deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-50430
Published: 2025-10-01
Description: In the Linux kernel, the following vulnerability has been resolved:

mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING

vub300_enable_sdio_irq() works with mutex and need TASK_RUNNING here.
Ensure that we mark current as TASK_RUNNING for sleepable context.

[   77.554641] do not call blocking ops when !TASK_RUNNING; state=1 set at [<ffffffff92a72c1d>] sdio_irq_thread+0x17d/0x5b0
[   77.554652] WARNING: CPU: 2 PID: 1983 at kernel/sched/core.c:9813 __might_sleep+0x116/0x160
[   77.554905] CPU: 2 PID: 1983 Comm: ksdioirqd/mmc1 Tainted: G           OE      6.1.0-rc5 #1
[   77.554910] Hardware name: Intel(R) Client Systems NUC8i7BEH/NUC8BEB, BIOS BECFL357.86A.0081.2020.0504.1834 05/04/2020
[   77.554912] RIP: 0010:__might_sleep+0x116/0x160
[   77.554920] RSP: 0018:ffff888107b7fdb8 EFLAGS: 00010282
[   77.554923] RAX: [PII_REDACTED] RBX: ffff888118c1b740 RCX: [PII_REDACTED]
[   77.554926] RDX: [PII_REDACTED] RSI: [PII_REDACTED] RDI: ffffed1020f6ffa9
[   77.554928] RBP: ffff888107b7fde0 R08: [PII_REDACTED] R09: ffffed1043ea60ba
[   77.554930] R10: ffff88821f5305cb R11: ffffed1043ea60b9 R12: ffffffff93aa3a60
[   77.554932] R13:[PII_REDACTED]00011b R14: 7fffffffffffffff R15: ffffffffc0558660
[   77.554934] FS:  [PII_REDACTED](0000) GS:ffff88821f500000(0000) knlGS:[PII_REDACTED]
[   77.554937] CS:  0010 DS: 0000 ES: 0000 CR0: [PII_REDACTED]
[   77.554939] CR2: 00007f8a44010d68 CR3:[PII_REDACTED]21a003 CR4:[PII_REDACTED]3706e0
[   77.554942] Call Trace:
[   77.554944]  <TASK>
[   77.554952]  mutex_lock+0x78/0xf0
[   77.554973]  vub300_enable_sdio_irq+0x103/0x3c0 [vub300]
[   77.554981]  sdio_irq_thread+0x25c/0x5b0
[   77.555006]  kthread+0x2b8/0x370
[   77.555017]  ret_from_fork+0x1f/0x30
[   77.555023]  </TASK>
[   77.555025] ---[ end trace [PII_REDACTED] ]---
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/32d5af247d4de6a35769ca1d027480a37c28fd0c; https://git.kernel.org/stable/c/48e91ae755f027d817ed7e51db9963ddb7081946; https://git.kernel.org/stable/c/4a44cd249604e29e7b90ae796d7692f5773dd348
CVE: CVE-2022-50431
Published: 2025-10-01
Description: In the Linux kernel, the following vulnerability has been resolved:

ALSA: aoa: i2sbus: fix possible memory leak in i2sbus_add_dev()

dev_set_name() in soundbus_add_one() allocates memory for name, it need be
freed when of_device_register() fails, call soundbus_dev_put() to give up
the reference that hold in device_initialize(), so that it can be freed in
kobject_cleanup() when the refcount hit to 0. And other resources are also
freed in i2sbus_release_dev(), so it can return 0 directly.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/027fee10e3a400cf6f3237374a1248da1082807b; https://git.kernel.org/stable/c/4a4c8482e370d697738a78dcd7bf2780832cb712; https://git.kernel.org/stable/c/5bdea[PII_REDACTED]10b90d70b02f2fbaf48b2c0eb
CVE: CVE-2022-50433
Published: 2025-10-01
Description: In the Linux kernel, the following vulnerability has been resolved:

efi: ssdt: Don't free memory if ACPI table was loaded successfully

Amadeusz reports KASAN use-after-free errors introduced by commit
3881ee0b1edc ("efi: avoid efivars layer when loading SSDTs from
variables"). The problem appears to be that the memory that holds the
new ACPI table is now freed unconditionally, instead of only when the
ACPI core reported a failure to load the table.

