Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-50307 State: PUBLISHED Published: 2025-09-15T14:46:02.608Z Last Updated: 2025-09-15T14:46:02.608Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: s390/cio: fix out-of-bounds access on cio_ignore free The channel-subsystem-driver scans for newly available devices whenever device-IDs are removed from the cio_ignore list using a command such as: echo free >/proc/cio_ignore Since an I/O device scan might interfer with running I/Os, commit 172da89ed0ea ("s390/cio: avoid excessive path-verification requests") introduced an optimization to exclude online devices from the scan. The newly added check for online devices i
equests") introduced an optimization to exclude online devices from the scan. The newly added check for online devices incorrectly assumes that an I/O-subchannel's drvdata points to a struct io_subchannel_private. For devices that are bound to a non-default I/O subchannel driver, such as the vfio_ccw driver, this results in an out-of-bounds read access during each scan. Fix this by changing the scan logic to rely on a driver-independent online indication. For this we can use struct subchannel->config.ena, which is the driver's requested subchannel-enabled state. Since I/Os can only be started on enabled subchannels, this matches the intent of the original optimization of not scanning devices
can only be started on enabled subchannels, this matches the intent of the original optimization of not scanning devices where I/O might be running. References: - https://git.kernel.org/stable/c/0e501fd0f38e42304bfa0d46a812d93f80294a87 - https://git.kernel.org/stable/c/106ab66cf5467726ca5ead51623043d37c06820a - https://git.kernel.org/stable/c/1b6074112742f65ece71b0f299ca5a6a887d2db6
CVE ID: CVE-2022-50308 State: PUBLISHED Published: 2025-09-15T14:46:03.510Z Last Updated: 2025-09-15T14:46:03.510Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: Add checks for devm_kcalloc As the devm_kcalloc may return NULL, the return value needs to be checked to avoid NULL poineter dereference. References: - https://git.kernel.org/stable/c/4518d7cc38b7d1a7ce5a7878ca601c91e19fe47d - https://git.kernel.org/stable/c/f849c116d320e85d1e2c2804c0edb0be3953b62d - https://git.kernel.org/stable/c/7830e2289eb4b74970b6cd1b6cc68dcd021c2281 - https://git.kernel.org/stable/c/b1e4f92dd0c1d3c162d7ca6c1196995565cca96d - https://g
89eb4b74970b6cd1b6cc68dcd021c2281 - https://git.kernel.org/stable/c/b1e4f92dd0c1d3c162d7ca6c1196995565cca96d - https://git.kernel.org/stable/c/1bf5ee979076ceb121ee51c95197d890b1cee7f4
CVE ID: CVE-2022-50309 State: PUBLISHED Published: 2025-09-15T14:46:04.490Z Last Updated: 2025-09-15T14:46:04.490Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: media: xilinx: vipp: Fix refcount leak in xvip_graph_dma_init of_get_child_by_name() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak. References: - https://git.kernel.org/stable/c/7b0efe7534071e0153708886355d80db69525d50 - https://git.kernel.org/stable/c/6e7b3b1e4e9f739800cd8010b75a9bee8d808cee - https://git.kernel.org/stable/c/3c38467c3255c428cdbd3cefaccca4662f3
