deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-47301
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

igb: Fix use-after-free error during reset

Cleans the next descriptor to watch (next_to_watch) when cleaning the
TX ring.

Failure to do so can cause invalid memory accesses. If igb_poll() runs
while the controller is reset this can lead to the driver try to free
a skb that was already freed.

(The crash is harder to reproduce with the igb driver, but the same
potential problem exists as the code is identical to igc)
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/7b292608db23ccbbfbfa50cdb155d01725d7a52e; https://git.kernel.org/stable/c/88e0720133d42d34851c8721cf5f289a50a8710f; https://git.kernel.org/stable/c/8e24c12f2ff6d32fd9f057382f08e748ec97194c
CVE: CVE-2021-47304
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

tcp: fix tcp_init_transfer() to not reset icsk_ca_initialized

This commit fixes a bug (found by syzkaller) that could cause spurious
double-initializations for congestion control modules, which could cause
memory leaks or other problems for congestion control modules (like CDG)
that allocate memory in their init functions.

The buggy scenario constructed by syzkaller was something like:

(1) create a TCP socket
(2) initiate a TFO connect via sendto()
(3) while socket is in TCP_SYN_SENT, call setsockopt(TCP_CONGESTION),
    which calls:
       tcp_set_congestion_control() ->
         tcp_reinit_congestion_control() ->
           tcp_init_congestion_control()
(4) receive ACK, connection is established, call tcp_init_transfer(),
    set icsk_ca_initialized=0 (without first calling cc->release()),
    call tcp_init_congestion_control() again.

Note that in this sequence tcp_init_congestion_control() is called
twice without a cc->release() call in between. Thus, for CC modules
that allocate memory in their init() function, e.g, CDG, a memory leak
may occur. The syzkaller tool managed to find a reproducer that
triggered such a leak in CDG.

The bug was introduced when that commit 8919a9b31eb4 ("tcp: Only init
congestion control if not initialized already")
introduced icsk_ca_initialized and set icsk_ca_initialized to 0 in
tcp_init_transfer(), missing the possibility for a sequence like the
one above, where a process could call setsockopt(TCP_CONGESTION) in
state TCP_SYN_SENT (i.e. after the connect() or TFO open sendmsg()),
which would call tcp_init_congestion_control(). It did not intend to
reset any initialization that the user had already explicitly made;
it just missed the possibility of that particular sequence (which
syzkaller managed to find).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-415
References: https://git.kernel.org/stable/c/ad4ba[PII_REDACTED]a5977ad12db4f0c34080e52f7; https://git.kernel.org/stable/c/be5d1b61a2ad28c7e57fe8bfa277373e8ecffcdc; https://git.kernel.org/stable/c/fe77b85828ca9ddc42977b79de9e40d18545b4fe
CVE: CVE-2021-47305
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

dma-buf/sync_file: Don't leak fences on merge failure

Each add_fence() call does a dma_fence_get() on the relevant fence.  In
the error path, we weren't calling dma_fence_put() so all those fences
got leaked.  Also, in the krealloc_array failure case, we weren't
freeing the fences array.  Instead, ensure that i and fences are always
zero-initialized and dma_fence_put() all the fences and kfree(fences) on
every error path.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-617
References: https://git.kernel.org/stable/c/0d514185ae792d3a1903c8e1a83899aa996705ce; https://git.kernel.org/stable/c/19edcd97727aae9362444a859a24d99a8730cb27; https://git.kernel.org/stable/c/19f51c[PII_REDACTED]d2c8c6427cd3e21ddf1ac3f8
CVE: CVE-2021-47306
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

net: fddi: fix UAF in fza_probe

fp is netdev private data and it cannot be
used after free_netdev() call. Using fp after free_netdev()
can cause UAF bug. Fix it by moving free_netdev() after error message.

TURBOchannel adapter")
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/04b06716838bfc26742dbed3ae1d3697fe5317ee; https://git.kernel.org/stable/c/bdfbb51f7a437ae8ea91317a5c133ec13adf3c47; https://git.kernel.org/stable/c/deb7178eb940e2c5caca1b1db084a69b2e59b4c9
CVE: CVE-2021-47307
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

cifs: prevent NULL deref in cifs_compose_mount_options()

The optional @ref parameter might contain an NULL node_name, so
prevent dereferencing it in cifs_compose_mount_options().

