deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-50009
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix null-ptr-deref in f2fs_get_dnode_of_data

There is issue as follows when test f2fs atomic write:
F2FS-fs (loop0): Can't find valid F2FS filesystem in 2th superblock
F2FS-fs (loop0): invalid crc_offset: 0
F2FS-fs (loop0): f2fs_check_nid_range: out-of-range nid=1, run fsck to fix.
F2FS-fs (loop0): f2fs_check_nid_range: out-of-range nid=2, run fsck to fix.
==================================================================
BUG: KASAN: null-ptr-deref in f2fs_get_dnode_of_data+0xac/0x16d0
Read of size 8 at addr [PII_REDACTED] by task rep/1990

CPU: 4 PID: 1990 Comm: rep Not tainted 5.19.0-rc6-next-20220715 #266
Call Trace:
 <TASK>
 dump_stack_lvl+0x6e/0x91
 print_report.cold+0x49a/0x6bb
 kasan_report+0xa8/0x130
 f2fs_get_dnode_of_data+0xac/0x16d0
 f2fs_do_write_data_page+0x2a5/0x1030
 move_data_page+0x3c5/0xdf0
 do_garbage_collect+0x2015/0x36c0
 f2fs_gc+0x554/0x1d30
 f2fs_balance_fs+0x7f5/0xda0
 f2fs_write_single_data_page+0xb66/0xdc0
 f2fs_write_cache_pages+0x716/0x1420
 f2fs_write_data_pages+0x84f/0x9a0
 do_writepages+0x130/0x3a0
 filemap_fdatawrite_wbc+0x87/0xa0
 file_write_and_wait_range+0x157/0x1c0
 f2fs_do_sync_file+0x206/0x12d0
 f2fs_sync_file+0x99/0xc0
 vfs_fsync_range+0x75/0x140
 f2fs_file_write_iter+0xd7b/0x1850
 vfs_write+0x645/0x780
 ksys_write+0xf1/0x1e0
 do_syscall_64+0x3b/0x90
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

As 3db1de0e582c commit changed atomic write way which new a cow_inode for
atomic write file, and also mark cow_inode as FI_ATOMIC_FILE.
When f2fs_do_write_data_page write cow_inode will use cow_inode's cow_inode
which is NULL. Then will trigger null-ptr-deref.
To solve above issue, introduce FI_COW_FILE flag for COW inode.

Fiexes: 3db1de0e582c("f2fs: change the current atomic write way")
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/0f63e33eca6fa29a11c76fa31db5fe1cada5ad6e; https://git.kernel.org/stable/c/4a2c5b7994960fac29cf8a3f4e62855bae1b27d4; https://git.kernel.org/stable/c/7000ad53ec1b17bd2fac76984b7b0c663755cbb7
CVE: CVE-2022-50010
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

video: fbdev: i740fb: Check the argument of i740_calc_vclk()

Since the user can control the arguments of the ioctl() from the user
space, under special arguments that may result in a divide-by-zero bug.

If the user provides an improper 'pixclock' value that makes the argumet
of i740_calc_vclk() less than 'I740_RFREQ_FIX', it will cause a
divide-by-zero bug in:
    drivers/video/fbdev/i740fb.c:353 p_best = min(15, ilog2(I740_MAX_VCO_FREQ / (freq / I740_RFREQ_FIX)));

The following log can reveal it:

divide error: 0000 [#1] PREEMPT SMP KASAN PTI
RIP: 0010:i740_calc_vclk drivers/video/fbdev/i740fb.c:353 [inline]
RIP: 0010:i740fb_decode_var drivers/video/fbdev/i740fb.c:646 [inline]
RIP: 0010:i740fb_set_par+0x163f/0x3b70 drivers/video/fbdev/i740fb.c:742
Call Trace:
 fb_set_var+0x604/0xeb0 drivers/video/fbdev/core/fbmem.c:1034
 do_fb_ioctl+0x234/0x670 drivers/video/fbdev/core/fbmem.c:1110
 fb_ioctl+0xdd/0x130 drivers/video/fbdev/core/fbmem.c:1189

Fix this by checking the argument of i740_calc_vclk() first.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-369
References: https://git.kernel.org/stable/c/2b7f559152a33c55f51b569b22efbe5e24886798; https://git.kernel.org/stable/c/40bf722f8064f50200b8c4f8946cd625b441dda9; https://git.kernel.org/stable/c/4b20c61365140d432dee7da7aa294215e7b900d9
CVE: CVE-2022-50012
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

powerpc/64: Init jump labels before parse_early_param()

On 64-bit, calling jump_label_init() in setup_feature_keys() is too
late because static keys may be used in subroutines of
parse_early_param() which is again subroutine of early_init_devtree().