So let's fix this, by omitting the kfree() on success.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/11497fd69cd2282538ec6eb4cda1d16fc061233d; https://git.kernel.org/stable/c/4b017e59f01097f19b938f6dc4dc2c[PII_REDACTED]
CVE: CVE-2022-50434
Published: 2025-10-01
Description: In the Linux kernel, the following vulnerability has been resolved:

blk-mq: fix possible memleak when register 'hctx' failed

There's issue as follows when do fault injection test:
unreferenced object 0xffff888132a9f400 (size 512):
  comm "insmod", pid 308021, jiffies[PII_REDACTED] (age 509.733s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 08 f4 a9 32 81 88 ff ff  ...........2....
    08 f4 a9 32 81 88 ff ff 00 00 00 00 00 00 00 00  ...2............
  backtrace:
    [<00000000e8952bb4>] kmalloc_node_trace+0x22/0xa0
    [<00000000f9980e0f>] blk_mq_alloc_and_init_hctx+0x3f1/0x7e0
    [<000000002e719efa>] blk_mq_realloc_hw_ctxs+0x1e6/0x230
    [<000000004f1fda40>] blk_mq_init_allocated_queue+0x27e/0x910
    [<[PII_REDACTED]7123ec>] __blk_mq_alloc_disk+0x67/0xf0
    [<00000000a2a34657>] 0xffffffffa2ad310f
    [<00000000b173f718>] 0xffffffffa2af824a
    [<[PII_REDACTED]a1dabb>] do_one_initcall+0x87/0x2a0
    [<00000000f32fdf93>] do_init_module+0xdf/0x320
    [<00000000cbe8541e>] load_module+0x3006/0x3390
    [<[PII_REDACTED]ed1bdb>] __do_sys_finit_module+0x113/0x1b0
    [<00000000a1a29ae8>] do_syscall_64+0x35/0x80
    [<000000009cd878b0>] entry_SYSCALL_64_after_hwframe+0x46/0xb0

Fault injection context as follows:
 kobject_add
 blk_mq_register_hctx
 blk_mq_sysfs_register
 blk_register_queue
 device_add_disk
 null_add_dev.part.0 [null_blk]

As 'blk_mq_register_hctx' may already add some objects when failed halfway,
but there isn't do fallback, caller don't know which objects add failed.
To solve above issue just do fallback when add objects failed halfway in
'blk_mq_register_hctx'.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/02bc8bc6eab03c84373281b85cb6e98747172ff7; https://git.kernel.org/stable/c/33e8a3f61814ea30615d0fafaf50477975d6c1ca; https://git.kernel.org/stable/c/4b7a21c57b14fbcd0e[PII_REDACTED]e5933f5088e9
CVE: CVE-2022-50435
Published: 2025-10-01
Description: In the Linux kernel, the following vulnerability has been resolved:

ext4: avoid crash when inline data creation follows DIO write

When inode is created and written to using direct IO, there is nothing
to clear the EXT4_STATE_MAY_INLINE_DATA flag. Thus when inode gets
truncated later to say 1 byte and written using normal write, we will
try to store the data as inline data. This confuses the code later
because the inode now has both normal block and inline data allocated
and the confusion manifests for example as:

kernel BUG at fs/ext4/inode.c:2721!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 359 Comm: repro Not tainted 5.19.0-rc8-00001-g31ba1e3b8305-dirty #15
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-1.fc36 04/01/2014
RIP: 0010:ext4_writepages+0x363d/0x3660
RSP: 0018:ffffc90000ccf260 EFLAGS: 00010293
RAX: ffffffff81e1abcd RBX: [PII_REDACTED] RCX: ffff88810842a180
RDX: [PII_REDACTED] RSI: [PII_REDACTED] RDI: [PII_REDACTED]
RBP: ffffc90000ccf650 R08: ffffffff81e17d58 R09: ffffed10222c680b
R10: dfffe910222c680c R11: 1ffff110222c680a R12: ffff[PII_REDACTED]28
R13: ffffc90000ccf880 R14: [PII_REDACTED] R15: [PII_REDACTED]
FS:  00007f72635d2640(0000) GS:ffff88811b000000(0000) knlGS:[PII_REDACTED]
CS:  0010 DS: 0000 ES: 0000 CR0: [PII_REDACTED]
CR2: [PII_REDACTED] CR3: 000000010aa74000 CR4:[PII_REDACTED]150eb0
Call Trace:
 <TASK>
 do_writepages+0x397/0x640
 filemap_fdatawrite_wbc+0x151/0x1b0
 file_write_and_wait_range+0x1c9/0x2b0
 ext4_sync_file+0x19e/0xa00
 vfs_fsync_range+0x17b/0x190
 ext4_buffered_write_iter+0x488/0x530
 ext4_file_write_iter+0x449/0x1b90
 vfs_write+0xbcd/0xf40
 ksys_write+0x198/0x2c0
 __x64_sys_write+0x7b/0x90
 do_syscall_64+0x3d/0x90
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
 </TASK>

Fix the problem by clearing EXT4_STATE_MAY_INLINE_DATA when we are doing
direct IO write to a file.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/4bb26f2885ac6930984ee451b952c5a6042f2c0e; https://git.kernel.org/stable/c/771f15782d95760cde352c8d4bfd6f2c70719568; https://git.kernel.org/stable/c/89db2b50469bdbccb06ab072096d9d403124abac
CVE: CVE-2022-50436
Published: 2025-10-01
Description: In the Linux kernel, the following vulnerability has been resolved:

ext4: don't set up encryption key during jbd2 transaction

Commit a80f7fcf1867 ("ext4: fixup ext4_fc_track_* functions' signature")
extended the scope of the transaction in ext4_unlink() too far, making
it include the call to ext4_find_entry().  However, ext4_find_entry()
can deadlock when called from within a transaction because it may need
to set up the directory's encryption key.

Fix this by restoring the transaction to its original scope.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/1ba993208bcfd691e241483420a2a761d3f15750; https://git.kernel.org/stable/c/206dd3acfb9bca54a25b228c7c7c2257eedde09b; https://git.kernel.org/stable/c/23ad034760dd38e12b0e0e1b28b9629f330810a1
CVE: CVE-2022-50437
Published: 2025-10-01
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/msm/hdmi: fix memory corruption with too many bridges

Add the missing sanity check on the bridge counter to avoid corrupting
data beyond the fixed-sized bridge array in case there are ever more
than eight bridges.

Patchwork: https://patchwork.freedesktop.org/patch/502670/
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://git.kernel.org/stable/c/08c7375fa27a8ceee028868e03ffb3a0db919d44; https://git.kernel.org/stable/c/3c43f3ec731c233eb84b66199ee76dbf3ec6ecae; https://git.kernel.org/stable/c/4c1294da6aed1f16d47a417dcfe6602833c3c95c
CVE: CVE-2022-50438
Published: 2025-10-01
Description: In the Linux kernel, the following vulnerability has been resolved:

net: hinic: fix memory leak when reading function table

When the input parameter idx meets the expected case option in
hinic_dbg_get_func_table(), read_data is not released. Fix it.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/4c1f602df8956bc0decdafd7e4fc7eef50c550b1; https://git.kernel.org/stable/c/bb01910763f935b16538084b4269696e0de17f79; https://git.kernel.org/stable/c/e6765fe8de372a84f8dbe9e03ec13c7c70f946b8
CVE: CVE-2022-50439
Published: 2025-10-01
Description: In the Linux kernel, the following vulnerability has been resolved:

ASoC: mediatek: mt8173: Enable IRQ when pdata is ready

If the device does not come straight from reset, we might receive an IRQ
before we are ready to handle it.


