(). But when A is removed, it still has a connection with fwnode still pointing to B. Thus it tries to drops th
ove_match(). But when A is removed, it still has a connection with fwnode still pointing to B. Thus it tries to drops the reference in coresight_release_platform_data(), raising the bells like : [ 91.990153] ------------[ cut here ]------------ [ 91.990163] refcount_t: addition on 0; use-after-free. [ 91.990212] WARNING: CPU: 0 PID: 461 at lib/refcount.c:25 refcount_warn_saturate+0xa0/0x144 [ 91.990260] Modules linked in: coresight_funnel coresight_replicator coresight_etm4x(-) crct10dif_ce coresight ip_tables x_tables ipv6 [last unloaded: coresight_cpu_debug] [ 91.990398] CPU: 0 PID: 461 Comm: rmmod Tainted: G W T 5.19.0-rc2+ #53 [ 91.990418] Hardware name: ARM LTD ARM Juno Development Plat
CPU: 0 PID: 461 Comm: rmmod Tainted: G W T 5.19.0-rc2+ #53 [ 91.990418] Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno Development Platform, BIOS EDK II Feb 1 2019 [ 91.990434] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 91.990454] pc : refcount_warn_saturate+0xa0/0x144 [ 91.990476] lr : refcount_warn_saturate+0xa0/0x144 [ 91.990496] sp : ffff80000c843640 [ 91.990509] x29: ffff80000c843640 x28: ffff800009957c28 x27: ffff80000c8439a8 [ 91.990560] x26: ffff00097eff1990 x25: ffff8000092b6ad8 x24: ffff00097eff19a8 [ 91.990610] x23: ffff80000c8439a8 x22: 0000000000000000 x21: ffff80000c8439c2 [ 91.990659] x20: 0000000000000000 x19: ffff00097eff1a10 x18: ffff80
c8439a8 x22: 0000000000000000 x21: ffff80000c8439c2 [ 91.990659] x20: 0000000000000000 x19: ffff00097eff1a10 x18: ffff80000ab99c40 [ 91.990708] x17: 0000000000000000 x16: 0000000000000000 x15: ffff80000abf6fa0 [ 91.990756] x14: 000000000000001d x13: 0a2e656572662d72 x12: 657466612d657375 [ 91.990805] x11: 203b30206e6f206e x10: 6f69746964646120 x9 : ffff8000081aba28 [ 91.990854] x8 : 206e6f206e6f6974 x7 : 69646461203a745f x6 : 746e756f63666572 [ 91.990903] x5 : ffff00097648ec58 x4 : 0000000000000000 x3 : 0000000000000027 [ 91.990952] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff00080260ba00 [ 91.991000] Call trace: [ 91.991012] refcount_warn_saturate+0xa0/0x144 [ 91.991034] kobject_ge
00 x0 : ffff00080260ba00 [ 91.991000] Call trace: [ 91.991012] refcount_warn_saturate+0xa0/0x144 [ 91.991034] kobject_get+0xac/0xb0 [ 91.991055] of_node_get+0x2c/0x40 [ 91.991076] of_fwnode_get+0x40/0x60 [ 91.991094] fwnode_handle_get+0x3c/0x60 [ 91.991116] fwnode_get_nth_parent+0xf4/0x110 [ 91.991137] fwnode_full_name_string+0x48/0xc0 [ 91.991158] device_node_string+0x41c/0x530 [ 91.991178] pointer+0x320/0x3ec [ 91.991198] vsnprintf+0x23c/0x750 [ 91.991217] vprintk_store+0x104/0x4b0 [ 91.991238] vprintk_emit+0x8c/0x360 [ 91.991257] vprintk_default+0x44/0x50 [ 91.991276] vprintk+0xcc/0xf0 [ 91.991295] _printk+0x68/0x90 [ 91.991315] of_node_release+0x13c/0x14c [ 91.991334] kobject_put+0x98/0x
