Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
handle FOLL_FORCE. So let's just get rid of it. Thanks to Nadav Amit for pointing out that the pte_dirty() check in FOLL_FORCE code is problematic and might be exploitable. Note 1: We don't check for the PTE being dirty because it doesn't matter for making a "was COWed" decision anymore, and whoever modifies the page has to set the page dirty either way. Note 2: Kernels before extended uffd-wp support and before PageAnonExclusive (< 5.19) can simply revert the problematic commit instead and be safe regarding UFFDIO_CONTINUE. A backport to v5.19 requires minor adjustments due to lack of vma_soft_dirty_enabled(). References: - https://git.kernel.org/stable/c/9def52eb10baab3b700858003d462fcf17
ue to lack of vma_soft_dirty_enabled(). References: - https://git.kernel.org/stable/c/9def52eb10baab3b700858003d462fcf17d62873 - https://git.kernel.org/stable/c/5535be3099717646781ce1540cf725965d680e7b
CVE ID: CVE-2022-50015 State: PUBLISHED Published: 2025-06-18T11:01:19.516Z Last Updated: 2025-06-19T13:10:46.860Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: hda-ipc: Do not process IPC reply before firmware boot It is not yet clear, but it is possible to create a firmware so broken that it will send a reply message before a FW_READY message (it is not yet clear if FW_READY will arrive later). Since the reply_data is allocated only after the FW_READY message, this will lead to a NULL pointer dereference if not filtered out. The issue was reported with IPC4 firmware but the same condition is present for IPC
ter dereference if not filtered out. The issue was reported with IPC4 firmware but the same condition is present for IPC3. References: - https://git.kernel.org/stable/c/48945246cf802b9866f3a821103f1a7a196baf68 - https://git.kernel.org/stable/c/499cc881b09c8283ab5e75b0d6d21cb427722161
CVE ID: CVE-2022-50016 State: PUBLISHED Published: 2025-06-18T11:01:20.427Z Last Updated: 2025-06-19T13:10:48.324Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: cnl: Do not process IPC reply before firmware boot It is not yet clear, but it is possible to create a firmware so broken that it will send a reply message before a FW_READY message (it is not yet clear if FW_READY will arrive later). Since the reply_data is allocated only after the FW_READY message, this will lead to a NULL pointer dereference if not filtered out. The issue was reported with IPC4 firmware but the same condition is present for IPC3. R
dereference if not filtered out. The issue was reported with IPC4 firmware but the same condition is present for IPC3. References: - https://git.kernel.org/stable/c/230f646085d17a008b609eb8fe8befb8811868f0 - https://git.kernel.org/stable/c/acacd9eefd0def5a83244d88e5483b5f38ee7287
CVE ID: CVE-2022-50017 State: PUBLISHED Published: 2025-06-18T11:01:21.357Z Last Updated: 2025-06-18T11:01:21.357Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mips: cavium-octeon: Fix missing of_node_put() in octeon2_usb_clocks_start We should call of_node_put() for the reference 'uctl_node' returned by of_get_parent() which will increase the refcount. Otherwise, there will be a refcount leak bug. References: - https://git.kernel.org/stable/c/9d1afa0169a84dcd5b79901d792edeb8403684ab - https://git.kernel.org/stable/c/af87a469695dc2b2419b2fdff0bf41db5265b325 - https://git.kernel.org/stable/c/c06166a484eece51916dd700a870e53356b
/stable/c/af87a469695dc2b2419b2fdff0bf41db5265b325 - https://git.kernel.org/stable/c/c06166a484eece51916dd700a870e53356b7e1bc - https://git.kernel.org/stable/c/1b49707df679b5510ed06ace7378ddc2aec5c3fb - https://git.kernel.org/stable/c/1e39037e44d7fa3728686af146f9285ea197097d - https://git.kernel.org/stable/c/7822d994eb9579a1df4cdbc315db090a041e50f3 - https://git.kernel.org/stable/c/a80016c40cc797c7f3e5a705b8e12ae447280335 - https://git.kernel.org/stable/c/7a9f743ceead60ed454c46fbc3085ee9a79cbebb
CVE ID: CVE-2022-50018 State: REJECTED Published: 2025-06-18T11:01:22.276Z Last Updated: 2025-06-18T14:10:04.415Z Description: No description available.