For example booting with "threadirqs":

  static_key_enable_cpuslocked(): static key '0xc[PII_REDACTED]53260' used before call to jump_label_init()
  WARNING: CPU: 0 PID: 0 at kernel/jump_label.c:166 static_key_enable_cpuslocked+0xfc/0x120
  ...
  NIP static_key_enable_cpuslocked+0xfc/0x120
  LR  static_key_enable_cpuslocked+0xf8/0x120
  Call Trace:
    static_key_enable_cpuslocked+0xf8/0x120 (unreliable)
    static_key_enable+0x30/0x50
    setup_forced_irqthreads+0x28/0x40
    do_early_param+0xa0/0x108
    parse_args+0x290/0x4e0
    parse_early_options+0x48/0x5c
    parse_early_param+0x58/0x84
    early_init_devtree+0xd4/0x518
    early_setup+0xb4/0x214

So call jump_label_init() just before parse_early_param() in
early_init_devtree().

[mpe: Add call trace to change log and minor wording edits.]
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/8f9357313cdcadb0a311b44c29d4eaccc7fa632f; https://git.kernel.org/stable/c/ca829e05d3d4f728810cc5e4b468d9ebc7745eb3; https://git.kernel.org/stable/c/e3c9e9452a8ea12d335b1e59b2c72e1b99c699b8
CVE: CVE-2022-50013
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix to avoid use f2fs_bug_on() in f2fs_new_node_page()

As Dipanjan Das <mail.dipanjan.das@gmail.com> reported, syzkaller
found a f2fs bug as below:

RIP: 0010:f2fs_new_node_page+0x19ac/0x1fc0 fs/f2fs/node.c:1295
Call Trace:
 write_all_xattrs fs/f2fs/xattr.c:487 [inline]
 __f2fs_setxattr+0xe76/0x2e10 fs/f2fs/xattr.c:743
 f2fs_setxattr+0x233/0xab0 fs/f2fs/xattr.c:790
 f2fs_xattr_generic_set+0x133/0x170 fs/f2fs/xattr.c:86
 __vfs_setxattr+0x115/0x180 fs/xattr.c:182
 __vfs_setxattr_noperm+0x125/0x5f0 fs/xattr.c:216
 __vfs_setxattr_locked+0x1cf/0x260 fs/xattr.c:277
 vfs_setxattr+0x13f/0x330 fs/xattr.c:303
 setxattr+0x146/0x160 fs/xattr.c:611
 path_setxattr+0x1a7/0x1d0 fs/xattr.c:630
 __do_sys_lsetxattr fs/xattr.c:653 [inline]
 __se_sys_lsetxattr fs/xattr.c:649 [inline]
 __x64_sys_lsetxattr+0xbd/0x150 fs/xattr.c:649
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x46/0xb0

NAT entry and nat bitmap can be inconsistent, e.g. one nid is free
in nat bitmap, and blkaddr in its NAT entry is not NULL_ADDR, it
may trigger BUG_ON() in f2fs_new_node_page(), fix it.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/141170b759e03958f296033bb7001be62d1d363b; https://git.kernel.org/stable/c/29e734ec33ae4bd7de4018fb0fb0eec808c36b92; https://git.kernel.org/stable/c/43ce0a0bda2c54dad91d5a1943554eed9e050f55
CVE: CVE-2022-50015
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

ASoC: SOF: Intel: hda-ipc: Do not process IPC reply before firmware boot

It is not yet clear, but it is possible to create a firmware so broken
that it will send a reply message before a FW_READY message (it is not
yet clear if FW_READY will arrive later).
Since the reply_data is allocated only after the FW_READY message, this
will lead to a NULL pointer dereference if not filtered out.

