deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-50863
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: rtw89: free unused skb to prevent memory leak

This avoid potential memory leak under power saving mode.
References: https://git.kernel.org/stable/c/216c59b66f2d0c428a4fdaa24dc28cd6be4a2bf6; https://git.kernel.org/stable/c/d4b4f6ff8ff1b87d25977423cf38fb61744d0023; https://git.kernel.org/stable/c/eae672f[PII_REDACTED]58b9e5d3d33e9e4af9dca1d
CVE: CVE-2022-50864
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

nilfs2: fix shift-out-of-bounds due to too large exponent of block size

If field s_log_block_size of superblock data is corrupted and too large,
init_nilfs() and load_nilfs() still can trigger a shift-out-of-bounds
warning followed by a kernel panic (if panic_on_warn is set):

 shift exponent 38973 is too large for 32-bit type 'int'
 Call Trace:
  <TASK>
  dump_stack_lvl+0xcd/0x134
  ubsan_epilogue+0xb/0x50
  __ubsan_handle_shift_out_of_bounds.cold.12+0x17b/0x1f5
  init_nilfs.cold.11+0x18/0x1d [nilfs2]
  nilfs_mount+0x9b5/0x12b0 [nilfs2]
  ...

This fixes the issue by adding and using a new helper function for getting
block size with sanity check.
References: https://git.kernel.org/stable/c/8b6ef451b5701b37d9a[PII_REDACTED]776a662edfc; https://git.kernel.org/stable/c/a16731fa1b96226c75bbf18e73513b14fc318360; https://git.kernel.org/stable/c/ddb6615a168f97b91175e00eda4c644741cf531c
CVE: CVE-2022-50865
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

tcp: fix a signed-integer-overflow bug in tcp_add_backlog()

The type of sk_rcvbuf and sk_sndbuf in struct sock is int, and
in tcp_add_backlog(), the variable limit is caculated by adding
sk_rcvbuf, sk_sndbuf and 64 * 1024, it may exceed the max value
of int and overflow. This patch reduces the limit budget by
halving the sndbuf to solve this issue since ACK packets are much
smaller than the payload.
References: https://git.kernel.org/stable/c/28addf029417d53b1df062b4c87feb7bc033cb5f; https://git.kernel.org/stable/c/4f23cb2be530785db284a685d1b1c30224d8a538; https://git.kernel.org/stable/c/9d04b4d0feee12bce6bfe37f30d8e953d3c30368
CVE: CVE-2022-50866
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

ASoC: pxa: fix null-pointer dereference in filter()

kasprintf() would return NULL pointer when kmalloc() fail to allocate.
Need to check the return pointer before calling strcmp().
References: https://git.kernel.org/stable/c/0abd1d78317a3a2dfe00b203fbf14ee7df537e0a; https://git.kernel.org/stable/c/21a1409e8cf73053b54f7860548e3043dfa351a9; https://git.kernel.org/stable/c/21b92cf41952577a95bfa430e39478cbd66e42a7
CVE: CVE-2022-50867
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/msm/a6xx: Fix kvzalloc vs state_kcalloc usage

adreno_show_object() is a trap!  It will re-allocate the pointer it is
passed on first call, when the data is ascii85 encoded, using kvmalloc/
kvfree().  Which means the data *passed* to it must be kvmalloc'd, ie.
we cannot use the state_kcalloc() helper.

This partially reverts commit ec8f1813bf8d ("drm/msm/a6xx: Replace
kcalloc() with kvzalloc()"), but adds the missing kvfree() to fix the
memory leak that was present previously.  And adds a warning comment.

Patchwork: https://patchwork.freedesktop.org/patch/507014/
References: https://git.kernel.org/stable/c/4b1bbc0571a5d7ee10f754186dc3d619b9ced5c1; https://git.kernel.org/stable/c/83d18e9d9c0150d98dc24e3642ea93f5e245322c
CVE: CVE-2022-50868
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

hwrng: amd - Fix PCI device refcount leak

for_each_pci_dev() is implemented by pci_get_device(). The comment of
pci_get_device() says that it will increase the reference count for the
returned pci_dev and also decrease the reference count for the input
pci_dev @from if it is not NULL.

