Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-49094 State: PUBLISHED Published: 2025-02-26T01:54:48.163Z Last Updated: 2025-05-04T08:29:45.881Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net/tls: fix slab-out-of-bounds bug in decrypt_internal The memory size of tls_ctx->rx.iv for AES128-CCM is 12 setting in tls_set_sw_offload(). The return value of crypto_aead_ivsize() for "ccm(aes)" is 16. So memcpy() require 16 bytes from 12 bytes memory space will trigger slab-out-of-bounds bug as following: ================================================================== BUG: KASAN: slab-out-of-bounds in decrypt_internal+0x385/0xc40 [tls] Read of size 16 at addr
========================== BUG: KASAN: slab-out-of-bounds in decrypt_internal+0x385/0xc40 [tls] Read of size 16 at addr ffff888114e84e60 by task tls/10911 Call Trace: <TASK> dump_stack_lvl+0x34/0x44 print_report.cold+0x5e/0x5db ? decrypt_internal+0x385/0xc40 [tls] kasan_report+0xab/0x120 ? decrypt_internal+0x385/0xc40 [tls] kasan_check_range+0xf9/0x1e0 memcpy+0x20/0x60 decrypt_internal+0x385/0xc40 [tls] ? tls_get_rec+0x2e0/0x2e0 [tls] ? process_rx_list+0x1a5/0x420 [tls] ? tls_setup_from_iter.constprop.0+0x2e0/0x2e0 [tls] decrypt_skb_update+0x9d/0x400 [tls] tls_sw_recvmsg+0x3c8/0xb50 [tls] Allocated by task 10911: kasan_save_stack+0x1e/0x40 __kasan_kmalloc+0x81/0xa0 tls_set_sw_offload+0x2eb/0
3c8/0xb50 [tls] Allocated by task 10911: kasan_save_stack+0x1e/0x40 __kasan_kmalloc+0x81/0xa0 tls_set_sw_offload+0x2eb/0xa20 [tls] tls_setsockopt+0x68c/0x700 [tls] __sys_setsockopt+0xfe/0x1b0 Replace the crypto_aead_ivsize() with prot->iv_size + prot->salt_size when memcpy() iv value in TLS_1_3_VERSION scenario. References: - https://git.kernel.org/stable/c/2b7d14c105dd8f6412eda5a91e1e6154653731e3 - https://git.kernel.org/stable/c/589154d0f18945f41d138a5b4e49e518d294474b - https://git.kernel.org/stable/c/6e2f1b033b17dedda51d465861b69e58317d6343 - https://git.kernel.org/stable/c/29be1816cbab9a0dc6243120939fd10a92753756 - https://git.kernel.org/stable/c/2304660ab6c425df64d95301b601424c6a50f28b
le/c/29be1816cbab9a0dc6243120939fd10a92753756 - https://git.kernel.org/stable/c/2304660ab6c425df64d95301b601424c6a50f28b - https://git.kernel.org/stable/c/9381fe8c849cfbe50245ac01fc077554f6eaa0e2
CVE ID: CVE-2022-49095 State: PUBLISHED Published: 2025-02-26T01:54:48.637Z Last Updated: 2025-05-04T08:29:47.033Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one() The error handling path of the probe releases a resource that is not freed in the remove function. In some cases, a ioremap() must be undone. Add the missing iounmap() call in the remove function. References: - https://git.kernel.org/stable/c/ce430cfad6a5385d5b7f7c1dc3fa50f10abfd41b - https://git.kernel.org/stable/c/1e0c01319dedf1e63ec5df37ead048e17afd92ba - https://git.kernel.org/stable/c/db863ab2baf058ed05c
//git.kernel.org/stable/c/1e0c01319dedf1e63ec5df37ead048e17afd92ba - https://git.kernel.org/stable/c/db863ab2baf058ed05c7b723612e3c40c9dd6885 - https://git.kernel.org/stable/c/34a47f7ddb4fd1cbd12397aa6f7dad1de08b4050 - https://git.kernel.org/stable/c/c5f77b595379b5191316edd365a542f8b1526066 - https://git.kernel.org/stable/c/aefd755a96051aa56b198cb7ecd168b22ba384f6 - https://git.kernel.org/stable/c/de6aee0978f164d3d0c771ce03e3066a26c371c5 - https://git.kernel.org/stable/c/a845c678e094894f38cc9526d212b21933ce44c7 - https://git.kernel.org/stable/c/16ed828b872d12ccba8f07bcc446ae89ba662f9c