/stable/c/6e7b3b1e4e9f739800cd8010b75a9bee8d808cee - https://git.kernel.org/stable/c/3c38467c3255c428cdbd3cefaccca4662f302dc9 - https://git.kernel.org/stable/c/59b315353252abe7b8fdb8651ca31b8484ce287a - https://git.kernel.org/stable/c/2630cc88327a5557aa0d9cc63be95e3c6e0a55b3 - https://git.kernel.org/stable/c/2ea7caa9684687cf3adc1467cf4af3653a776192 - https://git.kernel.org/stable/c/22b93530bbe6af9dce8e520bb6e978d1bda39d2b - https://git.kernel.org/stable/c/3336210948b22c2db43e9df2ea403d251b4d24ab - https://git.kernel.org/stable/c/1c78f19c3a0ea312a8178a6bfd8934eb93e9b10a
CVE ID: CVE-2022-50310 State: PUBLISHED Published: 2025-09-15T14:46:05.486Z Last Updated: 2025-09-15T14:46:05.486Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ip6mr: fix UAF issue in ip6mr_sk_done() when addrconf_init_net() failed If the initialization fails in calling addrconf_init_net(), devconf_all is the pointer that has been released. Then ip6mr_sk_done() is called to release the net, accessing devconf->mc_forwarding directly causes invalid pointer access. The process is as follows: setup_net() ops_init() addrconf_init_net() all = kmemdup(...) ---> alloc "all" ... net->ipv6.devconf_all = all; __addrconf_sysctl_register(
t() addrconf_init_net() all = kmemdup(...) ---> alloc "all" ... net->ipv6.devconf_all = all; __addrconf_sysctl_register() ---> failed ... kfree(all); ---> ipv6.devconf_all invalid ... ops_exit_list() ... ip6mr_sk_done() devconf = net->ipv6.devconf_all; //devconf is invalid pointer if (!devconf || !atomic_read(&devconf->mc_forwarding)) The following is the Call Trace information: BUG: KASAN: use-after-free in ip6mr_sk_done+0x112/0x3a0 Read of size 4 at addr ffff888075508e88 by task ip/14554 Call Trace: <TASK> dump_stack_lvl+0x8e/0xd1 print_report+0x155/0x454 kasan_report+0xba/0x1f0 kasan_check_range+0x35/0x1b0 ip6mr_sk_done+0x112/0x3a0 rawv6_close+0x48/0x70 inet_release+0x109/0x230 inet6_rele
a/0x1f0 kasan_check_range+0x35/0x1b0 ip6mr_sk_done+0x112/0x3a0 rawv6_close+0x48/0x70 inet_release+0x109/0x230 inet6_release+0x4c/0x70 sock_release+0x87/0x1b0 igmp6_net_exit+0x6b/0x170 ops_exit_list+0xb0/0x170 setup_net+0x7ac/0xbd0 copy_net_ns+0x2e6/0x6b0 create_new_namespaces+0x382/0xa50 unshare_nsproxy_namespaces+0xa6/0x1c0 ksys_unshare+0x3a4/0x7e0 __x64_sys_unshare+0x2d/0x40 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 RIP: 0033:0x7f7963322547 </TASK> Allocated by task 14554: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 __kasan_kmalloc+0xa1/0xb0 __kmalloc_node_track_caller+0x4a/0xb0 kmemdup+0x28/0x60 addrconf_init_net+0x1be/0x840 ops_init+0xa5/0x410 setup_net+0x
0 __kmalloc_node_track_caller+0x4a/0xb0 kmemdup+0x28/0x60 addrconf_init_net+0x1be/0x840 ops_init+0xa5/0x410 setup_net+0x5aa/0xbd0 copy_net_ns+0x2e6/0x6b0 create_new_namespaces+0x382/0xa50 unshare_nsproxy_namespaces+0xa6/0x1c0 ksys_unshare+0x3a4/0x7e0 __x64_sys_unshare+0x2d/0x40 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Freed by task 14554: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 kasan_save_free_info+0x2a/0x40 ____kasan_slab_free+0x155/0x1b0 slab_free_freelist_hook+0x11b/0x220 __kmem_cache_free+0xa4/0x360 addrconf_init_net+0x623/0x840 ops_init+0xa5/0x410 setup_net+0x5aa/0xbd0 copy_net_ns+0x2e6/0x6b0 create_new_namespaces+0x382/0xa50 unshare_nsproxy_namespac
init+0xa5/0x410 setup_net+0x5aa/0xbd0 copy_net_ns+0x2e6/0x6b0 create_new_namespaces+0x382/0xa50 unshare_nsproxy_namespaces+0xa6/0x1c0 ksys_unshare+0x3a4/0x7e0 __x64_sys_unshare+0x2d/0x40 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 References: - https://git.kernel.org/stable/c/22a68c3b9362eaac7b035eba09e95e6b3f7a912c - https://git.kernel.org/stable/c/1ca695207ed2271ecbf8ee6c641970f621c157cc
