Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
x1610 kernel/workqueue.c:2289 worker_thread+0x665/0x1080 kernel/workqueue.c:2436 kthread+0x2e4/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306 It was caused by srv->listener that might be set to null by tipc_topsrv_stop() in net .exit whereas it's still used in tipc_topsrv_accept() worker. srv->listener is protected by srv->idr_lock in tipc_topsrv_stop(), so add a check for srv->listener under srv->idr_lock in tipc_topsrv_accept() to avoid the null-ptr-deref. To ensure the lsock is not released during the tipc_topsrv_accept(), move sock_release() after tipc_topsrv_work_stop() where it's waiting until the tipc_topsrv_accept worker to be done. Note that sk_call
ase() after tipc_topsrv_work_stop() where it's waiting until the tipc_topsrv_accept worker to be done. Note that sk_callback_lock is used to protect sk->sk_user_data instead of srv->listener, and it should check srv in tipc_topsrv_listener_data_ready() instead. This also ensures that no more tipc_topsrv_accept worker will be started after tipc_conn_close() is called in tipc_topsrv_stop() where it sets sk->sk_user_data to null. References: - https://git.kernel.org/stable/c/ce69bdac2310152bb70845024d5d704c52aabfc3 - https://git.kernel.org/stable/c/24b129aed8730e48f47d852d58d76825ab6f407c - https://git.kernel.org/stable/c/32a3d4660b34ce49ac0162338ebe362098e2f5df - https://git.kernel.org/stable/
6825ab6f407c - https://git.kernel.org/stable/c/32a3d4660b34ce49ac0162338ebe362098e2f5df - https://git.kernel.org/stable/c/7a939503fc32bff4ed60800b73ff7fbb4aea2142 - https://git.kernel.org/stable/c/cedb41664e27b2cae7e21487f1bee22dcd84037d - https://git.kernel.org/stable/c/82cb4e4612c633a9ce320e1773114875604a3cce
CVE ID: CVE-2022-50556 State: PUBLISHED Published: 2025-10-22T13:23:17.527Z Last Updated: 2025-10-22T13:23:17.527Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm: Fix potential null-ptr-deref due to drmm_mode_config_init() drmm_mode_config_init() will call drm_mode_create_standard_properties() and won't check the ret value. When drm_mode_create_standard_properties() failed due to alloc, property will be a NULL pointer and may causes the null-ptr-deref. Fix the null-ptr-deref by adding the ret value check. Found null-ptr-deref while testing insert module bochs: general protection fault, probably for non-canonical address 0xd
Found null-ptr-deref while testing insert module bochs: general protection fault, probably for non-canonical address 0xdffffc000000000c: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067] CPU: 3 PID: 249 Comm: modprobe Not tainted 6.1.0-rc1+ #364 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014 RIP: 0010:drm_object_attach_property+0x73/0x3c0 [drm] Call Trace: <TASK> __drm_connector_init+0xb6c/0x1100 [drm] bochs_pci_probe.cold.11+0x4cb/0x7fe [bochs] pci_device_probe+0x17d/0x340 really_probe+0x1db/0x5d0 __driver_probe_device+0x1e7/0x250 driver_probe_device+0x4a/0x120 __driver_attach+0
+0x17d/0x340 really_probe+0x1db/0x5d0 __driver_probe_device+0x1e7/0x250 driver_probe_device+0x4a/0x120 __driver_attach+0xcd/0x2c0 bus_for_each_dev+0x11a/0x1b0 bus_add_driver+0x3d7/0x500 driver_register+0x18e/0x320 do_one_initcall+0xc4/0x3e0 do_init_module+0x1b4/0x630 load_module+0x5dca/0x7230 __do_sys_finit_module+0x100/0x170 do_syscall_64+0x3f/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7ff65af9f839 References: - https://git.kernel.org/stable/c/5ae70041a6d7de62a0cdb2bbcfe0c9cf753035d0 - https://git.kernel.org/stable/c/d06e827a65a6bcd2e329045d891d0739cec1cf4a - https://git.kernel.org/stable/c/b14147464251f66e38fa39f0aae9780466db8610 - https://git.kernel.org/stable/c/961620ad676