[    2.334737] Unable to handle kernel read from unreadable memory at virtual address[PII_REDACTED]0001e4
[    2.522601] Call trace:
[    2.525040]  regmap_read+0x1c/0x80
[    2.528434]  mt8173_afe_irq_handler+0x40/0xf0
...
[    2.598921]  start_kernel+0x338/0x42c
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/190685ff4ee03eef8f12c71d8f626e414fa078a9; https://git.kernel.org/stable/c/27e7cf595d4a9fea9d3906b47d0faa87896beeb3; https://git.kernel.org/stable/c/4cbb264d4e9136acab2c8fd39e39ab1b1402b84b
CVE: CVE-2022-50440
Published: 2025-10-01
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/vmwgfx: Validate the box size for the snooped cursor

Invalid userspace dma surface copies could potentially overflow
the memcpy from the surface to the snooped image leading to crashes.
To fix it the dimensions of the copybox have to be validated
against the expected size of the snooped cursor.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/439cbbc1519547f9a7b483f0de33b556ebfec901; https://git.kernel.org/stable/c/4cf949c7fafe21e085a4ee386bb2dade9067316e; https://git.kernel.org/stable/c/4d54d11b[PII_REDACTED]1c58a00f733b16a93edfc4
CVE: CVE-2022-50441
Published: 2025-10-01
Description: In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: Lag, fix failure to cancel delayed bond work

Commit 0d4e8ed139d8 ("net/mlx5: Lag, avoid lockdep warnings")
accidentally removed a call to cancel delayed bond work thus it may
cause queued delay to expire and fall on an already destroyed work
queue.

Fix by restoring the call cancel_delayed_work_sync() before
destroying the workqueue.

This prevents call trace such as this:

[  329.230417] BUG: kernel NULL pointer dereference, address: [PII_REDACTED]
 [  329.231444] #PF: supervisor write access in kernel mode
 [  329.232233] #PF: error_code(0x0002) - not-present page
 [  329.233007] PGD 0 P4D 0
 [  329.233476] Oops: 0002 [#1] SMP
 [  329.234012] CPU: 5 PID: 145 Comm: kworker/u20:4 Tainted: G OE      6.0.0-rc5_mlnx #1
 [  329.235282] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
 [  329.236868] Workqueue: mlx5_cmd_0000:08:00.1 cmd_work_handler [mlx5_core]
 [  329.237886] RIP: 0010:_raw_spin_lock+0xc/0x20
 [  329.238585] Code: f0 0f b1 17 75 02 f3 c3 89 c6 e9 6f 3c 5f ff 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 0f 1f 44 00 00 31 c0 ba 01 00 00 00 <f0> 0f b1 17 75 02 f3 c3 89 c6 e9 45 3c 5f ff 0f 1f 44 00 00 0f 1f
 [  329.241156] RSP: 0018:ffffc900001b0e98 EFLAGS: 00010046
 [  329.241940] RAX: [PII_REDACTED] RBX: ffffffff82374ae0 RCX: [PII_REDACTED]
 [  329.242954] RDX: [PII_REDACTED] RSI: [PII_REDACTED] RDI: [PII_REDACTED]
 [  329.243974] RBP: ffff888106ccf000 R08: ffff[PII_REDACTED]c8 R09: ffff[PII_REDACTED]00
 [  329.244990] R10: [PII_REDACTED] R11: ffffffff826669f8 R12: [PII_REDACTED]
 [  329.246009] R13: [PII_REDACTED] R14: ffff888100aa7ce0 R15: ffff88852ca80000
 [  329.247030] FS:  [PII_REDACTED](0000) GS:ffff88852ca80000(0000) knlGS:[PII_REDACTED]
 [  329.248260] CS:  0010 DS: 0000 ES: 0000 CR0: [PII_REDACTED]
 [  329.249111] CR2: [PII_REDACTED] CR3: 000000016d675001 CR4:[PII_REDACTED]770ee0
 [  329.250133] DR0: [PII_REDACTED] DR1: [PII_REDACTED] DR2: [PII_REDACTED]
 [  329.251152] DR3: [PII_REDACTED] DR6: 00000000fffe0ff0 DR7: [PII_REDACTED]
 [  329.252176] PKRU: 55555554
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/4d1c1379d71777ddeda3e54f8fc26e9ecbfd1009; https://git.kernel.org/stable/c/5df57bb04e91add52fb67e226209df9a17f06a89; https://git.kernel.org/stable/c/8f1b8b3133504bf9125ee507ddcc3a8fb41a41f0
CVE: CVE-2022-50443
Published: 2025-10-01
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/rockchip: lvds: fix PM usage counter unbalance in poweron

