deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-53812
Published: 2025-12-09
Description: In the Linux kernel, the following vulnerability has been resolved:

media: mediatek: vcodec: fix decoder disable pm crash

Can't call pm_runtime_disable when the architecture support sub device for
'dev->pm.dev' is NUll, or will get below crash log.

[   10.771551] pc : _raw_spin_lock_irq+0x4c/0xa0
[   10.771556] lr : __pm_runtime_disable+0x30/0x130
[   10.771558] sp : ffffffc01e4cb800
[   10.771559] x29: ffffffc01e4cb800 x28: ffffffdf082108a8
[   10.771563] x27: ffffffc01e4cbd70 x26: ffffff8605df55f0
[   10.771567] x25: [PII_REDACTED] x24: [PII_REDACTED]
[   10.771570] x23: ffffff85c0dc9c00 x22: [PII_REDACTED]
[   10.771573] x21: [PII_REDACTED] x20: [PII_REDACTED]
[   10.771577] x19:[PII_REDACTED]0000f4 x18: ffffffdf2e9fbe18
[   10.771580] x17: [PII_REDACTED] x16: ffffffdf2df13c74
[   10.771583] x15:[PII_REDACTED]0002ea x14: [PII_REDACTED]
[   10.771587] x13: ffffffdf2de1b62c x12: ffffffdf2e9e30e4
[   10.771590] x11: [PII_REDACTED] x10: [PII_REDACTED]
[   10.771593] x9 : [PII_REDACTED] x8 :[PII_REDACTED]0000f4
[   10.771596] x7 : 6bff6264632c6264 x6 : [PII_REDACTED]
[   10.771600] x5 : [PII_REDACTED] x4 : [PII_REDACTED]
[   10.771603] x3 : [PII_REDACTED] x2 : [PII_REDACTED]
[   10.771608] x1 : [PII_REDACTED] x0 :[PII_REDACTED]0000f4
[   10.771613] Call trace:
[   10.771617]  _raw_spin_lock_irq+0x4c/0xa0
[   10.771620]  __pm_runtime_disable+0x30/0x130
[   10.771657]  mtk_vcodec_probe+0x69c/0x728 [mtk_vcodec_dec 800cc929d6631f79f9b273254c8db94d0d3500dc]
[   10.771662]  platform_drv_probe+0x9c/0xbc
[   10.771665]  really_probe+0x13c/0x3a0
[   10.771668]  driver_probe_device+0x84/0xc0
[   10.771671]  device_driver_attach+0x54/0x78
References: https://git.kernel.org/stable/c/03e9773388a27242e6139f3d5b5fd00112adb5c3; https://git.kernel.org/stable/c/34fe290090ecfcf405cad9d0e0ddc8b8246ffaa2; https://git.kernel.org/stable/c/9d2f13fb47dcab6d094f34ecfd6a879a409722b3
CVE: CVE-2023-53813
Published: 2025-12-09
Description: In the Linux kernel, the following vulnerability has been resolved:

ext4: fix rbtree traversal bug in ext4_mb_use_preallocated

During allocations, while looking for preallocations(PA) in the per
inode rbtree, we can't do a direct traversal of the tree because
ext4_mb_discard_group_preallocation() can paralelly mark the pa deleted
and that can cause direct traversal to skip some entries. This was
leading to a BUG_ON() being hit [1] when we missed a PA that could satisfy
our request and ultimately tried to create a new PA that would overlap
with the missed one.

To makes sure we handle that case while still keeping the performance of
the rbtree, we make use of the fact that the only pa that could possibly
overlap the original goal start is the one that satisfies the below
conditions:

  1. It must have it's logical start immediately to the left of
  (ie less than) original logical start.

  2. It must not be deleted

To find this pa we use the following traversal method:

1. Descend into the rbtree normally to find the immediate neighboring
PA. Here we keep descending irrespective of if the PA is deleted or if
it overlaps with our request etc. The goal is to find an immediately
adjacent PA.

2. If the found PA is on right of original goal, use rb_prev() to find
the left adjacent PA.

3. Check if this PA is deleted and keep moving left with rb_prev() until
a non deleted PA is found.

4. This is the PA we are looking for. Now we can check if it can satisfy
the original request and proceed accordingly.

This approach also takes care of having deleted PAs in the tree.