Addresses-Coverity: 1476408 ("Explicit null dereferenced")
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/03313d1c3a2f086bb60920607ab79ac8f8578306; https://git.kernel.org/stable/c/ae3d181f4e912f51af7776ea165f199b16fc165d; https://git.kernel.org/stable/c/e58c162789becede894d3e94c0ce6695a2ef5796
CVE: CVE-2021-47308
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

scsi: libfc: Fix array index out of bound exception

Fix array index out of bound exception in fc_rport_prli_resp().
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://git.kernel.org/stable/c/0fe70c15f9435bb3c[PII_REDACTED]5d62ee38b0e03; https://git.kernel.org/stable/c/[PII_REDACTED]1c623e20882b3b443f23f77de1ea8b; https://git.kernel.org/stable/c/4921b1618045ffab71b1050bf0014df3313a2289
CVE: CVE-2021-47309
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

net: validate lwtstate->data before returning from skb_tunnel_info()

skb_tunnel_info() returns pointer of lwtstate->data as ip_tunnel_info
type without validation. lwtstate->data can have various types such as
mpls_iptunnel_encap, etc and these are not compatible.
So skb_tunnel_info() should validate before returning that pointer.

Splat looks like:
BUG: KASAN: slab-out-of-bounds in vxlan_get_route+0x418/0x4b0 [vxlan]
Read of size 2 at addr ffff888106ec2698 by task ping/811

CPU: 1 PID: 811 Comm: ping Not tainted 5.13.0+ #1195
Call Trace:
 dump_stack_lvl+0x56/0x7b
 print_address_description.constprop.8.cold.13+0x13/0x2ee
 ? vxlan_get_route+0x418/0x4b0 [vxlan]
 ? vxlan_get_route+0x418/0x4b0 [vxlan]
 kasan_report.cold.14+0x83/0xdf
 ? vxlan_get_route+0x418/0x4b0 [vxlan]
 vxlan_get_route+0x418/0x4b0 [vxlan]
 [ ... ]
 vxlan_xmit_one+0x148b/0x32b0 [vxlan]
 [ ... ]
 vxlan_xmit+0x25c5/0x4780 [vxlan]
 [ ... ]
 dev_hard_start_xmit+0x1ae/0x6e0
 __dev_queue_xmit+0x1f39/0x31a0
 [ ... ]
 neigh_xmit+0x2f9/0x940
 mpls_xmit+0x911/0x1600 [mpls_iptunnel]
 lwtunnel_xmit+0x18f/0x450
 ip_finish_output2+0x867/0x2040
 [ ... ]
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://git.kernel.org/stable/c/2179d96ec702cc33ead02a9ce40ece599b8538c5; https://git.kernel.org/stable/c/67a9c94317402b826fc3db32afc8f39336803d97; https://git.kernel.org/stable/c/83bdcfbd968bcc91a0632b7b625e4a9b0cba5e0d
CVE: CVE-2021-47310
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

net: ti: fix UAF in tlan_remove_one

priv is netdev private data and it cannot be
used after free_netdev() call. Using priv after free_netdev()
can cause UAF bug. Fix it by moving free_netdev() at the end of the
function.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/0336f8ffece62f882ab[PII_REDACTED]a786a983f70; https://git.kernel.org/stable/c/0538b0ab7d2c396e385694228c7cdcd2d2c514e9; https://git.kernel.org/stable/c/93efab0ef2a607fff9166d447c4035f98b5db342
CVE: CVE-2021-47311
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

net: qcom/emac: fix UAF in emac_remove

adpt is netdev private data and it cannot be
used after free_netdev() call. Using adpt after free_netdev()
can cause UAF bug. Fix it by moving free_netdev() at the end of the
function.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/11e9d163d631198bb3eb41a677a61b499516c0f7; https://git.kernel.org/stable/c/2b70ca92847c619d6264c7372ef74fcbfd1e048c; https://git.kernel.org/stable/c/4d04a42b926e682140776e54188f4a44f1f01a81
CVE: CVE-2021-47312
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: Fix dereference of null pointer flow

In the case where chain->flags & NFT_CHAIN_HW_OFFLOAD is false then
nft_flow_rule_create is not called and flow is NULL. The subsequent
error handling execution via label err_destroy_flow_rule will lead
to a null pointer dereference on flow when calling nft_flow_rule_destroy.
Since the error path to err_destroy_flow_rule has to cater for null
and non-null flows, only call nft_flow_rule_destroy if flow is non-null
to fix this issue.