- https://git.kernel.org/stable/c/b14147464251f66e38fa39f0aae9780466db8610 - https://git.kernel.org/stable/c/961620ad67611a7320a49f4b6f3c5e2906833a03 - https://git.kernel.org/stable/c/834c23e4f798dcdc8af251b3c428ceef94741991
CVE ID: CVE-2022-50557 State: PUBLISHED Published: 2025-10-22T13:23:18.131Z Last Updated: 2025-10-22T13:23:18.131Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: pinctrl: thunderbay: fix possible memory leak in thunderbay_build_functions() The thunderbay_add_functions() will free memory of thunderbay_funcs when everything is ok, but thunderbay_funcs will not be freed when thunderbay_add_functions() fails, then there will be a memory leak, so we need to add kfree() when thunderbay_add_functions() fails to fix it. In addition, doing some cleaner works, moving kfree(funcs) from thunderbay_add_functions() to thunderbay_build_functi
t. In addition, doing some cleaner works, moving kfree(funcs) from thunderbay_add_functions() to thunderbay_build_functions(). References: - https://git.kernel.org/stable/c/3650943bab29d03ef147290451237713ed1942cd - https://git.kernel.org/stable/c/aae4846e8e49044cb51d0276bec2a3fc2d5cd8da - https://git.kernel.org/stable/c/83e1bcaf8cef26edaaf2a6098ef760f563683483
CVE ID: CVE-2022-50558 State: PUBLISHED Published: 2025-10-22T13:23:18.717Z Last Updated: 2025-10-22T13:23:18.717Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: regmap-irq: Use the new num_config_regs property in regmap_add_irq_chip_fwnode Commit faa87ce9196d ("regmap-irq: Introduce config registers for irq types") added the num_config_regs, then commit 9edd4f5aee84 ("regmap-irq: Deprecate type registers and virtual registers") suggested to replace num_type_reg with it. However, regmap_add_irq_chip_fwnode wasn't modified to use the new property. Later on, commit 255a03bb1bb3 ("ASoC: wcd9335: Convert irq chip to config regs") r
n't modified to use the new property. Later on, commit 255a03bb1bb3 ("ASoC: wcd9335: Convert irq chip to config regs") removed the old num_type_reg property from the WCD9335 driver's struct regmap_irq_chip, causing a null pointer dereference in regmap_irq_set_type when it tried to index d->type_buf as it was never allocated in regmap_add_irq_chip_fwnode: [ 39.199374] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ 39.200006] Call trace: [ 39.200014] regmap_irq_set_type+0x84/0x1c0 [ 39.200026] __irq_set_trigger+0x60/0x1c0 [ 39.200040] __setup_irq+0x2f4/0x78c [ 39.200051] request_threaded_irq+0xe8/0x1a0 Use num_config_regs in regmap_add_irq_chip_fwnode in
_setup_irq+0x2f4/0x78c [ 39.200051] request_threaded_irq+0xe8/0x1a0 Use num_config_regs in regmap_add_irq_chip_fwnode instead of num_type_reg, and fall back to it if num_config_regs isn't defined to maintain backward compatibility. References: - https://git.kernel.org/stable/c/57bb34330c0fc70bb4ab96399a3c1b80e73e9d49 - https://git.kernel.org/stable/c/961db32e52f4d34a9a95939a30393fd190397f84 - https://git.kernel.org/stable/c/84498d1fb35de6ab71bdfdb6270a464fb4a0951b
