Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-50293 State: PUBLISHED Published: 2025-09-15T14:45:49.338Z Last Updated: 2025-09-15T14:45:49.338Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: btrfs: do not BUG_ON() on ENOMEM when dropping extent items for a range If we get -ENOMEM while dropping file extent items in a given range, at btrfs_drop_extents(), due to failure to allocate memory when attempting to increment the reference count for an extent or drop the reference count, we handle it with a BUG_ON(). This is excessive, instead we can simply abort the transaction and return the error to the caller. In fact most callers of btrfs_drop_extents(), direct
an simply abort the transaction and return the error to the caller. In fact most callers of btrfs_drop_extents(), directly or indirectly, already abort the transaction if btrfs_drop_extents() returns any error. Also, we already have error paths at btrfs_drop_extents() that may return -ENOMEM and in those cases we abort the transaction, like for example anything that changes the b+tree may return -ENOMEM due to a failure to allocate a new extent buffer when COWing an existing extent buffer, such as a call to btrfs_duplicate_item() for example. So replace the BUG_ON() calls with proper logic to abort the transaction and return the error. References: - https://git.kernel.org/stable/c/50f993da94
ith proper logic to abort the transaction and return the error. References: - https://git.kernel.org/stable/c/50f993da945074b2a069da099a0331b23a0c89a0 - https://git.kernel.org/stable/c/7fbcb635c8fc927d139f3302babcf1b42c09265c - https://git.kernel.org/stable/c/1baf3370e2dc5e6bd1368348736189457dab2a27 - https://git.kernel.org/stable/c/162d053e15fe985f754ef495a96eb3db970c43ed
CVE ID: CVE-2022-50294 State: PUBLISHED Published: 2025-09-15T14:45:50.252Z Last Updated: 2025-09-15T14:45:50.252Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: fix memory leak in lbs_init_adapter() When kfifo_alloc() failed in lbs_init_adapter(), cmd buffer is not released. Add free memory to processing error path. References: - https://git.kernel.org/stable/c/4c102ad59bfa66c0f6662af64fa3b9007b02c20f - https://git.kernel.org/stable/c/98e0ff6980c89239d9e5d3da90d791c2383dc23a - https://git.kernel.org/stable/c/23b34e08de5c2380414c9d3c33e8235094bcccae - https://git.kernel.org/stable/c/9c8f50c7433bdfba1588831c41313
el.org/stable/c/23b34e08de5c2380414c9d3c33e8235094bcccae - https://git.kernel.org/stable/c/9c8f50c7433bdfba1588831c413136ecc3f29f99 - https://git.kernel.org/stable/c/037f84c0bfae5c436c651d0e804264e2648010ec - https://git.kernel.org/stable/c/653d13a73e498d0bb6aeaf689aaa960defa7878b - https://git.kernel.org/stable/c/d46c33f667b05c22bc5c5b69aa730349c4b6fe31 - https://git.kernel.org/stable/c/16a03958618fb91bb1bc7077cf3211055162cc2f
CVE ID: CVE-2022-50295 State: PUBLISHED Published: 2025-09-15T14:45:51.241Z Last Updated: 2025-09-15T14:45:51.241Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: io_uring/msg_ring: Fix NULL pointer dereference in io_msg_send_fd() Syzkaller produced the below call trace: BUG: KASAN: null-ptr-deref in io_msg_ring+0x3cb/0x9f0 Write of size 8 at addr 0000000000000070 by task repro/16399 CPU: 0 PID: 16399 Comm: repro Not tainted 6.1.0-rc1 #28 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 Call Trace: <TASK> dump_stack_lvl+0xcd/0x134 ? io_msg_ring+0x3cb/0x9f0 kasan_report+0xbc/0xf0 ? io_msg_ring+0x3cb/0x9f0