Addresses-Coverity: ("Explicity null dereference")
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/4ca041f919f13783b0b03894783deee00dbca19a; https://git.kernel.org/stable/c/70a5a1950cca02c5cd161bb3846b4d983eed97d3; https://git.kernel.org/stable/c/4ca041f919f13783b0b03894783deee00dbca19a
CVE: CVE-2021-47313
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

cpufreq: CPPC: Fix potential memleak in cppc_cpufreq_cpu_init

It's a classic example of memleak, we allocate something, we fail and
never free the resources.

Make sure we free all resources on policy ->init() failures.
CVSS Score: 8.4 (HIGH)
CWE: CWE-400
References: https://git.kernel.org/stable/c/b[PII_REDACTED]55885b19d2acef977f1ca132e80a3; https://git.kernel.org/stable/c/e1b2b2b61d30d7ce057ec17237c217d152ed97f2; https://git.kernel.org/stable/c/fe2535a44904a77615a3af8e8fd7dafb98fb0e1b
CVE: CVE-2021-47314
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

memory: fsl_ifc: fix leak of private memory on probe failure

On probe error the driver should free the memory allocated for private
structure.  Fix this by using resource-managed allocation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/3b45b8a7d549bd92ec94b5357c2c2c1a7ed107e4; https://git.kernel.org/stable/c/443f6ca6fd186b4fa4e6f377b6e19a91feb1a0d5; https://git.kernel.org/stable/c/48ee69825f7480622ed447b[PII_REDACTED]d3b3ad0
CVE: CVE-2021-47315
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

memory: fsl_ifc: fix leak of IO mapping on probe failure

On probe error the driver should unmap the IO memory.  Smatch reports:

  drivers/memory/fsl_ifc.c:298 fsl_ifc_ctrl_probe() warn: 'fsl_ifc_ctrl_dev->gregs' not released on lines: 298.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-617
References: https://git.kernel.org/stable/c/28f71fd81ebd3b386bf5c7c[PII_REDACTED]f7d72c1; https://git.kernel.org/stable/c/3b132ab67fc7a358fff35e808fa65d4bea452521; https://git.kernel.org/stable/c/6b3b002de90738e3c85853a682ce7e0fa078d42b
CVE: CVE-2021-47316
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix NULL dereference in nfs3svc_encode_getaclres

In error cases the dentry may be NULL.

Before 20798dfe249a, the encoder also checked dentry and
d_really_is_positive(dentry), but that looks like overkill to me--zero
status should be enough to guarantee a positive dentry.

This isn't the first time we've seen an error-case NULL dereference
hidden in the initialization of a local variable in an xdr encoder.  But
I went back through the other recent rewrites and didn't spot any
similar bugs.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/650e6f383a6eb40f7c0a010982a74ab4b6893870; https://git.kernel.org/stable/c/ab1016d39cc052064e32f25ad18ef8767a0ee3b8; https://git.kernel.org/stable/c/e79057d15d96ef19de4de6d7e479bae3d58a2a8d
CVE: CVE-2021-47317
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

powerpc/bpf: Fix detecting BPF atomic instructions

Commit 91c960b0056672 ("bpf: Rename BPF_XADD and prepare to encode other
atomics in .imm") converted BPF_XADD to BPF_ATOMIC and added a way to
distinguish instructions based on the immediate field. Existing JIT
implementations were updated to check for the immediate field and to
reject programs utilizing anything more than BPF_ADD (such as BPF_FETCH)
in the immediate field.

However, the check added to powerpc64 JIT did not look at the correct
BPF instruction. Due to this, such programs would be accepted and
incorrectly JIT'ed resulting in soft lockups, as seen with the atomic
bounds test. Fix this by looking at the correct immediate value.
CVSS Score: 3.3 (LOW)
CWE: CWE-667
References: https://git.kernel.org/stable/c/0d435b6d94b05dcfd836d758a63145aa566618e2; https://git.kernel.org/stable/c/419ac821766cbdb9fd85872bb3f1a589df05c94c; https://git.kernel.org/stable/c/7284dab07e4d51d453cc42851fae9ec4fac6ef2f
CVE: CVE-2021-47318
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

arch_topology: Avoid use-after-free for scale_freq_data

Currently topology_scale_freq_tick() (which gets called from
scheduler_tick()) may end up using a pointer to "struct
scale_freq_data", which was previously cleared by
topology_clear_scale_freq_source(), as there is no protection in place
here. The users of topology_clear_scale_freq_source() though needs a
guarantee that the previously cleared scale_freq_data isn't used
anymore, so they can free the related resources.