rintk+0xcc/0xf0 [ 91.991295] _printk+0x68/0x90 [ 91.991315] of_node_release+0x13c/0x14c [ 91.991334] kobject_put+0x98/0x114 [ 91.991354] of_node_put+0x24/0x34 [ 91.991372] of_fwnode_put+0x40/0x5c [ 91.991390] fwnode_handle_put+0x38/0x50 [ 91.991411] coresight_release_platform_data+0x74/0xb0 [coresight] [ 91.991472] coresight_unregister+0x64/0xcc [coresight] [ 91.991525] etm4_remove_dev+0x64/0x78 [coresight_etm4x] [ 91.991563] etm4_remove_amba+0x1c/0x2c [coresight_etm4x] [ 91.991598] amba_remove+0x3c/0x19c ---truncated--- References: - https://git.kernel.org/stable/c/e9205d8dd1cafb7cff689ef9ddf06276a68f54a4 - https://git.kernel.org/stable/c/847b9273dd61567fb77617eabc5fa002594db062 - https://g
dd1cafb7cff689ef9ddf06276a68f54a4 - https://git.kernel.org/stable/c/847b9273dd61567fb77617eabc5fa002594db062 - https://git.kernel.org/stable/c/b49b29ee113a87997bcca0bb0585bb46582846c1 - https://git.kernel.org/stable/c/d43e967963c4d1b2b49f894d2f1b12865f87b098 - https://git.kernel.org/stable/c/bc57850fcb7e4cb91b6321d0ce83357cefd55c54 - https://git.kernel.org/stable/c/2af89ebacf299b7fba5f3087d35e8a286ec33706
CVE ID: CVE-2022-50215 State: PUBLISHED Published: 2025-06-18T11:03:52.197Z Last Updated: 2025-06-18T11:03:52.197Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: scsi: sg: Allow waiting for commands to complete on removed device When a SCSI device is removed while in active use, currently sg will immediately return -ENODEV on any attempt to wait for active commands that were sent before the removal. This is problematic for commands that use SG_FLAG_DIRECT_IO since the data buffer may still be in use by the kernel when userspace frees or reuses it after getting ENODEV, leading to corrupted userspace memory (in the case of READ-t
nel when userspace frees or reuses it after getting ENODEV, leading to corrupted userspace memory (in the case of READ-type commands) or corrupted data being sent to the device (in the case of WRITE-type commands). This has been seen in practice when logging out of a iscsi_tcp session, where the iSCSI driver may still be processing commands after the device has been marked for removal. Change the policy to allow userspace to wait for active sg commands even when the device is being removed. Return -ENODEV only when there are no more responses to read. References: - https://git.kernel.org/stable/c/bbc118acf7baf9e93c5e1314d14f481301af4d0f - https://git.kernel.org/stable/c/f5e61d9b4a699dd16f32d
git.kernel.org/stable/c/bbc118acf7baf9e93c5e1314d14f481301af4d0f - https://git.kernel.org/stable/c/f5e61d9b4a699dd16f32d5f39eb1cf98d84c92ed - https://git.kernel.org/stable/c/ed9afd967cbfe7da2dc0d5e52c62a778dfe9f16b - https://git.kernel.org/stable/c/f135c65085eed869d10e4e7923ce1015288618da - https://git.kernel.org/stable/c/408bfa1489a3cfe7150b81ab0b0df99b23dd5411 - https://git.kernel.org/stable/c/8c004b7dbb340c1e5889f5fb9e5baa6f6e5303e8 - https://git.kernel.org/stable/c/35e60ec39e862159cb92923eefd5230d4a873cb9 - https://git.kernel.org/stable/c/03d8241112d5e3cccce1a01274a221099f07d2e1 - https://git.kernel.org/stable/c/3455607fd7be10b449f5135c00dc306b85dc0d21
CVE ID: CVE-2022-50216 State: REJECTED Published: 2025-06-18T11:03:52.798Z Last Updated: 2025-06-18T13:46:52.461Z Description: No description available.
