deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-50829
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb()

It is possible that skb is freed in ath9k_htc_rx_msg(), then
usb_submit_urb() fails and we try to free skb again. It causes
use-after-free bug. Moreover, if alloc_skb() fails, urb->context becomes
NULL but rx_buf is not freed and there can be a memory leak.

The patch removes unnecessary nskb and makes skb processing more clear: it
is supposed that ath9k_htc_rx_msg() either frees old skb or passes its
managing to another callback function.

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
References: https://git.kernel.org/stable/c/0c8dd2ea4b419da96ab4953e4967e9363e2f8a4f; https://git.kernel.org/stable/c/355f16f756aad0c95cdaa0c14a34ab4137d32815; https://git.kernel.org/stable/c/53b9bb1a00c4285ee7f58a11129dbea015db61bc
CVE: CVE-2022-50830
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

auxdisplay: hd44780: Fix potential memory leak in hd44780_remove()

hd44780_probe() allocates a memory chunk for hd with kzalloc() and
makes "lcd->drvdata->hd44780" point to it. When we call hd44780_remove(),
we should release all relevant memory and resource. But "lcd->drvdata
->hd44780" is not released, which will lead to a memory leak.

We should release the "lcd->drvdata->hd44780" in hd44780_remove() to fix
the memory leak bug.
References: https://git.kernel.org/stable/c/5d407911e605702ffcc0e97a6db546592ab27dd0; https://git.kernel.org/stable/c/6cd37f8232f5e169a723e1d5fbe3b2139c2ef763; https://git.kernel.org/stable/c/8311961a1724bfc64390c539dedc31e067a80315
CVE: CVE-2022-50831
Published: 2025-12-30
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2022-50832
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: wilc1000: fix potential memory leak in wilc_mac_xmit()

The wilc_mac_xmit() returns NETDEV_TX_OK without freeing skb, add
dev_kfree_skb() to fix it. Compile tested only.
References: https://git.kernel.org/stable/c/07dcd756e28f27e4f8fcd8b809ffa05a5cc5de2b; https://git.kernel.org/stable/c/5706d00fde3f1d5eb7296a4dfefb6aea35108224; https://git.kernel.org/stable/c/a12610e83789c838493034e5c50ac5c903ad8c0d
CVE: CVE-2022-50833
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: use hdev->workqueue when queuing hdev->{cmd,ncmd}_timer works

syzbot is reporting attempt to schedule hdev->cmd_work work from system_wq
WQ into hdev->workqueue WQ which is under draining operation [1], for
commit c8efcc2589464ac7 ("workqueue: allow chained queueing during
destruction") does not allow such operation.

The check introduced by commit 877afadad2dce8aa ("Bluetooth: When HCI work
queue is drained, only queue chained work") was incomplete.

Use hdev->workqueue WQ when queuing hdev->{cmd,ncmd}_timer works because
hci_{cmd,ncmd}_timeout() calls queue_work(hdev->workqueue). Also, protect
the queuing operation with RCU read lock in order to avoid calling
queue_delayed_work() after cancel_delayed_work() completed.
References: https://git.kernel.org/stable/c/3c6b036fe5c8ed8b6c4cbdc[PII_REDACTED]2907ef0; https://git.kernel.org/stable/c/c4635cf3d845a7324c25c52d549b70c8bd7ad4c7; https://git.kernel.org/stable/c/deee93d13d[PII_REDACTED]79a8a0915036ecd83261
CVE: CVE-2022-50834
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

nfc: Fix potential resource leaks

nfc_get_device() take reference for the device, add missing
nfc_put_device() to release it when not need anymore.
Also fix the style warnning by use error EOPNOTSUPP instead of
ENOTSUPP.
References: https://git.kernel.org/stable/c/277f0d0a9084e7454e5532c823a7a876a7b00af7; https://git.kernel.org/stable/c/a743128fca394a43425020a4f287d3168d94d04f; https://git.kernel.org/stable/c/b32f6bef248562bb5191ada527717ea50b319466
CVE: CVE-2022-50835
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

jbd2: add miss release buffer head in fc_do_one_pass()