Call Trace: <TASK> dump_stack_lvl+0xcd/0x134 ? io_msg_ring+0x3cb/0x9f0 kasan_report+0xbc/0xf0 ? io_msg_ring+0x3cb/0x9f0 kasan_check_range+0x140/0x190 io_msg_ring+0x3cb/0x9f0 ? io_msg_ring_prep+0x300/0x300 io_issue_sqe+0x698/0xca0 io_submit_sqes+0x92f/0x1c30 __do_sys_io_uring_enter+0xae4/0x24b0 .... RIP: 0033:0x7f2eaf8f8289 RSP: 002b:00007fff40939718 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f2eaf8f8289 RDX: 0000000000000000 RSI: 0000000000006f71 RDI: 0000000000000004 RBP: 00007fff409397a0 R08: 0000000000000000 R09: 0000000000000039 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004006d0 R13: 00007fff40939880 R14: 0000000000000
0000000000039 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004006d0 R13: 00007fff40939880 R14: 0000000000000000 R15: 0000000000000000 </TASK> Kernel panic - not syncing: panic_on_warn set ... We don't have a NULL check on file_ptr in io_msg_send_fd() function, so when file_ptr is NUL src_file is also NULL and get_file() dereferences a NULL pointer and leads to above crash. Add a NULL check to fix this issue. References: - https://git.kernel.org/stable/c/0163e04ea64cc3dfaa12390286e5f2f481c3b2e3 - https://git.kernel.org/stable/c/16bbdfe5fb0e78e0acb13e45fc127e9a296913f2
CVE ID: CVE-2022-50296 State: PUBLISHED Published: 2025-09-15T14:45:52.121Z Last Updated: 2025-09-15T14:45:52.121Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: UM: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK When CONFIG_CPUMASK_OFFSTACK and CONFIG_DEBUG_PER_CPU_MAPS is selected, cpu_max_bits_warn() generates a runtime warning similar as below while we show /proc/cpuinfo. Fix this by using nr_cpu_ids (the runtime limit) instead of NR_CPUS to iterate CPUs. [ 3.052463] ------------[ cut here ]------------ [ 3.059679] WARNING: CPU: 3 PID: 1 at include/linux/cpumask.h:108 show_cpuinfo+0x5e8/0x5f0 [ 3.070072] Modules linked
0x60/0x88 [ 3.217625] [<900000000023d268>] __warn+0xd0/0x100 [ 3.223958] [<9000000000cf3c90>] warn_slowpath_fmt+0x7c/0xcc [ 3.231150] [<9000000000210220>] show_cpuinfo+0x5e8/0x5f0 [ 3.238080] [<90000000004f578c>] seq_read_iter+0x354/0x4b4 [ 3.245098] [<90000000004c2e90>] new_sync_read+0x17c/0x1c4 [ 3.252114] [<90000000004c5174>] vfs_read+0x138/0x1d0 [ 3.258694] [<90000000004c55f8>] ksys_read+0x70/0x100 [ 3.265265] [<9000000000cfde9c>] do_syscall+0x7c/0x94 [ 3.271820] [<9000000000202fe4>] handle_syscall+0xc4/0x160 [ 3.281824] ---[ end trace 8b484262b4b8c24c ]--- References: - https://git.kernel.org/stable/c/8f96aa67c2ccbd7e41b8dc992b8d13cfe206d571 - https://git.kernel.org/stable/c/dbd964a733d
- https://git.kernel.org/stable/c/8f96aa67c2ccbd7e41b8dc992b8d13cfe206d571 - https://git.kernel.org/stable/c/dbd964a733db015bbb9dff592c259c736398140f - https://git.kernel.org/stable/c/844748412be03a236dcf4a208b588162a275e189 - https://git.kernel.org/stable/c/cd251d39b13485eb94ee65bb000d024e02c00e45 - https://git.kernel.org/stable/c/6a73e6edcbf3cdd82796dcdf0c0f5fe5d91021af - https://git.kernel.org/stable/c/7efe61dc6aa45aab8a40e304fa2dae21e33b0db4 - https://git.kernel.org/stable/c/5177bdc38eaa1c1ca6302214ab06913540cd00a2 - https://git.kernel.org/stable/c/2e3863cc02c156b51b50592d43ffa6a13b680b0d - https://git.kernel.org/stable/c/16c546e148fa6d14a019431436a6f7b4087dbccd