CVE ID: CVE-2022-50217 State: PUBLISHED Published: 2025-06-18T11:03:53.451Z Last Updated: 2025-06-18T11:03:53.451Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: fuse: write inode in fuse_release() A race between write(2) and close(2) allows pages to be dirtied after fuse_flush -> write_inode_now(). If these pages are not flushed from fuse_release(), then there might not be a writable open file later. So any remaining dirty pages must be written back before the file is released. This is a partial revert of the blamed commit. References: - https://git.kernel.org/stable/c/5ccb0420b7c9334ab8122037847101931b899301 - https://git.ker
blamed commit. References: - https://git.kernel.org/stable/c/5ccb0420b7c9334ab8122037847101931b899301 - https://git.kernel.org/stable/c/4bd9d5d20f344d015422969302d12653c903c271 - https://git.kernel.org/stable/c/035ff33cf4db101250fb980a3941bf078f37a544
CVE ID: CVE-2022-50218 State: PUBLISHED Published: 2025-06-18T11:03:54.101Z Last Updated: 2025-06-18T11:03:54.101Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: iio: light: isl29028: Fix the warning in isl29028_remove() The driver use the non-managed form of the register function in isl29028_remove(). To keep the release order as mirroring the ordering in probe, the driver should use non-managed form in probe, too. The following log reveals it: [ 32.374955] isl29028 0-0010: remove [ 32.376861] general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN PTI [ 32.377676] KASAN: nu
ion fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN PTI [ 32.377676] KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037] [ 32.379432] RIP: 0010:kernfs_find_and_get_ns+0x28/0xe0 [ 32.385461] Call Trace: [ 32.385807] sysfs_unmerge_group+0x59/0x110 [ 32.386110] dpm_sysfs_remove+0x58/0xc0 [ 32.386391] device_del+0x296/0xe50 [ 32.386959] cdev_device_del+0x1d/0xd0 [ 32.387231] devm_iio_device_unreg+0x27/0xb0 [ 32.387542] devres_release_group+0x319/0x3d0 [ 32.388162] i2c_device_remove+0x93/0x1f0 References: - https://git.kernel.org/stable/c/ca63d5abf404d2934e2ac03545350de7bb8c8e96 - https://git.kernel.org/stable/c/359f3b150eab30805fe0e4e9
.kernel.org/stable/c/ca63d5abf404d2934e2ac03545350de7bb8c8e96 - https://git.kernel.org/stable/c/359f3b150eab30805fe0e4e9d616887d7257a625 - https://git.kernel.org/stable/c/ed43fb20d3d1fca9d79db0d5faf4321a4dd58c23 - https://git.kernel.org/stable/c/fb1888205c0782f287e5dd4ffff1f665332e868c - https://git.kernel.org/stable/c/fac589fb764699a4bcd288f6656b8cd0408ea968 - https://git.kernel.org/stable/c/4f0ebfb4b9bfad2326c0b2c3cc7e37f4b9ee9eba - https://git.kernel.org/stable/c/a1135205b0affd255510775a27df571aca84ab4b - https://git.kernel.org/stable/c/06674fc7c003b9d0aa1d37fef7ab2c24802cc6ad
CVE ID: CVE-2022-50219 State: PUBLISHED Published: 2025-06-18T11:03:54.711Z Last Updated: 2025-06-18T11:03:54.711Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix KASAN use-after-free Read in compute_effective_progs Syzbot found a Use After Free bug in compute_effective_progs(). The reproducer creates a number of BPF links, and causes a fault injected alloc to fail, while calling bpf_link_detach on them. Link detach triggers the link to be freed by bpf_link_free(), which calls __cgroup_bpf_detach() and update_effective_progs(). If the memory allocation in this function fails, the function restores the pointer to the bpf