CVE ID: CVE-2022-50559 State: PUBLISHED Published: 2025-10-22T13:23:19.290Z Last Updated: 2025-10-22T13:23:19.290Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: clk: imx: scu: fix memleak on platform_device_add() fails No error handling is performed when platform_device_add() fails. Add error processing before return, and modified the return value. References: - https://git.kernel.org/stable/c/9209e6bab75d4008d9f4248c66008f3ffd24c931 - https://git.kernel.org/stable/c/43c589b7a187ef481b594317eaab8c8f269e4a68 - https://git.kernel.org/stable/c/05fe0b3d69b8e094db207648ab21cade56d71cd8 - https://git.kernel.org/stable/c/855ae87a2073
https://git.kernel.org/stable/c/05fe0b3d69b8e094db207648ab21cade56d71cd8 - https://git.kernel.org/stable/c/855ae87a2073ebf1b395e020de54fdf9ce7d166f
CVE ID: CVE-2022-50560 State: PUBLISHED Published: 2025-10-22T13:23:20.117Z Last Updated: 2025-10-22T13:23:20.117Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/meson: explicitly remove aggregate driver at module unload time Because component_master_del wasn't being called when unloading the meson_drm module, the aggregate device would linger forever in the global aggregate_devices list. That means when unloading and reloading the meson_dw_hdmi module, component_add would call into try_to_bring_up_aggregate_device and find the unbound meson_drm aggregate device. This would in turn dereference some of the aggregate_device's
te_device and find the unbound meson_drm aggregate device. This would in turn dereference some of the aggregate_device's struct entries which point to memory automatically freed by the devres API when unbinding the aggregate device from meson_drv_unbind, and trigger an use-after-free bug: [ +0.000014] ============================================================= [ +0.000007] BUG: KASAN: use-after-free in find_components+0x468/0x500 [ +0.000017] Read of size 8 at addr ffff000006731688 by task modprobe/2536 [ +0.000018] CPU: 4 PID: 2536 Comm: modprobe Tainted: G C O 5.19.0-rc6-lrmbkasan+ #1 [ +0.000010] Hardware name: Hardkernel ODROID-N2Plus (DT) [ +0.000008] Call trace: [ +0.000005] dump_bac
6-lrmbkasan+ #1 [ +0.000010] Hardware name: Hardkernel ODROID-N2Plus (DT) [ +0.000008] Call trace: [ +0.000005] dump_backtrace+0x1ec/0x280 [ +0.000011] show_stack+0x24/0x80 [ +0.000007] dump_stack_lvl+0x98/0xd4 [ +0.000010] print_address_description.constprop.0+0x80/0x520 [ +0.000011] print_report+0x128/0x260 [ +0.000007] kasan_report+0xb8/0xfc [ +0.000007] __asan_report_load8_noabort+0x3c/0x50 [ +0.000009] find_components+0x468/0x500 [ +0.000008] try_to_bring_up_aggregate_device+0x64/0x390 [ +0.000009] __component_add+0x1dc/0x49c [ +0.000009] component_add+0x20/0x30 [ +0.000008] meson_dw_hdmi_probe+0x28/0x34 [meson_dw_hdmi] [ +0.000013] platform_probe+0xd0/0x220 [ +0.000008] really_probe+0x
00008] meson_dw_hdmi_probe+0x28/0x34 [meson_dw_hdmi] [ +0.000013] platform_probe+0xd0/0x220 [ +0.000008] really_probe+0x3ac/0xa80 [ +0.000008] __driver_probe_device+0x1f8/0x400 [ +0.000008] driver_probe_device+0x68/0x1b0 [ +0.000008] __driver_attach+0x20c/0x480 [ +0.000009] bus_for_each_dev+0x114/0x1b0 [ +0.000007] driver_attach+0x48/0x64 [ +0.000009] bus_add_driver+0x390/0x564 [ +0.000007] driver_register+0x1a8/0x3e4 [ +0.000009] __platform_driver_register+0x6c/0x94 [ +0.000007] meson_dw_hdmi_platform_driver_init+0x30/0x1000 [meson_dw_hdmi] [ +0.000014] do_one_initcall+0xc4/0x2b0 [ +0.000008] do_init_module+0x154/0x570 [ +0.000010] load_module+0x1a78/0x1ea4 [ +0.000008] __do_sys_init_module