pm_runtime_get_sync will increment pm usage counter even it failed.
Forgetting to putting operation will result in reference leak here.
We fix it by replacing it with the newest pm_runtime_resume_and_get
to keep usage counter balanced.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/110bf15825edf4f20bc4e56aba624297861b06ab; https://git.kernel.org/stable/c/12a9b4c4ebd9a0ba856370e088564af83cffd565; https://git.kernel.org/stable/c/4dba27f1a14592ac4cf71c3bc1cc1fd05dea8015
CVE: CVE-2022-50444
Published: 2025-10-01
Description: In the Linux kernel, the following vulnerability has been resolved:

clk: tegra20: Fix refcount leak in tegra20_clock_init

of_find_matching_node() returns a node pointer with refcount
incremented, we should use of_node_put() on it when not need anymore.
Add missing of_node_put() to avoid refcount leak.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/0172d14f50098f5736b4b272a1529a3e05419bd6; https://git.kernel.org/stable/c/4e343bafe03ff68a62f48f8235cf98f2c685468b; https://git.kernel.org/stable/c/53531d00e2a8a28a3bf56ea58b18ff3611824f37
CVE: CVE-2022-50446
Published: 2025-10-01
Description: In the Linux kernel, the following vulnerability has been resolved:

ARC: mm: fix leakage of memory allocated for PTE

Since commit d9820ff ("ARC: mm: switch pgtable_t back to struct page *")
a memory leakage problem occurs. Memory allocated for page table entries
not released during process termination. This issue can be reproduced by
a small program that allocates a large amount of memory. After several
runs, you'll see that the amount of free memory has reduced and will
continue to reduce after each run. All ARC CPUs are effected by this
issue. The issue was introduced since the kernel stable release v5.15-rc1.

As described in commit d9820ff after switch pgtable_t back to struct
page *, a pointer to "struct page" and appropriate functions are used to
allocate and free a memory page for PTEs, but the pmd_pgtable macro hasn't
changed and returns the direct virtual address from the PMD (PGD) entry.
Than this address used as a parameter in the __pte_free() and as a result
this function couldn't release memory page allocated for PTEs.

Fix this issue by changing the pmd_pgtable macro and returning pointer to
struct page.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/14009ada[PII_REDACTED]ab4ad0441b811780ea8773; https://git.kernel.org/stable/c/4fd9df10cb7a9289fbd22d669f9f98164d95a1ce; https://git.kernel.org/stable/c/d83a69966e8b6ae9dd447f3ac704c0223bceb7f7
CVE: CVE-2022-50447
Published: 2025-10-01
Description: In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_conn: Fix crash on hci_create_cis_sync

When attempting to connect multiple ISO sockets without using
DEFER_SETUP may result in the following crash:

BUG: KASAN: null-ptr-deref in hci_create_cis_sync+0x18b/0x2b0
Read of size 2 at addr [PII_REDACTED] by task kworker/u3:1/50