CVE ID: CVE-2022-50019 State: PUBLISHED Published: 2025-06-18T11:01:23.332Z Last Updated: 2025-09-03T12:58:59.693Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: tty: serial: Fix refcount leak bug in ucc_uart.c In soc_info(), of_find_node_by_type() will return a node pointer with refcount incremented. We should use of_node_put() when it is not used anymore. References: - https://git.kernel.org/stable/c/8245e7d1d7f75a9255ad1e8146752e5051d528b8 - https://git.kernel.org/stable/c/ec56f886f3bf0f15f7a3844d4c025e165b8e8de7 - https://git.kernel.org/stable/c/59bc4c19d53bdac61ec952c01c6e864f5f0f8367 - https://git.kernel.org/stable/c/ca3f
8e8de7 - https://git.kernel.org/stable/c/59bc4c19d53bdac61ec952c01c6e864f5f0f8367 - https://git.kernel.org/stable/c/ca3fc1c38e4253bc019881301a28ea60b8b0bca3 - https://git.kernel.org/stable/c/81939c4fbc2d5c754d0f1c1f05149d4b70d751ed - https://git.kernel.org/stable/c/17c32546166d8a7d2579c4b57c8b16241f94a66b - https://git.kernel.org/stable/c/f6ed634eedb1a8a6a8cb110a7695c7abb70ffcbf - https://git.kernel.org/stable/c/d24d7bb2cd947676f9b71fb944d045e09b8b282f
CVE ID: CVE-2022-50020 State: PUBLISHED Published: 2025-06-18T11:01:24.227Z Last Updated: 2025-06-18T11:01:24.227Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ext4: avoid resizing to a partial cluster size This patch avoids an attempt to resize the filesystem to an unaligned cluster boundary. An online resize to a size that is not integral to cluster size results in the last iteration attempting to grow the fs by a negative amount, which trips a BUG_ON and leaves the fs with a corrupted in-memory superblock. References: - https://git.kernel.org/stable/c/53f62a4201be1cfc1e3c971e566888b182c3ffb0 - https://git.kernel.org/stable
. References: - https://git.kernel.org/stable/c/53f62a4201be1cfc1e3c971e566888b182c3ffb0 - https://git.kernel.org/stable/c/952b3dc02baaae6a69c71c0aca23e06741182d9a - https://git.kernel.org/stable/c/7bdfb01fc5f6b3696728aeb527c50386e0ee09a1 - https://git.kernel.org/stable/c/a6805b3dcf5cd41f2ae3a03dca43411135b99849 - https://git.kernel.org/stable/c/80288883294c5b4ed18bae0d8bd9c4a12f297074 - https://git.kernel.org/stable/c/72b850a2a996f72541172e7cf686d54a2b29bcd8 - https://git.kernel.org/stable/c/0082e99a9074ff88eff729c70c93454c8588d8e1 - https://git.kernel.org/stable/c/69cb8e9d8cd97cdf5e293b26d70a9dee3e35e6bd
CVE ID: CVE-2022-50021 State: PUBLISHED Published: 2025-06-18T11:01:25.045Z Last Updated: 2025-06-18T11:01:25.045Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ext4: block range must be validated before use in ext4_mb_clear_bb() Block range to free is validated in ext4_free_blocks() using ext4_inode_block_valid() and then it's passed to ext4_mb_clear_bb(). However in some situations on bigalloc file system the range might be adjusted after the validation in ext4_free_blocks() which can lead to troubles on corrupted file systems such as one found by syzkaller that resulted in the following BUG kernel BUG at fs/ext4/ext4.h:3319