Since topology_scale_freq_tick() is called from scheduler tick, we don't
want to add locking in there. Use the RCU update mechanism instead
(which is already used by the scheduler's utilization update path) to
guarantee race free updates here.

synchronize_rcu() makes sure that all RCU critical sections that started
before it is called, will finish before it returns. And so the callers
of topology_clear_scale_freq_source() don't need to worry about their
callback getting called anymore.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/83150f5d05f065fb5c12c612f119015cabdcc124; https://git.kernel.org/stable/c/ccdf7e073170886bc370c613e269de610a794c4a; https://git.kernel.org/stable/c/83150f5d05f065fb5c12c612f119015cabdcc124
CVE: CVE-2021-47319
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

virtio-blk: Fix memory leak among suspend/resume procedure

The vblk->vqs should be freed before we call init_vqs()
in virtblk_restore().
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/04c6e60b884cb5e94ff32af46867fb41d5848358; https://git.kernel.org/stable/c/102d6bc6475ab09bab579c18704e6cf8d898e93c; https://git.kernel.org/stable/c/29a2f4a3214aa14d61cc9737c9f886dae9dbb710
CVE: CVE-2021-47320
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

nfs: fix acl memory leak of posix_acl_create()

When looking into another nfs xfstests report, I found acl and
default_acl in nfs3_proc_create() and nfs3_proc_mknod() error
paths are possibly leaked. Fix them in advance.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/0704f617040c397ae73c1f88f3956787ec5d6529; https://git.kernel.org/stable/c/1fcb6fcd74a222d9ead54d405842fc763bb86262; https://git.kernel.org/stable/c/2e3960f276b4574a9bb0dfa31a7497302f6363b2
CVE: CVE-2021-47321
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

watchdog: Fix possible use-after-free by calling del_timer_sync()

This driver's remove path calls del_timer(). However, that function
does not wait until the timer handler finishes. This means that the
timer handler may still be running after the driver's remove function
has finished, which would result in a use-after-free.

Fix by calling del_timer_sync(), which makes sure the timer handler
has finished, and unable to re-schedule itself.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/1a053c4d716898a53c2e31c574a70ea0c37044a3; https://git.kernel.org/stable/c/4c05dac488a660fe2925c047ecb119e7afaaeb1e; https://git.kernel.org/stable/c/58606882ad8ec6c39e0f40344b922921ef94ab4d
CVE: CVE-2021-47322
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

NFSv4: Fix an Oops in pnfs_mark_request_commit() when doing O_DIRECT

Fix an Oopsable condition in pnfs_mark_request_commit() when we're
putting a set of writes on the commit list to reschedule them after a
failed pNFS attempt.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://git.kernel.org/stable/c/3731d44bba8e0116b052b1b374476c5f6dd9a456; https://git.kernel.org/stable/c/5c7ef8a[PII_REDACTED]a1e19b070e951f0730b2153; https://git.kernel.org/stable/c/7aec9f862411906f8c27071ba65a1e110ad7d2fd
CVE: CVE-2021-47323
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

watchdog: sc520_wdt: Fix possible use-after-free in wdt_turnoff()

This module's remove path calls del_timer(). However, that function
does not wait until the timer handler finishes. This means that the
timer handler may still be running after the driver's remove function
has finished, which would result in a use-after-free.

Fix by calling del_timer_sync(), which makes sure the timer handler
has finished, and unable to re-schedule itself.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/0015581a79bbf8e521f85dddb7d3e4a66b9f51d4; https://git.kernel.org/stable/c/2aef07017fae21c3d8acea9656b10e3b9c0f1e04; https://git.kernel.org/stable/c/522e75ed63f67e815d4ec0deace67df22d9ce78e
CVE: CVE-2021-47324
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

watchdog: Fix possible use-after-free in wdt_startup()

This module's remove path calls del_timer(). However, that function
does not wait until the timer handler finishes. This means that the
timer handler may still be running after the driver's remove function
has finished, which would result in a use-after-free.

Fix by calling del_timer_sync(), which makes sure the timer handler
has finished, and unable to re-schedule itself.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/0ac50a76cf3cd63db000648b3b19f3f98b8aaa76; https://git.kernel.org/stable/c/146cc288fb80c662c9c35e7bc58325d1ac0a7875; https://git.kernel.org/stable/c/63a3dc24bd053792f84cb4eef0168b1266202a02
CVE: CVE-2021-47325
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

iommu/arm-smmu: Fix arm_smmu_device refcount leak in address translation

The reference counting issue happens in several exception handling paths
of arm_smmu_iova_to_phys_hard(). When those error scenarios occur, the
function forgets to decrease the refcount of "smmu" increased by
arm_smmu_rpm_get(), causing a refcount leak.