CVE ID: CVE-2022-50311 State: PUBLISHED Published: 2025-09-15T14:46:06.504Z Last Updated: 2025-09-15T14:46:06.504Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: cxl: Fix refcount leak in cxl_calc_capp_routing of_get_next_parent() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. This function only calls of_node_put() in normal path, missing it in the error path. Add missing of_node_put() to avoid refcount leak. References: - https://git.kernel.org/stable/c/c9bebc503881c1391f6c4f820134884adecf1519 - https://git.kernel.org/stable/c/ee870f72465015327ad96204b0e92450d04870cd
e/c/c9bebc503881c1391f6c4f820134884adecf1519 - https://git.kernel.org/stable/c/ee870f72465015327ad96204b0e92450d04870cd - https://git.kernel.org/stable/c/f2d60f6ba173cded65081cee690b67802395a479 - https://git.kernel.org/stable/c/81c8bbf5b2b5f0c8030fff1716c00849cda8571a - https://git.kernel.org/stable/c/6a310e8db5409676b4b3e6c1f54dff174e4fd04d - https://git.kernel.org/stable/c/651e8bc9d0418c20a1989b7c078c64c2a6346fa3 - https://git.kernel.org/stable/c/2d7b6580384e6d65419933ddc525bd176095da54 - https://git.kernel.org/stable/c/1d09697ff22908ae487fc8c4fbde1811732be523
CVE ID: CVE-2022-50312 State: PUBLISHED Published: 2025-09-15T14:46:07.399Z Last Updated: 2025-09-15T14:46:07.399Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drivers: serial: jsm: fix some leaks in probe This error path needs to unwind instead of just returning directly. References: - https://git.kernel.org/stable/c/ff9a5e50fb1910be33e62925bc7ee3bef474879e - https://git.kernel.org/stable/c/3bf05c2650cf6b8d83bf0b0d808cc78c6ee7e84c - https://git.kernel.org/stable/c/6066bd69ffba3a6abc7c0793ccba1da79b7d77e3 - https://git.kernel.org/stable/c/744c2d33a88b082d9d504520f0132b3d688547b2 - https://git.kernel.org/stable/c/71ffe5111f0ff
https://git.kernel.org/stable/c/744c2d33a88b082d9d504520f0132b3d688547b2 - https://git.kernel.org/stable/c/71ffe5111f0ffa2fd43c14fd176c6f05d4e82212 - https://git.kernel.org/stable/c/6be8e565a4a60530797a974d0a3d0e30656166a1 - https://git.kernel.org/stable/c/737594536dc3ce732976c0d84bb1dcc842065521 - https://git.kernel.org/stable/c/3ea1fd63fdf0e83b491c2a9f25b395aa0e4bf6e8 - https://git.kernel.org/stable/c/1d5859ef229e381f4db38dce8ed58e4bf862006b
CVE ID: CVE-2022-50313 State: PUBLISHED Published: 2025-09-15T14:46:08.357Z Last Updated: 2025-09-15T14:46:08.357Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: erofs: fix order >= MAX_ORDER warning due to crafted negative i_size As syzbot reported [1], the root cause is that i_size field is a signed type, and negative i_size is also less than EROFS_BLKSIZ. As a consequence, it's handled as fast symlink unexpectedly. Let's fall back to the generic path to deal with such unusual i_size. [1] https://lore.kernel.org/r/000000000000ac8efa05e7feaa1f@google.com References: - https://git.kernel.org/stable/c/17a0cdbd7b0cf0fc0d7ca4187a6
