deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-50103
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed

With cgroup v2, the cpuset's cpus_allowed mask can be empty indicating
that the cpuset will just use the effective CPUs of its parent. So
cpuset_can_attach() can call task_can_attach() with an empty mask.
This can lead to cpumask_any_and() returns nr_cpu_ids causing the call
to dl_bw_of() to crash due to percpu value access of an out of bound
CPU value. For example:

	[80468.182258] BUG: unable to handle page fault for address: ffffffff8b6648b0
	  :
	[80468.191019] RIP: 0010:dl_cpu_busy+0x30/0x2b0
	  :
	[80468.207946] Call Trace:
	[80468.208947]  cpuset_can_attach+0xa0/0x140
	[80468.209953]  cgroup_migrate_execute+0x8c/0x490
	[80468.210931]  cgroup_update_dfl_csses+0x254/0x270
	[80468.211898]  cgroup_subtree_control_write+0x322/0x400
	[80468.212854]  kernfs_fop_write_iter+0x11c/0x1b0
	[80468.213777]  new_sync_write+0x11f/0x1b0
	[80468.214689]  vfs_write+0x1eb/0x280
	[80468.215592]  ksys_write+0x5f/0xe0
	[80468.216463]  do_syscall_64+0x5c/0x80
	[80468.224287]  entry_SYSCALL_64_after_hwframe+0x44/0xae

Fix that by using effective_cpus instead. For cgroup v1, effective_cpus
is the same as cpus_allowed. For v2, effective_cpus is the real cpumask
to be used by tasks within the cpuset anyway.

Also update task_can_attach()'s 2nd argument name to cs_effective_cpus to
reflect the change. In addition, a check is added to task_can_attach()
to guard against the possibility that cpumask_any_and() may return a
value >= nr_cpu_ids.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://git.kernel.org/stable/c/147f66d22f58712dce7ccdd6a1f6cb3ee8042df4; https://git.kernel.org/stable/c/336626564b58071b8980a4e6a31a8f5d92705d9b; https://git.kernel.org/stable/c/357f3f0e522a6ce1ce4a571cb780d9861d53bec7
CVE: CVE-2022-50104
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

powerpc/xive: Fix refcount leak in xive_get_max_prio

of_find_node_by_path() returns a node pointer with
refcount incremented, we should use of_node_put() on it when done.
Add missing of_node_put() to avoid refcount leak.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/255b650cbec6849443ce2e0cdd187fd5e61c218c; https://git.kernel.org/stable/c/2e18b869a8d574cfe9ee64df9c3d0a7ac7ed07a8; https://git.kernel.org/stable/c/5ed9709d262bf026b2ff64979fbfe0f496287588
CVE: CVE-2022-50105
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

powerpc/spufs: Fix refcount leak in spufs_init_isolated_loader

of_find_node_by_path() returns remote device nodepointer with
refcount incremented, we should use of_node_put() on it when done.
Add missing of_node_put() to avoid refcount leak.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/0aa5de2547b7ccf0a31bc740d12f829fae243112; https://git.kernel.org/stable/c/14329d29a048dc35aac2374fb3d588d8190095a2; https://git.kernel.org/stable/c/4288eb035ba4ddb53245e9365c919bb51ac00c2c
CVE: CVE-2022-50106
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

powerpc/cell/axon_msi: Fix refcount leak in setup_msi_msg_address

of_get_next_parent() returns a node pointer with refcount incremented,
we should use of_node_put() on it when not need anymore.
Add missing of_node_put() in the error path to avoid refcount leak.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/00dc7cbbb558955ff410fd392cc9b0366eb06df0; https://git.kernel.org/stable/c/02ed44125d7a[PII_REDACTED]ca126b60f8dd7a88b1; https://git.kernel.org/stable/c/51cf876b11fb6ca06f69e9d1de58f892d1522e9d
CVE: CVE-2022-50107
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

cifs: Fix memory leak when using fscache

If we hit the 'index == next_cached' case, we leak a refcount on the
struct page.  Fix this by using readahead_folio() which takes care of
the refcount for you.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/7105b4047481bc2950fb767cff328d8b75292c0f; https://git.kernel.org/stable/c/ae497726cd090673a4d20ac725ccc2de8067a7a5; https://git.kernel.org/stable/c/c6f62f81b488d00afaa86bae26c6ce9ab12c709e
CVE: CVE-2022-50108
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

mfd: max77620: Fix refcount leak in max77620_initialise_fps

of_get_child_by_name() returns a node pointer with refcount
incremented, we should use of_node_put() on it when not need anymore.
Add missing of_node_put() to avoid refcount leak.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/1520669c8255bd637c6b248b2be910e2688d38dd; https://git.kernel.org/stable/c/50d5fe8cb94c319cb4316f4d824570c075565354; https://git.kernel.org/stable/c/a29c[PII_REDACTED]5b[PII_REDACTED]86a5f348b5db14
CVE: CVE-2022-50109
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

video: fbdev: amba-clcd: Fix refcount leak bugs

In clcdfb_of_init_display(), we should call of_node_put() for the
references returned by of_graph_get_next_endpoint() and
of_graph_get_remote_port_parent() which have increased the refcount.