rrupted file systems such as one found by syzkaller that resulted in the following BUG kernel BUG at fs/ext4/ext4.h:3319! PREEMPT SMP NOPTI CPU: 28 PID: 4243 Comm: repro Kdump: loaded Not tainted 5.19.0-rc6+ #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1.fc35 04/01/2014 RIP: 0010:ext4_free_blocks+0x95e/0xa90 Call Trace: <TASK> ? lock_timer_base+0x61/0x80 ? __es_remove_extent+0x5a/0x760 ? __mod_timer+0x256/0x380 ? ext4_ind_truncate_ensure_credits+0x90/0x220 ext4_clear_blocks+0x107/0x1b0 ext4_free_data+0x15b/0x170 ext4_ind_truncate+0x214/0x2c0 ? _raw_spin_unlock+0x15/0x30 ? ext4_discard_preallocations+0x15a/0x410 ? ext4_journal_check_start+0xe/0x90 ? __ext4_journal_start_
n_unlock+0x15/0x30 ? ext4_discard_preallocations+0x15a/0x410 ? ext4_journal_check_start+0xe/0x90 ? __ext4_journal_start_sb+0x2f/0x110 ext4_truncate+0x1b5/0x460 ? __ext4_journal_start_sb+0x2f/0x110 ext4_evict_inode+0x2b4/0x6f0 evict+0xd0/0x1d0 ext4_enable_quotas+0x11f/0x1f0 ext4_orphan_cleanup+0x3de/0x430 ? proc_create_seq_private+0x43/0x50 ext4_fill_super+0x295f/0x3ae0 ? snprintf+0x39/0x40 ? sget_fc+0x19c/0x330 ? ext4_reconfigure+0x850/0x850 get_tree_bdev+0x16d/0x260 vfs_get_tree+0x25/0xb0 path_mount+0x431/0xa70 __x64_sys_mount+0xe2/0x120 do_syscall_64+0x5b/0x80 ? do_user_addr_fault+0x1e2/0x670 ? exc_page_fault+0x70/0x170 entry_SYSCALL_64_after_hwframe+0x46/0xb0 RIP: 0033:0x7fdf4e512ace Fix
ddr_fault+0x1e2/0x670 ? exc_page_fault+0x70/0x170 entry_SYSCALL_64_after_hwframe+0x46/0xb0 RIP: 0033:0x7fdf4e512ace Fix it by making sure that the block range is properly validated before used every time it changes in ext4_free_blocks() or ext4_mb_clear_bb(). References: - https://git.kernel.org/stable/c/7550aade978371ac582f6d43b14c4cb89ca54463 - https://git.kernel.org/stable/c/560a2744cbbf03cac65a6394f9b0d99aa437c867 - https://git.kernel.org/stable/c/a2522041d248a8c969cbbc97e1fc2cd8b4de120d - https://git.kernel.org/stable/c/1e1c2b86ef86a8477fd9b9a4f48a6bfe235606f6
CVE ID: CVE-2022-50022 State: PUBLISHED Published: 2025-06-18T11:01:25.965Z Last Updated: 2025-07-15T15:43:42.948Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drivers:md:fix a potential use-after-free bug In line 2884, "raid5_release_stripe(sh);" drops the reference to sh and may cause sh to be released. However, sh is subsequently used in lines 2886 "if (sh->batch_head && sh != sh->batch_head)". This may result in an use-after-free bug. It can be fixed by moving "raid5_release_stripe(sh);" to the bottom of the function. References: - https://git.kernel.org/stable/c/7470a4314b239e9a9580f248fdf4c9a92805490e - https://git.kern
the function. References: - https://git.kernel.org/stable/c/7470a4314b239e9a9580f248fdf4c9a92805490e - https://git.kernel.org/stable/c/09cf99bace7789d91caa8d10fbcfc8b2fb35857f - https://git.kernel.org/stable/c/e5b3dd2d92c4511e81f6e4ec9c5bb7ad25e03d13 - https://git.kernel.org/stable/c/f5d46f1b47f65da1faf468277b261eb78c8e25b5 - https://git.kernel.org/stable/c/5d8325fd15892c8ab1146edc1d7ed8463de39636 - https://git.kernel.org/stable/c/d9b94c3ace549433de8a93eeb27b0391fc8ac406 - https://git.kernel.org/stable/c/eb3a4f73f43f839df981dda5859e8e075067a360 - https://git.kernel.org/stable/c/104212471b1c1817b311771d817fb692af983173