.org/r/000000000000ac8efa05e7feaa1f@google.com References: - https://git.kernel.org/stable/c/17a0cdbd7b0cf0fc0d7ca4187a67f8f1c18c291f - https://git.kernel.org/stable/c/0ab621fcdff1a58ff4de51a8590fa92a0ecd34be - https://git.kernel.org/stable/c/acc2f40b980c61a9178b72cdedd150b829064997 - https://git.kernel.org/stable/c/b6c8330f5b0f22149957a2e4977fd0f01a9db7cd - https://git.kernel.org/stable/c/6235fb899b25fd287d5e42635ff82196395708cc - https://git.kernel.org/stable/c/1dd73601a1cba37a0ed5f89a8662c90191df5873
CVE ID: CVE-2022-50314 State: PUBLISHED Published: 2025-09-15T14:46:09.240Z Last Updated: 2025-09-15T14:46:09.240Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: nbd: Fix hung when signal interrupts nbd_start_device_ioctl() syzbot reported hung task [1]. The following program is a simplified version of the reproducer: int main(void) { int sv[2], fd; if (socketpair(AF_UNIX, SOCK_STREAM, 0, sv) < 0) return 1; if ((fd = open("/dev/nbd0", 0)) < 0) return 1; if (ioctl(fd, NBD_SET_SIZE_BLOCKS, 0x81) < 0) return 1; if (ioctl(fd, NBD_SET_SOCK, sv[0]) < 0) return 1; if (ioctl(fd, NBD_DO_IT) < 0) return 1; return 0; } When signal interru
f (ioctl(fd, NBD_SET_SOCK, sv[0]) < 0) return 1; if (ioctl(fd, NBD_DO_IT) < 0) return 1; return 0; } When signal interrupt nbd_start_device_ioctl() waiting the condition atomic_read(&config->recv_threads) == 0, the task can hung because it waits the completion of the inflight IOs. This patch fixes the issue by clearing queue, not just shutdown, when signal interrupt nbd_start_device_ioctl(). References: - https://git.kernel.org/stable/c/3ba3846cb3e2fb3c6fbf79e998472821b298419e - https://git.kernel.org/stable/c/c7b4641bd2395c2f3cd3b0a0cbf292ed9d489398 - https://git.kernel.org/stable/c/3575949513ea3b387b30dac1e69468a923c86caf - https://git.kernel.org/stable/c/b2700f98b3f4dd19fb4315b70581e5caff
g/stable/c/3575949513ea3b387b30dac1e69468a923c86caf - https://git.kernel.org/stable/c/b2700f98b3f4dd19fb4315b70581e5caff89eb49 - https://git.kernel.org/stable/c/c0d73be0af8c1310713bc39a8d7a22e35084e14f - https://git.kernel.org/stable/c/62006a72b05e0d38727eef5188700f2488be5e89 - https://git.kernel.org/stable/c/35fb7d4a53d9e36d1b91161ea9870d9c6d57dccf - https://git.kernel.org/stable/c/1de7c3cf48fc41cd95adb12bd1ea9033a917798a
CVE ID: CVE-2022-50315 State: PUBLISHED Published: 2025-09-15T14:46:10.177Z Last Updated: 2025-09-15T14:46:10.177Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS UBSAN complains about array-index-out-of-bounds: [ 1.980703] kernel: UBSAN: array-index-out-of-bounds in /build/linux-9H675w/linux-5.15.0/drivers/ata/libahci.c:968:41 [ 1.980709] kernel: index 15 is out of range for type 'ahci_em_priv [8]' [ 1.980713] kernel: CPU: 0 PID: 209 Comm: scsi_eh_8 Not tainted 5.15.0-25-generic #25-Ubuntu [ 1.980716] kernel: Hardware name: System manufacturer System Product Name/P5Q3, BIOS
nted 5.15.0-25-generic #25-Ubuntu [ 1.980716] kernel: Hardware name: System manufacturer System Product Name/P5Q3, BIOS 1102 06/11/2010 [ 1.980718] kernel: Call Trace: [ 1.980721] kernel: <TASK> [ 1.980723] kernel: show_stack+0x52/0x58 [ 1.980729] kernel: dump_stack_lvl+0x4a/0x5f [ 1.980734] kernel: dump_stack+0x10/0x12 [ 1.980736] kernel: ubsan_epilogue+0x9/0x45 [ 1.980739] kernel: __ubsan_handle_out_of_bounds.cold+0x44/0x49 [ 1.980742] kernel: ahci_qc_issue+0x166/0x170 [libahci] [ 1.980748] kernel: ata_qc_issue+0x135/0x240 [ 1.980752] kernel: ata_exec_internal_sg+0x2c4/0x580 [ 1.980754] kernel: ? vprintk_default+0x1d/0x20 [ 1.980759] kernel: ata_exec_internal+0x67/0xa0 [ 1.980762] kernel:
580 [ 1.980754] kernel: ? vprintk_default+0x1d/0x20 [ 1.980759] kernel: ata_exec_internal+0x67/0xa0 [ 1.980762] kernel: sata_pmp_read+0x8d/0xc0 [ 1.980765] kernel: sata_pmp_read_gscr+0x3c/0x90 [ 1.980768] kernel: sata_pmp_attach+0x8b/0x310 [ 1.980771] kernel: ata_eh_revalidate_and_attach+0x28c/0x4b0 [ 1.980775] kernel: ata_eh_recover+0x6b6/0xb30 [ 1.980778] kernel: ? ahci_do_hardreset+0x180/0x180 [libahci] [ 1.980783] kernel: ? ahci_stop_engine+0xb0/0xb0 [libahci] [ 1.980787] kernel: ? ahci_do_softreset+0x290/0x290 [libahci] [ 1.980792] kernel: ? trace_event_raw_event_ata_eh_link_autopsy_qc+0xe0/0xe0 [ 1.980795] kernel: sata_pmp_eh_recover.isra.0+0x214/0x560 [ 1.980799] kernel: sata_pmp_erro
h_link_autopsy_qc+0xe0/0xe0 [ 1.980795] kernel: sata_pmp_eh_recover.isra.0+0x214/0x560 [ 1.980799] kernel: sata_pmp_error_handler+0x23/0x40 [ 1.980802] kernel: ahci_error_handler+0x43/0x80 [libahci] [ 1.980806] kernel: ata_scsi_port_error_handler+0x2b1/0x600 [ 1.980810] kernel: ata_scsi_error+0x9c/0xd0 [ 1.980813] kernel: scsi_error_handler+0xa1/0x180 [ 1.980817] kernel: ? scsi_unjam_host+0x1c0/0x1c0 [ 1.980820] kernel: kthread+0x12a/0x150 [ 1.980823] kernel: ? set_kthread_struct+0x50/0x50 [ 1.980826] kernel: ret_from_fork+0x22/0x30 [ 1.980831] kernel: </TASK> This happens because sata_pmp_init_links() initialize link->pmp up to SATA_PMP_MAX_PORTS while em_priv is declared as 8 elements arra
because sata_pmp_init_links() initialize link->pmp up to SATA_PMP_MAX_PORTS while em_priv is declared as 8 elements array. I can't find the maximum Enclosure Management ports specified in AHCI spec v1.3.1, but "12.2.1 LED message type" states that "Port Multiplier Information" can utilize 4 bits, which implies it can support up to 16 ports. Hence, use SATA_PMP_MAX_PORTS as EM_MAX_SLOTS to resolve the issue. BugLink: https://bugs.launchpad.net/bugs/1970074 References: - https://git.kernel.org/stable/c/f70bd4339cb68bc7e206af4c922bc0d249244403 - https://git.kernel.org/stable/c/da2ea4a961d9f89ed248734e7032350c260dc3a3 - https://git.kernel.org/stable/c/67a00c299c5c143817c948fbc7de1a2fa1af38fb - h
/da2ea4a961d9f89ed248734e7032350c260dc3a3 - https://git.kernel.org/stable/c/67a00c299c5c143817c948fbc7de1a2fa1af38fb - https://git.kernel.org/stable/c/383b7c50f5445ff8dbbf03080905648d6980c39d - https://git.kernel.org/stable/c/303d0f761431d848dd8d7ff9fd9b8c101879cabe - https://git.kernel.org/stable/c/8fbe13de1cc7cef2564be3cbf60400b33eee023b - https://git.kernel.org/stable/c/d6314d5f68764550c84d732ce901ddd3ac6b415f - https://git.kernel.org/stable/c/1e41e693f458eef2d5728207dbd327cd3b16580a
CVE ID: CVE-2022-50316 State: PUBLISHED Published: 2025-09-15T14:48:49.320Z Last Updated: 2025-09-16T08:02:06.742Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: orangefs: Fix kmemleak in orangefs_sysfs_init() When insert and remove the orangefs module, there are kobjects memory leaked as below: unreferenced object 0xffff88810f95af00 (size 64): comm "insmod", pid 783, jiffies 4294813439 (age 65.512s) hex dump (first 32 bytes): a0 83 af 01 81 88 ff ff 08 af 95 0f 81 88 ff ff ................ 08 af 95 0f 81 88 ff ff 00 00 00 00 00 00 00 00 ................ backtrace: [<0000000031ab7788>] kmalloc_trace+0x27/0xa0 [<000000005a6e4dfe