update_effective_progs(). If the memory allocation in this function fails, the function restores the pointer to the bpf_cgroup_link on the cgroup list, but the memory gets freed just after it returns. After this, every subsequent call to update_effective_progs() causes this already deallocated pointer to be dereferenced in prog_list_length(), and triggers KASAN UAF error. To fix this issue don't preserve the pointer to the prog or link in the list, but remove it and replace it with a dummy prog without shrinking the table. The subsequent call to __cgroup_bpf_detach() or __cgroup_bpf_detach() will correct it. References: - https://git.kernel.org/stable/c/3527e3cbb84d8868c4d4e91ba55915f96d39e
cgroup_bpf_detach() will correct it. References: - https://git.kernel.org/stable/c/3527e3cbb84d8868c4d4e91ba55915f96d39ec3d - https://git.kernel.org/stable/c/1f8ca9c40e6222ce431e9ba5dae3cccce8ef9443 - https://git.kernel.org/stable/c/6336388715afa419cc97d0255bda3bba1b96b7ca - https://git.kernel.org/stable/c/be001f9da71eaa3b61e186fb88bde3279728bdca - https://git.kernel.org/stable/c/4c46091ee985ae84c60c5e95055d779fcd291d87
CVE ID: CVE-2022-50220 State: PUBLISHED Published: 2025-06-18T11:03:55.461Z Last Updated: 2025-07-15T15:43:48.595Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: usbnet: Fix linkwatch use-after-free on disconnect usbnet uses the work usbnet_deferred_kevent() to perform tasks which may sleep. On disconnect, completion of the work was originally awaited in ->ndo_stop(). But in 2003, that was moved to ->disconnect() by historic commit "[PATCH] USB: usbnet, prevent exotic rtnl deadlock": https://git.kernel.org/tglx/history/c/0f138bbfd83c The change was made because back then, the kernel's workqueue implementation did not allow wait
x/history/c/0f138bbfd83c The change was made because back then, the kernel's workqueue implementation did not allow waiting for a single work. One had to wait for completion of *all* work by calling flush_scheduled_work(), and that could deadlock when waiting for usbnet_deferred_kevent() with rtnl_mutex held in ->ndo_stop(). The commit solved one problem but created another: It causes a use-after-free in USB Ethernet drivers aqc111.c, asix_devices.c, ax88179_178a.c, ch9200.c and smsc75xx.c: * If the drivers receive a link change interrupt immediately before disconnect, they raise EVENT_LINK_RESET in their (non-sleepable) ->status() callback and schedule usbnet_deferred_kevent(). * usbnet_def
raise EVENT_LINK_RESET in their (non-sleepable) ->status() callback and schedule usbnet_deferred_kevent(). * usbnet_deferred_kevent() invokes the driver's ->link_reset() callback, which calls netif_carrier_{on,off}(). * That in turn schedules the work linkwatch_event(). Because usbnet_deferred_kevent() is awaited after unregister_netdev(), netif_carrier_{on,off}() may operate on an unregistered netdev and linkwatch_event() may run after free_netdev(), causing a use-after-free. In 2010, usbnet was changed to only wait for a single instance of usbnet_deferred_kevent() instead of *all* work by commit 23f333a2bfaf ("drivers/net: don't use flush_scheduled_work()"). Unfortunately the commit negle
