deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-50135
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

RDMA/rxe: Fix BUG: KASAN: null-ptr-deref in rxe_qp_do_cleanup

The function rxe_create_qp calls rxe_qp_from_init. If some error
occurs, the error handler of function rxe_qp_from_init will set
both scq and rcq to NULL.

Then rxe_create_qp calls rxe_put to handle qp. In the end,
rxe_qp_do_cleanup is called by rxe_put. rxe_qp_do_cleanup directly
accesses scq and rcq before checking them. This will cause
null-ptr-deref error.

The call graph is as below:

rxe_create_qp {
  ...
  rxe_qp_from_init {
    ...
  err1:
    ...
    qp->rcq = NULL;  <---rcq is set to NULL
    qp->scq = NULL;  <---scq is set to NULL
    ...
  }

qp_init:
  rxe_put{
    ...
    rxe_qp_do_cleanup {
      ...
      atomic_dec(&qp->scq->num_wq); <--- scq is accessed
      ...
      atomic_dec(&qp->rcq->num_wq); <--- rcq is accessed
    }
}
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/37da51efe6eaa0560f46803c8c436a48a2084da7; https://git.kernel.org/stable/c/8598b9d0a364c1663c96fc0fab9df0d36c809aea
CVE: CVE-2022-50136
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

RDMA/siw: Fix duplicated reported IW_CM_EVENT_CONNECT_REPLY event

If siw_recv_mpa_rr returns -EAGAIN, it means that the MPA reply hasn't
been received completely, and should not report IW_CM_EVENT_CONNECT_REPLY
in this case. This may trigger a call trace in iw_cm. A simple way to
trigger this:
 server: ib_send_lat
 client: ib_send_lat -R <server_ip>

The call trace looks like this:

 kernel BUG at drivers/infiniband/core/iwcm.c:894!
 invalid opcode: 0000 [#1] PREEMPT SMP NOPTI
 <...>
 Workqueue: iw_cm_wq cm_work_handler [iw_cm]
 Call Trace:
  <TASK>
  cm_work_handler+0x1dd/0x370 [iw_cm]
  process_one_work+0x1e2/0x3b0
  worker_thread+0x49/0x2e0
  ? rescuer_thread+0x370/0x370
  kthread+0xe5/0x110
  ? kthread_complete_and_exit+0x20/0x20
  ret_from_fork+0x1f/0x30
  </TASK>
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/0066246d2d7e2619f3ecf3cf07333c59e6e7d84d; https://git.kernel.org/stable/c/11edf0bba15ea9df49478affec7974f351bb2f6e; https://git.kernel.org/stable/c/1434de50a5d9dab91c8ce031bc23b3e2178379c5
CVE: CVE-2022-50137
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

RDMA/irdma: Fix a window for use-after-free

During a destroy CQ an interrupt may cause processing of a CQE after CQ
resources are freed by irdma_cq_free_rsrc(). Fix this by moving the call
to irdma_cq_free_rsrc() after the irdma_sc_cleanup_ceqes(), which is
called under the cq_lock.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/0abf2eef80295923b819ce89ff9edc1fe61be17c; https://git.kernel.org/stable/c/350ac793a03c8a30a3f2b27fc282cd1c67070763; https://git.kernel.org/stable/c/8ecef7890b3aea78c8bbb501a4b5b8134367b821
CVE: CVE-2022-50138
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

RDMA/qedr: Fix potential memory leak in __qedr_alloc_mr()

__qedr_alloc_mr() allocates a memory chunk for "mr->info.pbl_table" with
init_mr_info(). When rdma_alloc_tid() and rdma_register_tid() fail, "mr"
is released while "mr->info.pbl_table" is not released, which will lead
to a memory leak.