If we break for_each_pci_dev() loop with pdev not NULL, we need to call
pci_dev_put() to decrease the reference count. Add the missing
pci_dev_put() for the normal and error path.
References: https://git.kernel.org/stable/c/1199f8e02941b326c60ab71a63002b7c80e38212; https://git.kernel.org/stable/c/2b79a5e560779b35e1164d57ae35c48b43373082; https://git.kernel.org/stable/c/2e10ecd012ae2b2a374b34f307e9bc1e6096c03d
CVE: CVE-2022-50869
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: Fix slab-out-of-bounds in r_page

When PAGE_SIZE is 64K, if read_log_page is called by log_read_rst for
the first time, the size of *buffer would be equal to
DefaultLogPageSize(4K).But for *buffer operations like memcpy,
if the memory area size(n) which being assigned to buffer is larger
than 4K (log->page_size(64K) or bytes(64K-page_off)), it will cause
an out of boundary error.
 Call trace:
  [...]
  kasan_report+0x44/0x130
  check_memory_region+0xf8/0x1a0
  memcpy+0xc8/0x100
  ntfs_read_run_nb+0x20c/0x460
  read_log_page+0xd0/0x1f4
  log_read_rst+0x110/0x75c
  log_replay+0x1e8/0x4aa0
  ntfs_loadlog_and_replay+0x290/0x2d0
  ntfs_fill_super+0x508/0xec0
  get_tree_bdev+0x1fc/0x34c
  [...]

Fix this by setting variable r_page to NULL in log_read_rst.
References: https://git.kernel.org/stable/c/6d076293e5bffdf897ea5f975669206e09beed6a; https://git.kernel.org/stable/c/bf86a640a34947d92062996e1a75b9cd9d83dd19; https://git.kernel.org/stable/c/ecfbd57cf9c5ca225184ae266ce44ae473792132
CVE: CVE-2022-50870
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

powerpc/rtas: avoid device tree lookups in rtas_os_term()

rtas_os_term() is called during panic. Its behavior depends on a couple
of conditions in the /rtas node of the device tree, the traversal of
which entails locking and local IRQ state changes. If the kernel panics
while devtree_lock is held, rtas_os_term() as currently written could
hang.

Instead of discovering the relevant characteristics at panic time,
cache them in file-static variables at boot. Note the lookup for
"ibm,extended-os-term" is converted to of_property_read_bool() since it
is a boolean property, not an RTAS function token.

[mpe: Incorporate suggested change from Nick]
References: https://git.kernel.org/stable/c/06a07fbb32b3a23eec20a42b1e64474da0a3b33e; https://git.kernel.org/stable/c/464d10e8d797454e16a173ef1292a446b2adf21c; https://git.kernel.org/stable/c/698e682c849e356fb47a8be47ca8baa817cf31e0
CVE: CVE-2022-50871
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: ath11k: Fix qmi_msg_handler data structure initialization

qmi_msg_handler is required to be null terminated by QMI module.
There might be a case where a handler for a msg id is not present in the
handlers array which can lead to infinite loop while searching the handler
and therefore out of bound access in qmi_invoke_handler().
Hence update the initialization in qmi_msg_handler data structure.

Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.5.0.1-01100-QCAHKSWPL_SILICONZ-1
References: https://git.kernel.org/stable/c/a10e1530c424bb277b4edc7def0195857a548495; https://git.kernel.org/stable/c/d5d71de448f36e34592f7c81b5e300d3e8dbb735; https://git.kernel.org/stable/c/ed3725e15a154ebebf44e0c34806c57525483f92
CVE: CVE-2022-50872
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

ARM: OMAP2+: Fix memory leak in realtime_counter_init()

The "sys_clk" resource is malloced by clk_get(),
it is not released when the function return.
References: https://git.kernel.org/stable/c/10fcdad2b9f3f424873714eb8713a3e6f7ab84bb; https://git.kernel.org/stable/c/4862c41d5f3bee1ec64c979c82bd8cfe96b78f7d; https://git.kernel.org/stable/c/4f7ad1b08533247c4bf29217ba499ea4138cc2c1
CVE: CVE-2022-50873
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

vdpa/vp_vdpa: fix kfree a wrong pointer in vp_vdpa_remove

In vp_vdpa_remove(), the code kfree(&vp_vdpa_mgtdev->mgtdev.id_table) uses
a reference of pointer as the argument of kfree, which is the wrong pointer
and then may hit crash like this:

Unable to handle kernel paging request at virtual address 00ffff003363e30c
Internal error: Oops: 96000004 [#1] SMP
Call trace:
 rb_next+0x20/0x5c
 ext4_readdir+0x494/0x5c4 [ext4]
 iterate_dir+0x168/0x1b4
 __se_sys_getdents64+0x68/0x170
 __arm64_sys_getdents64+0x24/0x30
 el0_svc_common.constprop.0+0x7c/0x1bc
 do_el0_svc+0x2c/0x94
 el0_svc+0x20/0x30
 el0_sync_handler+0xb0/0xb4
 el0_sync+0x160/0x180
Code: 54000220 f9400441 b4000161 aa0103e0 (f9400821)
SMP: stopping secondary CPUs
Starting crashdump kernel...
References: https://git.kernel.org/stable/c/6ccc891f36d0c20ee220551caabdcd3886ec584b; https://git.kernel.org/stable/c/8fe12680b2c[PII_REDACTED]35013ec9219c93ec540; https://git.kernel.org/stable/c/ed843d6ed7310a27cf7c8ee0a82a482eed0cb4a6
CVE: CVE-2022-50874
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

RDMA/erdma: Fix refcount leak in erdma_mmap

rdma_user_mmap_entry_get() take reference, we should release it when not
need anymore, add the missing rdma_user_mmap_entry_put() in the error
path to fix it.
References: https://git.kernel.org/stable/c/410f0f46ffca4d0102470c1e0c747ecfece4204c; https://git.kernel.org/stable/c/8372207b009d6abdd60bb05624640bd86386599f; https://git.kernel.org/stable/c/ee84146c05ad2316b9a7222d0ec4413e0bf30eeb
CVE: CVE-2022-50875
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

of: overlay: fix null pointer dereferencing in find_dup_cset_node_entry() and find_dup_cset_prop()

When kmalloc() fail to allocate memory in kasprintf(), fn_1 or fn_2 will
be NULL, and strcmp() will cause null pointer dereference.
References: https://git.kernel.org/stable/c/2b4af99b[PII_REDACTED]3821019dd13a4ac48c0219; https://git.kernel.org/stable/c/71d88c7453ec3d2ceff98e18ce4d6354abd3b5b6; https://git.kernel.org/stable/c/9ec5781879b4535ad59b5354b385825378e45618
CVE: CVE-2022-50876
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

usb: musb: Fix musb_gadget.c rxstate overflow bug

The usb function device call musb_gadget_queue() adds the passed
request to musb_ep::req_list,If the (request->length > musb_ep->packet_sz)
and (is_buffer_mapped(req) return false),the rxstate() will copy all data
in fifo to request->buf which may cause request->buf out of bounds.