4/0x2b0 [ +0.000008] do_init_module+0x154/0x570 [ +0.000010] load_module+0x1a78/0x1ea4 [ +0.000008] __do_sys_init_module+0x184/0x1cc [ +0.000008] __arm64_sys_init_module+0x78/0xb0 [ +0.000008] invoke_syscall+0x74/0x260 [ +0.000008] el0_svc_common.constprop.0+0xcc/0x260 [ +0.000009] do_el0_svc+0x50/0x70 [ +0.000008] el0_svc+0x68/0x1a0 [ +0.000009] el0t_64_sync_handler+0x11c/0x150 [ +0.000009] el0t_64_sync+0x18c/0x190 [ +0.000014] Allocated by task 902: [ +0.000007] kasan_save_stack+0x2c/0x5c [ +0.000009] __kasan_kmalloc+0x90/0xd0 [ +0.000007] __kmalloc_node+0x240/0x580 [ +0.000010] memcg_alloc_slab_cgroups+0xa4/0x1ac [ +0.000010] memcg_slab_post_alloc_hook+0xbc/0x4c0 [ +0.000008] kmem_cache_a
000010] memcg_alloc_slab_cgroups+0xa4/0x1ac [ +0.000010] memcg_slab_post_alloc_hook+0xbc/0x4c0 [ +0.000008] kmem_cache_alloc_node+0x1d0/0x490 [ +0.000009] __alloc_skb+0x1d4/0x310 [ +0.000010] alloc_skb_with_frags+0x8c/0x620 [ +0.000008] sock_alloc_send_pskb+0x5ac/0x6d0 [ +0.000010] unix_dgram_sendmsg+0x2e0/0x12f0 [ +0.000010] sock_sendmsg+0xcc/0x110 [ +0.000007] sock_write_iter+0x1d0/0x304 [ +0.000008] new_sync_write+0x364/0x460 [ +0.000007] vfs_write+0x420/0x5ac [ +0.000008] ksys_write+0x19c/0x1f0 [ +0.000008] __arm64_sys_write+0x78/0xb0 [ +0.000007] invoke_syscall+0x74/0x260 [ +0.000008] el0_svc_common.constprop.0+0x1a8/0x260 [ +0.000009] do_el0_svc+0x50/0x70 [ +0.000007] el0_svc+0x68/0x1a
260 [ +0.000008] el0_svc_common.constprop.0+0x1a8/0x260 [ +0.000009] do_el0_svc+0x50/0x70 [ +0.000007] el0_svc+0x68/0x1a0 [ +0.000008] el0t_64_sync_handler+0x11c/0x150 [ +0.000008] el0t_64_sync+0x18c/0x190 [ +0.000013] Freed by task 2509: [ +0.000008] kasan_save_stack+0x2c/0x5c [ +0.000007] kasan_set_track+0x2c/0x40 [ +0.000008] kasan_set_free_info+0x28/0x50 [ +0.000008] ____kasan_slab_free+0x128/0x1d4 [ +0.000008] __kasan_slab_free+0x18/0x24 [ +0.000007] slab_free_freelist_hook+0x108/0x230 [ +0.000010] ---truncated--- References: - https://git.kernel.org/stable/c/8a427a22839daacd36531a62c83d5c9cd6f20657 - https://git.kernel.org/stable/c/587c7da877219e6185217bf64418e62e114dab1e - https://git
39daacd36531a62c83d5c9cd6f20657 - https://git.kernel.org/stable/c/587c7da877219e6185217bf64418e62e114dab1e - https://git.kernel.org/stable/c/f11aa996fc01888f870be0e79ba71526888c0d8a - https://git.kernel.org/stable/c/6ef20de2fe0ee1decedbfabb17782897ca27bfe5 - https://git.kernel.org/stable/c/8616f2a0589a80e08434212324250eb22f6a66ce
CVE ID: CVE-2022-50561 State: PUBLISHED Published: 2025-10-22T13:23:20.802Z Last Updated: 2025-10-22T13:23:20.802Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: iio: fix memory leak in iio_device_register_eventset() When iio_device_register_sysfs_group() returns failed, iio_device_register_eventset() needs to free attrs array. Otherwise, kmemleak would scan & report memory leak as below: unreferenced object 0xffff88810a1cc3c0 (size 32): comm "100-i2c-vcnl302", pid 728, jiffies 4295052307 (age 156.027s) backtrace: __kmalloc+0x46/0x1b0 iio_device_register_eventset at drivers/iio/industrialio-event.c:541 __iio_device_register at