We should release the "mr->info.pbl_table" with qedr_free_pbl() when error
occurs to fix the memory leak.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/07ba048df306dc93fc4d2ef670b9e24644a2069f; https://git.kernel.org/stable/c/79ce50dddaf28b5c57911ecc80a2be17a0b17f83; https://git.kernel.org/stable/c/7e647a8d5fc0a2c8e0f36f585a6388286a25bb15
CVE: CVE-2022-50139
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

usb: aspeed-vhub: Fix refcount leak bug in ast_vhub_init_desc()

We should call of_node_put() for the reference returned by
of_get_child_by_name() which has increased the refcount.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/0e0a40c803643f4edc30f0660f2f3bea4d57a99a; https://git.kernel.org/stable/c/220fafb4ed04187e9c17be4152da5a7f2ffbdd8c; https://git.kernel.org/stable/c/[PII_REDACTED]ca24c3229414c769323fb8bf39b4bf
CVE: CVE-2022-50140
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

memstick/ms_block: Fix a memory leak

'erased_blocks_bitmap' is never freed. As it is allocated at the same time
as 'used_blocks_bitmap', it is likely that it should be freed also at the
same time.

Add the corresponding bitmap_free() in msb_data_clear().
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/16e[PII_REDACTED]7416abf45393d6a80a5a1034429; https://git.kernel.org/stable/c/37958980eb4cd71ae594ace093c11b6a91e165e8; https://git.kernel.org/stable/c/39be95d1ff7b44c1e969af72ba9da7332dfcc1da
CVE: CVE-2022-50141
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

mmc: sdhci-of-esdhc: Fix refcount leak in esdhc_signal_voltage_switch

of_find_matching_node() returns a node pointer with refcount
incremented, we should use of_node_put() on it when not need anymore.
Add missing of_node_put() to avoid refcount leak.
of_node_put() checks null pointer.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/352377cf74710bc3368dddf78f17210dfe456933; https://git.kernel.org/stable/c/4c472a2c9ed6ea9d272268d7f484d4303c549f1a; https://git.kernel.org/stable/c/547db1dd98d1815574ebea7358015a17199a93bc
CVE: CVE-2022-50142
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

intel_th: msu: Fix vmalloced buffers

After commit f5ff79fddf0e ("dma-mapping: remove CONFIG_DMA_REMAP") there's
a chance of DMA buffer getting allocated via vmalloc(), which messes up
the mmapping code:

> RIP: msc_mmap_fault [intel_th_msu]
> Call Trace:
>  <TASK>
>  __do_fault
>  do_fault
...

Fix this by accounting for vmalloc possibility.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://git.kernel.org/stable/c/0ed72c6bc632cbf8d979ac60f982ff84b7bb610a; https://git.kernel.org/stable/c/4914c50670b6a531e2cb17cd984cc565b4681312; https://git.kernel.org/stable/c/566887bad7ff2297d6b3f9659c702ba075f3d62d
CVE: CVE-2022-50143
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

intel_th: Fix a resource leak in an error handling path

If an error occurs after calling 'pci_alloc_irq_vectors()',
'pci_free_irq_vectors()' must be called as already done in the remove
function.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/086c28ab7c5699256aced0049aae9c42f1410313; https://git.kernel.org/stable/c/859342220accd0d332864fafbf4e3d2d0492bc3f; https://git.kernel.org/stable/c/9b5469573a274729bdb04b60a8d71f8d09940a31
CVE: CVE-2022-50145
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

dmaengine: sf-pdma: Add multithread support for a DMA channel

When we get a DMA channel and try to use it in multiple threads it
will cause oops and hanging the system.

% echo 64 > /sys/module/dmatest/parameters/threads_per_chan
% echo 10000 > /sys/module/dmatest/parameters/iterations
% echo 1 > /sys/module/dmatest/parameters/run
[   89.480664] Unable to handle kernel NULL pointer dereference at virtual
               address[PII_REDACTED]0000a0
[   89.488725] Oops [#1]
[   89.494708] CPU: 2 PID: 1008 Comm: dma0chan0-copy0 Not tainted
               5.17.0-rc5
[   89.509385] epc : vchan_find_desc+0x32/0x46
[   89.513553]  ra : sf_pdma_tx_status+0xca/0xd6

This happens because of data race. Each thread rewrite channels's
descriptor as soon as device_prep_dma_memcpy() is called. It leads to the
situation when the driver thinks that it uses right descriptor that
actually is freed or substituted for other one.