In fc_do_one_pass() miss release buffer head after use which will lead
to reference count leak.
References: https://git.kernel.org/stable/c/1f48116cbd3404898c9022892e114dd7cc3063c1; https://git.kernel.org/stable/c/27c7bd35135d5ab38b9138ecf186ce54a96c98d9; https://git.kernel.org/stable/c/56fcd0788f0d9243c1754bd6f80b8b327c4afeee
CVE: CVE-2022-50836
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

remoteproc: sysmon: fix memory leak in qcom_add_sysmon_subdev()

The kfree() should be called when of_irq_get_byname() fails or
devm_request_threaded_irq() fails in qcom_add_sysmon_subdev(),
otherwise there will be a memory leak, so add kfree() to fix it.
References: https://git.kernel.org/stable/c/131c0a3ead78d45f0f39ddb42cf1bd9be26239b0; https://git.kernel.org/stable/c/1a62bebe0705556d37cfa8409ddc759b11d404f6; https://git.kernel.org/stable/c/27441fab2651cd909d8a5440ca079bc50245f427
CVE: CVE-2022-50837
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

net: dsa: tag_8021q: avoid leaking ctx on dsa_tag_8021q_register() error path

If dsa_tag_8021q_setup() fails, for example due to the inability of the
device to install a VLAN, the tag_8021q context of the switch will leak.
Make sure it is freed on the error path.
References: https://git.kernel.org/stable/c/09f30f394e832ed09859b6a80fdd20668a9104ff; https://git.kernel.org/stable/c/14ed46a13aba42a6ddd85de6f6274090df3586a5; https://git.kernel.org/stable/c/39691d51af99f80efb9e365f94b8e0c791fa1a2f
CVE: CVE-2022-50838
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

net: stream: purge sk_error_queue in sk_stream_kill_queues()

Changheon Lee reported TCP socket leaks, with a nice repro.

It seems we leak TCP sockets with the following sequence:

1) SOF_TIMESTAMPING_TX_ACK is enabled on the socket.

   Each ACK will cook an skb put in error queue, from __skb_tstamp_tx().
   __skb_tstamp_tx() is using skb_clone(), unless
   SOF_TIMESTAMPING_OPT_TSONLY was also requested.

2) If the application is also using MSG_ZEROCOPY, then we put in the
   error queue cloned skbs that had a struct ubuf_info attached to them.

   Whenever an struct ubuf_info is allocated, sock_zerocopy_alloc()
   does a sock_hold().

   As long as the cloned skbs are still in sk_error_queue,
   socket refcount is kept elevated.

3) Application closes the socket, while error queue is not empty.

Since tcp_close() no longer purges the socket error queue,
we might end up with a TCP socket with at least one skb in
error queue keeping the socket alive forever.

This bug can be (ab)used to consume all kernel memory
and freeze the host.

We need to purge the error queue, with proper synchronization
against concurrent writers.
References: https://git.kernel.org/stable/c/4f1d37ff4226eb99d6b69e9f4518e279e1a851bf; https://git.kernel.org/stable/c/6f00bd0402a1e3d2d556afba57c045bd7931e4d3; https://git.kernel.org/stable/c/8c330c36b3970d0917f48827fa6c7a9c75aa4602
CVE: CVE-2022-50839
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

jbd2: fix potential buffer head reference count leak

As in 'jbd2_fc_wait_bufs' if buffer isn't uptodate, will return -EIO without
update 'journal->j_fc_off'. But 'jbd2_fc_release_bufs' will release buffer head
from ‘j_fc_off - 1’ if 'bh' is NULL will terminal release which will lead to
buffer head buffer head reference count leak.
To solve above issue, update 'journal->j_fc_off' before return -EIO.
References: https://git.kernel.org/stable/c/68ed9c76b2affd47177b92495446abb7262d0ef7; https://git.kernel.org/stable/c/7a33dde572fceb45d02d188e0213c47059401c93; https://git.kernel.org/stable/c/9b073d73725366d886b711b74e058c02f51e7a0e
CVE: CVE-2022-50840
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

scsi: snic: Fix possible UAF in snic_tgt_create()

Smatch reports a warning as follows:

drivers/scsi/snic/snic_disc.c:307 snic_tgt_create() warn:
  '&tgt->list' not removed from list

If device_add() fails in snic_tgt_create(), tgt will be freed, but
tgt->list will not be removed from snic->disc.tgt_list, then list traversal
may cause UAF.