CPU: 0 PID: 50 Comm: kworker/u3:1 Not tainted
6.0.0-rc7-02243-gb84a13ff4eda #4373
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009),
BIOS 1.16.0-1.fc36 04/01/2014
Workqueue: hci0 hci_cmd_sync_work
Call Trace:
 <TASK>
 dump_stack_lvl+0x19/0x27
 kasan_report+0xbc/0xf0
 ? hci_create_cis_sync+0x18b/0x2b0
 hci_create_cis_sync+0x18b/0x2b0
 ? get_link_mode+0xd0/0xd0
 ? __ww_mutex_lock_slowpath+0x10/0x10
 ? mutex_lock+0xe0/0xe0
 ? get_link_mode+0xd0/0xd0
 hci_cmd_sync_work+0x111/0x190
 process_one_work+0x427/0x650
 worker_thread+0x87/0x750
 ? process_one_work+0x650/0x650
 kthread+0x14e/0x180
 ? kthread_exit+0x50/0x50
 ret_from_fork+0x22/0x30
 </TASK>
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/09a3b0c9c7c6b10587fbb610b718014703cff341; https://git.kernel.org/stable/c/50757a259ba78c4e938b5735e76ffec6cd0c942e; https://git.kernel.org/stable/c/a190cd9dc62d6ebeb679c1abe9dda4162dfefc84
CVE: CVE-2022-50448
Published: 2025-10-01
Description: In the Linux kernel, the following vulnerability has been resolved:

mm/uffd: fix warning without PTE_MARKER_UFFD_WP compiled in

When PTE_MARKER_UFFD_WP not configured, it's still possible to reach pte
marker code and trigger an warning. Add a few CONFIG_PTE_MARKER_UFFD_WP
ifdefs to make sure the code won't be reached when not compiled in.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/2204a880cb0c51952463a24a4fa01a6514c5a25a; https://git.kernel.org/stable/c/515778e2d790652a38a24554fdb7f21420d91efc; https://git.kernel.org/stable/c/b76e4eb02e9edb9a0a51942acdb373ca01346e8c
CVE: CVE-2022-50449
Published: 2025-10-01
Description: In the Linux kernel, the following vulnerability has been resolved:

clk: samsung: Fix memory leak in _samsung_clk_register_pll()

If clk_register() fails, @pll->rate_table may have allocated memory by
kmemdup(), so it needs to be freed, otherwise will cause memory leak
issue, this patch fixes it.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/2e8dc0626fe86ae08914478dec1419618c557bc0; https://git.kernel.org/stable/c/4887ec922e407b4feaf060c7b099482a5c52dee3; https://git.kernel.org/stable/c/4e501a31af8efa593a2f003637b56d00b75dca23
CVE: CVE-2022-50450
Published: 2025-10-01
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2022-50451
Published: 2025-10-01
Description: In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: Fix memory leak on ntfs_fill_super() error path

syzbot reported kmemleak as below:

BUG: memory leak
unreferenced object 0xffff8880122f1540 (size 32):
  comm "a.out", pid 6664, jiffies[PII_REDACTED] (age 25.500s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 ed ff ed ff 00 00 00 00  ................
  backtrace:
    [<ffffffff81b16052>] ntfs_init_fs_context+0x22/0x1c0
    [<ffffffff8164aaa7>] alloc_fs_context+0x217/0x430
    [<ffffffff81626dd4>] path_mount+0x704/0x1080
    [<ffffffff81627e7c>] __x64_sys_mount+0x18c/0x1d0
    [<ffffffff84593e14>] do_syscall_64+0x34/0xb0
    [<ffffffff84600087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd

This patch fixes this issue by freeing mount options on error path of
ntfs_fill_super().
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/2600c80ea7b39f987c3fa89287e73d62e322bbbd; https://git.kernel.org/stable/c/2dd9ccfb06bcdad30ad92d96c3affa38a458679e; https://git.kernel.org/stable/c/51e76a232f8c037f1d9e9922edc25b003d5f3414
CVE: CVE-2022-50452
Published: 2025-10-01
Description: In the Linux kernel, the following vulnerability has been resolved:

net: sched: cake: fix null pointer access issue when cake_init() fails

When the default qdisc is cake, if the qdisc of dev_queue fails to be
inited during mqprio_init(), cake_reset() is invoked to clear
resources. In this case, the tins is NULL, and it will cause gpf issue.