With current fixes a descriptor changes its value only when it has
been used. A new descriptor is acquired from vc->desc_issued queue that
is already filled with descriptors that are ready to be sent. Threads
have no direct access to DMA channel descriptor. Now it is just possible
to queue a descriptor for further processing.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/4c7350b1dd8a192af844de32fc99b9e34c876fda; https://git.kernel.org/stable/c/5ab2782c944e324008ef5d658f2494a9f0e3c5ac; https://git.kernel.org/stable/c/a93b3f1e11971a91b6441b6d47488f4492cc113f
CVE: CVE-2022-50146
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

PCI: dwc: Deallocate EPC memory on dw_pcie_ep_init() errors

If dw_pcie_ep_init() fails to perform any action after the EPC memory is
initialized and the MSI memory region is allocated, the latter parts won't
be undone thus causing a memory leak.  Add a cleanup-on-error path to fix
these leaks.

[bhelgaas: commit log]
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/2d546db5c80c45cac3ccd929550244fd58f4ff58; https://git.kernel.org/stable/c/3b453f5d06d1f1d6b20a75ea51dc7b53ae78f479; https://git.kernel.org/stable/c/8161e9626b50892eaedbd8070ecb1586ecedb109
CVE: CVE-2022-50147
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

mm/mempolicy: fix get_nodes out of bound access

When user specified more nodes than supported, get_nodes will access nmask
array out of bounds.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://git.kernel.org/stable/c/000eca5d044d1ee23b4ca311793cf3fc528da6c6; https://git.kernel.org/stable/c/[PII_REDACTED]4e7e3d12008802cfb6c28a8aa16d85; https://git.kernel.org/stable/c/8176f6a0d9c1b06bc7af7c3d6acd4a66448939df
CVE: CVE-2022-50148
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

kernfs: fix potential NULL dereference in __kernfs_remove

When lockdep is enabled, lockdep_assert_held_write would
cause potential NULL pointer dereference.

Fix the following smatch warnings:

fs/kernfs/dir.c:1353 __kernfs_remove() warn: variable dereferenced before check 'kn' (see line 1346)
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/4a9f35b8729c5bf13ea671c908c17ed74c48fc50; https://git.kernel.org/stable/c/72b5d5aef246a0387cefa23121dd90901c7a691a; https://git.kernel.org/stable/c/b871986d9d3071f5082664ac274d93f08db257cd
CVE: CVE-2022-50150
Published: 2025-06-18
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2022-50151
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

usb: cdns3: fix random warning message when driver load

Warning log:
[    4.141392] Unexpected gfp: 0x4 (GFP_DMA32). Fixing up to gfp: 0xa20 (GFP_ATOMIC). Fix your code!
[    4.150340] CPU: 1 PID: 175 Comm: 1-0050 Not tainted 5.15.5-00039-g2fd9ae1b568c #20
[    4.158010] Hardware name: Freescale i.MX8QXP MEK (DT)
[    4.163155] Call trace:
[    4.165600]  dump_backtrace+0x0/0x1b0
[    4.169286]  show_stack+0x18/0x68
[    4.172611]  dump_stack_lvl+0x68/0x84
[    4.176286]  dump_stack+0x18/0x34
[    4.179613]  kmalloc_fix_flags+0x60/0x88
[    4.183550]  new_slab+0x334/0x370
[    4.186878]  ___slab_alloc.part.108+0x4d4/0x748
[    4.191419]  __slab_alloc.isra.109+0x30/0x78
[    4.195702]  kmem_cache_alloc+0x40c/0x420
[    4.199725]  dma_pool_alloc+0xac/0x1f8
[    4.203486]  cdns3_allocate_trb_pool+0xb4/0xd0

pool_alloc_page(struct dma_pool *pool, gfp_t mem_flags)
{
	...
	page = kmalloc(sizeof(*page), mem_flags);
	page->vaddr = dma_alloc_coherent(pool->dev, pool->allocation,
					 &page->dma, mem_flags);
	...
}

kmalloc was called with mem_flags, which is passed down in
cdns3_allocate_trb_pool() and have GFP_DMA32 flags.
kmall_fix_flags() report warning.