(While we are at it, also fix a possible overflow bug in calculating the
end of a PA)

[1] https://lore.kernel.org/linux-ext4/CA+G9fYv2FRpLqBZf34ZinR8bU2_ZRAUOjKAD3+tKRFaEQHtt8Q@mail.gmail.com/
References: https://git.kernel.org/stable/c/339fee69a1daa71d6f97e47a867e2c32419a2406; https://git.kernel.org/stable/c/9d3de7ee192a6a253f475197fe4d2e2af10a731f
CVE: CVE-2023-53814
Published: 2025-12-09
Description: In the Linux kernel, the following vulnerability has been resolved:

PCI: Fix dropping valid root bus resources with .end = zero

On r8a7791/koelsch:

  kmemleak: 1 new suspected memory leaks (see /sys/kernel/debug/kmemleak)
  # cat /sys/kernel/debug/kmemleak
  unreferenced object 0xc3a34e00 (size 64):
    comm "swapper/0", pid 1, jiffies[PII_REDACTED] (age 199.080s)
    hex dump (first 32 bytes):
      b4 5d 81 f0 b4 5d 81 f0 c0 b0 a2 c3 00 00 00 00  .]...]..........
      00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    backtrace:
      [<fe3aa979>] __kmalloc+0xf0/0x140
      [<34bd6bc0>] resource_list_create_entry+0x18/0x38
      [<767046bc>] pci_add_resource_offset+0x20/0x68
      [<b3f3edf2>] devm_of_pci_get_host_bridge_resources.constprop.0+0xb0/0x390

When coalescing two resources for a contiguous aperture, the second
resource is enlarged to cover the full contiguous range, while the first
resource is marked invalid.  This invalidation is done by clearing the
flags, start, and end members.

When adding the initial resources to the bus later, invalid resources are
skipped.  Unfortunately, the check for an invalid resource considers only
the end member, causing false positives.

E.g. on r8a7791/koelsch, root bus resource 0 ("bus 00") is skipped, and no
longer registered with pci_bus_insert_busn_res() (causing the memory leak),
nor printed:

   pci-rcar-gen2 ee090000.pci: host bridge /soc/pci@ee090000 ranges:
   pci-rcar-gen2 ee090000.pci:      MEM 0x00ee080000..0x00ee08ffff -> 0x00ee080000
   pci-rcar-gen2 ee090000.pci: PCI: revision 11
   pci-rcar-gen2 ee090000.pci: PCI host bridge to bus 0000:00
  -pci_bus 0000:00: root bus resource [bus 00]
   pci_bus 0000:00: root bus resource [mem 0xee080000-0xee08ffff]

Fix this by only skipping resources where all of the flags, start, and end
members are zero.
References: https://git.kernel.org/stable/c/7e6f2714d93cdf977b6124a80af2cf0e14e2d407; https://git.kernel.org/stable/c/9d8ba74a181b1c81def21168795ed96cbe6f05ed; https://git.kernel.org/stable/c/e4af080f3ef6a65b0d702988c2471a47c9ae2cc0
CVE: CVE-2023-53815
Published: 2025-12-09
Description: In the Linux kernel, the following vulnerability has been resolved:

posix-timers: Prevent RT livelock in itimer_delete()

itimer_delete() has a retry loop when the timer is concurrently expired. On
non-RT kernels this just spin-waits until the timer callback has completed,
except for posix CPU timers which have HAVE_POSIX_CPU_TIMERS_TASK_WORK
enabled.

In that case and on RT kernels the existing task could live lock when
preempting the task which does the timer delivery.

Replace spin_unlock() with an invocation of timer_wait_running() to handle
it the same way as the other retry loops in the posix timer code.
References: https://git.kernel.org/stable/c/0670c4c567b27bd8f999a943028f4fe60d1a1106; https://git.kernel.org/stable/c/9d9e522010eb5685d8b53e8a24320653d9d4cbbf; https://git.kernel.org/stable/c/c1968bb8a28625cc95d2ad3ca872ab98c9c36d59
CVE: CVE-2023-53816
Published: 2025-12-09
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: fix potential kgd_mem UAFs

kgd_mem pointers returned by kfd_process_device_translate_handle are
only guaranteed to be valid while p->mutex is held. As soon as the mutex
is unlocked, another thread can free the BO.
References: https://git.kernel.org/stable/c/5045360f3bb62ccd4f87202e33489f71f8bbc3fc; https://git.kernel.org/stable/c/5ca14fb5552ac13a2402d306c0bd2379a71610ff; https://git.kernel.org/stable/c/9da050b0d9e04439d225a2ec3044af70cdfb3933
CVE: CVE-2023-53817
Published: 2025-12-09
Description: In the Linux kernel, the following vulnerability has been resolved:

crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui()