CVE ID: CVE-2022-50297 State: PUBLISHED Published: 2025-09-15T14:45:53.146Z Last Updated: 2025-10-29T10:50:10.393Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: verify the expected usb_endpoints are present The bug arises when a USB device claims to be an ATH9K but doesn't have the expected endpoints. (In this case there was an interrupt endpoint where the driver expected a bulk endpoint.) The kernel needs to be able to handle such devices without getting an internal error. usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 3 PID: 500 at drivers/usb/core/urb.c:493 usb_submit_urb+0xce2/0x1430 drivers/usb/core/
r, pipe 3 != type 1 WARNING: CPU: 3 PID: 500 at drivers/usb/core/urb.c:493 usb_submit_urb+0xce2/0x1430 drivers/usb/core/urb.c:493 Modules linked in: CPU: 3 PID: 500 Comm: kworker/3:2 Not tainted 5.10.135-syzkaller #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 Workqueue: events request_firmware_work_func RIP: 0010:usb_submit_urb+0xce2/0x1430 drivers/usb/core/urb.c:493 Call Trace: ath9k_hif_usb_alloc_rx_urbs drivers/net/wireless/ath/ath9k/hif_usb.c:908 [inline] ath9k_hif_usb_alloc_urbs+0x75e/0x1010 drivers/net/wireless/ath/ath9k/hif_usb.c:1019 ath9k_hif_usb_dev_init drivers/net/wireless/ath/ath9k/hif_usb.c:1109 [inline] ath9k_hif_usb_firmware_cb+0x142/0x530
1019 ath9k_hif_usb_dev_init drivers/net/wireless/ath/ath9k/hif_usb.c:1109 [inline] ath9k_hif_usb_firmware_cb+0x142/0x530 drivers/net/wireless/ath/ath9k/hif_usb.c:1242 request_firmware_work_func+0x12e/0x240 drivers/base/firmware_loader/main.c:1097 process_one_work+0x9af/0x1600 kernel/workqueue.c:2279 worker_thread+0x61d/0x12f0 kernel/workqueue.c:2425 kthread+0x3b4/0x4a0 kernel/kthread.c:313 ret_from_fork+0x22/0x30 arch/x86/entry/entry_64.S:299 Found by Linux Verification Center (linuxtesting.org) with Syzkaller. References: - https://git.kernel.org/stable/c/932f0a5e829fb0b823f96d7fa9a0f4fc96660b77 - https://git.kernel.org/stable/c/d008a202a0528a058bac658e657c010ce8534f4a - https://git.kernel.
3f96d7fa9a0f4fc96660b77 - https://git.kernel.org/stable/c/d008a202a0528a058bac658e657c010ce8534f4a - https://git.kernel.org/stable/c/d64436af0bc3c9e579be761d7684f228fb95f3bb - https://git.kernel.org/stable/c/ca57748593ddd8e46d033fbaeb9d01ec533a6bfe - https://git.kernel.org/stable/c/1824ccabee5445347b83642e4087cc2eca070343 - https://git.kernel.org/stable/c/c319196a0e34ed2e66d6f876f58d8d446335c2a7 - https://git.kernel.org/stable/c/2d2eccf52ea0215c8d386b62af0b5fd4fc122bd5 - https://git.kernel.org/stable/c/0b7e6d681e00a96cde2b32a15ffa70e1be2e3209 - https://git.kernel.org/stable/c/16ef02bad239f11f322df8425d302be62f0443ce
CVE ID: CVE-2022-50298 State: PUBLISHED Published: 2025-09-15T14:45:54.112Z Last Updated: 2025-09-15T14:45:54.112Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: slimbus: qcom-ngd: cleanup in probe error path Add proper error path in probe() to cleanup resources previously acquired/allocated to fix warnings visible during probe deferral: notifier callback qcom_slim_ngd_ssr_notify already registered WARNING: CPU: 6 PID: 70 at kernel/notifier.c:28 notifier_chain_register+0x5c/0x90 Modules linked in: CPU: 6 PID: 70 Comm: kworker/u16:1 Not tainted 6.0.0-rc3-next-20220830 #380 Call trace: notifier_chain_register+0x5c/0x90 srcu_notif