f ff 00 00 00 00 00 00 00 00 ................ backtrace: [<0000000031ab7788>] kmalloc_trace+0x27/0xa0 [<000000005a6e4dfe>] orangefs_sysfs_init+0x42/0x3a0 [<00000000722645ca>] 0xffffffffa02780fe [<000000004232d9f7>] do_one_initcall+0x87/0x2a0 [<0000000054f22384>] do_init_module+0xdf/0x320 [<000000003263bdea>] load_module+0x2f98/0x3330 [<0000000052cd4153>] __do_sys_finit_module+0x113/0x1b0 [<00000000250ae02b>] do_syscall_64+0x35/0x80 [<00000000f11c03c7>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 unreferenced object 0xffff88810f95ae80 (size 64): comm "insmod", pid 783, jiffies 4294813439 (age 65.512s) hex dump (first 32 bytes): c8 90 0f 02 81 88 ff ff 88 ae 95 0f 81 88 ff ff ................ 88
4294813439 (age 65.512s) hex dump (first 32 bytes): c8 90 0f 02 81 88 ff ff 88 ae 95 0f 81 88 ff ff ................ 88 ae 95 0f 81 88 ff ff 00 00 00 00 00 00 00 00 ................ backtrace: [<0000000031ab7788>] kmalloc_trace+0x27/0xa0 [<000000001a4841fa>] orangefs_sysfs_init+0xc7/0x3a0 [<00000000722645ca>] 0xffffffffa02780fe [<000000004232d9f7>] do_one_initcall+0x87/0x2a0 [<0000000054f22384>] do_init_module+0xdf/0x320 [<000000003263bdea>] load_module+0x2f98/0x3330 [<0000000052cd4153>] __do_sys_finit_module+0x113/0x1b0 [<00000000250ae02b>] do_syscall_64+0x35/0x80 [<00000000f11c03c7>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 unreferenced object 0xffff88810f95ae00 (size 64): comm "insmod", p
00f11c03c7>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 unreferenced object 0xffff88810f95ae00 (size 64): comm "insmod", pid 783, jiffies 4294813440 (age 65.511s) hex dump (first 32 bytes): 60 87 a1 00 81 88 ff ff 08 ae 95 0f 81 88 ff ff `............... 08 ae 95 0f 81 88 ff ff 00 00 00 00 00 00 00 00 ................ backtrace: [<0000000031ab7788>] kmalloc_trace+0x27/0xa0 [<000000005915e797>] orangefs_sysfs_init+0x12b/0x3a0 [<00000000722645ca>] 0xffffffffa02780fe [<000000004232d9f7>] do_one_initcall+0x87/0x2a0 [<0000000054f22384>] do_init_module+0xdf/0x320 [<000000003263bdea>] load_module+0x2f98/0x3330 [<0000000052cd4153>] __do_sys_finit_module+0x113/0x1b0 [<00000000250ae02b>] do_syscall_64+0
>] load_module+0x2f98/0x3330 [<0000000052cd4153>] __do_sys_finit_module+0x113/0x1b0 [<00000000250ae02b>] do_syscall_64+0x35/0x80 [<00000000f11c03c7>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 unreferenced object 0xffff88810f95ad80 (size 64): comm "insmod", pid 783, jiffies 4294813440 (age 65.511s) hex dump (first 32 bytes): 78 90 0f 02 81 88 ff ff 88 ad 95 0f 81 88 ff ff x............... 88 ad 95 0f 81 88 ff ff 00 00 00 00 00 00 00 00 ................ backtrace: [<0000000031ab7788>] kmalloc_trace+0x27/0xa0 [<000000007a14eb35>] orangefs_sysfs_init+0x1ac/0x3a0 [<00000000722645ca>] 0xffffffffa02780fe [<000000004232d9f7>] do_one_initcall+0x87/0x2a0 [<0000000054f22384>] do_init_module+0xdf/0x320 [
ca>] 0xffffffffa02780fe [<000000004232d9f7>] do_one_initcall+0x87/0x2a0 [<0000000054f22384>] do_init_module+0xdf/0x320 [<000000003263bdea>] load_module+0x2f98/0x3330 [<0000000052cd4153>] __do_sys_finit_module+0x113/0x1b0 [<00000000250ae02b>] do_syscall_64+0x35/0x80 [<00000000f11c03c7>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 unreferenced object 0xffff88810f95ac00 (size 64): comm "insmod", pid 783, jiffies 4294813440 (age 65.531s) hex dump (first 32 bytes): e0 ff 67 02 81 88 ff ff 08 ac 95 0f 81 88 ff ff ..g............. 08 ac 95 0f 81 88 ff ff 00 00 00 00 00 00 00 00 ................ backtrace: [<0000000031ab7788>] kmalloc_trace+0x27/0xa0 [<000000001f38adcb>] orangefs_sysfs_init+0x291/0x3a0