Remove from snic->disc.tgt_list before free().
References: https://git.kernel.org/stable/c/1895e908b3ae66a5312fd1b2cdda2da82993dca7; https://git.kernel.org/stable/c/3007f96ca20c848d0b1b052df6d2cb5ae5586e78; https://git.kernel.org/stable/c/3772319e40527e6a5f2ec1d729e01f271d818f5c
CVE: CVE-2022-50842
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/virtio: Check whether transferred 2D BO is shmem

Transferred 2D BO always must be a shmem BO. Add check for that to prevent
NULL dereference if userspace passes a VRAM BO.
References: https://git.kernel.org/stable/c/36e133af33ea54193378b190cf92c47c12a43d34; https://git.kernel.org/stable/c/989164305b933af06d69bb91044dafbd01025371; https://git.kernel.org/stable/c/e473216b42aa1fd9fc6b94b608b42c210c655908
CVE: CVE-2022-50843
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

dm clone: Fix UAF in clone_dtr()

Dm_clone also has the same UAF problem when dm_resume()
and dm_destroy() are concurrent.

Therefore, cancelling timer again in clone_dtr().
References: https://git.kernel.org/stable/c/342cfd8426dff4228e6c714bcb9fc8295a2748dd; https://git.kernel.org/stable/c/520b56cfd9faee7683f081c3a38f11a81b13a68e; https://git.kernel.org/stable/c/856edd0e92f3fe89606b704c86a93daedddfe6ec
CVE: CVE-2022-50844
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: Fix type of second parameter in odn_edit_dpm_table() callback

With clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG),
indirect call targets are validated against the expected function
pointer prototype to make sure the call target is valid to help mitigate
ROP attacks. If they are not identical, there is a failure at run time,
which manifests as either a kernel panic or thread getting killed. A
proposed warning in clang aims to catch these at compile time, which
reveals:

  drivers/gpu/drm/amd/amdgpu/../pm/swsmu/amdgpu_smu.c:3008:29: error: incompatible function pointer types initializing 'int (*)(void *, uint32_t, long *, uint32_t)' (aka 'int (*)(void *, unsigned int, long *, unsigned int)') with an expression of type 'int (void *, enum PP_OD_DPM_TABLE_COMMAND, long *, uint32_t)' (aka 'int (void *, enum PP_OD_DPM_TABLE_COMMAND, long *, unsigned int)') [-Werror,-Wincompatible-function-pointer-types-strict]
          .odn_edit_dpm_table      = smu_od_edit_dpm_table,
                                     ^~~~~~~~~~~~~~~~~~~~~
  1 error generated.

There are only two implementations of ->odn_edit_dpm_table() in 'struct
amd_pm_funcs': smu_od_edit_dpm_table() and pp_odn_edit_dpm_table(). One
has a second parameter type of 'enum PP_OD_DPM_TABLE_COMMAND' and the
other uses 'u32'. Ultimately, smu_od_edit_dpm_table() calls
->od_edit_dpm_table() from 'struct pptable_funcs' and
pp_odn_edit_dpm_table() calls ->odn_edit_dpm_table() from 'struct
pp_hwmgr_func', which both have a second parameter type of 'enum
PP_OD_DPM_TABLE_COMMAND'.

Update the type parameter in both the prototype in 'struct amd_pm_funcs'
and pp_odn_edit_dpm_table() to 'enum PP_OD_DPM_TABLE_COMMAND', which
cleans up the warning.
References: https://git.kernel.org/stable/c/24cba9d865157c9e23128fbcf8b86f5da9570edd; https://git.kernel.org/stable/c/36217f676b55932a12d6732c[PII_REDACTED]5fdee6; https://git.kernel.org/stable/c/e4d0ef752081e7aa6ffb7ccac11c499c732a2e05
CVE: CVE-2022-50845
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

ext4: fix inode leak in ext4_xattr_inode_create() on an error path

There is issue as follows when do setxattr with inject fault:

[localhost]# fsck.ext4  -fn  /dev/sda
e2fsck 1.46.6-rc1 (12-Sep-2022)
Pass 1: Checking inodes, blocks, and sizes
Pass 2: Checking directory structure
Pass 3: Checking directory connectivity
Pass 4: Checking reference counts
Unattached zero-length inode 15.  Clear? no

Unattached inode 15
Connect to /lost+found? no

Pass 5: Checking group summary information

/dev/sda: ********** WARNING: Filesystem still has errors **********

/dev/sda: 15/655360 files (0.0% non-contiguous), 66755/2621440 blocks

This occurs in 'ext4_xattr_inode_create()'. If 'ext4_mark_inode_dirty()'
fails, dropping i_nlink of the inode is needed. Or will lead to inode leak.
References: https://git.kernel.org/stable/c/0f709e08caffb41bbc9b38b9a4c1bd[PII_REDACTED]; https://git.kernel.org/stable/c/322cf639b0b7f137543072c55545adab782b3a25; https://git.kernel.org/stable/c/70e5b46beba64706430a87a6d516054225e8ac8a
CVE: CVE-2022-50846
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

mmc: via-sdmmc: fix return value check of mmc_add_host()

mmc_add_host() may return error, if we ignore its return value,
it will lead two issues:
1. The memory that allocated in mmc_alloc_host() is leaked.
2. In the remove() path, mmc_remove_host() will be called to
   delete device, but it's not added yet, it will lead a kernel
   crash because of null-ptr-deref in device_del().

Fix this by checking the return value and goto error path which
will call mmc_free_host().
References: https://git.kernel.org/stable/c/076bcd2c93e16b05c10564e299d6e5d26a766d00; https://git.kernel.org/stable/c/0959cc1685eb19774300d43ef25e318b457b156b; https://git.kernel.org/stable/c/0ec94795114edc7e24ec71849dce42bfa61dafa3
CVE: CVE-2022-50847
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/bridge: it6505: Initialize AUX channel in it6505_i2c_probe

During device boot, the HPD interrupt could be triggered before the DRM
subsystem registers it6505 as a DRM bridge. In such cases, the driver
tries to access AUX channel and causes NULL pointer dereference.
Initializing the AUX channel earlier to prevent such error.
References: https://git.kernel.org/stable/c/172d4d64075075f955e6e416915e3f287eec514a; https://git.kernel.org/stable/c/8ed[PII_REDACTED]fc3f36a432718036c21cc51e2ba; https://git.kernel.org/stable/c/e577d4b13064c337b83fe7edecb3f34e87144821
CVE: CVE-2022-50848
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

drivers: dio: fix possible memory leak in dio_init()

If device_register() returns error, the 'dev' and name needs be
freed. Add a release function, and then call put_device() in the
error path, so the name is freed in kobject_cleanup() and to the
'dev' is freed in release function.
References: https://git.kernel.org/stable/c/4b68caa95064ac464f1b261d08ac677e753d1088; https://git.kernel.org/stable/c/78fddc0ff971f9874d53c854818cc4aafa144114; https://git.kernel.org/stable/c/8e002b9fe831b27d4506df6fa60cb33ba0730ac3
CVE: CVE-2022-50850
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

scsi: ipr: Fix WARNING in ipr_init()

ipr_init() will not call unregister_reboot_notifier() when
pci_register_driver() fails, which causes a WARNING. Call
unregister_reboot_notifier() when pci_register_driver() fails.

notifier callback ipr_halt [ipr] already registered
WARNING: CPU: 3 PID: 299 at kernel/notifier.c:29
notifier_chain_register+0x16d/0x230
Modules linked in: ipr(+) xhci_pci_renesas xhci_hcd ehci_hcd usbcore
led_class gpu_sched drm_buddy video wmi drm_ttm_helper ttm
drm_display_helper drm_kms_helper drm drm_panel_orientation_quirks
agpgart cfbft
CPU: 3 PID: 299 Comm: modprobe Tainted: G        W
6.1.0-rc1-00190-g39508d23b672-dirty #332
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014
RIP: 0010:notifier_chain_register+0x16d/0x230
Call Trace:
 <TASK>
 __blocking_notifier_chain_register+0x73/0xb0
 ipr_init+0x30/0x1000 [ipr]
 do_one_initcall+0xdb/0x480
 do_init_module+0x1cf/0x680
 load_module+0x6a50/0x70a0
 __do_sys_finit_module+0x12f/0x1c0
 do_syscall_64+0x3f/0x90
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
References: https://git.kernel.org/stable/c/020b66023712b1cc42c6ab8b76e4ec13efe4a092; https://git.kernel.org/stable/c/4399a8632e5f8f1f695d91d992c7d418fb451f07; https://git.kernel.org/stable/c/5debd337f534b122f7c5eac6557a41b5636c9b51
CVE: CVE-2022-50852
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt7921: fix use after free in mt7921_acpi_read()