CVE ID: CVE-2022-50023 State: PUBLISHED Published: 2025-06-18T11:01:26.869Z Last Updated: 2025-06-18T11:01:26.869Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-axi-dmac: ignore interrupt if no descriptor If the channel has no descriptor and the interrupt is raised then the kernel will OOPS. Check the result of vchan_next_desc() in the handler axi_chan_block_xfer_complete() to avoid the error happening. References: - https://git.kernel.org/stable/c/54aa6c49361b79f7f6b15fc63dfe9ea52c70bb03 - https://git.kernel.org/stable/c/3d05aeebbde8c69593d8aa512b7c08b8f0ad25ba - https://git.kernel.org/stable/c/820f5ce999d2f9996
s://git.kernel.org/stable/c/3d05aeebbde8c69593d8aa512b7c08b8f0ad25ba - https://git.kernel.org/stable/c/820f5ce999d2f99961e88c16d65cd26764df0590
CVE ID: CVE-2022-50024 State: PUBLISHED Published: 2025-06-18T11:01:27.959Z Last Updated: 2025-06-18T11:01:27.959Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-axi-dmac: do not print NULL LLI during error During debugging we have seen an issue where axi_chan_dump_lli() is passed a NULL LLI pointer which ends up causing an OOPS due to trying to get fields from it. Simply print NULL LLI and exit to avoid this. References: - https://git.kernel.org/stable/c/af76e6fdcf92f1a742b788d0dba5edd194267bf9 - https://git.kernel.org/stable/c/ad764df73ae5eada265fffc0408404703cbb2b8d - https://git.kernel.org/stable/c/86cb0defe0e
- https://git.kernel.org/stable/c/ad764df73ae5eada265fffc0408404703cbb2b8d - https://git.kernel.org/stable/c/86cb0defe0e275453bc39e856bb523eb425a6537
CVE ID: CVE-2022-50025 State: PUBLISHED Published: 2025-06-18T11:01:28.816Z Last Updated: 2025-09-03T12:59:01.003Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: cxl: Fix a memory leak in an error handling path A bitmap_zalloc() must be balanced by a corresponding bitmap_free() in the error handling path of afu_allocate_irqs(). References: - https://git.kernel.org/stable/c/c2c7a29f99788e9e5dfe41d16868ea33da7cc235 - https://git.kernel.org/stable/c/6544ff559315498ad6c0a311359ca44987f9ca07 - https://git.kernel.org/stable/c/89d51dc6878c47b6400922fac21b6a33f9d1a588 - https://git.kernel.org/stable/c/695af60af755873399ce01cb9717676882
g/stable/c/89d51dc6878c47b6400922fac21b6a33f9d1a588 - https://git.kernel.org/stable/c/695af60af755873399ce01cb97176768828bc1fd - https://git.kernel.org/stable/c/4be138bcd6d68cec0ce47051b117541061f5141a - https://git.kernel.org/stable/c/addff638c41753639368c252d0c5ba0d8fe9ed97 - https://git.kernel.org/stable/c/c2557780ee7818b701681c226fa4cb7c0b171665 - https://git.kernel.org/stable/c/3a15b45b5454da862376b5d69a4967f5c6fa1368
CVE ID: CVE-2022-50026 State: PUBLISHED Published: 2025-06-18T11:01:29.650Z Last Updated: 2025-06-19T13:10:49.871Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: habanalabs/gaudi: fix shift out of bounds When validating NIC queues, queue offset calculation must be performed only for NIC queues. References: - https://git.kernel.org/stable/c/b09e5ab18c9f52ff14cf968770e15d5b2dd85c43 - https://git.kernel.org/stable/c/19958bf4ef3124f6e93fd9e2de0b54d2a356a4db - https://git.kernel.org/stable/c/01622098aeb05a5efbb727199bbc2a4653393255
CVE ID: CVE-2022-50027 State: PUBLISHED Published: 2025-06-18T11:01:30.485Z Last Updated: 2025-07-15T15:43:44.007Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix possible memory leak when failing to issue CMF WQE There is no corresponding free routine if lpfc_sli4_issue_wqe fails to issue the CMF WQE in lpfc_issue_cmf_sync_wqe. If ret_val is non-zero, then free the iocbq request structure. References: - https://git.kernel.org/stable/c/9c8e2e607270a368834a0ef72aa82d970f89c596 - https://git.kernel.org/stable/c/4eb7a1beff03836d3df271cd23b790884e3facb9 - https://git.kernel.org/stable/c/2f67dc7970bce3529edce93a0a1423