CVE ID: CVE-2022-49096 State: PUBLISHED Published: 2025-02-26T01:54:49.108Z Last Updated: 2025-10-01T19:57:05.717Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: sfc: add missing xdp queue reinitialization After rx/tx ring buffer size is changed, kernel panic occurs when it acts XDP_TX or XDP_REDIRECT. When tx/rx ring buffer size is changed(ethtool -G), sfc driver reallocates and reinitializes rx and tx queues and their buffer (tx_queue->buffer). But it misses reinitializing xdp queues(efx->xdp_tx_queues). So, while it is acting XDP_TX or XDP_REDIRECT, it uses the uninitialized tx_queue->buffer. A new function efx_set_xdp_
. So, while it is acting XDP_TX or XDP_REDIRECT, it uses the uninitialized tx_queue->buffer. A new function efx_set_xdp_channels() is separated from efx_set_channels() to handle only xdp queues. Splat looks like: BUG: kernel NULL pointer dereference, address: 000000000000002a #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 0 P4D 0 Oops: 0002 [#4] PREEMPT SMP NOPTI RIP: 0010:efx_tx_map_chunk+0x54/0x90 [sfc] CPU: 2 PID: 0 Comm: swapper/2 Tainted: G D 5.17.0+ #55 e8beeee8289528f11357029357cf Code: 48 8b 8d a8 01 00 00 48 8d 14 52 4c 8d 2c d0 44 89 e0 48 85 c9 74 0e 44 89 e2 4c 89 f6 48 80 RSP: 0018:ffff92f121e45c60 EFLAGS: 00010297 RIP: 0010:efx_tx_map
d 2c d0 44 89 e0 48 85 c9 74 0e 44 89 e2 4c 89 f6 48 80 RSP: 0018:ffff92f121e45c60 EFLAGS: 00010297 RIP: 0010:efx_tx_map_chunk+0x54/0x90 [sfc] RAX: 0000000000000040 RBX: ffff92ea506895c0 RCX: ffffffffc0330870 RDX: 0000000000000001 RSI: 00000001139b10ce RDI: ffff92ea506895c0 RBP: ffffffffc0358a80 R08: 00000001139b110d R09: 0000000000000000 R10: 0000000000000001 R11: ffff92ea414c0088 R12: 0000000000000040 R13: 0000000000000018 R14: 00000001139b10ce R15: ffff92ea506895c0 FS: 0000000000000000(0000) GS:ffff92f121ec0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Code: 48 8b 8d a8 01 00 00 48 8d 14 52 4c 8d 2c d0 44 89 e0 48 85 c9 74 0e 44 89 e2 4c 89 f6 48 80 CR2
0000000080050033 Code: 48 8b 8d a8 01 00 00 48 8d 14 52 4c 8d 2c d0 44 89 e0 48 85 c9 74 0e 44 89 e2 4c 89 f6 48 80 CR2: 000000000000002a CR3: 00000003e6810004 CR4: 00000000007706e0 RSP: 0018:ffff92f121e85c60 EFLAGS: 00010297 PKRU: 55555554 RAX: 0000000000000040 RBX: ffff92ea50689700 RCX: ffffffffc0330870 RDX: 0000000000000001 RSI: 00000001145a90ce RDI: ffff92ea50689700 RBP: ffffffffc0358a80 R08: 00000001145a910d R09: 0000000000000000 R10: 0000000000000001 R11: ffff92ea414c0088 R12: 0000000000000040 R13: 0000000000000018 R14: 00000001145a90ce R15: ffff92ea50689700 FS: 0000000000000000(0000) GS:ffff92f121e80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2
000000000000(0000) GS:ffff92f121e80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000000002a CR3: 00000003e6810005 CR4: 00000000007706e0 PKRU: 55555554 Call Trace: <IRQ> efx_xdp_tx_buffers+0x12b/0x3d0 [sfc 84c94b8e32d44d296c17e10a634d3ad454de4ba5] __efx_rx_packet+0x5c3/0x930 [sfc 84c94b8e32d44d296c17e10a634d3ad454de4ba5] efx_rx_packet+0x28c/0x2e0 [sfc 84c94b8e32d44d296c17e10a634d3ad454de4ba5] efx_ef10_ev_process+0x5f8/0xf40 [sfc 84c94b8e32d44d296c17e10a634d3ad454de4ba5] ? enqueue_task_fair+0x95/0x550 efx_poll+0xc4/0x360 [sfc 84c94b8e32d44d296c17e10a634d3ad454de4ba5] Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kern