Fix it by add the length check :
fifocnt = min_t(unsigned, request->length - request->actual, fifocnt);
References: https://git.kernel.org/stable/c/3c84c7f592c4ba38f54ddaddd0115acc443025db; https://git.kernel.org/stable/c/523313881f0aa5cbbdb548ce575b6e58b202bd76; https://git.kernel.org/stable/c/7c80f3a918ba9aa26fb699ee887064ec3af0396a
CVE: CVE-2022-50877
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

net: broadcom: bcm4908_enet: update TX stats after actual transmission

Queueing packets doesn't guarantee their transmission. Update TX stats
after hardware confirms consuming submitted data.

This also fixes a possible race and NULL dereference.
bcm4908_enet_start_xmit() could try to access skb after freeing it in
the bcm4908_enet_poll_tx().
References: https://git.kernel.org/stable/c/2adedc80faec243ede55355e57142110d6f46e08; https://git.kernel.org/stable/c/c9589e18a60c55c76772a38117ef9a16b942e56b; https://git.kernel.org/stable/c/ef3556ee16c68735ec69bd08df41d1cd83b14ad3
CVE: CVE-2022-50878
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

gpu: lontium-lt9611: Fix NULL pointer dereference in lt9611_connector_init()

A NULL check for bridge->encoder shows that it may be NULL, but it
already been dereferenced on all paths leading to the check.
812	if (!bridge->encoder) {

Dereference the pointer bridge->encoder.
810	drm_connector_attach_encoder(&lt9611->connector, bridge->encoder);
References: https://git.kernel.org/stable/c/3959e8faf8bf6bea619e8856c736db64e6eced37; https://git.kernel.org/stable/c/912f84e15e94ab87f5a7156aa[PII_REDACTED]d8304; https://git.kernel.org/stable/c/a29f7427041a943484f916157c43c46d3bbf25d4
CVE: CVE-2022-50879
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

objtool: Fix SEGFAULT

find_insn() will return NULL in case of failure. Check insn in order
to avoid a kernel Oops for NULL pointer dereference.
References: https://git.kernel.org/stable/c/0af0e115ff59d638f45416a004cdd8edb38db40c; https://git.kernel.org/stable/c/23a249b1185cdd5bfb6971d1608ba49e589f2288; https://git.kernel.org/stable/c/38b9415abbd703438ebbc6fb74990bd0fbddc5b9
CVE: CVE-2022-50882
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

media: uvcvideo: Fix memory leak in uvc_gpio_parse

Previously the unit buffer was allocated before checking the IRQ for
privacy GPIO. In case of error, the unit buffer was leaked.

Allocate the unit buffer after the IRQ to avoid it.

Addresses-Coverity-ID: 1474639 ("Resource leak")
References: https://git.kernel.org/stable/c/4a7ae8d982a89b3b43b36ec7d62a2e3d06ffa16e; https://git.kernel.org/stable/c/6c5da92103bddd1f0c36cb69446ff7cae3043986; https://git.kernel.org/stable/c/deb8f32ae4b10a48c433f2da1b1159521ac24674
CVE: CVE-2022-50883
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

bpf: Prevent decl_tag from being referenced in func_proto arg

Syzkaller managed to hit another decl_tag issue:

  btf_func_proto_check kernel/bpf/btf.c:4506 [inline]
  btf_check_all_types kernel/bpf/btf.c:4734 [inline]
  btf_parse_type_sec+0x1175/0x1980 kernel/bpf/btf.c:4763
  btf_parse kernel/bpf/btf.c:5042 [inline]
  btf_new_fd+0x65a/0xb00 kernel/bpf/btf.c:6709
  bpf_btf_load+0x6f/0x90 kernel/bpf/syscall.c:4342
  __sys_bpf+0x50a/0x6c0 kernel/bpf/syscall.c:5034
  __do_sys_bpf kernel/bpf/syscall.c:5093 [inline]
  __se_sys_bpf kernel/bpf/syscall.c:5091 [inline]
  __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5091
  do_syscall_64+0x54/0x70 arch/x86/entry/common.c:48

This seems similar to commit ea68376c8bed ("bpf: prevent decl_tag from being
referenced in func_proto") but for the argument.
References: https://git.kernel.org/stable/c/3f3d54962a032581996edda8e6bcbf7a30371234; https://git.kernel.org/stable/c/e6d276dcc9204f95632580c43d66c52ca502d7ec; https://git.kernel.org/stable/c/f17472d4599697d701aa239b4c475a506bccfd19
CVE: CVE-2022-50884
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

drm: Prevent drm_copy_field() to attempt copying a NULL pointer

There are some struct drm_driver fields that are required by drivers since
drm_copy_field() attempts to copy them to user-space via DRM_IOCTL_VERSION.