d of *all* work by commit 23f333a2bfaf ("drivers/net: don't use flush_scheduled_work()"). Unfortunately the commit neglected to move the wait back to ->ndo_stop(). Rectify that omission at long last. References: - https://git.kernel.org/stable/c/d2d6b530d89b0a912148018027386aa049f0a309 - https://git.kernel.org/stable/c/e2a521a7dcc463c5017b4426ca0804e151faeff7 - https://git.kernel.org/stable/c/7f77dcbc030c2faa6d8e8a594985eeb34018409e - https://git.kernel.org/stable/c/8b4588b8b00b299be16a35be67b331d8fdba03f3 - https://git.kernel.org/stable/c/135199a2edd459d2b123144efcd7f9bcd95128e4 - https://git.kernel.org/stable/c/635fd8953e4309b54ca6a81bed1d4a87668694f4 - https://git.kernel.org/stable/c/d49b
5128e4 - https://git.kernel.org/stable/c/635fd8953e4309b54ca6a81bed1d4a87668694f4 - https://git.kernel.org/stable/c/d49bb8cf9bfaa06aa527eb30f1a52a071da2e32f - https://git.kernel.org/stable/c/db3b738ae5f726204876f4303c49cfdf4311403f - https://git.kernel.org/stable/c/a69e617e533edddf3fa3123149900f36e0a6dc74
CVE ID: CVE-2022-50221 State: PUBLISHED Published: 2025-06-18T11:03:56.096Z Last Updated: 2025-06-18T11:03:56.096Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/fb-helper: Fix out-of-bounds access Clip memory range to screen-buffer size to avoid out-of-bounds access in fbdev deferred I/O's damage handling. Fbdev's deferred I/O can only track pages. From the range of pages, the damage handler computes the clipping rectangle for the display update. If the fbdev screen buffer ends near the beginning of a page, that page could contain more scanlines. The damage handler would then track these non-existing scanlines as dirty and
e, that page could contain more scanlines. The damage handler would then track these non-existing scanlines as dirty and provoke an out-of-bounds access during the screen update. Hence, clip the maximum memory range to the size of the screen buffer. While at it, rename the variables min/max to min_off/max_off in drm_fb_helper_deferred_io(). This avoids confusion with the macros of the same name. References: - https://git.kernel.org/stable/c/9c49ac792c639dbec0728b513329a32461f72253 - https://git.kernel.org/stable/c/ae25885bdf59fde40726863c57fd20e4a0642183
CVE ID: CVE-2022-50222 State: PUBLISHED Published: 2025-06-18T11:03:56.744Z Last Updated: 2025-09-03T12:59:06.426Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: tty: vt: initialize unicode screen buffer syzbot reports kernel infoleak at vcs_read() [1], for buffer can be read immediately after resize operation. Initialize buffer using kzalloc(). ---------- #include <fcntl.h> #include <unistd.h> #include <sys/ioctl.h> #include <linux/fb.h> int main(int argc, char *argv[]) { struct fb_var_screeninfo var = { }; const int fb_fd = open("/dev/fb0", 3); ioctl(fb_fd, FBIOGET_VSCREENINFO, &var); var.yres = 0x21; ioctl(fb_fd, FBIOPUT_VSC
onst int fb_fd = open("/dev/fb0", 3); ioctl(fb_fd, FBIOGET_VSCREENINFO, &var); var.yres = 0x21; ioctl(fb_fd, FBIOPUT_VSCREENINFO, &var); return read(open("/dev/vcsu", O_RDONLY), &var, sizeof(var)) == -1; } ---------- References: - https://git.kernel.org/stable/c/e02fa87e572bb7d90dcdbce9c0f519f1eb992e96 - https://git.kernel.org/stable/c/cc9e874dace0c89ae535230c7da19b764746811e - https://git.kernel.org/stable/c/5c6c65681f39bf71bc72ed589dec3b8b20e75cac - https://git.kernel.org/stable/c/446f123aa6021e5f75a20789f05ff3f7ae51a42f - https://git.kernel.org/stable/c/777a462e1ae50a01fc4a871efa8e34d596a1e17d - https://git.kernel.org/stable/c/e0ef23e9b0ad18b9fd3741b0f1ad2282e4a18def - https://git.kernel.