94b8e32d44d296c17e10a634d3ad454de4ba5] Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/ed7a824fda8732578d1014fad1f7fb0363705090 - https://git.kernel.org/stable/c/b8c46bc358d84701e7f7ffa054037db25f25da0e - https://git.kernel.org/stable/c/dcc85e1593686e42c6749ef3d356db34759d59e8 - https://git.kernel.org/stable/c/059a47f1da93811d37533556d67e72f2261b1127
CVE ID: CVE-2022-49097 State: PUBLISHED Published: 2025-02-26T01:54:49.601Z Last Updated: 2025-05-04T08:29:49.573Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: NFS: Avoid writeback threads getting stuck in mempool_alloc() In a low memory situation, allow the NFS writeback code to fail without getting stuck in infinite loops in mempool_alloc(). References: - https://git.kernel.org/stable/c/c74e2f6ecc51bd08bb5b0335477dba954a50592e - https://git.kernel.org/stable/c/ea029e4ce760f786919d06ef52efa2e50ea92a5f - https://git.kernel.org/stable/c/1b3fa9a3c420c31e77b406ddc28f3a627100516c - https://git.kernel.org/stable/c/a6caeddd68977a1a
ps://git.kernel.org/stable/c/1b3fa9a3c420c31e77b406ddc28f3a627100516c - https://git.kernel.org/stable/c/a6caeddd68977a1aaaf62fbd1955b41dd5c3c5d3 - https://git.kernel.org/stable/c/0bae835b63c53f86cdc524f5962e39409585b22c
CVE ID: CVE-2022-49098 State: PUBLISHED Published: 2025-02-26T01:54:50.073Z Last Updated: 2025-05-04T12:44:17.900Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Fix potential crash on module unload The vmbus driver relies on the panic notifier infrastructure to perform some operations when a panic event is detected. Since vmbus can be built as module, it is required that the driver handles both registering and unregistering such panic notifier callback. After commit 74347a99e73a ("x86/Hyper-V: Unload vmbus channel in hv panic callback") though, the panic notifier registration is done unconditionally in the
r-V: Unload vmbus channel in hv panic callback") though, the panic notifier registration is done unconditionally in the module initialization routine whereas the unregistering procedure is conditionally guarded and executes only if HV_FEATURE_GUEST_CRASH_MSR_AVAILABLE capability is set. This patch fixes that by unconditionally unregistering the panic notifier in the module's exit routine as well. References: - https://git.kernel.org/stable/c/6b4c0149a56147b29169e07000d566162892722a - https://git.kernel.org/stable/c/2133c422a103cf7c7768c37b9ac382e73b691892 - https://git.kernel.org/stable/c/cf580d2e3884dbafd6b90269b03a24d661578624 - https://git.kernel.org/stable/c/dcd6b1a624c0ffa21034d8b1e02e9
el.org/stable/c/cf580d2e3884dbafd6b90269b03a24d661578624 - https://git.kernel.org/stable/c/dcd6b1a624c0ffa21034d8b1e02e9d068458f596 - https://git.kernel.org/stable/c/5ea98d0f5f035c1bcf1517ccec0e024ae35a48b2 - https://git.kernel.org/stable/c/3d0078f8bddd58d9bb1ad40bbe929f8633abb276 - https://git.kernel.org/stable/c/792f232d57ff28bbd5f9c4abe0466b23d5879dc8