70 Comm: kworker/u16:1 Not tainted 6.0.0-rc3-next-20220830 #380 Call trace: notifier_chain_register+0x5c/0x90 srcu_notifier_chain_register+0x44/0x90 qcom_register_ssr_notifier+0x38/0x4c qcom_slim_ngd_ctrl_probe+0xd8/0x400 platform_probe+0x6c/0xe0 really_probe+0xbc/0x2d4 __driver_probe_device+0x78/0xe0 driver_probe_device+0x3c/0x12c __device_attach_driver+0xb8/0x120 bus_for_each_drv+0x78/0xd0 __device_attach+0xa8/0x1c0 device_initial_probe+0x18/0x24 bus_probe_device+0xa0/0xac deferred_probe_work_func+0x88/0xc0 process_one_work+0x1d4/0x320 worker_thread+0x2cc/0x44c kthread+0x110/0x114 ret_from_fork+0x10/0x20 References: - https://git.kernel.org/stable/c/1d567179f27788925dc90fe5e905cdabfce7d190
110/0x114 ret_from_fork+0x10/0x20 References: - https://git.kernel.org/stable/c/1d567179f27788925dc90fe5e905cdabfce7d190 - https://git.kernel.org/stable/c/0c76110a3129c8d56d8fb7b6270dcc0c5c2f1a41 - https://git.kernel.org/stable/c/ef5c42e6eb29a86abbcd4b2fd427e5194e51053c - https://git.kernel.org/stable/c/16f14551d0df9e7cd283545d7d748829594d912f
CVE ID: CVE-2022-50299 State: PUBLISHED Published: 2025-09-15T14:45:55.071Z Last Updated: 2025-09-15T14:45:55.071Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: md: Replace snprintf with scnprintf Current code produces a warning as shown below when total characters in the constituent block device names plus the slashes exceeds 200. snprintf() returns the number of characters generated from the given input, which could cause the expression “200 – len” to wrap around to a large positive number. Fix this by using scnprintf() instead, which returns the actual number of characters written into the buffer. [ 1513.267938] -----------
g scnprintf() instead, which returns the actual number of characters written into the buffer. [ 1513.267938] ------------[ cut here ]------------ [ 1513.267943] WARNING: CPU: 15 PID: 37247 at <snip>/lib/vsprintf.c:2509 vsnprintf+0x2c8/0x510 [ 1513.267944] Modules linked in: <snip> [ 1513.267969] CPU: 15 PID: 37247 Comm: mdadm Not tainted 5.4.0-1085-azure #90~18.04.1-Ubuntu [ 1513.267969] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 05/09/2022 [ 1513.267971] RIP: 0010:vsnprintf+0x2c8/0x510 <-snip-> [ 1513.267982] Call Trace: [ 1513.267986] snprintf+0x45/0x70 [ 1513.267990] ? disk_name+0x71/0xa0 [ 1513.267993] dump_zones+0x114/0x240 [raid
race: [ 1513.267986] snprintf+0x45/0x70 [ 1513.267990] ? disk_name+0x71/0xa0 [ 1513.267993] dump_zones+0x114/0x240 [raid0] [ 1513.267996] ? _cond_resched+0x19/0x40 [ 1513.267998] raid0_run+0x19e/0x270 [raid0] [ 1513.268000] md_run+0x5e0/0xc50 [ 1513.268003] ? security_capable+0x3f/0x60 [ 1513.268005] do_md_run+0x19/0x110 [ 1513.268006] md_ioctl+0x195e/0x1f90 [ 1513.268007] blkdev_ioctl+0x91f/0x9f0 [ 1513.268010] block_ioctl+0x3d/0x50 [ 1513.268012] do_vfs_ioctl+0xa9/0x640 [ 1513.268014] ? __fput+0x162/0x260 [ 1513.268016] ksys_ioctl+0x75/0x80 [ 1513.268017] __x64_sys_ioctl+0x1a/0x20 [ 1513.268019] do_syscall_64+0x5e/0x200 [ 1513.268021] entry_SYSCALL_64_after_hwframe+0x44/0xa9 References: -