Fix this issue by jumping to "out" label when those error scenarios
occur.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/0f0c5ea09139777d90729d408b807021f2ea6492; https://git.kernel.org/stable/c/43d1aaa1965f9b58035196dac49b1e1e6c9c25eb; https://git.kernel.org/stable/c/5f9741a9a91f25c89e04b408cd61e3ab050ce24b
CVE: CVE-2021-47326
Published: 2024-05-21
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2021-47327
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

iommu/arm-smmu: Fix arm_smmu_device refcount leak when arm_smmu_rpm_get fails

arm_smmu_rpm_get() invokes pm_runtime_get_sync(), which increases the
refcount of the "smmu" even though the return value is less than 0.

The reference counting issue happens in some error handling paths of
arm_smmu_rpm_get() in its caller functions. When arm_smmu_rpm_get()
fails, the caller functions forget to decrease the refcount of "smmu"
increased by arm_smmu_rpm_get(), causing a refcount leak.

Fix this issue by calling pm_runtime_resume_and_get() instead of
pm_runtime_get_sync() in arm_smmu_rpm_get(), which can keep the refcount
balanced in case of failure.
CVSS Score: 7.1 (HIGH)
CWE: CWE-911
References: https://git.kernel.org/stable/c/1adf30f198c26539a62d761e45af72cde570413d; https://git.kernel.org/stable/c/3761ae0d0e549f2acdaf11f49df4ed06d256b20f; https://git.kernel.org/stable/c/c4007596fbdabc29f858dc2e1990858a146b60b2
CVE: CVE-2021-47328
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

scsi: iscsi: Fix conn use after free during resets

If we haven't done a unbind target call we can race where
iscsi_conn_teardown wakes up the EH thread and then frees the conn while
those threads are still accessing the conn ehwait.

We can only do one TMF per session so this just moves the TMF fields from
the conn to the session. We can then rely on the
iscsi_session_teardown->iscsi_remove_session->__iscsi_unbind_session call
to remove the target and it's devices, and know after that point there is
no device or scsi-ml callout trying to access the session.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/89812e7957ab0746eab66ed6fc49d52bb4dca250; https://git.kernel.org/stable/c/bf20d85a88384574fabb3d53ad62a8af57e7ab11; https://git.kernel.org/stable/c/d04958a348e560938410e04a12fb99da9c7e6a00
CVE: CVE-2021-47329
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

scsi: megaraid_sas: Fix resource leak in case of probe failure

The driver doesn't clean up all the allocated resources properly when
scsi_add_host(), megasas_start_aen() function fails during the PCI device
probe.

Clean up all those resources.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-400
References: https://git.kernel.org/stable/c/04b6b9ea80906e3b41ff120b45db31768947cf72; https://git.kernel.org/stable/c/0680db6f41920b2c91c7df3cc9cd5968701a6f74; https://git.kernel.org/stable/c/0c6226601c3e191a44a57d8f9f814b7e5c308959
CVE: CVE-2021-47330
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

tty: serial: 8250: serial_cs: Fix a memory leak in error handling path

In the probe function, if the final 'serial_config()' fails, 'info' is
leaking.

Add a resource handling path to free this memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/331f5923fce4f45b8170ccf06c529e8eb28f37bc; https://git.kernel.org/stable/c/34f4590f5ec9859ea9136249f528173d150bd584; https://git.kernel.org/stable/c/7a80f71601af015856a0aeb1e3c294037ac3dd32
CVE: CVE-2021-47331
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

usb: common: usb-conn-gpio: fix NULL pointer dereference of charger

When power on system with OTG cable, IDDIG's interrupt arises before
the charger registration, it will cause a NULL pointer dereference,
fix the issue by registering the power supply before requesting
IDDIG/VBUS irq.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/1a133a0996d6b4c83509d570ed4edcba34c44f25; https://git.kernel.org/stable/c/436906fd248e018403bcda61a9311d9af02912f1; https://git.kernel.org/stable/c/880287910b1892ed2cb38977893b947382a09d21
CVE: CVE-2021-47332
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

ALSA: usx2y: Don't call free_pages_exact() with NULL address

Unlike some other functions, we can't pass NULL pointer to
free_pages_exact().  Add a proper NULL check for avoiding possible
Oops.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/7d7f30cf182e55023fa8fde4c084b2d37c6be69d; https://git.kernel.org/stable/c/82e5ee742fdd8874fe996181b87fafe1eb5f1196; https://git.kernel.org/stable/c/88262229b778f4f7a896da828d966f94dcb35d19