CVE ID: CVE-2022-49099 State: PUBLISHED Published: 2025-02-26T01:54:50.571Z Last Updated: 2025-05-04T08:29:51.900Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Fix initialization of device object in vmbus_device_register() Initialize the device's dma_{mask,parms} pointers and the device's dma_mask value before invoking device_register(). Address the following trace with 5.17-rc7: [ 49.646839] WARNING: CPU: 0 PID: 189 at include/linux/dma-mapping.h:543 netvsc_probe+0x37a/0x3a0 [hv_netvsc] [ 49.646928] Call Trace: [ 49.646930] <TASK> [ 49.646935] vmbus_probe+0x40/0x60 [hv_vmbus] [ 49.646942] really_probe+0x1
[ 49.646928] Call Trace: [ 49.646930] <TASK> [ 49.646935] vmbus_probe+0x40/0x60 [hv_vmbus] [ 49.646942] really_probe+0x1ce/0x3b0 [ 49.646948] __driver_probe_device+0x109/0x180 [ 49.646952] driver_probe_device+0x23/0xa0 [ 49.646955] __device_attach_driver+0x76/0xe0 [ 49.646958] ? driver_allows_async_probing+0x50/0x50 [ 49.646961] bus_for_each_drv+0x84/0xd0 [ 49.646964] __device_attach+0xed/0x170 [ 49.646967] device_initial_probe+0x13/0x20 [ 49.646970] bus_probe_device+0x8f/0xa0 [ 49.646973] device_add+0x41a/0x8e0 [ 49.646975] ? hrtimer_init+0x28/0x80 [ 49.646981] device_register+0x1b/0x20 [ 49.646983] vmbus_device_register+0x5e/0xf0 [hv_vmbus] [ 49.646991] vmbus_add_channel_work+0x12d/0x190 [
ster+0x1b/0x20 [ 49.646983] vmbus_device_register+0x5e/0xf0 [hv_vmbus] [ 49.646991] vmbus_add_channel_work+0x12d/0x190 [hv_vmbus] [ 49.646999] process_one_work+0x21d/0x3f0 [ 49.647002] worker_thread+0x4a/0x3b0 [ 49.647005] ? process_one_work+0x3f0/0x3f0 [ 49.647007] kthread+0xff/0x130 [ 49.647011] ? kthread_complete_and_exit+0x20/0x20 [ 49.647015] ret_from_fork+0x22/0x30 [ 49.647020] </TASK> [ 49.647021] ---[ end trace 0000000000000000 ]--- References: - https://git.kernel.org/stable/c/2fe4b8631427618175a32f125062df91a5fe3f73 - https://git.kernel.org/stable/c/3a5469582c241abca22500f36a9cb8e9331969cf
CVE ID: CVE-2022-49100 State: PUBLISHED Published: 2025-02-26T01:54:51.044Z Last Updated: 2025-05-04T08:29:53.050Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: virtio_console: eliminate anonymous module_init & module_exit Eliminate anonymous module_init() and module_exit(), which can lead to confusion or ambiguity when reading System.map, crashes/oops/bugs, or an initcall_debug log. Give each of these init and exit functions unique driver-specific names to eliminate the anonymous names. Example 1: (System.map) ffffffff832fc78c t init ffffffff832fc79e t init ffffffff832fc8f8 t init Example 2: (initcall_debug log) calling init+
p) ffffffff832fc78c t init ffffffff832fc79e t init ffffffff832fc8f8 t init Example 2: (initcall_debug log) calling init+0x0/0x12 @ 1 initcall init+0x0/0x12 returned 0 after 15 usecs calling init+0x0/0x60 @ 1 initcall init+0x0/0x60 returned 0 after 2 usecs calling init+0x0/0x9a @ 1 initcall init+0x0/0x9a returned 0 after 74 usecs References: - https://git.kernel.org/stable/c/93e3d88321d2274fa4e26b006e19cc10fec331c2 - https://git.kernel.org/stable/c/7deaddb704713608e0ae559e27185581b9af71a0 - https://git.kernel.org/stable/c/0f3d824bd70a1303464d5e93ee3e7afe7832fe89 - https://git.kernel.org/stable/c/3504b0a177208eda85bf472bbf7c9aa77d2b8343 - https://git.kernel.org/stable/c/c69b442125bf009fce26e15