Besides, we should call of_node_put() both in fail path or when
the references are not used anymore.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/2688df86c02da6bdc9866b62d974e169a2678883; https://git.kernel.org/stable/c/26c2b7d9fac42eb8317f3ceefa4c1a9a9170ca69; https://git.kernel.org/stable/c/29f06f1905c312671a09ee85ca92ac04a1d9f305
CVE: CVE-2022-50110
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

watchdog: sp5100_tco: Fix a memory leak of EFCH MMIO resource

Unlike release_mem_region(), a call to release_resource() does not
free the resource, so it has to be freed explicitly to avoid a memory
leak.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/3a1becb1f13268ef58f19190608a7c742fb6fcf5; https://git.kernel.org/stable/c/84ddf527f90755beec6b55ce2e31331f5ccd4e37; https://git.kernel.org/stable/c/c6d9c0798ed366a09a9e53d71edcd2266e34a6eb
CVE: CVE-2022-50111
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

ASoC: mt6359: Fix refcount leak bug

In mt6359_parse_dt() and mt6359_accdet_parse_dt(), we should call
of_node_put() for the reference returned by of_get_child_by_name()
which has increased the refcount.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/1e7fe6906e9755d9e0242f9619c894ecd82fb9da; https://git.kernel.org/stable/c/3d69d86b3e9d82f524e7e1906adcbbe939dc836e; https://git.kernel.org/stable/c/a8d5df69e2ec702d979f7d04ed519caf8691a032
CVE: CVE-2022-50112
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

rpmsg: qcom_smd: Fix refcount leak in qcom_smd_parse_edge

of_parse_phandle() returns a node pointer with refcount
incremented, we should use of_node_put() on it when done.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/43e42c25a232a6862e7d2f292a069ac828559030; https://git.kernel.org/stable/c/65382585f067d4256ba087934f30f85c9b6984de; https://git.kernel.org/stable/c/8ee5d40ae29e63f6fd6cbf9dcfc0a48c474013db
CVE: CVE-2022-50113
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

ASoc: audio-graph-card2: Fix refcount leak bug in __graph_get_type()

We should call of_node_put() for the reference before its replacement
as it returned by of_get_parent() which has increased the refcount.
Besides, we should also call of_node_put() before return.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/3bb0c0b5f0f866fc3785380e0860dc37ceacf342; https://git.kernel.org/stable/c/7a63a8c253bf57dfd9fa3ee2a7f1a3727505f947; https://git.kernel.org/stable/c/eda26893dabfc6da7a1e1ff5f8628ed9faab3ab9
CVE: CVE-2022-50114
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

net: 9p: fix refcount leak in p9_read_work() error handling

p9_req_put need to be called when m->rreq->rc.sdata is NULL to avoid
temporary refcount leak.

[Dominique: commit wording adjustments, p9_req_put argument fixes for rebase]
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/34b9a188557c1d5a50e07cf228d054101aee0af3; https://git.kernel.org/stable/c/4ac7573e1f9333073fa8d303acc941c9b7ab7f61; https://git.kernel.org/stable/c/622f2a467bdfbce73fd43ea74b5f0fd2caaa8c5d
CVE: CVE-2022-50115
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

ASoC: SOF: ipc3-topology: Prevent double freeing of ipc_control_data via load_bytes

We have sanity checks for byte controls and if any of the fail the locally
allocated scontrol->ipc_control_data is freed up, but not set to NULL.

On a rollback path of the error the higher level code will also try to free
the scontrol->ipc_control_data which will eventually going to lead to
memory corruption as double freeing memory is not a good thing.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: https://git.kernel.org/stable/c/8463986b54295e6b65ddf2b7c65627d01ce7643b; https://git.kernel.org/stable/c/c2eddfcafcffaf1b9245ea0dde9143bbfb47d5d1; https://git.kernel.org/stable/c/d5bd47f3ca124058a8e87eae4508afeda2132611
CVE: CVE-2022-50117
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

vfio: Split migration ops from main device ops

vfio core checks whether the driver sets some migration op (e.g.
set_state/get_state) and accordingly calls its op.