But it can be possible that a driver has a bug and did not set some of the
fields, which leads to drm_copy_field() attempting to copy a NULL pointer:

[ +10.395966] Unable to handle kernel access to user memory outside uaccess routines at virtual address [PII_REDACTED]
[  +0.010955] Mem abort info:
[  +0.002835]   ESR = 0x[PII_REDACTED]000004
[  +0.003872]   EC = 0x25: DABT (current EL), IL = 32 bits
[  +0.005395]   SET = 0, FnV = 0
[  +0.003113]   EA = 0, S1PTW = 0
[  +0.003182]   FSC = 0x04: level 0 translation fault
[  +0.004964] Data abort info:
[  +0.002919]   ISV = 0, ISS = 0x00000004
[  +0.003886]   CM = 0, WnR = 0
[  +0.003040] user pgtable: 4k pages, 48-bit VAs, pgdp=[PII_REDACTED]dad000
[  +0.006536] [[PII_REDACTED]] pgd=[PII_REDACTED], p4d=[PII_REDACTED]
[  +0.006925] Internal error: Oops: 96000004 [#1] SMP
...
[  +0.011113] pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[  +0.007061] pc : __pi_strlen+0x14/0x150
[  +0.003895] lr : drm_copy_field+0x30/0x1a4
[  +0.004156] sp : ffff8000094b3a50
[  +0.003355] x29: ffff8000094b3a50 x28: ffff8000094b3b70 x27: [PII_REDACTED]
[  +0.007242] x26: ffff443743c2ba00 x25: [PII_REDACTED] x24: [PII_REDACTED]
[  +0.007243] x23: ffff443743c2ba00 x22: ffff8000094b3b70 x21: [PII_REDACTED]
[  +0.007241] x20: [PII_REDACTED] x19: ffff8000094b3b90 x18: [PII_REDACTED]
[  +0.007241] x17: [PII_REDACTED] x16: [PII_REDACTED] x15: 0000aaab14b9af40
[  +0.007241] x14: [PII_REDACTED] x13: [PII_REDACTED] x12: [PII_REDACTED]
[  +0.007239] x11: [PII_REDACTED] x10: [PII_REDACTED] x9 : ffffa524ad67d4d8
[  +0.007242] x8 : [PII_REDACTED] x7 : 7f7f7f7f7f7f7f7f x6 : 6c6e6263606e7141
[  +0.007239] x5 : [PII_REDACTED] x4 : [PII_REDACTED] x3 : [PII_REDACTED]
[  +0.007241] x2 : [PII_REDACTED] x1 : ffff8000094b3b90 x0 : [PII_REDACTED]
[  +0.007240] Call trace:
[  +0.002475]  __pi_strlen+0x14/0x150
[  +0.003537]  drm_version+0x84/0xac
[  +0.003448]  drm_ioctl_kernel+0xa8/0x16c
[  +0.003975]  drm_ioctl+0x270/0x580
[  +0.003448]  __arm64_sys_ioctl+0xb8/0xfc
[  +0.003978]  invoke_syscall+0x78/0x100
[  +0.003799]  el0_svc_common.constprop.0+0x4c/0xf4
[  +0.004767]  do_el0_svc+0x38/0x4c
[  +0.003357]  el0_svc+0x34/0x100
[  +0.003185]  el0t_64_sync_handler+0x11c/0x150
[  +0.004418]  el0t_64_sync+0x190/0x194
[  +0.003716] Code: 92402c04 b200c3e8 f13fc09f 5400088c (a9400c02)
[  +0.006180] ---[ end trace [PII_REDACTED] ]---
References: https://git.kernel.org/stable/c/2d6708ea5c2033ff53267feff1876a717689989f; https://git.kernel.org/stable/c/6cf5e9356b2d856403ee480f987f3ea64dbf8d8c; https://git.kernel.org/stable/c/8052612b9d08048ebbebcb572894670b4ac07d2f
CVE: CVE-2022-50885
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