The process is as follows:
qdisc_create_dflt()
	cake_init()
		q->tins = kvcalloc(...)        --->failed, q->tins is NULL
	...
	qdisc_put()
		...
		cake_reset()
			...
			cake_dequeue_one()
				b = &q->tins[...]   --->q->tins is NULL

The following is the Call Trace information:
general protection fault, probably for non-canonical address
0xdffffc[PII_REDACTED]: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x[PII_REDACTED]000000-0x[PII_REDACTED]000007]
RIP: 0010:cake_dequeue_one+0xc9/0x3c0
Call Trace:
<TASK>
cake_reset+0xb1/0x140
qdisc_reset+0xed/0x6f0
qdisc_destroy+0x82/0x4c0
qdisc_put+0x9e/0xb0
qdisc_create_dflt+0x2c3/0x4a0
mqprio_init+0xa71/0x1760
qdisc_create+0x3eb/0x1000
tc_modify_qdisc+0x408/0x1720
rtnetlink_rcv_msg+0x38e/0xac0
netlink_rcv_skb+0x12d/0x3a0
netlink_unicast+0x4a2/0x740
netlink_sendmsg+0x826/0xcc0
sock_sendmsg+0xc5/0x100
____sys_sendmsg+0x583/0x690
___sys_sendmsg+0xe8/0x160
__sys_sendmsg+0xbf/0x160
do_syscall_64+0x35/0x80
entry_SYSCALL_64_after_hwframe+0x46/0xb0
RIP: 0033:0x7f89e5122d04
</TASK>
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/154f4c06d9dbec1a14e91286c70b[PII_REDACTED]e0; https://git.kernel.org/stable/c/1dc0a019550fd38ec6cab2d73c90df2bd659c96b; https://git.kernel.org/stable/c/51f9a8921ceacd7bf0d3f47fa867a64988ba1dcb
CVE: CVE-2022-50453
Published: 2025-10-01
Description: In the Linux kernel, the following vulnerability has been resolved:

gpiolib: cdev: fix NULL-pointer dereferences

There are several places where we can crash the kernel by requesting
lines, unbinding the GPIO device, then calling any of the system calls
relevant to the GPIO character device's annonymous file descriptors:
ioctl(), read(), poll().

While I observed it with the GPIO simulator, it will also happen for any
of the GPIO devices that can be hot-unplugged - for instance any HID GPIO
expander (e.g. CP2112).

This affects both v1 and v2 uAPI.

This fixes it partially by checking if gdev->chip is not NULL but it
doesn't entirely remedy the situation as we still have a race condition
in which another thread can remove the device after the check.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/533aae7c94dbc2b14301cfd68ae7e0e90f0c8438; https://git.kernel.org/stable/c/6d79546622baab843172b52c3af035f83c1b21df; https://git.kernel.org/stable/c/7c755a2d6df511eeb5afba966ac28140f9ea5063
CVE: CVE-2022-50454
Published: 2025-10-01
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/nouveau: fix a use-after-free in nouveau_gem_prime_import_sg_table()

nouveau_bo_init() is backed by ttm_bo_init() and ferries its return code
back to the caller. On failures, ttm will call nouveau_bo_del_ttm() and
free the memory.Thus, when nouveau_bo_init() returns an error, the gem
object has already been released. Then the call to nouveau_bo_ref() will
use the freed "nvbo->bo" and lead to a use-after-free bug.

We should delete the call to nouveau_bo_ref() to avoid the use-after-free.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/3aeda2fe6517cc52663d4ce3588dd43f0d4124a7; https://git.kernel.org/stable/c/540dfd188ea[PII_REDACTED]c1c220bd035a7db0e51; https://git.kernel.org/stable/c/56ee9577915dc06f[PII_REDACTED]2a9ef68dbdb5a8