ace: __kmalloc+0x46/0x1b0 iio_device_register_eventset at drivers/iio/industrialio-event.c:541 __iio_device_register at drivers/iio/industrialio-core.c:1959 __devm_iio_device_register at drivers/iio/industrialio-core.c:2040 References: - https://git.kernel.org/stable/c/dc6afd6070f3a5b086c8c5cfa6ded63ae44494da - https://git.kernel.org/stable/c/5de3add7509c95685f1185683b817dd206c4b1f1 - https://git.kernel.org/stable/c/a154b1c139fbf6a49762159be81d425d41ceec87 - https://git.kernel.org/stable/c/86fdd15e10e404e70ecb2a3bff24d70356d42b36
CVE ID: CVE-2022-50562 State: PUBLISHED Published: 2025-10-22T13:23:21.421Z Last Updated: 2025-10-22T13:23:21.421Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: tpm: acpi: Call acpi_put_table() to fix memory leak The start and length of the event log area are obtained from TPM2 or TCPA table, so we call acpi_get_table() to get the ACPI information, but the acpi_get_table() should be coupled with acpi_put_table() to release the ACPI memory, add the acpi_put_table() properly to fix the memory leak. While we are at it, remove the redundant empty line at the end of the tpm_read_log_acpi(). References: - https://git.kernel.org/stab
at it, remove the redundant empty line at the end of the tpm_read_log_acpi(). References: - https://git.kernel.org/stable/c/8ddc48068ac85740d3d5f9f3b0b323e733a35b33 - https://git.kernel.org/stable/c/638cd298dfebce46919cbd6cf1884701215f506d - https://git.kernel.org/stable/c/694a3d66f493afd77c704c6de91d9be4d6e004e4 - https://git.kernel.org/stable/c/bf31e3f8077af539feaf4e9bbf82e8eb51e7e5a8 - https://git.kernel.org/stable/c/8740a12ca2e2959531ad253bac99ada338b33d80
CVE ID: CVE-2022-50563 State: PUBLISHED Published: 2025-10-22T13:23:22.080Z Last Updated: 2025-10-22T13:23:22.080Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: dm thin: Fix UAF in run_timer_softirq() When dm_resume() and dm_destroy() are concurrent, it will lead to UAF, as follows: BUG: KASAN: use-after-free in __run_timers+0x173/0x710 Write of size 8 at addr ffff88816d9490f0 by task swapper/0/0 <snip> Call Trace: <IRQ> dump_stack_lvl+0x73/0x9f print_report.cold+0x132/0xaa2 _raw_spin_lock_irqsave+0xcd/0x160 __run_timers+0x173/0x710 kasan_report+0xad/0x110 __run_timers+0x173/0x710 __asan_store8+0x9c/0x140 __run_timers+0x173/0x
__run_timers+0x173/0x710 kasan_report+0xad/0x110 __run_timers+0x173/0x710 __asan_store8+0x9c/0x140 __run_timers+0x173/0x710 call_timer_fn+0x310/0x310 pvclock_clocksource_read+0xfa/0x250 kvm_clock_read+0x2c/0x70 kvm_clock_get_cycles+0xd/0x20 ktime_get+0x5c/0x110 lapic_next_event+0x38/0x50 clockevents_program_event+0xf1/0x1e0 run_timer_softirq+0x49/0x90 __do_softirq+0x16e/0x62c __irq_exit_rcu+0x1fa/0x270 irq_exit_rcu+0x12/0x20 sysvec_apic_timer_interrupt+0x8e/0xc0 One of the concurrency UAF can be shown as below: use free do_resume | __find_device_hash_cell | dm_get | atomic_inc(&md->holders) | | dm_destroy | __dm_destroy | if (!dm_suspended_md(md)) | atomic_read(&md->holders) | msleep(1) dm_r
inc(&md->holders) | | dm_destroy | __dm_destroy | if (!dm_suspended_md(md)) | atomic_read(&md->holders) | msleep(1) dm_resume | __dm_resume | dm_table_resume_targets | pool_resume | do_waker #add delay work | dm_put | atomic_dec(&md->holders) | | dm_table_destroy | pool_dtr | __pool_dec | __pool_destroy | destroy_workqueue | kfree(pool) # free pool time out __do_softirq run_timer_softirq # pool has already been freed This can be easily reproduced using: 1. create thin-pool 2. dmsetup suspend pool 3. dmsetup resume pool 4. dmsetup remove_all # Concurrent with 3 The root cause of this UAF bug is that dm_resume() adds timer after dm_destroy() skips cancelling the timer because of suspend status