However, currently mlx5 driver sets the above ops without regards to its
migration caps.

This might lead to unexpected usage/Oops if user space may call to the
above ops even if the driver doesn't support migration. As for example,
the migration state_mutex is not initialized in that case.

The cleanest way to manage that seems to split the migration ops from
the main device ops, this will let the driver setting them separately
from the main ops when it's applicable.

As part of that, validate ops construction on registration and include a
check for VFIO_MIGRATION_STOP_COPY since the uAPI claims it must be set
in migration_flags.

HISI driver was changed as well to match this scheme.

This scheme may enable down the road to come with some extra group of
ops (e.g. DMA log) that can be set without regards to the other options
based on driver caps.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/6e97eba8ad8748fabb795cffc5d9e1a7dcfd7367; https://git.kernel.org/stable/c/bba6b12d73d36e0ddbc2c3ac5668a667b00d4345
CVE: CVE-2022-50119
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

rpmsg: Fix possible refcount leak in rpmsg_register_device_override()

rpmsg_register_device_override need to call put_device to free vch when
driver_set_override fails.

Fix this by adding a put_device() to the error path.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/01e6885b75e25a2dd0726455ef18ef9ce5e7dc87; https://git.kernel.org/stable/c/280ae5a028ef5d14ef9277746a3026a30aaebe4f; https://git.kernel.org/stable/c/3fdd5b2bb09fc2b5bf3504778f51c89bb48c097f
CVE: CVE-2022-50120
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

remoteproc: imx_rproc: Fix refcount leak in imx_rproc_addr_init

of_parse_phandle() returns a node pointer with refcount
incremented, we should use of_node_put() on it when not needed anymore.
This function has two paths missing of_node_put().
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/0dc1663e3fc22c72e1ab33be7701a0d51cca84ef; https://git.kernel.org/stable/c/16da9f84e26f89e58cac194ff19fefd9de27d975; https://git.kernel.org/stable/c/61afafe8b938bc74841cf4b1a73dd08b9d287c5a
CVE: CVE-2022-50121
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

remoteproc: k3-r5: Fix refcount leak in k3_r5_cluster_of_init

Every iteration of for_each_available_child_of_node() decrements
the reference count of the previous node.
When breaking early from a for_each_available_child_of_node() loop,
we need to explicitly call of_node_put() on the child node.
Add missing of_node_put() to avoid refcount leak.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/3f83c4cf1b78331c23876977aa7b9151aff2f9e1; https://git.kernel.org/stable/c/61cd8cd3b6b33c7eae3b45cf783b114f2ae53528; https://git.kernel.org/stable/c/75358732af9b26acfe3e609943290bcba13330fc
CVE: CVE-2022-50122
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

ASoC: mediatek: mt8173-rt5650: Fix refcount leak in mt8173_rt5650_dev_probe

of_parse_phandle() returns a node pointer with refcount
incremented, we should use of_node_put() on it when not need anymore.
Fix refcount leak in some error paths.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/06ace427953f5036b64aed658f0055f65d76fd27; https://git.kernel.org/stable/c/403d46971936f9f704b91cecffe66e44aa39e915; https://git.kernel.org/stable/c/5ec83aa7a9e5bcca80ccd49978916feb4e0ffc07
CVE: CVE-2022-50123
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

ASoC: mediatek: mt8173: Fix refcount leak in mt8173_rt5650_rt5676_dev_probe

of_parse_phandle() returns a node pointer with refcount
incremented, we should use of_node_put() on it when not need anymore.
Fix missing of_node_put() in error paths.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/540c7b7385fb[PII_REDACTED]8b4b2bbfa06c7f79c; https://git.kernel.org/stable/c/58567ed2878f70e0ded242cb529fb4a7618ea9f8; https://git.kernel.org/stable/c/769399bce8825e1dcc5050dab78e15ab578baf4f
CVE: CVE-2022-50124
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

ASoC: mt6797-mt6351: Fix refcount leak in mt6797_mt6351_dev_probe

of_parse_phandle() returns a node pointer with refcount
incremented, we should use of_node_put() on it when not need anymore.
Add missing of_node_put() to avoid refcount leak.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/1042353bb67cd1c9109d7481ea182c[PII_REDACTED]; https://git.kernel.org/stable/c/38dc6faef05f33b4c889be8b7d65878e465c1c4b; https://git.kernel.org/stable/c/67a28402a9e8c229c7588f214d81d52903ea06ea
CVE: CVE-2022-50125
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