The issue was reported with IPC4 firmware but the same condition is present
for IPC3.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/48945246cf802b9866f3a821103f1a7a196baf68; https://git.kernel.org/stable/c/499cc881b09c8283ab5e75b0d6d21cb427722161
CVE: CVE-2022-50016
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

ASoC: SOF: Intel: cnl: Do not process IPC reply before firmware boot

It is not yet clear, but it is possible to create a firmware so broken
that it will send a reply message before a FW_READY message (it is not
yet clear if FW_READY will arrive later).
Since the reply_data is allocated only after the FW_READY message, this
will lead to a NULL pointer dereference if not filtered out.

The issue was reported with IPC4 firmware but the same condition is present
for IPC3.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/230f646085d17a008b609eb8fe8befb8811868f0; https://git.kernel.org/stable/c/acacd9eefd0def5a83244d88e5483b5f38ee7287
CVE: CVE-2022-50017
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

mips: cavium-octeon: Fix missing of_node_put() in octeon2_usb_clocks_start

We should call of_node_put() for the reference 'uctl_node' returned by
of_get_parent() which will increase the refcount. Otherwise, there will
be a refcount leak bug.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/1b49707df679b5510ed06ace7378ddc2aec5c3fb; https://git.kernel.org/stable/c/1e39037e44d7fa3728686af146f9285ea197097d; https://git.kernel.org/stable/c/7822d994eb9579a1df4cdbc315db090a041e50f3
CVE: CVE-2022-50018
Published: 2025-06-18
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2022-50019
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

tty: serial: Fix refcount leak bug in ucc_uart.c

In soc_info(), of_find_node_by_type() will return a node pointer
with refcount incremented. We should use of_node_put() when it is
not used anymore.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/17c32546166d8a7d2579c4b57c8b16241f94a66b; https://git.kernel.org/stable/c/59bc4c19d53bdac61ec952c01c6e864f5f0f8367; https://git.kernel.org/stable/c/81939c4fbc2d5c754d0f1c1f05149d4b70d751ed
CVE: CVE-2022-50020
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

ext4: avoid resizing to a partial cluster size

This patch avoids an attempt to resize the filesystem to an
unaligned cluster boundary.  An online resize to a size that is not
integral to cluster size results in the last iteration attempting to
grow the fs by a negative amount, which trips a BUG_ON and leaves the fs
with a corrupted in-memory superblock.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-1284
References: https://git.kernel.org/stable/c/0082e99a9074ff88eff729c70c93454c8588d8e1; https://git.kernel.org/stable/c/69cb8e9d8cd97cdf5e293b26d70a9dee3e35e6bd; https://git.kernel.org/stable/c/72b850a2a996f72541172e7cf686d54a2b29bcd8
CVE: CVE-2022-50021
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

ext4: block range must be validated before use in ext4_mb_clear_bb()

Block range to free is validated in ext4_free_blocks() using
ext4_inode_block_valid() and then it's passed to ext4_mb_clear_bb().
However in some situations on bigalloc file system the range might be
adjusted after the validation in ext4_free_blocks() which can lead to
troubles on corrupted file systems such as one found by syzkaller that
resulted in the following BUG

kernel BUG at fs/ext4/ext4.h:3319!
PREEMPT SMP NOPTI
CPU: 28 PID: 4243 Comm: repro Kdump: loaded Not tainted 5.19.0-rc6+ #1
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1.fc35 04/01/2014
RIP: 0010:ext4_free_blocks+0x95e/0xa90
Call Trace:
 <TASK>
 ? lock_timer_base+0x61/0x80
 ? __es_remove_extent+0x5a/0x760
 ? __mod_timer+0x256/0x380
 ? ext4_ind_truncate_ensure_credits+0x90/0x220
 ext4_clear_blocks+0x107/0x1b0
 ext4_free_data+0x15b/0x170
 ext4_ind_truncate+0x214/0x2c0
 ? _raw_spin_unlock+0x15/0x30
 ? ext4_discard_preallocations+0x15a/0x410
 ? ext4_journal_check_start+0xe/0x90
 ? __ext4_journal_start_sb+0x2f/0x110
 ext4_truncate+0x1b5/0x460
 ? __ext4_journal_start_sb+0x2f/0x110
 ext4_evict_inode+0x2b4/0x6f0
 evict+0xd0/0x1d0
 ext4_enable_quotas+0x11f/0x1f0
 ext4_orphan_cleanup+0x3de/0x430
 ? proc_create_seq_private+0x43/0x50
 ext4_fill_super+0x295f/0x3ae0
 ? snprintf+0x39/0x40
 ? sget_fc+0x19c/0x330
 ? ext4_reconfigure+0x850/0x850
 get_tree_bdev+0x16d/0x260
 vfs_get_tree+0x25/0xb0
 path_mount+0x431/0xa70
 __x64_sys_mount+0xe2/0x120
 do_syscall_64+0x5b/0x80
 ? do_user_addr_fault+0x1e2/0x670
 ? exc_page_fault+0x70/0x170
 entry_SYSCALL_64_after_hwframe+0x46/0xb0
RIP: 0033:0x7fdf4e512ace