t.kernel.org/stable/c/3504b0a177208eda85bf472bbf7c9aa77d2b8343 - https://git.kernel.org/stable/c/c69b442125bf009fce26e15aa5616caf8a3673c3 - https://git.kernel.org/stable/c/44c2d5fbe7b2bd1f8cb114d608a591a73a5d4ae6 - https://git.kernel.org/stable/c/3fd5dee7404ce40c79cba468bb2510115639d975 - https://git.kernel.org/stable/c/71612aee09ecea3475f8751dc841d75a011b1fd0 - https://git.kernel.org/stable/c/fefb8a2a941338d871e2d83fbd65fbfa068857bd
CVE ID: CVE-2022-49101 State: REJECTED Published: 2025-02-26T01:54:51.561Z Last Updated: 2025-02-26T11:29:50.175Z Description: No description available.
CVE ID: CVE-2022-49102 State: PUBLISHED Published: 2025-02-26T01:54:52.038Z Last Updated: 2025-10-01T19:57:05.589Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: habanalabs: fix possible memory leak in MMU DR fini This patch fixes what seems to be copy paste error. We will have a memory leak if the host-resident shadow is NULL (which will likely happen as the DR and HR are not dependent). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/12e49aefda2e04b07604f13e03f40027cbeb0dc6 - https://git.kernel.org/stable/c/6d421fb7a9eddd8ce0a05641a3db97283fe20699 - https://git.kernel.org/stabl
f40027cbeb0dc6 - https://git.kernel.org/stable/c/6d421fb7a9eddd8ce0a05641a3db97283fe20699 - https://git.kernel.org/stable/c/30058d3a83cfe8c6aacbfe5ab13c01dd0c1799e3 - https://git.kernel.org/stable/c/eb85eec858c1a5c11d3a0bff403f6440b05b40dc
CVE ID: CVE-2022-49103 State: PUBLISHED Published: 2025-02-26T01:54:52.530Z Last Updated: 2025-10-01T19:57:05.438Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: NFSv4.2: fix reference count leaks in _nfs42_proc_copy_notify() [You don't often get email from xiongx18@fudan.edu.cn. Learn why this is important at http://aka.ms/LearnAboutSenderIdentification.] The reference counting issue happens in two error paths in the function _nfs42_proc_copy_notify(). In both error paths, the function simply returns the error code and forgets to balance the refcount of object `ctx`, bumped by get_nfs_open_context() earlier, which may cause re
r code and forgets to balance the refcount of object `ctx`, bumped by get_nfs_open_context() earlier, which may cause refcount leaks. Fix it by balancing refcount of the `ctx` object before the function returns in both error paths. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/9b9feec97c1fc7dd9bb69f62c4905cddf1801599 - https://git.kernel.org/stable/c/b37f482ba9f0e6382c188e3fccf6c4b2fdc938eb - https://git.kernel.org/stable/c/fb73bf6305f4eb8f0cf9a61ee874d55f019d6dc4 - https://git.kernel.org/stable/c/f46f632f9cfae4b2e3635fa58840a8ec584c42e3 - https://git.kernel.org/stable/c/b7f114edd54326f730a754547e7cfb197b5bc132
CVE ID: CVE-2022-49104 State: PUBLISHED Published: 2025-02-26T01:54:53.004Z Last Updated: 2025-10-01T19:57:05.282Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: staging: vchiq_core: handle NULL result of find_service_by_handle In case of an invalid handle the function find_servive_by_handle returns NULL. So take care of this and avoid a NULL pointer dereference. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/aa0b7296785312a4bfa8fac0ba8ad78698fd9fcf - https://git.kernel.org/stable/c/42f2142a337ee372455574809fc924580a7e51b2 - https://git.kernel.org/stable/c/04202f54dd8899e10f56a8