0x1a/0x20 [ 1513.268019] do_syscall_64+0x5e/0x200 [ 1513.268021] entry_SYSCALL_64_after_hwframe+0x44/0xa9 References: - https://git.kernel.org/stable/c/3b0a2bd51f60418ecd67493586a2bb2174199de3 - https://git.kernel.org/stable/c/897b1450abe5a67c842a5d24173ce4449ccdfa94 - https://git.kernel.org/stable/c/97238b88583c27c9d3b4a0cedb45f816523f17c3 - https://git.kernel.org/stable/c/76694e9ce0b2238c0a5f3ba54f9361dd3770ec78 - https://git.kernel.org/stable/c/5d8259c9d1915a50c60c7d6e9e7fb9b7da64a175 - https://git.kernel.org/stable/c/41ca95033a0c47cd6dace1f0a36a6eb5ebe799e6 - https://git.kernel.org/stable/c/f95825c4e51cf9a653b0ef947ac78401fc9d3a40 - https://git.kernel.org/stable/c/1727fd5015d8f93474148f9
t.kernel.org/stable/c/f95825c4e51cf9a653b0ef947ac78401fc9d3a40 - https://git.kernel.org/stable/c/1727fd5015d8f93474148f94e34cda5aa6ad4a43
CVE ID: CVE-2022-50300 State: PUBLISHED Published: 2025-09-15T14:45:55.896Z Last Updated: 2025-09-15T14:45:55.896Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix extent map use-after-free when handling missing device in read_one_chunk Store the error code before freeing the extent_map. Though it's reference counted structure, in that function it's the first and last allocation so this would lead to a potential use-after-free. The error can happen eg. when chunk is stored on a missing device and the degraded mount option is missing. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=216721 References: - https://git
degraded mount option is missing. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=216721 References: - https://git.kernel.org/stable/c/b8e7ed42bc3ca0d0e4191ee394d34962d3624c22 - https://git.kernel.org/stable/c/fce3713197ebba239e1c7e02174ed216ea1ee014 - https://git.kernel.org/stable/c/169a4cf46882974d4db6d85eb623ec898e51bbc0 - https://git.kernel.org/stable/c/1742e1c90c3da344f3bb9b1f1309b3f47482756a
CVE ID: CVE-2022-50301 State: PUBLISHED Published: 2025-09-15T14:45:57.019Z Last Updated: 2025-09-15T14:45:57.019Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: iommu/omap: Fix buffer overflow in debugfs There are two issues here: 1) The "len" variable needs to be checked before the very first write. Otherwise if omap2_iommu_dump_ctx() with "bytes" less than 32 it is a buffer overflow. 2) The snprintf() function returns the number of bytes that *would* have been copied if there were enough space. But we want to know the number of bytes which were *actually* copied so use scnprintf() instead. References: - https://git.kernel.or
to know the number of bytes which were *actually* copied so use scnprintf() instead. References: - https://git.kernel.org/stable/c/706e359cf046c142db290244c3f4938b20fbe805 - https://git.kernel.org/stable/c/ec53b99b6b9da8b501f001595a6260c03b42d5b7 - https://git.kernel.org/stable/c/648472df221f2bbffb433b964bcb87baccc586d8 - https://git.kernel.org/stable/c/4010a1afaae1c0fb9c2cac5de703bed29b1f1782 - https://git.kernel.org/stable/c/2fee0dbfaeaaa4bda04279ce772c4572b1429d04 - https://git.kernel.org/stable/c/0c7043a5b5c3b35f5dc8875757f71e7f491d64d4 - https://git.kernel.org/stable/c/bd0438f534b2e31b12f0b39b355c5dc2bbdaf854 - https://git.kernel.org/stable/c/9814cc350e0765ce69244bf55ae4c8b29facd27e - h
/bd0438f534b2e31b12f0b39b355c5dc2bbdaf854 - https://git.kernel.org/stable/c/9814cc350e0765ce69244bf55ae4c8b29facd27e - https://git.kernel.org/stable/c/184233a5202786b20220acd2d04ddf909ef18f29