e of this UAF bug is that dm_resume() adds timer after dm_destroy() skips cancelling the timer because of suspend status. After timeout, it will call run_timer_softirq(), however pool has already been freed. The concurrency UAF bug will happen. Therefore, cancelling timer again in __pool_destroy(). References: - https://git.kernel.org/stable/c/7ee059d06a5d3c15465959e0472993e80fbe4e81 - https://git.kernel.org/stable/c/550a4fac7ecfee5bac6a0dd772456ca62fb72f46 - https://git.kernel.org/stable/c/e8b8e0d2bbf7d1172c4f435621418e29ee408d46 - https://git.kernel.org/stable/c/7ae6aa649394e1e7f6dafb55ce0d578c0572a280 - https://git.kernel.org/stable/c/34fe9c2251f19786a6689149a6212c6c0de1d63b - https://git
394e1e7f6dafb55ce0d578c0572a280 - https://git.kernel.org/stable/c/34fe9c2251f19786a6689149a6212c6c0de1d63b - https://git.kernel.org/stable/c/34cd15d83b7206188d440b29b68084fcafde9395 - https://git.kernel.org/stable/c/94e231c9d6f2648d2f1f68e7f476e050ee0a6159 - https://git.kernel.org/stable/c/d9971fa4d8bde63d49c743c1b32d12fbbd3a30bd - https://git.kernel.org/stable/c/88430ebcbc0ec637b710b947738839848c20feff
CVE ID: CVE-2022-50564 State: PUBLISHED Published: 2025-10-22T13:23:22.703Z Last Updated: 2025-10-22T13:23:22.703Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: s390/netiucv: Fix return type of netiucv_tx() With clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG), indirect call targets are validated against the expected function pointer prototype to make sure the call target is valid to help mitigate ROP attacks. If they are not identical, there is a failure at run time, which manifests as either a kernel panic or thread getting killed. A proposed warning in clang aims to catch these at compile time, which reveals:
kernel panic or thread getting killed. A proposed warning in clang aims to catch these at compile time, which reveals: drivers/s390/net/netiucv.c:1854:21: error: incompatible function pointer types initializing 'netdev_tx_t (*)(struct sk_buff *, struct net_device *)' (aka 'enum netdev_tx (*)(struct sk_buff *, struct net_device *)') with an expression of type 'int (struct sk_buff *, struct net_device *)' [-Werror,-Wincompatible-function-pointer-types-strict] .ndo_start_xmit = netiucv_tx, ^~~~~~~~~~ ->ndo_start_xmit() in 'struct net_device_ops' expects a return type of 'netdev_tx_t', not 'int'. Adjust the return type of netiucv_tx() to match the prototype's to resolve the warning and potentia
ev_tx_t', not 'int'. Adjust the return type of netiucv_tx() to match the prototype's to resolve the warning and potential CFI failure, should s390 select ARCH_SUPPORTS_CFI_CLANG in the future. Additionally, while in the area, remove a comment block that is no longer relevant. References: - https://git.kernel.org/stable/c/f13d870fce90f01cf930bfaffecc8185ae0be21c - https://git.kernel.org/stable/c/eccc88c0efe407e579291792ad07a7dedc0f63f0 - https://git.kernel.org/stable/c/85d392710275355425df8618ccbebbc336f5acc5 - https://git.kernel.org/stable/c/4bee3c75d5bf7c2b5dc0b520410eb40449e5da31 - https://git.kernel.org/stable/c/3ac0217ca9186c2f9af9a0113a331a42aa847894 - https://git.kernel.org/stable/c/df