During NVMeTCP Authentication a controller can trigger a kernel
oops by specifying the 8192 bit Diffie Hellman group and passing
a correctly sized, but zeroed Diffie Hellamn value.
mpi_cmp_ui() was detecting this if the second parameter was 0,
but 1 is passed from dh_is_pubkey_valid(). This causes the null
pointer u->d to be dereferenced towards the end of mpi_cmp_ui()
References: https://git.kernel.org/stable/c/0fc7147c694394f8a8cbc19570c6bc918cac0906; https://git.kernel.org/stable/c/12ac013ad7ff0df066451e825801d805095b3776; https://git.kernel.org/stable/c/61f5453e9706e[PII_REDACTED]4e0c8f9031485fb5f
CVE: CVE-2023-53818
Published: 2025-12-09
Description: In the Linux kernel, the following vulnerability has been resolved:

ARM: zynq: Fix refcount leak in zynq_early_slcr_init

of_find_compatible_node() returns a node pointer with refcount incremented,
we should use of_node_put() on error path.
Add missing of_node_put() to avoid refcount leak.
References: https://git.kernel.org/stable/c/1cc12d10d13ae5ad8d3f7432a4c0156d221fc99b; https://git.kernel.org/stable/c/227f8c1c5c4b3d131b66e57e58d38054f441b915; https://git.kernel.org/stable/c/351b7e93d02b50b2faae2d4bda28e16a8389cbb7
CVE: CVE-2023-53819
Published: 2025-12-09
Description: In the Linux kernel, the following vulnerability has been resolved:

amdgpu: validate offset_in_bo of drm_amdgpu_gem_va

This is motivated by OOB access in amdgpu_vm_update_range when
offset_in_bo+map_size overflows.

v2: keep the validations in amdgpu_vm_bo_map
v3: add the validations to amdgpu_vm_bo_map/amdgpu_vm_bo_replace_map
    rather than to amdgpu_gem_va_ioctl
References: https://git.kernel.org/stable/c/4300a47e4017c9febb60ffa7d39723eeaed00f2b; https://git.kernel.org/stable/c/82aace80cfaab778245bd2f9e31b67953725e4d0; https://git.kernel.org/stable/c/968e27fd037ec[PII_REDACTED]a9b9836eccc0e0a12
CVE: CVE-2025-14285
Published: 2025-12-09
Description: A vulnerability was found in code-projects Employee Profile Management System 1.0. Affected is an unknown function of the file edit_personnel.php. The manipulation of the argument per_id results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/tiancesec/CVE/issues/15; https://vuldb.com/?ctiid.334873
CVE: CVE-2025-66470
Published: 2025-12-09
Description: NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are subject to a XSS vulnerability through the ui.interactive_image component of NiceGUI. The component renders SVG content using Vue's v-html directive without any sanitization. This allows attackers to inject malicious HTML or JavaScript via the SVG <foreignObject> tag whenever the image component is rendered or updated. This is particularly dangerous for dashboards or multi-user applications displaying user-generated content or annotations. This issue is fixed in version 3.4.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/zauberzeug/nicegui/commit/58ad0b36e19922de16bbc79ea3ddd29851b1a3e3; https://github.com/zauberzeug/nicegui/security/advisories/GHSA-2m4f-cg75-76w2; https://github.com/zauberzeug/nicegui/security/advisories/GHSA-2m4f-cg75-76w2
CVE: CVE-2025-66481
Published: 2025-12-09
Description: DeepChat is an open-source AI chat platform that supports cloud models and LLMs. Versions 0.5.1 and below are vulnerable to XSS attacks through improperly sanitized Mermaid content. The recent security patch for MermaidArtifact.vue is insufficient and can be bypassed using unquoted HTML attributes combined with HTML entity encoding. Remote Code Execution is possible on the victim's machine via the electron.ipcRenderer interface, bypassing the regex filter intended to strip dangerous attributes. There is no fix at time of publication.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79, CWE-80, CWE-94, CWE-79
References: https://github.com/ThinkInAIXYZ/deepchat/security/advisories/GHSA-h9f5-7hhf-fqm4; https://github.com/ThinkInAIXYZ/deepchat/security/advisories/GHSA-h9f5-7hhf-fqm4
CVE: CVE-2025-66490
Published: 2025-12-09
Description: Traefik is an HTTP reverse proxy and load balancer. For versions prior to 2.11.32 and 2.11.31 through 3.6.2, requests using PathPrefix, Path or PathRegex matchers can bypass path normalization. When Traefik uses path-based routing, requests containing URL-encoded restricted characters (/, \, Null, ;, ?, #) can bypass the middleware chain and reach unintended backends. For example, a request to http://mydomain.example.com/admin%2F could reach service-a without triggering my-security-middleware, bypassing security controls for the /admin/ path. This issue is fixed in versions 2.11.32 and 3.6.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-436
References: https://github.com/traefik/traefik/releases/tag/v2.11.32; https://github.com/traefik/traefik/releases/tag/v3.6.4; https://github.com/traefik/traefik/security/advisories/GHSA-gm3x-23wp-hc2c
CVE: CVE-2025-66491
Published: 2025-12-09
Description: Traefik is an HTTP reverse proxy and load balancer. Versions 3.5.0 through 3.6.2 have inverted TLS verification logic in the nginx.ingress.kubernetes.io/proxy-ssl-verify annotation. Setting the annotation to "on" (intending to enable backend TLS certificate verification) actually disables verification, allowing man-in-the-middle attacks against HTTPS backends when operators believe they are protected. This issue is fixed in version 3.6.3.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://github.com/traefik/traefik/commit/14a1aedf5704673d875d210d7bacf103a43c77e4; https://github.com/traefik/traefik/releases/tag/v3.6.3; https://github.com/traefik/traefik/security/advisories/GHSA-7vww-mvcr-x6vj
CVE: CVE-2022-50657
Published: 2025-12-09
Description: In the Linux kernel, the following vulnerability has been resolved:

riscv: mm: add missing memcpy in kasan_init

Hi Atish,

It seems that the panic is due to the missing memcpy during kasan_init.
Could you please check whether this patch is helpful?

When doing kasan_populate, the new allocated base_pud/base_p4d should
contain kasan_early_shadow_{pud, p4d}'s content. Add the missing memcpy
to avoid page fault when read/write kasan shadow region.

Tested on:
 - qemu with sv57 and CONFIG_KASAN on.
 - qemu with sv48 and CONFIG_KASAN on.
References: https://git.kernel.org/stable/c/9f2ac64d6ca60db99132e08628ac2899f956a0ec; https://git.kernel.org/stable/c/ff0f6becf3a6f817838b6f80a2c9cca43dce0576
CVE: CVE-2022-50658
Published: 2025-12-09
Description: In the Linux kernel, the following vulnerability has been resolved:

cpufreq: qcom: fix memory leak in error path

If for some reason the speedbin length is incorrect, then there is a
memory leak in the error path because we never free the speedbin buffer.
This commit fixes the error path to always free the speedbin buffer.
References: https://git.kernel.org/stable/c/9f42cf54403a42cb092636804d2628d8ecf71e75; https://git.kernel.org/stable/c/b5606e3ab1f7cc00d89903f4a11fe57747bb3a68; https://git.kernel.org/stable/c/b6ea267e0c6bdf5463358e2a2e5280cfa6cacc48
CVE: CVE-2022-50659
Published: 2025-12-09
Description: In the Linux kernel, the following vulnerability has been resolved:

hwrng: geode - Fix PCI device refcount leak

for_each_pci_dev() is implemented by pci_get_device(). The comment of
pci_get_device() says that it will increase the reference count for the
returned pci_dev and also decrease the reference count for the input
pci_dev @from if it is not NULL.

If we break for_each_pci_dev() loop with pdev not NULL, we need to call
pci_dev_put() to decrease the reference count. We add a new struct
'amd_geode_priv' to record pointer of the pci_dev and membase, and then
add missing pci_dev_put() for the normal and error path.
References: https://git.kernel.org/stable/c/19b7b85773b18457ff85a9ff4f5e2a2d4bf7ed0c; https://git.kernel.org/stable/c/5cc818ad53df650cac8fb41d[PII_REDACTED]af3f03; https://git.kernel.org/stable/c/6b9e43c4098f1310f5b4d52121d007a219fa5d43
CVE: CVE-2022-50660
Published: 2025-12-09
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: ipw2200: fix memory leak in ipw_wdev_init()