........... backtrace: [<0000000031ab7788>] kmalloc_trace+0x27/0xa0 [<000000001f38adcb>] orangefs_sysfs_init+0x291/0x3a0 [<00000000722645ca>] 0xffffffffa02780fe [<000000004232d9f7>] do_one_initcall+0x87/0x2a0 [<0000000054f22384>] do_init_module+0xdf/0x320 [<000000003263bdea>] load_module+0x2f98/0x3330 [<0000000052cd4153>] __do_sys_finit_module+0x113/0x1b0 [<00000000250ae02b>] do_syscall_64+0x35/ ---truncated--- References: - https://git.kernel.org/stable/c/9ce4ba7fff5af36da82dc5964221367630621b99 - https://git.kernel.org/stable/c/22409490294180c39be7dd0e5b2667d41556307d - https://git.kernel.org/stable/c/1f2c0e8a587bcafad85019a2d80f158d8d41a868
CVE ID: CVE-2022-50317 State: PUBLISHED Published: 2025-09-15T14:48:50.167Z Last Updated: 2025-09-15T14:48:50.167Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/bridge: megachips: Fix a null pointer dereference bug When removing the module we will get the following warning: [ 31.911505] i2c-core: driver [stdp2690-ge-b850v3-fw] unregistered [ 31.912484] general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN PTI [ 31.913338] KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] [ 31.915280] RIP: 0010:drm_bridge_remove+0x97/0x130 [ 31.921825] Call Trace: [
e [0x0000000000000008-0x000000000000000f] [ 31.915280] RIP: 0010:drm_bridge_remove+0x97/0x130 [ 31.921825] Call Trace: [ 31.922533] stdp4028_ge_b850v3_fw_remove+0x34/0x60 [megachips_stdpxxxx_ge_b850v3_fw] [ 31.923139] i2c_device_remove+0x181/0x1f0 The two bridges (stdp2690, stdp4028) do not probe at the same time, so the driver does not call ge_b850v3_resgiter() when probing, causing the driver to try to remove the object that has not been initialized. Fix this by checking whether both the bridges are probed. References: - https://git.kernel.org/stable/c/aaa512ad1e59f2edf8a9e4f2b167a44b24670679 - https://git.kernel.org/stable/c/5bc20bafcd87ba0858ab772cefc7047cb51bc249 - https://git.kernel.or
9e4f2b167a44b24670679 - https://git.kernel.org/stable/c/5bc20bafcd87ba0858ab772cefc7047cb51bc249 - https://git.kernel.org/stable/c/1daf69228e310938177119c4eadcd30fc75c81e0 - https://git.kernel.org/stable/c/877e92e9b1bdeb580b31a46061005936be902cd4 - https://git.kernel.org/stable/c/4610e7a4111fa3f3ce27c09d6d94008c55f1cd31 - https://git.kernel.org/stable/c/21764467ab396d9f08921e0a5ffa1214244e1ad9 - https://git.kernel.org/stable/c/7371fad5cfe6eada6bb5523c895fd6074b15c2b9 - https://git.kernel.org/stable/c/1ff673333d46d2c1b053ebd0c1c7c7c79e36943e
CVE ID: CVE-2022-50318 State: PUBLISHED Published: 2025-09-15T14:48:51.035Z Last Updated: 2025-09-15T14:48:51.035Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel/uncore: Fix reference count leak in hswep_has_limit_sbox() pci_get_device() will increase the reference count for the returned 'dev'. We need to call pci_dev_put() to decrease the reference count. Since 'dev' is only used in pci_read_config_dword(), let's add pci_dev_put() right after it. References: - https://git.kernel.org/stable/c/5a96c10a56037db006ba6769307a9731cf6073be - https://git.kernel.org/stable/c/e293263248f25c6b8aa1caf7c1103d40aa03311e - http