49e5da31 - https://git.kernel.org/stable/c/3ac0217ca9186c2f9af9a0113a331a42aa847894 - https://git.kernel.org/stable/c/dfbf0122ea1b9b3e73fa22c8ff6bd888935c54fc - https://git.kernel.org/stable/c/e7a849f740e3576e79cba403697e916f4c3a6f12 - https://git.kernel.org/stable/c/d034fa43af92fc46a81d882f46d9cc3e4ffdbbcc - https://git.kernel.org/stable/c/88d86d18d7cf7e9137c95f9d212bb9fff8a1b4be
CVE ID: CVE-2022-50565 State: PUBLISHED Published: 2025-10-22T13:23:23.335Z Last Updated: 2025-10-22T13:23:23.335Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: plfxlc: fix potential memory leak in __lf_x_usb_enable_rx() urbs does not be freed in exception paths in __lf_x_usb_enable_rx(). That will trigger memory leak. To fix it, add kfree() for urbs within "error" label. Compile tested only. References: - https://git.kernel.org/stable/c/286464463a05cb4bad80b134e24f8ffaab20bee4 - https://git.kernel.org/stable/c/fce7e46273649d9cdcd98d89551975a65f206a14 - https://git.kernel.org/stable/c/895b3b06efc285c1245242e9638b9ae251dc
stable/c/fce7e46273649d9cdcd98d89551975a65f206a14 - https://git.kernel.org/stable/c/895b3b06efc285c1245242e9638b9ae251dc13ec
CVE ID: CVE-2022-50566 State: PUBLISHED Published: 2025-10-22T13:23:23.917Z Last Updated: 2025-10-22T13:23:23.917Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mtd: Fix device name leak when register device failed in add_mtd_device() There is a kmemleak when register device failed: unreferenced object 0xffff888101aab550 (size 8): comm "insmod", pid 3922, jiffies 4295277753 (age 925.408s) hex dump (first 8 bytes): 6d 74 64 30 00 88 ff ff mtd0.... backtrace: [<00000000bde26724>] __kmalloc_node_track_caller+0x4e/0x150 [<000000003c32b416>] kvasprintf+0xb0/0x130 [<000000001f7a8f15>] kobject_set_name_vargs+0x2f/0xb0 [<000000006e781
e/0x150 [<000000003c32b416>] kvasprintf+0xb0/0x130 [<000000001f7a8f15>] kobject_set_name_vargs+0x2f/0xb0 [<000000006e781163>] dev_set_name+0xab/0xe0 [<00000000e30d0c78>] add_mtd_device+0x4bb/0x700 [<00000000f3d34de7>] mtd_device_parse_register+0x2ac/0x3f0 [<00000000c0d88488>] 0xffffffffa0238457 [<00000000b40d0922>] 0xffffffffa02a008f [<0000000023d17b9d>] do_one_initcall+0x87/0x2a0 [<00000000770f6ca6>] do_init_module+0xdf/0x320 [<000000007b6768fe>] load_module+0x2f98/0x3330 [<00000000346bed5a>] __do_sys_finit_module+0x113/0x1b0 [<00000000674c2290>] do_syscall_64+0x35/0x80 [<000000004c6a8d97>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 If register device failed, should call put_device() to give
000000004c6a8d97>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 If register device failed, should call put_device() to give up the reference. References: - https://git.kernel.org/stable/c/a75f45afa932bfb24a2603ebcea5efd2e7cdcfd6 - https://git.kernel.org/stable/c/2302e2dc42b1f84f951c725ce742fc21c5a1e151 - https://git.kernel.org/stable/c/db07fe76df01f40cb897d6e9066b84e46957beb3 - https://git.kernel.org/stable/c/fa0d32ab8407d7481450c664fd0de64f2dae9489 - https://git.kernel.org/stable/c/330bc5533e8a8ed69cb951d5a8edce9bddb9db21 - https://git.kernel.org/stable/c/71212d73184845c944ef1b43f092e643e5bde003 - https://git.kernel.org/stable/c/1b172fb05d6315ecec082fd7544a3390e96f0d7e - https://git.kernel.org/
b43f092e643e5bde003 - https://git.kernel.org/stable/c/1b172fb05d6315ecec082fd7544a3390e96f0d7e - https://git.kernel.org/stable/c/bcabe1dc2a344adbb3382930a23e273ba9382277 - https://git.kernel.org/stable/c/895d68a39481a75c680aa421546931fb11942fa6