In the error path of ipw_wdev_init(), exception value is returned, and
the memory applied for in the function is not released. Also the memory
is not released in ipw_pci_probe(). As a result, memory leakage occurs.
So memory release needs to be added to the error path of ipw_wdev_init().
References: https://git.kernel.org/stable/c/112c1af02b8f535baf42ef9d807aea963705ef15; https://git.kernel.org/stable/c/1f590fb3d14e5db3a9e06ee141b1685c429278ce; https://git.kernel.org/stable/c/62ec7e8bf42f1542f966dda687c654aae81718c8
CVE: CVE-2022-50662
Published: 2025-12-09
Description: In the Linux kernel, the following vulnerability has been resolved:

RDMA/hns: fix memory leak in hns_roce_alloc_mr()

When hns_roce_mr_enable() failed in hns_roce_alloc_mr(), mr_key is not
released. Compiled test only.
References: https://git.kernel.org/stable/c/164fa80330a81db67c26d10d071083941d29a510; https://git.kernel.org/stable/c/35f9cd060e68ff910e49bf37b1b0d336a311849a; https://git.kernel.org/stable/c/a115aa00b18f7b8982b8f458149632caf64a862a
CVE: CVE-2022-50663
Published: 2025-12-09
Description: In the Linux kernel, the following vulnerability has been resolved:

net: stmmac: fix possible memory leak in stmmac_dvr_probe()

The bitmap_free() should be called to free priv->af_xdp_zc_qps
when create_singlethread_workqueue() fails, otherwise there will
be a memory leak, so we add the err path error_wq_init to fix it.
References: https://git.kernel.org/stable/c/446757787baf99b7db15cb347783c45a37bfe21f; https://git.kernel.org/stable/c/96e50897029f65222ef76cfe9bc802321fcea33b; https://git.kernel.org/stable/c/a137f3f27f9290933fe7e40e6dc8a445781c31a2
CVE: CVE-2022-50664
Published: 2025-12-09
Description: In the Linux kernel, the following vulnerability has been resolved:

media: dvb-frontends: fix leak of memory fw
References: https://git.kernel.org/stable/c/25cab05aa2df904ee1fea37d8dfa0d92c951bb4e; https://git.kernel.org/stable/c/438a4a8dece2abac099777a00db91784c0996cdc; https://git.kernel.org/stable/c/438cd29fec3ea09769639f6032687e0c1434dbe0
CVE: CVE-2022-50666
Published: 2025-12-09
Description: In the Linux kernel, the following vulnerability has been resolved:

RDMA/siw: Fix QP destroy to wait for all references dropped.

Delay QP destroy completion until all siw references to QP are
dropped. The calling RDMA core will free QP structure after
successful return from siw_qp_destroy() call, so siw must not
hold any remaining reference to the QP upon return.
A use-after-free was encountered in xfstest generic/460, while
testing NFSoRDMA. Here, after a TCP connection drop by peer,
the triggered siw_cm_work_handler got delayed until after
QP destroy call, referencing a QP which has already freed.
References: https://git.kernel.org/stable/c/0ed8bf9d0bb19f3f5eedd73f04aaf5bba9ac0737; https://git.kernel.org/stable/c/5c75d608fad58301b63e7d69200c13c3a1d411da; https://git.kernel.org/stable/c/74ad141e995a730760b1bcfa14854b7f1057d6bc
CVE: CVE-2022-50667
Published: 2025-12-09
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/vmwgfx: Fix memory leak in vmw_mksstat_add_ioctl()

If the copy of the description string from userspace fails, then the page
for the instance descriptor doesn't get freed before returning -EFAULT,
which leads to a memleak.
References: https://git.kernel.org/stable/c/53066b144715332ce9370143c33c50d9a4d3e809; https://git.kernel.org/stable/c/6ad40bbb2c25f17b899fcea114ebc0a46d8a938b; https://git.kernel.org/stable/c/a40c7f61d12fbd1e785e59140b9efd57127c0c33
CVE: CVE-2022-50668
Published: 2025-12-09
Description: In the Linux kernel, the following vulnerability has been resolved:

ext4: fix deadlock due to mbcache entry corruption

When manipulating xattr blocks, we can deadlock infinitely looping
inside ext4_xattr_block_set() where we constantly keep finding xattr
block for reuse in mbcache but we are unable to reuse it because its
reference count is too big. This happens because cache entry for the
xattr block is marked as reusable (e_reusable set) although its
reference count is too big. When this inconsistency happens, this
inconsistent state is kept indefinitely and so ext4_xattr_block_set()
keeps retrying indefinitely.