it.kernel.org/stable/c/42f2142a337ee372455574809fc924580a7e51b2 - https://git.kernel.org/stable/c/04202f54dd8899e10f56a89c4c1ede0043fa22af - https://git.kernel.org/stable/c/3b424f6586a870b8d657c5e5419465bbe0e7b61f - https://git.kernel.org/stable/c/ca225857faf237234d2fffe5d1919467dfadd822
CVE ID: CVE-2022-49105 State: PUBLISHED Published: 2025-02-26T01:54:53.509Z Last Updated: 2025-10-01T19:57:05.139Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: staging: wfx: fix an error handling in wfx_init_common() One error handler of wfx_init_common() return without calling ieee80211_free_hw(hw), which may result in memory leak. And I add one err label to unify the error handler, which is useful for the subsequent changes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/93498c6e775ae91732a8109dba1bdcd324908f84 - https://git.kernel.org/stable/c/86efcb524ae1889ae73f2a2f0bb7ff
l.org/stable/c/93498c6e775ae91732a8109dba1bdcd324908f84 - https://git.kernel.org/stable/c/86efcb524ae1889ae73f2a2f0bb7fff2ec757ab0 - https://git.kernel.org/stable/c/ab0fed1fa744173433cfd1dbaf9239f200ded650 - https://git.kernel.org/stable/c/9727912e906762a63c1a667c84731d3427653f88 - https://git.kernel.org/stable/c/60f1d3c92dc1ef1026e5b917a329a7fa947da036
CVE ID: CVE-2022-49106 State: PUBLISHED Published: 2025-02-26T01:54:53.985Z Last Updated: 2025-10-01T19:57:04.968Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: staging: vchiq_arm: Avoid NULL ptr deref in vchiq_dump_platform_instances vchiq_get_state() can return a NULL pointer. So handle this cases and avoid a NULL pointer derefence in vchiq_dump_platform_instances. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/176df12b38c70b0a45e6392a0ee5bc83489dfc29 - https://git.kernel.org/stable/c/4627250cabaa80278d3ab01ad107893cea83799f - https://git.kernel.org/stable/c/51e5e5c34c22c0bfe
s://git.kernel.org/stable/c/4627250cabaa80278d3ab01ad107893cea83799f - https://git.kernel.org/stable/c/51e5e5c34c22c0bfec0808d8c33e0b2fcf4c7c89 - https://git.kernel.org/stable/c/aa899e686d442c63d50f4d369cc02dbbf0941cb0
CVE ID: CVE-2022-49107 State: PUBLISHED Published: 2025-02-26T01:54:54.493Z Last Updated: 2025-10-01T19:57:04.832Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ceph: fix memory leak in ceph_readdir when note_last_dentry returns error Reset the last_readdir at the same time, and add a comment explaining why we don't free last_readdir when dir_emit returns false. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/f4429786129648a8f4bb1e5faa143c4478cc5c4a - https://git.kernel.org/stable/c/2fe82d3254029ef9ec4e7be890125d5ef4f537de - https://git.kernel.org/stable/c/e792575b902a3939ca4824
it.kernel.org/stable/c/2fe82d3254029ef9ec4e7be890125d5ef4f537de - https://git.kernel.org/stable/c/e792575b902a3939ca482491ee9fb3a236f99640 - https://git.kernel.org/stable/c/7f740ede35132d3d5d19747cad56a511d21bb156 - https://git.kernel.org/stable/c/f639d9867eea647005dc824e0e24f39ffc50d4e4