Don't dereference "sar_root" after it has been freed.
References: https://git.kernel.org/stable/c/3ed0b382cb36f6dac9f93b3a5533cfcd699409a5; https://git.kernel.org/stable/c/e7de4b4979bd8d313ec837931dde936653ca82ea
CVE: CVE-2022-50853
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

NFSv4: Fix a credential leak in _nfs4_discover_trunking()
References: https://git.kernel.org/stable/c/b247a9828f6607d41189fa6c2a3be754d33cae86; https://git.kernel.org/stable/c/c6aca4c7ba8f6d40a0cfeeb09160dd8efdf97c64; https://git.kernel.org/stable/c/dfad5d5e7511933c2ae3d12a[PII_REDACTED]c5a73d
CVE: CVE-2022-50854
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

nfc: virtual_ncidev: Fix memory leak in virtual_nci_send()

skb should be free in virtual_nci_send(), otherwise kmemleak will report
memleak.

Steps for reproduction (simulated in qemu):
	cd tools/testing/selftests/nci
	make
	./nci_dev

BUG: memory leak
unreferenced object 0xffff[PII_REDACTED]00 (size 208):
  comm "nci_dev", pid 206, jiffies[PII_REDACTED] (age 368.248s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<000000008d94c8fd>] __alloc_skb+0x1da/0x290
    [<[PII_REDACTED]8bc7f8>] nci_send_cmd+0xa3/0x350
    [<[PII_REDACTED]256a22>] nci_reset_req+0x6b/0xa0
    [<000000009e721112>] __nci_request+0x90/0x250
    [<000000005d556e59>] nci_dev_up+0x217/0x5b0
    [<00000000e618ce62>] nfc_dev_up+0x114/0x220
    [<[PII_REDACTED]1e226b>] nfc_genl_dev_up+0x94/0xe0
    [<000000009bb03517>] genl_family_rcv_msg_doit.isra.14+0x228/0x2d0
    [<00000000b7f8c101>] genl_rcv_msg+0x35c/0x640
    [<00000000c94075ff>] netlink_rcv_skb+0x11e/0x350
    [<[PII_REDACTED]0cfb1e>] genl_rcv+0x24/0x40
    [<[PII_REDACTED]593b40>] netlink_unicast+0x43f/0x640
    [<000000001d0b13cc>] netlink_sendmsg+0x73a/0xbf0
    [<[PII_REDACTED]72487f>] __sys_sendto+0x324/0x370
    [<00000000ef9f1747>] __x64_sys_sendto+0xdd/0x1b0
    [<000000001e437841>] do_syscall_64+0x3f/0x90
References: https://git.kernel.org/stable/c/2c46a9a5f0b1c7341aa[PII_REDACTED]9f3ff571678; https://git.kernel.org/stable/c/88e879c9f59511174ef0ab1a3c9c83e2dbf8a213; https://git.kernel.org/stable/c/e840d8f4a1b323973052a1af5ad4edafcde8ae3d
CVE: CVE-2022-50855
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

bpf: prevent leak of lsm program after failed attach

In [0], we added the ability to bpf_prog_attach LSM programs to cgroups,
but in our validation to make sure the prog is meant to be attached to
BPF_LSM_CGROUP, we return too early if the check fails. This results in
lack of decrementing prog's refcnt (through bpf_prog_put)
leaving the LSM program alive past the point of the expected lifecycle.
This fix allows for the decrement to take place.