l.org/stable/c/4eb7a1beff03836d3df271cd23b790884e3facb9 - https://git.kernel.org/stable/c/2f67dc7970bce3529edce93a0a14234d88b3fcd5
CVE ID: CVE-2022-50028 State: PUBLISHED Published: 2025-06-18T11:01:31.293Z Last Updated: 2025-06-18T11:01:31.293Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: gadgetfs: ep_io - wait until IRQ finishes after usb_ep_queue() if wait_for_completion_interruptible() is interrupted we need to wait until IRQ gets finished. Otherwise complete() from epio_complete() can corrupt stack. References: - https://git.kernel.org/stable/c/67a4874461422e633236a0286a01b483cd647113 - https://git.kernel.org/stable/c/118d967ce00a3d128bf731b35e4e2cb0facf5f00 - https://git.kernel.org/stable/c/77040efe59a141286d090c8a0d37c65a355a1832 - https://git.ker
d128bf731b35e4e2cb0facf5f00 - https://git.kernel.org/stable/c/77040efe59a141286d090c8a0d37c65a355a1832 - https://git.kernel.org/stable/c/ca06b4cde54f8ec8be3aa53fd339bd56e62c12b3 - https://git.kernel.org/stable/c/9ac14f973cb91f0c01776517e6d50981f32b8038 - https://git.kernel.org/stable/c/94aadba8d000d5de56af4ce8da3f334f21bf7a79 - https://git.kernel.org/stable/c/2b06d5d97c0e067108a122986767731d40742138 - https://git.kernel.org/stable/c/04cb742d4d8f30dc2e83b46ac317eec09191c68e
CVE ID: CVE-2022-50029 State: PUBLISHED Published: 2025-06-18T11:01:32.210Z Last Updated: 2025-06-18T11:01:32.210Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: clk: qcom: ipq8074: dont disable gcc_sleep_clk_src Once the usb sleep clocks are disabled, clock framework is trying to disable the sleep clock source also. However, it seems that it cannot be disabled and trying to do so produces: [ 245.436390] ------------[ cut here ]------------ [ 245.441233] gcc_sleep_clk_src status stuck at 'on' [ 245.441254] WARNING: CPU: 2 PID: 223 at clk_branch_wait+0x130/0x140 [ 245.450435] Modules linked in: xhci_plat_hcd xhci_hcd dwc3 dwc3_q
NING: CPU: 2 PID: 223 at clk_branch_wait+0x130/0x140 [ 245.450435] Modules linked in: xhci_plat_hcd xhci_hcd dwc3 dwc3_qcom leds_gpio [ 245.456601] CPU: 2 PID: 223 Comm: sh Not tainted 5.18.0-rc4 #215 [ 245.463889] Hardware name: Xiaomi AX9000 (DT) [ 245.470050] pstate: 204000c5 (nzCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 245.474307] pc : clk_branch_wait+0x130/0x140 [ 245.481073] lr : clk_branch_wait+0x130/0x140 [ 245.485588] sp : ffffffc009f2bad0 [ 245.489838] x29: ffffffc009f2bad0 x28: ffffff8003e6c800 x27: 0000000000000000 [ 245.493057] x26: 0000000000000000 x25: 0000000000000000 x24: ffffff800226ef20 [ 245.500175] x23: ffffffc0089ff550 x22: 0000000000000000 x21: ffffffc008476ad0 [ 2
00000000000000 x24: ffffff800226ef20 [ 245.500175] x23: ffffffc0089ff550 x22: 0000000000000000 x21: ffffffc008476ad0 [ 245.507294] x20: 0000000000000000 x19: ffffffc00965ac70 x18: fffffffffffc51a7 [ 245.514413] x17: 68702e3030303837 x16: 3a6d726f6674616c x15: ffffffc089f2b777 [ 245.521531] x14: ffffffc0095c9d18 x13: 0000000000000129 x12: 0000000000000129 [ 245.528649] x11: 00000000ffffffea x10: ffffffc009621d18 x9 : 0000000000000001 [ 245.535767] x8 : 0000000000000001 x7 : 0000000000017fe8 x6 : 0000000000000001 [ 245.542885] x5 : ffffff803fdca6d8 x4 : 0000000000000000 x3 : 0000000000000027 [ 245.550002] x2 : 0000000000000027 x1 : 0000000000000023 x0 : 0000000000000026 [ 245.557122] Call trac