ASoC: cros_ec_codec: Fix refcount leak in cros_ec_codec_platform_probe

of_parse_phandle() returns a node pointer with refcount
incremented, we should use of_node_put() on it when not need anymore.
Add missing of_node_put() to avoid refcount leak.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/0a034d93ee929a9ea89f3fa5f1d8492435b9ee6e; https://git.kernel.org/stable/c/1065c385325845c88350c765cc6e449f46741984; https://git.kernel.org/stable/c/b3e64b5562c077218295f2230fb5cf181193cb06
CVE: CVE-2022-50126
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted

Following process will fail assertion 'jh->b_frozen_data == NULL' in
jbd2_journal_dirty_metadata():

                   jbd2_journal_commit_transaction
unlink(dir/a)
 jh->b_transaction = trans1
 jh->b_jlist = BJ_Metadata
                    journal->j_running_transaction = NULL
                    trans1->t_state = T_COMMIT
unlink(dir/b)
 handle->h_trans = trans2
 do_get_write_access
  jh->b_modified = 0
  jh->b_frozen_data = frozen_buffer
  jh->b_next_transaction = trans2
 jbd2_journal_dirty_metadata
  is_handle_aborted
   is_journal_aborted // return false

           --> jbd2 abort <--

                     while (commit_transaction->t_buffers)
                      if (is_journal_aborted)
                       jbd2_journal_refile_buffer
                        __jbd2_journal_refile_buffer
                         WRITE_ONCE(jh->b_transaction,
						jh->b_next_transaction)
                         WRITE_ONCE(jh->b_next_transaction, NULL)
                         __jbd2_journal_file_buffer(jh, BJ_Reserved)
        J_ASSERT_JH(jh, jh->b_frozen_data == NULL) // assertion failure !

The reproducer (See detail in [Link]) reports:
 ------------[ cut here ]------------
 kernel BUG at fs/jbd2/transaction.c:1629!
 invalid opcode: 0000 [#1] PREEMPT SMP
 CPU: 2 PID: 584 Comm: unlink Tainted: G        W
 5.19.0-rc6-00115-g4a57a8400075-dirty #697
 RIP: 0010:jbd2_journal_dirty_metadata+0x3c5/0x470
 RSP: 0018:ffffc90000be7ce0 EFLAGS: 00010202
 Call Trace:
  <TASK>
  __ext4_handle_dirty_metadata+0xa0/0x290
  ext4_handle_dirty_dirblock+0x10c/0x1d0
  ext4_delete_entry+0x104/0x200
  __ext4_unlink+0x22b/0x360
  ext4_unlink+0x275/0x390
  vfs_unlink+0x20b/0x4c0
  do_unlinkat+0x42f/0x4c0
  __x64_sys_unlink+0x37/0x50
  do_syscall_64+0x35/0x80

After journal aborting, __jbd2_journal_refile_buffer() is executed with
holding @jh->b_state_lock, we can fix it by moving 'is_handle_aborted()'
into the area protected by @jh->b_state_lock.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-617
References: https://git.kernel.org/stable/c/0f61c6dc4b714be9d79cf0782ca02ba01c1b7ac3; https://git.kernel.org/stable/c/4a734f0869f970b8a9b65062ea40b09a5da9dba8; https://git.kernel.org/stable/c/6073389db83b903678a0920554fa19f5bdc51c48
CVE: CVE-2022-50127
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

RDMA/rxe: Fix error unwind in rxe_create_qp()

In the function rxe_create_qp(), rxe_qp_from_init() is called to
initialize qp, internally things like the spin locks are not setup until
rxe_qp_init_req().

If an error occures before this point then the unwind will call
rxe_cleanup() and eventually to rxe_qp_do_cleanup()/rxe_cleanup_task()
which will oops when trying to access the uninitialized spinlock.

Move the spinlock initializations earlier before any failures.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-908
References: https://git.kernel.org/stable/c/1a63f24e724f677db1ab21251f4d0011ae0bb5b5; https://git.kernel.org/stable/c/2ceeb04252e621c0b128ecc8fedbca922d11adba; https://git.kernel.org/stable/c/3c838ca6fbdb173102780d7bdf18f2f7d9e30979
CVE: CVE-2022-50128
Published: 2025-06-18
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2022-50129
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

RDMA/srpt: Fix a use-after-free

Change the LIO port members inside struct srpt_port from regular members
into pointers. Allocate the LIO port data structures from inside
srpt_make_tport() and free these from inside srpt_make_tport(). Keep
struct srpt_device as long as either an RDMA port or a LIO target port is
associated with it. This patch decouples the lifetime of struct srpt_port
(controlled by the RDMA core) and struct srpt_port_id (controlled by LIO).
This patch fixes the following KASAN complaint:

  BUG: KASAN: use-after-free in srpt_enable_tpg+0x31/0x70 [ib_srpt]
  Read of size 8 at addr ffff888141cc34b8 by task check/5093

  Call Trace:
   <TASK>
   show_stack+0x4e/0x53
   dump_stack_lvl+0x51/0x66
   print_address_description.constprop.0.cold+0xea/0x41e
   print_report.cold+0x90/0x205
   kasan_report+0xb9/0xf0
   __asan_load8+0x69/0x90
   srpt_enable_tpg+0x31/0x70 [ib_srpt]
   target_fabric_tpg_base_enable_store+0xe2/0x140 [target_core_mod]
   configfs_write_iter+0x18b/0x210
   new_sync_write+0x1f2/0x2f0
   vfs_write+0x3e3/0x540
   ksys_write+0xbb/0x140
   __x64_sys_write+0x42/0x50
   do_syscall_64+0x34/0x80
   entry_SYSCALL_64_after_hwframe+0x46/0xb0
   </TASK>
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/388326bb1c32fcd09371c1d494af71471ef3a04b; https://git.kernel.org/stable/c/4ee8c39968a648d58b273582d4b021044a41ee5e; https://git.kernel.org/stable/c/b5605148e6ce36bb21020d49010b[PII_REDACTED]28
CVE: CVE-2022-50130
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

staging: fbtft: core: set smem_len before fb_deferred_io_init call

The fbtft_framebuffer_alloc() calls fb_deferred_io_init() before
initializing info->fix.smem_len.  It is set to zero by the
framebuffer_alloc() function.  It will trigger a WARN_ON() at the
start of fb_deferred_io_init() and the function will not do anything.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/4178bfa3fc9de556dfe248a6eabe29280f0ffda5; https://git.kernel.org/stable/c/5185c319e8ea67657e0d3edd520a7276516c506a; https://git.kernel.org/stable/c/6ae6abe240306f878557d6eadd950a2e2561f59f
CVE: CVE-2022-50131
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

HID: mcp2221: prevent a buffer overflow in mcp_smbus_write()

Smatch Warning:
drivers/hid/hid-mcp2221.c:388 mcp_smbus_write() error: __memcpy()
'&mcp->txbuf[5]' too small (59 vs 255)
drivers/hid/hid-mcp2221.c:388 mcp_smbus_write() error: __memcpy() 'buf'
too small (34 vs 255)

The 'len' variable can take a value between 0-255 as it can come from
data->block[0] and it is user data. So add an bound check to prevent a
buffer overflow in memcpy().
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://git.kernel.org/stable/c/3c0f8a59f2cc8841ee6653399a77f4f3e6e9a270; https://git.kernel.org/stable/c/62ac2473553a00229e67bdf3cb023b62cf7f5a9a; https://git.kernel.org/stable/c/6402116a7b5ec80fa40fd145a80c813019cd555f
CVE: CVE-2022-50132
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

usb: cdns3: change place of 'priv_ep' assignment in cdns3_gadget_ep_dequeue(), cdns3_gadget_ep_enable()

If 'ep' is NULL, result of ep_to_cdns3_ep(ep) is invalid pointer
and its dereference with priv_ep->cdns3_dev may cause panic.

Found by Linux Verification Center (linuxtesting.org) with SVACE.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/7af83bb516d7aa4f96835288e4aeda21d7aa2a17; https://git.kernel.org/stable/c/bfa[PII_REDACTED]072454dba7933e4a4a7be44467a; https://git.kernel.org/stable/c/c3ffc9c4ca44bfe[PII_REDACTED]d133e1fb0630ea6
CVE: CVE-2022-50134
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

RDMA/hfi1: fix potential memory leak in setup_base_ctxt()

setup_base_ctxt() allocates a memory chunk for uctxt->groups with
hfi1_alloc_ctxt_rcv_groups(). When init_user_ctxt() fails, uctxt->groups
is not released, which will lead to a memory leak.

We should release the uctxt->groups with hfi1_free_ctxt_rcv_groups()
when init_user_ctxt() fails.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/1750be1e9f18787cf717c24dbc5fa029fc372a22; https://git.kernel.org/stable/c/2f90813f1c21c3d780585390af961bd17c8515ae; https://git.kernel.org/stable/c/90ef48a718f88935d4af53d7dadd1ceafe103ce6