Fix it by making sure that the block range is properly validated before
used every time it changes in ext4_free_blocks() or ext4_mb_clear_bb().
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/1e1c2b86ef86a8477fd9b9a4f48a6bfe235606f6; https://git.kernel.org/stable/c/560a2744cbbf03cac65a6394f9b0d99aa437c867; https://git.kernel.org/stable/c/7550aade978371ac582f6d43b14c4cb89ca54463
CVE: CVE-2022-50022
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

drivers:md:fix a potential use-after-free bug

In line 2884, "raid5_release_stripe(sh);" drops the reference to sh and
may cause sh to be released. However, sh is subsequently used in lines
2886 "if (sh->batch_head && sh != sh->batch_head)". This may result in an
use-after-free bug.

It can be fixed by moving "raid5_release_stripe(sh);" to the bottom of
the function.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/09cf99bace7789d91caa8d10fbcfc8b2fb35857f; https://git.kernel.org/stable/c/104212471b1c1817b311771d817fb692af983173; https://git.kernel.org/stable/c/5d8325fd15892c8ab1146edc1d7ed8463de39636
CVE: CVE-2022-50023
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

dmaengine: dw-axi-dmac: ignore interrupt if no descriptor

If the channel has no descriptor and the interrupt is raised then the
kernel will OOPS. Check the result of vchan_next_desc() in the handler
axi_chan_block_xfer_complete() to avoid the error happening.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/3d05aeebbde8c69593d8aa512b7c08b8f0ad25ba; https://git.kernel.org/stable/c/54aa6c49361b79f7f6b15fc63dfe9ea52c70bb03; https://git.kernel.org/stable/c/820f5ce999d2f99961e88c16d65cd26764df0590
CVE: CVE-2022-50024
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

dmaengine: dw-axi-dmac: do not print NULL LLI during error

During debugging we have seen an issue where axi_chan_dump_lli()
is passed a NULL LLI pointer which ends up causing an OOPS due
to trying to get fields from it. Simply print NULL LLI and exit
to avoid this.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/86cb0defe0e275453bc39e856bb523eb425a6537; https://git.kernel.org/stable/c/ad764df73ae5eada265fffc[PII_REDACTED]cbb2b8d; https://git.kernel.org/stable/c/af76e6fdcf92f1a742b788d0dba5edd194267bf9
CVE: CVE-2022-50025
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

cxl: Fix a memory leak in an error handling path

A bitmap_zalloc() must be balanced by a corresponding bitmap_free() in the
error handling path of afu_allocate_irqs().
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/3a15b45b5454da862376b5d69a4967f5c6fa1368; https://git.kernel.org/stable/c/4be138bcd6d68cec0ce47051b117541061f5141a; https://git.kernel.org/stable/c/6544ff559315498ad6c0a311359ca44987f9ca07
CVE: CVE-2022-50026
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

habanalabs/gaudi: fix shift out of bounds

When validating NIC queues, queue offset calculation must be
performed only for NIC queues.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://git.kernel.org/stable/c/01622098aeb05a5efbb727199bbc2a[PII_REDACTED]; https://git.kernel.org/stable/c/19958bf4ef3124f6e93fd9e2de0b54d2a356a4db; https://git.kernel.org/stable/c/b09e5ab18c9f52ff14cf968770e15d5b2dd85c43
CVE: CVE-2022-50027
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

scsi: lpfc: Fix possible memory leak when failing to issue CMF WQE

There is no corresponding free routine if lpfc_sli4_issue_wqe fails to
issue the CMF WQE in lpfc_issue_cmf_sync_wqe.

If ret_val is non-zero, then free the iocbq request structure.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/2f67dc7970bce3529edce93a0a14234d88b3fcd5; https://git.kernel.org/stable/c/4eb7a1beff03836d3df271cd23b790884e3facb9; https://git.kernel.org/stable/c/9c8e2e607270a368834a0ef72aa82d970f89c596
CVE: CVE-2022-50028
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

gadgetfs: ep_io - wait until IRQ finishes

after usb_ep_queue() if wait_for_completion_interruptible() is
interrupted we need to wait until IRQ gets finished.