c4a871efa8e34d596a1e17d - https://git.kernel.org/stable/c/e0ef23e9b0ad18b9fd3741b0f1ad2282e4a18def - https://git.kernel.org/stable/c/af77c56aa35325daa2bc2bed5c2ebf169be61b86
CVE ID: CVE-2022-50223 State: PUBLISHED Published: 2025-06-18T11:03:57.326Z Last Updated: 2025-06-19T13:10:53.321Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: LoongArch: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK When CONFIG_CPUMASK_OFFSTACK and CONFIG_DEBUG_PER_CPU_MAPS is selected, cpu_max_bits_warn() generates a runtime warning similar as below while we show /proc/cpuinfo. Fix this by using nr_cpu_ids (the runtime limit) instead of NR_CPUS to iterate CPUs. [ 3.052463] ------------[ cut here ]------------ [ 3.059679] WARNING: CPU: 3 PID: 1 at include/linux/cpumask.h:108 show_cpuinfo+0x5e8/0x5f0 [ 3.070072] Modules
-------- [ 3.059679] WARNING: CPU: 3 PID: 1 at include/linux/cpumask.h:108 show_cpuinfo+0x5e8/0x5f0 [ 3.070072] Modules linked in: efivarfs autofs4 [ 3.076257] CPU: 0 PID: 1 Comm: systemd Not tainted 5.19-rc5+ #1052 [ 3.084034] Hardware name: Loongson Loongson-3A5000-7A1000-1w-V0.1-CRB/Loongson-LS3A5000-7A1000-1w-EVB-V1.21, BIOS Loongson-UDK2018-V2.0.04082-beta7 04/27 [ 3.099465] Stack : 9000000100157b08 9000000000f18530 9000000000cf846c 9000000100154000 [ 3.109127] 9000000100157a50 0000000000000000 9000000100157a58 9000000000ef7430 [ 3.118774] 90000001001578e8 0000000000000040 0000000000000020 ffffffffffffffff [ 3.128412] 0000000000aaaaaa 1ab25f00eec96a37 900000010021de80 900000000101c890 [
0040 0000000000000020 ffffffffffffffff [ 3.128412] 0000000000aaaaaa 1ab25f00eec96a37 900000010021de80 900000000101c890 [ 3.138056] 0000000000000000 0000000000000000 0000000000000000 0000000000aaaaaa [ 3.147711] ffff8000339dc220 0000000000000001 0000000006ab4000 0000000000000000 [ 3.157364] 900000000101c998 0000000000000004 9000000000ef7430 0000000000000000 [ 3.167012] 0000000000000009 000000000000006c 0000000000000000 0000000000000000 [ 3.176641] 9000000000d3de08 9000000001639390 90000000002086d8 00007ffff0080286 [ 3.186260] 00000000000000b0 0000000000000004 0000000000000000 0000000000071c1c [ 3.195868] ... [ 3.199917] Call Trace: [ 3.203941] [<90000000002086d8>] show_stack+0x38/0x14c [ 3.21
0 0000000000071c1c [ 3.195868] ... [ 3.199917] Call Trace: [ 3.203941] [<90000000002086d8>] show_stack+0x38/0x14c [ 3.210666] [<9000000000cf846c>] dump_stack_lvl+0x60/0x88 [ 3.217625] [<900000000023d268>] __warn+0xd0/0x100 [ 3.223958] [<9000000000cf3c90>] warn_slowpath_fmt+0x7c/0xcc [ 3.231150] [<9000000000210220>] show_cpuinfo+0x5e8/0x5f0 [ 3.238080] [<90000000004f578c>] seq_read_iter+0x354/0x4b4 [ 3.245098] [<90000000004c2e90>] new_sync_read+0x17c/0x1c4 [ 3.252114] [<90000000004c5174>] vfs_read+0x138/0x1d0 [ 3.258694] [<90000000004c55f8>] ksys_read+0x70/0x100 [ 3.265265] [<9000000000cfde9c>] do_syscall+0x7c/0x94 [ 3.271820] [<9000000000202fe4>] handle_syscall+0xc4/0x160 [ 3.281824] ---[ en
[<9000000000cfde9c>] do_syscall+0x7c/0x94 [ 3.271820] [<9000000000202fe4>] handle_syscall+0xc4/0x160 [ 3.281824] ---[ end trace 8b484262b4b8c24c ]--- References: - https://git.kernel.org/stable/c/37268c7badd36f5381056d1651a6ee0b63b8ff3c - https://git.kernel.org/stable/c/28e112afa44ad0814120d41c68fa72372a2cd2c2
CVE ID: CVE-2022-50224 State: PUBLISHED Published: 2025-06-18T11:03:57.954Z Last Updated: 2025-07-15T15:43:49.693Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Treat NX as a valid SPTE bit for NPT Treat the NX bit as valid when using NPT, as KVM will set the NX bit when the NX huge page mitigation is enabled (mindblowing) and trigger the WARN that fires on reserved SPTE bits being set. KVM has required NX support for SVM since commit b26a71a1a5b9 ("KVM: SVM: Refuse to load kvm_amd if NX support is not available") for exactly this reason, but apparently it never occurred to anyone to actually test NPT with the mi