CVE ID: CVE-2022-50302 State: PUBLISHED Published: 2025-09-15T14:45:57.924Z Last Updated: 2025-09-15T14:45:57.924Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: lockd: set other missing fields when unlocking files vfs_lock_file() expects the struct file_lock to be fully initialised by the caller. Re-exported NFSv3 has been seen to Oops if the fl_file field is NULL. References: - https://git.kernel.org/stable/c/31c93ee5f1e4dc278b562e20f3c3274ac34997f3 - https://git.kernel.org/stable/c/95d42a8d3d4ae84a0bd3ee23e1fee240cdf0a9f0 - https://git.kernel.org/stable/c/688575aef211b0986fc51010116f5888a99d76a2 - https://git.kernel.org/stab
1fee240cdf0a9f0 - https://git.kernel.org/stable/c/688575aef211b0986fc51010116f5888a99d76a2 - https://git.kernel.org/stable/c/d7aa9f7778316beb690f6e2763b6d672ad8b256f - https://git.kernel.org/stable/c/18ebd35b61b4693a0ddc270b6d4f18def232e770
CVE ID: CVE-2022-50303 State: PUBLISHED Published: 2025-09-15T14:45:58.735Z Last Updated: 2025-09-16T08:02:05.373Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix double release compute pasid If kfd_process_device_init_vm returns failure after vm is converted to compute vm and vm->pasid set to compute pasid, KFD will not take pdd->drm_file reference. As a result, drm close file handler maybe called to release the compute pasid before KFD process destroy worker to release the same pasid and set vm->pasid to zero, this generates below WARNING backtrace and NULL pointer access. Add helper amdgpu_amdkfd_gpuvm_set_vm_
m->pasid to zero, this generates below WARNING backtrace and NULL pointer access. Add helper amdgpu_amdkfd_gpuvm_set_vm_pasid and call it at the last step of kfd_process_device_init_vm, to ensure vm pasid is the original pasid if acquiring vm failed or is the compute pasid with pdd->drm_file reference taken to avoid double release same pasid. amdgpu: Failed to create process VM object ida_free called for id=32770 which is not allocated. WARNING: CPU: 57 PID: 72542 at ../lib/idr.c:522 ida_free+0x96/0x140 RIP: 0010:ida_free+0x96/0x140 Call Trace: amdgpu_pasid_free_delayed+0xe1/0x2a0 [amdgpu] amdgpu_driver_postclose_kms+0x2d8/0x340 [amdgpu] drm_file_free.part.13+0x216/0x270 [drm] drm_close_help
1/0x2a0 [amdgpu] amdgpu_driver_postclose_kms+0x2d8/0x340 [amdgpu] drm_file_free.part.13+0x216/0x270 [drm] drm_close_helper.isra.14+0x60/0x70 [drm] drm_release+0x6e/0xf0 [drm] __fput+0xcc/0x280 ____fput+0xe/0x20 task_work_run+0x96/0xc0 do_exit+0x3d0/0xc10 BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: 0010:ida_free+0x76/0x140 Call Trace: amdgpu_pasid_free_delayed+0xe1/0x2a0 [amdgpu] amdgpu_driver_postclose_kms+0x2d8/0x340 [amdgpu] drm_file_free.part.13+0x216/0x270 [drm] drm_close_helper.isra.14+0x60/0x70 [drm] drm_release+0x6e/0xf0 [drm] __fput+0xcc/0x280 ____fput+0xe/0x20 task_work_run+0x96/0xc0 do_exit+0x3d0/0xc10 References: - https://git.kernel.org/stable/c/89f0d766c
80 ____fput+0xe/0x20 task_work_run+0x96/0xc0 do_exit+0x3d0/0xc10 References: - https://git.kernel.org/stable/c/89f0d766c9e3fdeafbed6f855d433c2768cde862 - https://git.kernel.org/stable/c/a02c07b619899179384fde06f951530438a3512d - https://git.kernel.org/stable/c/1a799c4c190ea9f0e81028e3eb3037ed0ab17ff5
CVE ID: CVE-2022-50304 State: PUBLISHED Published: 2025-09-15T14:45:59.614Z Last Updated: 2025-09-15T14:45:59.614Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mtd: core: fix possible resource leak in init_mtd() I got the error report while inject fault in init_mtd(): sysfs: cannot create duplicate filename '/devices/virtual/bdi/mtd-0' Call Trace: <TASK> dump_stack_lvl+0x67/0x83 sysfs_warn_dup+0x60/0x70 sysfs_create_dir_ns+0x109/0x120 kobject_add_internal+0xce/0x2f0 kobject_add+0x98/0x110 device_add+0x179/0xc00 device_create_groups_vargs+0xf4/0x100 device_create+0x7b/0xb0 bdi_register_va.part.13+0x58/0x2d0 bdi_register+0x9b/0