RDMA/rxe: Fix NULL-ptr-deref in rxe_qp_do_cleanup() when socket create failed

There is a null-ptr-deref when mount.cifs over rdma:

  BUG: KASAN: null-ptr-deref in rxe_qp_do_cleanup+0x2f3/0x360 [rdma_rxe]
  Read of size 8 at addr [PII_REDACTED] by task mount.cifs/3046

  CPU: 2 PID: 3046 Comm: mount.cifs Not tainted 6.1.0-rc5+ #62
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc3
  Call Trace:
   <TASK>
   dump_stack_lvl+0x34/0x44
   kasan_report+0xad/0x130
   rxe_qp_do_cleanup+0x2f3/0x360 [rdma_rxe]
   execute_in_process_context+0x25/0x90
   __rxe_cleanup+0x101/0x1d0 [rdma_rxe]
   rxe_create_qp+0x16a/0x180 [rdma_rxe]
   create_qp.part.0+0x27d/0x340
   ib_create_qp_kernel+0x73/0x160
   rdma_create_qp+0x100/0x230
   _smbd_get_connection+0x752/0x20f0
   smbd_get_connection+0x21/0x40
   cifs_get_tcp_session+0x8ef/0xda0
   mount_get_conns+0x60/0x750
   cifs_mount+0x103/0xd00
   cifs_smb3_do_mount+0x1dd/0xcb0
   smb3_get_tree+0x1d5/0x300
   vfs_get_tree+0x41/0xf0
   path_mount+0x9b3/0xdd0
   __x64_sys_mount+0x190/0x1d0
   do_syscall_64+0x35/0x80
   entry_SYSCALL_64_after_hwframe+0x46/0xb0

The root cause of the issue is the socket create failed in
rxe_qp_init_req().

So move the reset rxe_qp_do_cleanup() after the NULL ptr check.
References: https://git.kernel.org/stable/c/5b924632d84a60bc0c7fe6e9bbbce99d03908957; https://git.kernel.org/stable/c/6bb5a62bfd624039b05157745c[PII_REDACTED]93a9; https://git.kernel.org/stable/c/7340ca9f782be6fbe3f64a134dc112772764f766
CVE: CVE-2022-50886
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

mmc: toshsd: fix return value check of mmc_add_host()

mmc_add_host() may return error, if we ignore its return value, the memory
that allocated in mmc_alloc_host() will be leaked and it will lead a kernel
crash because of deleting not added device in the remove path.

So fix this by checking the return value and goto error path which will call
mmc_free_host(), besides, free_irq() also needs be called.
References: https://git.kernel.org/stable/c/3329e7b7132ca727263fb0ee214cf52cc6dcaaad; https://git.kernel.org/stable/c/34ae492f8d172f0bd193c24cad588b35419ea47a; https://git.kernel.org/stable/c/3dbb69a0242c31ea4c9eee22b1c41b515fe509a0
CVE: CVE-2022-50887
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

regulator: core: fix unbalanced of node refcount in regulator_dev_lookup()

I got the the following report:

  OF: ERROR: memory leak, expected refcount 1 instead of 2,
  of_node_get()/of_node_put() unbalanced - destroy cset entry:
  attach overlay node /i2c/pmic@62/regulators/exten