The inconsistent state is caused by non-atomic update of e_reusable bit.
e_reusable is part of a bitfield and e_reusable update can race with
update of e_referenced bit in the same bitfield resulting in loss of one
of the updates. Fix the problem by using atomic bitops instead.

This bug has been around for many years, but it became *much* easier
to hit after commit 65f8b80053a1 ("ext4: fix race when reusing xattr
blocks").
References: https://git.kernel.org/stable/c/127b80cefb941a81255c72f11081123f3a705369; https://git.kernel.org/stable/c/1be16a0c2f10186df505e28b0cc92d7f3366e2a8; https://git.kernel.org/stable/c/5bc0b2fda4b47c86278f7c6d30c211f425bf51cf
CVE: CVE-2022-50669
Published: 2025-12-09
Description: In the Linux kernel, the following vulnerability has been resolved:

misc: ocxl: fix possible name leak in ocxl_file_register_afu()

If device_register() returns error in ocxl_file_register_afu(),
the name allocated by dev_set_name() need be freed. As comment
of device_register() says, it should use put_device() to give
up the reference in the error path. So fix this by calling
put_device(), then the name can be freed in kobject_cleanup(),
and info is freed in info_release().
References: https://git.kernel.org/stable/c/0cd05062371a49774e8a45258bdedf0bd6d3d327; https://git.kernel.org/stable/c/2fce8b3583d1641a1716486f408478b58e96ec91; https://git.kernel.org/stable/c/3299983a6bf628249ac650908e62d12de959341e
CVE: CVE-2022-50670
Published: 2025-12-09
Description: In the Linux kernel, the following vulnerability has been resolved:

mmc: omap_hsmmc: fix return value check of mmc_add_host()

mmc_add_host() may return error, if we ignore its return value,
it will lead two issues:
1. The memory that allocated in mmc_alloc_host() is leaked.
2. In the remove() path, mmc_remove_host() will be called to
   delete device, but it's not added yet, it will lead a kernel
   crash because of null-ptr-deref in device_del().

Fix this by checking the return value and goto error path wihch
will call mmc_free_host().
References: https://git.kernel.org/stable/c/4e1dc24bcfc8257f24c0663badec7e4f3ae80558; https://git.kernel.org/stable/c/62005dfcc396424db3337a1dc3ab49623537f5e5; https://git.kernel.org/stable/c/a525cad241c339ca00bf7ebf03c5180f2a9b767c
CVE: CVE-2022-50671
Published: 2025-12-09
Description: In the Linux kernel, the following vulnerability has been resolved:

RDMA/rxe: Fix "kernel NULL pointer dereference" error

When rxe_queue_init in the function rxe_qp_init_req fails,
both qp->req.task.func and qp->req.task.arg are not initialized.

Because of creation of qp fails, the function rxe_create_qp will
call rxe_qp_do_cleanup to handle allocated resource.

Before calling __rxe_do_task, both qp->req.task.func and
qp->req.task.arg should be checked.
References: https://git.kernel.org/stable/c/0d773c58d702f0a7c16ee8d69617fd2c28350795; https://git.kernel.org/stable/c/3b8752f086eb6865cc3662ad13249b03024501e5; https://git.kernel.org/stable/c/48cd7098e71735ccafa0b3cf27c53924f9cb5b2f
CVE: CVE-2022-50672
Published: 2025-12-09
Description: In the Linux kernel, the following vulnerability has been resolved:

mailbox: zynq-ipi: fix error handling while device_register() fails

If device_register() fails, it has two issues:
1. The name allocated by dev_set_name() is leaked.
2. The parent of device is not NULL, device_unregister() is called
   in zynqmp_ipi_free_mboxes(), it will lead a kernel crash because
   of removing not added device.

Call put_device() to give up the reference, so the name is freed in
kobject_cleanup(). Add device registered check in zynqmp_ipi_free_mboxes()
to avoid null-ptr-deref.
References: https://git.kernel.org/stable/c/3fcf079958c00d83c51e4f250abf2c77fe9cc1b9; https://git.kernel.org/stable/c/4f05d8e2fb3ab702c2633a74571e1b31cb579985; https://git.kernel.org/stable/c/a39b4de0804f9fe0ae911b359ffd4afe7d9d933b