[0] https://lore.kernel.org/all/[PII_REDACTED]4[PII_REDACTED]-4-sdf@google.com/
References: https://git.kernel.org/stable/c/6a1504dd36cd9a0a69250d61da8bdb17b29f1fe8; https://git.kernel.org/stable/c/82b39df5ddb298daaf6dc504032ff7eb027fa106; https://git.kernel.org/stable/c/e89f3edffb860a0f54a9ed16deadb7a4a1fa3862
CVE: CVE-2022-50856
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

cifs: Fix xid leak in cifs_ses_add_channel()

Before return, should free the xid, otherwise, the
xid will be leaked.
References: https://git.kernel.org/stable/c/7286f875510486fdc2fc426b7c826262e2283a65; https://git.kernel.org/stable/c/847301f0ee1c29f34cc48547ce1071990f24969c; https://git.kernel.org/stable/c/db2a8b6c17e128d91f35d836c569f4a6bda4471b
CVE: CVE-2022-50857
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

rapidio: rio: fix possible name leak in rio_register_mport()

If device_register() returns error, the name allocated by dev_set_name()
need be freed.  It should use put_device() to give up the reference in the
error path, so that the name can be freed in kobject_cleanup(), and
list_del() is called to delete the port from rio_mports.
References: https://git.kernel.org/stable/c/0a71344f99289250e4d5b8adbac76f444485c840; https://git.kernel.org/stable/c/117fede82e9d6ea3de30746d500eb5edc2eb8310; https://git.kernel.org/stable/c/1bbad5793f404cf218757e3beb600eca6080330f
CVE: CVE-2022-50858
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

mmc: alcor: fix return value check of mmc_add_host()

mmc_add_host() may return error, if we ignore its return value, the memory
that allocated in mmc_alloc_host() will be leaked and it will lead a kernel
crash because of deleting not added device in the remove path.

So fix this by checking the return value and calling mmc_free_host() in the
error path.
References: https://git.kernel.org/stable/c/289c964fe182ce755044a6cd57698072e12ffa6f; https://git.kernel.org/stable/c/29c5b4da41f35108136d843c7432885c78cf8272; https://git.kernel.org/stable/c/48dc06333d75f41c2ce9ba954bc3231324b45914
CVE: CVE-2022-50859
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

cifs: Fix the error length of VALIDATE_NEGOTIATE_INFO message

Commit d5c7076b772a ("smb3: add smb3.1.1 to default dialect list")
extend the dialects from 3 to 4, but forget to decrease the extended
length when specific the dialect, then the message length is larger
than expected.

This maybe leak some info through network because not initialize the
message body.

After apply this patch, the VALIDATE_NEGOTIATE_INFO message length is
reduced from 28 bytes to 26 bytes.
References: https://git.kernel.org/stable/c/60480291c1fcafad8425d93f771b5bcc2bd398b4; https://git.kernel.org/stable/c/9312e04b6c6bc46354ecd0cc82052a2b3df0b529; https://git.kernel.org/stable/c/943eb0ede74ecd609fdfd3f0b83e0d237613e526
CVE: CVE-2022-50860
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

apparmor: Fix memleak in alloc_ns()

After changes in commit a1bd627b46d1 ("apparmor: share profile name on
replacement"), the hname member of struct aa_policy is not valid slab
object, but a subset of that, it can not be freed by kfree_sensitive(),
use aa_policy_destroy() to fix it.
References: https://git.kernel.org/stable/c/0250cf8d37bb5201a117177afd24dc73a1c81657; https://git.kernel.org/stable/c/12695b4b76d437b9c0182a6f7dfb2248013a9daf; https://git.kernel.org/stable/c/5f509fa740b17307f0cba412485072f632d5af36
CVE: CVE-2022-50861
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

NFSD: Finish converting the NFSv2 GETACL result encoder

The xdr_stream conversion inadvertently left some code that set the
page_len of the send buffer. The XDR stream encoders should handle
this automatically now.

This oversight adds garbage past the end of the Reply message.
Clients typically ignore the garbage, but NFSD does not need to send
it, as it leaks stale memory contents onto the wire.
References: https://git.kernel.org/stable/c/2b825efb0577a32a872e872a869e0947cf9dd6d3; https://git.kernel.org/stable/c/5030d4d2bf8b6f6f3d16401ab92a88bc5aa2377a; https://git.kernel.org/stable/c/a20b0abab966a189a79aba6ebf41f59024a3224d