In of_get_regulator(), the node is returned from of_parse_phandle()
with refcount incremented, after using it, of_node_put() need be called.
References: https://git.kernel.org/stable/c/0e88505ac0a6ae97746bcdbd4b042ee9f20455ae; https://git.kernel.org/stable/c/2b93c58adddd98812ad928bbc2063038f3df1ffd; https://git.kernel.org/stable/c/2f98469c3141f8e42ba11075a273fb795bbad57f
CVE: CVE-2022-50888
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

remoteproc: qcom: q6v5: Fix potential null-ptr-deref in q6v5_wcss_init_mmio()

q6v5_wcss_init_mmio() will call platform_get_resource_byname() that may
fail and return NULL. devm_ioremap() will use res->start as input, which
may causes null-ptr-deref. Check the ret value of
platform_get_resource_byname() to avoid the null-ptr-deref.
References: https://git.kernel.org/stable/c/0903a87490a9ed456ac765a84dcc484c1ee42c32; https://git.kernel.org/stable/c/098ebb9089c4eedea09333f912d105fa63377496; https://git.kernel.org/stable/c/3afa88ae9911b65702a3aca9d92ea23fe496e56f
CVE: CVE-2022-50889
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

dm integrity: Fix UAF in dm_integrity_dtr()

Dm_integrity also has the same UAF problem when dm_resume()
and dm_destroy() are concurrent.

Therefore, cancelling timer again in dm_integrity_dtr().
References: https://git.kernel.org/stable/c/792e51aac376cfb5bd527c2a30826223b82dd177; https://git.kernel.org/stable/c/9215b25f2e105032114e9b92c9783a2a84ee8af9; https://git.kernel.org/stable/c/9f8e1e54a3a424c6c4fb8742e094789d3ec91e42
CVE: CVE-2023-54167
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

m68k: mm: Move initrd phys_to_virt handling after paging_init()

When booting with an initial ramdisk on platforms where physical memory
does not start at address zero (e.g. on Amiga):

    initrd: 0ef0602c - 0f800000
    Zone ranges:
      DMA      [mem 0x[PII_REDACTED]000000-0x000000f7ffffffff]
      Normal   empty
    Movable zone start for each node
    Early memory node ranges
      node   0: [mem 0x[PII_REDACTED]000000-0x000000000f7fffff]
    Initmem setup node 0 [mem 0x[PII_REDACTED]000000-0x000000000f7fffff]
    Unable to handle kernel access at virtual address (ptrval)
    Oops: 00000000
    Modules linked in:
    PC: [<00201d3c>] memcmp+0x28/0x56

As phys_to_virt() relies on m68k_memoffset and module_fixup(), it must
not be called before paging_init().  Hence postpone the phys_to_virt
handling for the initial ramdisk until after calling paging_init().

While at it, reduce #ifdef clutter by using IS_ENABLED() instead.
References: https://git.kernel.org/stable/c/58662cfb459150b9c0c22d20cddaea439b3844bd; https://git.kernel.org/stable/c/ceb089e2337f810d3594d310953d9af4783f660a; https://git.kernel.org/stable/c/d4b97925e87eb133e400fe4a482d750c74ce392f
CVE: CVE-2023-54168
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

RDMA/mlx4: Prevent shift wrapping in set_user_sq_size()

The ucmd->log_sq_bb_count variable is controlled by the user so this
shift can wrap.  Fix it by using check_shl_overflow() in the same way
that it was done in commit 515f60004ed9 ("RDMA/hns: Prevent undefined
behavior in hns_roce_set_user_sq_size()").
References: https://git.kernel.org/stable/c/196a6df08b08699ace4ce70e1efcdd9081b6565f; https://git.kernel.org/stable/c/3ce0df3493277b9df275cb8455d9c677ae701230; https://git.kernel.org/stable/c/3d5ae269c4bd392ec1edbfb3bd031b8f42d7feff