GFP_DMA32 is not useful at all. dma_alloc_coherent() will handle
DMA memory region correctly by pool->dev. GFP_DMA32 can be removed
safely.
CVSS Score: 7.8 (HIGH)
References: https://git.kernel.org/stable/c/8659ab3d936fcf0084676f98b75b317017aa8f82; https://git.kernel.org/stable/c/8e142744f0e96abc69ccd99e6d6c7eb662267f21; https://git.kernel.org/stable/c/960a8a35a6027a08c4b511435bf59609b5d5e5cd
CVE: CVE-2022-50152
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

usb: ohci-nxp: Fix refcount leak in ohci_hcd_nxp_probe

of_parse_phandle() returns a node pointer with refcount
incremented, we should use of_node_put() on it when not need anymore.
Add missing of_node_put() to avoid refcount leak.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/302970b4cad3ebfda2c05ce06c322ccdc447d17e; https://git.kernel.org/stable/c/4db00c2fa6f8c9876a7e20511dccf43b50be9006; https://git.kernel.org/stable/c/50238c4b54c2ac6c2da7a84a4a2b0a570e3da0e2
CVE: CVE-2022-50153
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

usb: host: Fix refcount leak in ehci_hcd_ppc_of_probe

of_find_compatible_node() returns a node pointer with refcount
incremented, we should use of_node_put() on it when done.
Add missing of_node_put() to avoid refcount leak.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/038453b17fe30ea38f0f3c916e2ae2b7f8cef84e; https://git.kernel.org/stable/c/3a50c917c67dd0bc39c14de4a8b75a1d50fdce66; https://git.kernel.org/stable/c/585d22a5624ef2b540c337665c72fea8cd33db50
CVE: CVE-2022-50154
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

PCI: mediatek-gen3: Fix refcount leak in mtk_pcie_init_irq_domains()

of_get_child_by_name() returns a node pointer with refcount incremented, so
we should use of_node_put() on it when we don't need it anymore.

Add missing of_node_put() to avoid refcount leak.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/0675fe20da7fa69b1ba80c23470c1433a2356c03; https://git.kernel.org/stable/c/2aa166c39d5a8221e6e22ab1a583656d4c8dc7f7; https://git.kernel.org/stable/c/bf038503d5fe[PII_REDACTED]4233fe7aeb0984e961
CVE: CVE-2022-50155
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

mtd: parsers: ofpart: Fix refcount leak in bcm4908_partitions_fw_offset

of_find_node_by_path() returns a node pointer with refcount incremented,
we should use of_node_put() on it when not need anymore.
Add missing of_node_put() to avoid refcount leak.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/01bc3840d943cf725dea6ca13e11ffda82bad49a; https://git.kernel.org/stable/c/3193c3a3f4fca65cb06d9d48d07fb96bc1f5b2bd; https://git.kernel.org/stable/c/[PII_REDACTED]82b15014f364ec0cf2a843407f5af1
CVE: CVE-2022-50156
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

HID: cp2112: prevent a buffer overflow in cp2112_xfer()

Smatch warnings:
drivers/hid/hid-cp2112.c:793 cp2112_xfer() error: __memcpy()
'data->block[1]' too small (33 vs 255)
drivers/hid/hid-cp2112.c:793 cp2112_xfer() error: __memcpy() 'buf' too
small (64 vs 255)

The 'read_length' variable is provided by 'data->block[0]' which comes
from user and it(read_length) can take a value between 0-255. Add an
upper bound to 'read_length' variable to prevent a buffer overflow in
memcpy().
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://git.kernel.org/stable/c/26e427ac85c2b8d0d108cc80b6de34d33e2780c4; https://git.kernel.org/stable/c/381583845d19cb4bd21c[PII_REDACTED]f3fefa9caf; https://git.kernel.org/stable/c/3af7d60e9a6c17d6d41c4341f[PII_REDACTED]d372d
CVE: CVE-2022-50157
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

PCI: microchip: Fix refcount leak in mc_pcie_init_irq_domains()

of_get_next_child() returns a node pointer with refcount incremented, so we
should use of_node_put() on it when we don't need it anymore.