CVE ID: CVE-2022-49108 State: PUBLISHED Published: 2025-02-26T01:54:54.968Z Last Updated: 2025-10-01T19:57:04.686Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: clk: mediatek: Fix memory leaks on probe Handle the error branches to free memory where required. Addresses-Coverity-ID: 1491825 ("Resource leak") Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/c6a0b413398588fc2d8b174a79ea715b66413fca - https://git.kernel.org/stable/c/02742d1d5c95cff8b6e9379aae4ab12674f7265d - https://git.kernel.org/stable/c/7a688c91d3fd54c53e7a9edd6052cdae98dd99d8
CVE ID: CVE-2022-49109 State: PUBLISHED Published: 2025-02-26T01:54:55.508Z Last Updated: 2025-05-04T08:30:04.375Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ceph: fix inode reference leakage in ceph_get_snapdir() The ceph_get_inode() will search for or insert a new inode into the hash for the given vino, and return a reference to it. If new is non-NULL, its reference is consumed. We should release the reference when in error handing cases. References: - https://git.kernel.org/stable/c/3ae7163598c611a8892698e0c056fe794e52b44b - https://git.kernel.org/stable/c/9cd21981dedfb4fe9f344529e4be35727cb10940 - https://git.kernel.org
98e0c056fe794e52b44b - https://git.kernel.org/stable/c/9cd21981dedfb4fe9f344529e4be35727cb10940 - https://git.kernel.org/stable/c/b2d9bb3f06abddefdfa740b0a604575b6797e1bf - https://git.kernel.org/stable/c/322794d3355c33adcc4feace0045d85a8e4ed813
CVE ID: CVE-2022-49110 State: PUBLISHED Published: 2025-02-26T01:54:55.998Z Last Updated: 2025-05-04T08:30:05.756Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: revisit gc autotuning as of commit 4608fdfc07e1 ("netfilter: conntrack: collect all entries in one cycle") conntrack gc was changed to run every 2 minutes. On systems where conntrack hash table is set to large value, most evictions happen from gc worker rather than the packet path due to hash table distribution. This causes netlink event overflows when events are collected. This change collects average expiry of scanned entries and reschedules to
nk event overflows when events are collected. This change collects average expiry of scanned entries and reschedules to the average remaining value, within 1 to 60 second interval. To avoid event overflows, reschedule after each bucket and add a limit for both run time and number of evictions per run. If more entries have to be evicted, reschedule and restart 1 jiffy into the future. References: - https://git.kernel.org/stable/c/58d52743ae85d28c9335c6034d6ce350b8689951 - https://git.kernel.org/stable/c/7cd361d5e6d986c0d4cafb9ceaa803359048ae15 - https://git.kernel.org/stable/c/592e57591826f3d09c28d755a39ea8e9d13705ad - https://git.kernel.org/stable/c/2cfadb761d3d0219412fd8150faea60c7e863833
CVE ID: CVE-2022-49111 State: PUBLISHED Published: 2025-02-26T01:54:56.622Z Last Updated: 2025-05-04T08:30:07.124Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix use after free in hci_send_acl This fixes the following trace caused by receiving HCI_EV_DISCONN_PHY_LINK_COMPLETE which does call hci_conn_del without first checking if conn->type is in fact AMP_LINK and in case it is do properly cleanup upper layers with hci_disconn_cfm: ================================================================== BUG: KASAN: use-after-free in hci_send_acl+0xaba/0xc50 Read of size 8 at addr ffff88800e404818 by task bluetoothd/142