0000000000000027 [ 245.550002] x2 : 0000000000000027 x1 : 0000000000000023 x0 : 0000000000000026 [ 245.557122] Call trace: [ 245.564229] clk_branch_wait+0x130/0x140 [ 245.566490] clk_branch2_disable+0x2c/0x40 [ 245.570656] clk_core_disable+0x60/0xb0 [ 245.574561] clk_core_disable+0x68/0xb0 [ 245.578293] clk_disable+0x30/0x50 [ 245.582113] dwc3_qcom_remove+0x60/0xc0 [dwc3_qcom] [ 245.585588] platform_remove+0x28/0x60 [ 245.590361] device_remove+0x4c/0x80 [ 245.594179] device_release_driver_internal+0x1dc/0x230 [ 245.597914] device_driver_detach+0x18/0x30 [ 245.602861] unbind_store+0xec/0x110 [ 245.607027] drv_attr_store+0x24/0x40 [ 245.610847] sysfs_kf_write+0x44/0x60 [ 245.614405] kernfs_fop
_store+0xec/0x110 [ 245.607027] drv_attr_store+0x24/0x40 [ 245.610847] sysfs_kf_write+0x44/0x60 [ 245.614405] kernfs_fop_write_iter+0x128/0x1c0 [ 245.618052] new_sync_write+0xc0/0x130 [ 245.622391] vfs_write+0x1d4/0x2a0 [ 245.626123] ksys_write+0x58/0xe0 [ 245.629508] __arm64_sys_write+0x1c/0x30 [ 245.632895] invoke_syscall.constprop.0+0x5c/0x110 [ 245.636890] do_el0_svc+0xa0/0x150 [ 245.641488] el0_svc+0x18/0x60 [ 245.644872] el0t_64_sync_handler+0xa4/0x130 [ 245.647914] el0t_64_sync+0x174/0x178 [ 245.652340] ---[ end trace 0000000000000000 ]--- So, add CLK_IS_CRITICAL flag to the clock so that the kernel won't try to disable the sleep clock. References: - https://git.kernel.org/stable/c/38
g to the clock so that the kernel won't try to disable the sleep clock. References: - https://git.kernel.org/stable/c/38cee0d2b65eed42a44052de1bfdc0177b6c3f05 - https://git.kernel.org/stable/c/4203b76abe539f3cac258d4cf1e16e2dd95ea60f - https://git.kernel.org/stable/c/d401611a93b332914cf91eb9bc0b63fa1bdc17e9 - https://git.kernel.org/stable/c/6b90ab952401bd6c1a321dcfc0e0df080f2bc905 - https://git.kernel.org/stable/c/17d58499dc9c7e059dab7d170e9bae1e7e9c561b - https://git.kernel.org/stable/c/459411b9f0180e3f382d7abfa3028dd3285984c3 - https://git.kernel.org/stable/c/1bf7305e79aab095196131bdc87a97796e0e3fac
CVE ID: CVE-2022-50030 State: PUBLISHED Published: 2025-06-18T11:01:33.345Z Last Updated: 2025-06-18T11:01:33.345Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input Malformed user input to debugfs results in buffer overflow crashes. Adapt input string lengths to fit within internal buffers, leaving space for NULL terminators. References: - https://git.kernel.org/stable/c/927907f1cbb3408cadde637fccfc17bb6b10a87d - https://git.kernel.org/stable/c/c29a4baaad38a332c0ae480cf6d6c5bf75ac1828 - https://git.kernel.org/stable/c/b92506dc51f81741eb26609175ac206c2
rg/stable/c/c29a4baaad38a332c0ae480cf6d6c5bf75ac1828 - https://git.kernel.org/stable/c/b92506dc51f81741eb26609175ac206c20f06e0a - https://git.kernel.org/stable/c/2d544e9d19c109dfe34b3dc1253a8b2971abe060 - https://git.kernel.org/stable/c/f8191d40aa612981ce897e66cda6a88db8df17bb
CVE ID: CVE-2022-50031 State: REJECTED Published: 2025-06-18T11:01:34.049Z Last Updated: 2025-08-11T15:21:45.945Z Description: No description available.