mc_pcie_init_irq_domains() only calls of_node_put() in the normal path,
missing it in some error paths.  Add missing of_node_put() to avoid
refcount leak.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/6cd5f93b5c6a66c68a91dbc604a78207252ecd43; https://git.kernel.org/stable/c/880ece912b958a0c92cc0baa8e906fb9b49a4b53; https://git.kernel.org/stable/c/c0ad5c7e68d10f6f8ffb0f4329e3c19404fbca58
CVE: CVE-2022-50158
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

mtd: partitions: Fix refcount leak in parse_redboot_of

of_get_child_by_name() returns a node pointer with refcount
incremented, we should use of_node_put() on it when not need anymore.
Add missing of_node_put() to avoid refcount leak.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/55d0f7da66dec93c4d53d0886a[PII_REDACTED]a900; https://git.kernel.org/stable/c/7ec48ac18d8f9e002ce9bfbad[PII_REDACTED]9e499; https://git.kernel.org/stable/c/8ea607579d300b2f7fc997f3dd[PII_REDACTED]5fcd
CVE: CVE-2022-50159
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

of: check previous kernel's ima-kexec-buffer against memory bounds

Presently ima_get_kexec_buffer() doesn't check if the previous kernel's
ima-kexec-buffer lies outside the addressable memory range. This can result
in a kernel panic if the new kernel is booted with 'mem=X' arg and the
ima-kexec-buffer was allocated beyond that range by the previous kernel.
The panic is usually of the form below:

$ sudo kexec --initrd initrd vmlinux --append='mem=16G'

<snip>
 BUG: Unable to handle kernel data access on read at 0xc000c01fff7f0000
 Faulting instruction address: 0xc[PII_REDACTED]37974
 Oops: Kernel access of bad area, sig: 11 [#1]
<snip>
 NIP [c[PII_REDACTED]37974] ima_restore_measurement_list+0x94/0x6c0
 LR [c[PII_REDACTED]3b55c] ima_load_kexec_buffer+0xac/0x160
 Call Trace:
 [c[PII_REDACTED]1fa80] [c[PII_REDACTED]3b55c] ima_load_kexec_buffer+0xac/0x160
 [c[PII_REDACTED]1fb00] [c[PII_REDACTED]512c4] ima_init+0x80/0x108
 [c[PII_REDACTED]1fb70] [c[PII_REDACTED]514dc] init_ima+0x4c/0x120
 [c[PII_REDACTED]1fbf0] [c[PII_REDACTED]12240] do_one_initcall+0x60/0x2c0
 [c[PII_REDACTED]1fcc0] [c[PII_REDACTED]04ad0] kernel_init_freeable+0x344/0x3ec
 [c[PII_REDACTED]1fda0] [c[PII_REDACTED]128a4] kernel_init+0x34/0x1b0
 [c[PII_REDACTED]1fe10] [c[PII_REDACTED]0ce64] ret_from_kernel_thread+0x5c/0x64
 Instruction dump:
 f92100b8 f92100c0 90e10090 910100a0 4182050c 282a0017 3bc00[PII_REDACTED]0
 7c0802a6 fb610198 7c9b2378 f80101d0 <a1240000> 2c[PII_REDACTED]0614 e9240010
 ---[ end trace [PII_REDACTED] ]---

Fix this issue by checking returned PFN range of previous kernel's
ima-kexec-buffer with page_is_ram() to ensure correct memory bounds.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/1b2263d6c86fca8f30e[PII_REDACTED]bfc287bb27; https://git.kernel.org/stable/c/beb5bba5dd132650c073f815c685c60c3e5b783b; https://git.kernel.org/stable/c/cbf9c4b9617b6767886a913705ca14b7600c77db
CVE: CVE-2022-50160
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

mtd: maps: Fix refcount leak in ap_flash_init

of_find_matching_node() returns a node pointer with refcount
incremented, we should use of_node_put() on it when not need anymore.
Add missing of_node_put() to avoid refcount leak.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/77087a04c8fd554134bddcb8a9ff87b21f357926; https://git.kernel.org/stable/c/80b1465b2ae81ebb59bbe62bcb7a7f7d4e9ece6f; https://git.kernel.org/stable/c/941ef6997f9db704fe4fd62fc01e420fdd5048b2
CVE: CVE-2022-50161
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

mtd: maps: Fix refcount leak in of_flash_probe_versatile

of_find_matching_node_and_match() returns a node pointer with refcount
incremented, we should use of_node_put() on it when not need anymore.
Add missing of_node_put() to avoid refcount leak.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/33ec82a6d2b119938f26e5c8040ed5d92378eb54; https://git.kernel.org/stable/c/3c8de6a838b7e0eb392754ac89dd66e698684342; https://git.kernel.org/stable/c/4d67c8f74d804b20febf716ec96e9a475457ec60
CVE: CVE-2022-50162
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: libertas: Fix possible refcount leak in if_usb_probe()