Otherwise complete() from epio_complete() can corrupt stack.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/04cb742d4d8f30dc2e83b46ac317eec09191c68e; https://git.kernel.org/stable/c/118d967ce00a3d128bf731b35e4e2cb0facf5f00; https://git.kernel.org/stable/c/2b06d5d97c0e067108a[PII_REDACTED]1d40742138
CVE: CVE-2022-50029
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

clk: qcom: ipq8074: dont disable gcc_sleep_clk_src

Once the usb sleep clocks are disabled, clock framework is trying to
disable the sleep clock source also.

However, it seems that it cannot be disabled and trying to do so produces:
[  245.436390] ------------[ cut here ]------------
[  245.441233] gcc_sleep_clk_src status stuck at 'on'
[  245.441254] WARNING: CPU: 2 PID: 223 at clk_branch_wait+0x130/0x140
[  245.450435] Modules linked in: xhci_plat_hcd xhci_hcd dwc3 dwc3_qcom leds_gpio
[  245.456601] CPU: 2 PID: 223 Comm: sh Not tainted 5.18.0-rc4 #215
[  245.463889] Hardware name: Xiaomi AX9000 (DT)
[  245.470050] pstate: 204000c5 (nzCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[  245.474307] pc : clk_branch_wait+0x130/0x140
[  245.481073] lr : clk_branch_wait+0x130/0x140
[  245.485588] sp : ffffffc009f2bad0
[  245.489838] x29: ffffffc009f2bad0 x28: ffffff8003e6c800 x27: [PII_REDACTED]
[  245.493057] x26: [PII_REDACTED] x25: [PII_REDACTED] x24: ffffff800226ef20
[  245.500175] x23: ffffffc0089ff550 x22: [PII_REDACTED] x21: ffffffc008476ad0
[  245.507294] x20: [PII_REDACTED] x19: ffffffc00965ac70 x18: fffffffffffc51a7
[  245.514413] x17: 68702e[PII_REDACTED] x16: 3a6d726f6674616c x15: ffffffc089f2b777
[  245.521531] x14: ffffffc0095c9d18 x13: [PII_REDACTED] x12: [PII_REDACTED]
[  245.528649] x11: 00000000ffffffea x10: ffffffc009621d18 x9 : [PII_REDACTED]
[  245.535767] x8 : [PII_REDACTED] x7 :[PII_REDACTED]017fe8 x6 : [PII_REDACTED]
[  245.542885] x5 : ffffff803fdca6d8 x4 : [PII_REDACTED] x3 : [PII_REDACTED]
[  245.550002] x2 : [PII_REDACTED] x1 : [PII_REDACTED] x0 : [PII_REDACTED]
[  245.557122] Call trace:
[  245.564229]  clk_branch_wait+0x130/0x140
[  245.566490]  clk_branch2_disable+0x2c/0x40
[  245.570656]  clk_core_disable+0x60/0xb0
[  245.574561]  clk_core_disable+0x68/0xb0
[  245.578293]  clk_disable+0x30/0x50
[  245.582113]  dwc3_qcom_remove+0x60/0xc0 [dwc3_qcom]
[  245.585588]  platform_remove+0x28/0x60
[  245.590361]  device_remove+0x4c/0x80
[  245.594179]  device_release_driver_internal+0x1dc/0x230
[  245.597914]  device_driver_detach+0x18/0x30
[  245.602861]  unbind_store+0xec/0x110
[  245.607027]  drv_attr_store+0x24/0x40
[  245.610847]  sysfs_kf_write+0x44/0x60
[  245.614405]  kernfs_fop_write_iter+0x128/0x1c0
[  245.618052]  new_sync_write+0xc0/0x130
[  245.622391]  vfs_write+0x1d4/0x2a0
[  245.626123]  ksys_write+0x58/0xe0
[  245.629508]  __arm64_sys_write+0x1c/0x30
[  245.632895]  invoke_syscall.constprop.0+0x5c/0x110
[  245.636890]  do_el0_svc+0xa0/0x150
[  245.641488]  el0_svc+0x18/0x60
[  245.644872]  el0t_64_sync_handler+0xa4/0x130
[  245.647914]  el0t_64_sync+0x174/0x178
[  245.652340] ---[ end trace [PII_REDACTED] ]---