c00 device_create_groups_vargs+0xf4/0x100 device_create+0x7b/0xb0 bdi_register_va.part.13+0x58/0x2d0 bdi_register+0x9b/0xb0 init_mtd+0x62/0x171 [mtd] do_one_initcall+0x6c/0x3c0 do_init_module+0x58/0x222 load_module+0x268e/0x27d0 __do_sys_finit_module+0xd5/0x140 do_syscall_64+0x37/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd </TASK> kobject_add_internal failed for mtd-0 with -EEXIST, don't try to register things with the same name in the same directory. Error registering mtd class or bdi: -17 If init_mtdchar() fails in init_mtd(), mtd_bdi will not be unregistered, as a result, we can't load the mtd module again, to fix this by calling bdi_unregister(mtd_bdi) after out_procfs label. Reference
lt, we can't load the mtd module again, to fix this by calling bdi_unregister(mtd_bdi) after out_procfs label. References: - https://git.kernel.org/stable/c/78816504100cbd8e6836df9f58cc4fbb8b262f1c - https://git.kernel.org/stable/c/26c304a3f136009c5a2a04e2bf3ac6aa25aabcb4 - https://git.kernel.org/stable/c/1aadf01e5076b9ab6bf294b9622335c651314895
CVE ID: CVE-2022-50305 State: PUBLISHED Published: 2025-09-15T14:46:00.558Z Last Updated: 2025-09-15T14:46:00.558Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ASoC: sof_es8336: fix possible use-after-free in sof_es8336_remove() sof_es8336_remove() calls cancel_delayed_work(). However, that function does not wait until the work function finishes. This means that the callback function may still be running after the driver's remove function has finished, which would result in a use-after-free. Fix by calling cancel_delayed_work_sync(), which ensures that the work is properly cancelled, no longer running, and unable to re-schedu
ancel_delayed_work_sync(), which ensures that the work is properly cancelled, no longer running, and unable to re-schedule itself. References: - https://git.kernel.org/stable/c/b85102a3aa3810a09eb55692e8cd6ffbb304e57d - https://git.kernel.org/stable/c/390a1a98288a53b2e7555097d83c6e55d579b166 - https://git.kernel.org/stable/c/1b41beaa7a58467505ec3023af8aad74f878b888
CVE ID: CVE-2022-50306 State: PUBLISHED Published: 2025-09-15T14:46:01.672Z Last Updated: 2025-09-15T14:46:01.672Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ext4: fix potential out of bound read in ext4_fc_replay_scan() For scan loop must ensure that at least EXT4_FC_TAG_BASE_LEN space. If remain space less than EXT4_FC_TAG_BASE_LEN which will lead to out of bound read when mounting corrupt file system image. ADD_RANGE/HEAD/TAIL is needed to add extra check when do journal scan, as this three tags will read data during scan, tag length couldn't less than data length which will read. References: - https://git.kernel.org/sta
ad data during scan, tag length couldn't less than data length which will read. References: - https://git.kernel.org/stable/c/6969367c1500c15eddc38fda12f6d15518ad6d03 - https://git.kernel.org/stable/c/f234294812c9b68d603650d28743eafb718e7ad5 - https://git.kernel.org/stable/c/1b45cc5c7b920fd8bf72e5a888ec7abeadf41e09