CVE ID: CVE-2022-50032 State: PUBLISHED Published: 2025-06-18T11:01:34.767Z Last Updated: 2025-06-18T11:01:34.767Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: usb: renesas: Fix refcount leak bug In usbhs_rza1_hardware_init(), of_find_node_by_name() will return a node pointer with refcount incremented. We should use of_node_put() when it is not used anymore. References: - https://git.kernel.org/stable/c/36b18b777dece704b7c2e9e7947ca41a9b0fb009 - https://git.kernel.org/stable/c/cfa8f707a58d68b2341a9dd0b33cf048f0628b4d - https://git.kernel.org/stable/c/9790a5a4f07f38a5add85ec58c44797d3a7c3677 - https://git.kernel.org/stable/c/f
8f0628b4d - https://git.kernel.org/stable/c/9790a5a4f07f38a5add85ec58c44797d3a7c3677 - https://git.kernel.org/stable/c/fbdbd61a36d887e00114321c6758e359e9573a8e - https://git.kernel.org/stable/c/5c4b699193eba51f1bbf462d758d66f545fddd35 - https://git.kernel.org/stable/c/9d6d5303c39b8bc182475b22f45504106a07f086
CVE ID: CVE-2022-50033 State: PUBLISHED Published: 2025-06-18T11:01:35.679Z Last Updated: 2025-09-03T12:59:02.239Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: usb: host: ohci-ppc-of: Fix refcount leak bug In ohci_hcd_ppc_of_probe(), of_find_compatible_node() will return a node pointer with refcount incremented. We should use of_node_put() when it is not used anymore. References: - https://git.kernel.org/stable/c/fe6fe64403710287f0ae61a516954d8a4f7c9e3f - https://git.kernel.org/stable/c/c5c5bd5cdcc6dc9f75f53d1c89af463d39a2bb96 - https://git.kernel.org/stable/c/ec583e300aee9f152a64911445092d18e1c36729 - https://git.kernel.org/
d1c89af463d39a2bb96 - https://git.kernel.org/stable/c/ec583e300aee9f152a64911445092d18e1c36729 - https://git.kernel.org/stable/c/0334d23c56ecf1ee1563bb83e29cc5a51ed7fb4e - https://git.kernel.org/stable/c/cb5dd65e889163e723df1c2f02288cc527a57785 - https://git.kernel.org/stable/c/0fc62bbc95319bbd330e3645afc7c286acec9ef8 - https://git.kernel.org/stable/c/403132881e66db7aa98b55c6655daedd80d407fd - https://git.kernel.org/stable/c/40a959d7042bb7711e404ad2318b30e9f92c6b9b
CVE ID: CVE-2022-50034 State: PUBLISHED Published: 2025-06-18T11:01:36.435Z Last Updated: 2025-06-19T13:10:50.978Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: usb: cdns3 fix use-after-free at workaround 2 BUG: KFENCE: use-after-free read in __list_del_entry_valid+0x10/0xac cdns3_wa2_remove_old_request() { ... kfree(priv_req->request.buf); cdns3_gadget_ep_free_request(&priv_ep->endpoint, &priv_req->request); list_del_init(&priv_req->list); ^^^ use after free ... } cdns3_gadget_ep_free_request() free the space pointed by priv_req, but priv_req is used in the following list_del_init(). This patch move list_del_init() before cdn