usb_get_dev will be called before lbs_get_firmware_async which means that
usb_put_dev need to be called when lbs_get_firmware_async fails.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/00d0c4e59c0f8ad1f86874bb64b220394e687028; https://git.kernel.org/stable/c/4c8e2f9ce1428e44cb103035eeced7aeb6b80980; https://git.kernel.org/stable/c/5b92f406a5199b6b01dc664b9226d824ae2835f0
CVE: CVE-2022-50164
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: mvm: fix double list_add at iwl_mvm_mac_wake_tx_queue

After successfull station association, if station queues are disabled for
some reason, the related lists are not emptied. So if some new element is
added to the list in iwl_mvm_mac_wake_tx_queue, it can match with the old
one and produce a BUG like this:

[   46.535263] list_add corruption. prev->next should be next (ffff94c1c318a360), but was [PII_REDACTED]. (prev=ffff94c1d02d3388).
[   46.535283] ------------[ cut here ]------------
[   46.535284] kernel BUG at lib/list_debug.c:26!
[   46.535290] invalid opcode: 0000 [#1] PREEMPT SMP PTI
[   46.585304] CPU: 0 PID: 623 Comm: wpa_supplicant Not tainted 5.19.0-rc3+ #1
[   46.592380] Hardware name: Dell Inc. Inspiron 660s/0478VN       , BIOS A07 08/24/2012
[   46.600336] RIP: 0010:__list_add_valid.cold+0x3d/0x3f
[   46.605475] Code: f2 4c 89 c1 48 89 fe 48 c7 c7 c8 40 67 93 e8 20 cc fd ff 0f 0b 48 89 d1 4c 89 c6 4c 89 ca 48 c7 c7 70 40 67 93 e8 09 cc fd ff <0f> 0b 48 89 fe 48 c7 c7 00 41 67 93 e8 f8 cb fd ff 0f 0b 48 89 d1
[   46.624469] RSP: 0018:ffffb20800ab76d8 EFLAGS: 00010286
[   46.629854] RAX: [PII_REDACTED] RBX: ffff94c1c318a0e0 RCX: [PII_REDACTED]
[   46.637105] RDX: [PII_REDACTED] RSI: ffffffff9365e100 RDI: 00000000ffffffff
[   46.644356] RBP: ffff94c1c5f43370 R08: [PII_REDACTED] R09: [PII_REDACTED]
[   46.651607] R10: [PII_REDACTED] R11:[PII_REDACTED]3d7665 R12: ffff94c1c5f43388
[   46.658857] R13: ffff94c1d02d3388 R14: ffff94c1c318a360 R15: ffff94c1cf2289c0
[   46.666108] FS:  00007f65634ff7c0(0000) GS:ffff94c1da200000(0000) knlGS:[PII_REDACTED]
[   46.674331] CS:  0010 DS: 0000 ES: 0000 CR0: [PII_REDACTED]
[   46.680170] CR2: 00007f7dfe984460 CR3: 000000010e894003 CR4:[PII_REDACTED]0606f0
[   46.687422] Call Trace:
[   46.689906]  <TASK>
[   46.691950]  iwl_mvm_mac_wake_tx_queue+0xec/0x15c [iwlmvm]
[   46.697601]  ieee80211_queue_skb+0x4b3/0x720 [mac80211]
[   46.702973]  ? sta_info_get+0x46/0x60 [mac80211]
[   46.707703]  ieee80211_tx+0xad/0x110 [mac80211]
[   46.712355]  __ieee80211_tx_skb_tid_band+0x71/0x90 [mac80211]
...

In order to avoid this problem, we must also remove the related lists when
station queues are disabled.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: https://git.kernel.org/stable/c/14a3aacf517a9de725dd3219dbbcf741e31763c4; https://git.kernel.org/stable/c/182d3c1385f44ba7c508bf5b1292a7fe96ad4e9e; https://git.kernel.org/stable/c/38d71acc15a2e72806b516380af0adb3830d4639