So, add CLK_IS_CRITICAL flag to the clock so that the kernel won't try
to disable the sleep clock.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/17d58499dc9c7e059dab7d170e9bae1e7e9c561b; https://git.kernel.org/stable/c/1bf7305e79aab095196131bdc87a97796e0e3fac; https://git.kernel.org/stable/c/38cee0d2b65eed42a44052de1bfdc0177b6c3f05
CVE: CVE-2022-50030
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input

Malformed user input to debugfs results in buffer overflow crashes.  Adapt
input string lengths to fit within internal buffers, leaving space for NULL
terminators.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://git.kernel.org/stable/c/2d544e9d19c109dfe34b3dc1253a8b2971abe060; https://git.kernel.org/stable/c/927907f1cbb3408cadde637fccfc17bb6b10a87d; https://git.kernel.org/stable/c/b92506dc51f81741eb26609175ac206c20f06e0a
CVE: CVE-2022-50031
Published: 2025-06-18
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2022-50032
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

usb: renesas: Fix refcount leak bug

In usbhs_rza1_hardware_init(), of_find_node_by_name() will return
a node pointer with refcount incremented. We should use of_node_put()
when it is not used anymore.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/36b18b777dece704b7c2e9e7947ca41a9b0fb009; https://git.kernel.org/stable/c/5c4b699193eba51f1bbf462d758d66f545fddd35; https://git.kernel.org/stable/c/9790a5a4f07f38a5add85ec58c44797d3a7c3677
CVE: CVE-2022-50033
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

usb: host: ohci-ppc-of: Fix refcount leak bug

In ohci_hcd_ppc_of_probe(), of_find_compatible_node() will return
a node pointer with refcount incremented. We should use of_node_put()
when it is not used anymore.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/0334d23c56ecf1ee1563bb83e29cc5a51ed7fb4e; https://git.kernel.org/stable/c/0fc62bbc95319bbd330e3645afc7c286acec9ef8; https://git.kernel.org/stable/c/403132881e66db7aa98b55c6655daedd80d407fd
CVE: CVE-2022-50034
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

usb: cdns3 fix use-after-free at workaround 2

BUG: KFENCE: use-after-free read in __list_del_entry_valid+0x10/0xac

cdns3_wa2_remove_old_request()
{
	...
	kfree(priv_req->request.buf);
	cdns3_gadget_ep_free_request(&priv_ep->endpoint, &priv_req->request);
	list_del_init(&priv_req->list);
	^^^ use after free
	...
}

cdns3_gadget_ep_free_request() free the space pointed by priv_req,
but priv_req is used in the following list_del_init().

This patch move list_del_init() before cdns3_gadget_ep_free_request().
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/6d7ac60098b206d0472475b666cb09d556bec03d; https://git.kernel.org/stable/c/6fd50446e7c9a98b4bcf96815f5c9602a16ea472; https://git.kernel.org/stable/c/7d602f30149a117eea260208b1661bc404c21dfd
CVE: CVE-2022-50036
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/sun4i: dsi: Prevent underflow when computing packet sizes

Currently, the packet overhead is subtracted using unsigned arithmetic.
With a short sync pulse, this could underflow and wrap around to near
the maximal u16 value. Fix this by using signed subtraction. The call to
max() will correctly handle any negative numbers that are produced.

Apply the same fix to the other timings, even though those subtractions
are less likely to underflow.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-191
References: https://git.kernel.org/stable/c/82a1356a933d8443139f8886f11b63c974a09a67; https://git.kernel.org/stable/c/98e28de472ef248352f04f87e29e634ebb0ec240; https://git.kernel.org/stable/c/a1e7908f78f5a7f53f8cd83c7dcdfec974c95f26
CVE: CVE-2022-50037
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/i915/ttm: don't leak the ccs state

The kernel only manages the ccs state with lmem-only objects, however
the kernel should still take care not to leak the CCS state from the
previous user.

(cherry picked from commit 353819d85f87be46aeb9c1dd929d445a006fc6ec)
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/232d150fa15606e96c0e01e5c7a2d4e03f621787; https://git.kernel.org/stable/c/b431cffb4883b9e90d48f0c408674c50fef428a5