deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-50186
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

ath11k: fix missing skb drop on htc_tx_completion error

On htc_tx_completion error the skb is not dropped. This is wrong since
the completion_handler logic expect the skb to be consumed anyway even
when an error is triggered. Not freeing the skb on error is a memory
leak since the skb won't be freed anywere else. Correctly free the
packet on eid >= ATH11K_HTC_EP_COUNT before returning.

Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.5.0.1-01208-QCAHKSWPL_SILICONZ-1
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/1f[PII_REDACTED]ae7556492f50f83f038bbdf8c294; https://git.kernel.org/stable/c/dda25326839d6e6b1fe59e79616149e44ea4eaa4; https://git.kernel.org/stable/c/e5646fe3b7ef739c392e59da7db6adf5e1fdef42
CVE: CVE-2022-50187
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

ath11k: fix netdev open race

Make sure to allocate resources needed before registering the device.

This specifically avoids having a racing open() trigger a BUG_ON() in
mod_timer() when ath11k_mac_op_start() is called before the
mon_reap_timer as been set up.

I did not see this issue with next-20220310, but I hit it on every probe
with next-20220511. Perhaps some timing changed in between.

Here's the backtrace:

[   51.346947] kernel BUG at kernel/time/timer.c:990!
[   51.346958] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
...
[   51.578225] Call trace:
[   51.583293]  __mod_timer+0x298/0x390
[   51.589518]  mod_timer+0x14/0x20
[   51.595368]  ath11k_mac_op_start+0x41c/0x4a0 [ath11k]
[   51.603165]  drv_start+0x38/0x60 [mac80211]
[   51.610110]  ieee80211_do_open+0x29c/0x7d0 [mac80211]
[   51.617945]  ieee80211_open+0x60/0xb0 [mac80211]
[   51.625311]  __dev_open+0x100/0x1c0
[   51.631420]  __dev_change_flags+0x194/0x210
[   51.638214]  dev_change_flags+0x24/0x70
[   51.644646]  do_setlink+0x228/0xdb0
[   51.650723]  __rtnl_newlink+0x460/0x830
[   51.657162]  rtnl_newlink+0x4c/0x80
[   51.663229]  rtnetlink_rcv_msg+0x124/0x390
[   51.669917]  netlink_rcv_skb+0x58/0x130
[   51.676314]  rtnetlink_rcv+0x18/0x30
[   51.682460]  netlink_unicast+0x250/0x310
[   51.688960]  netlink_sendmsg+0x19c/0x3e0
[   51.695458]  ____sys_sendmsg+0x220/0x290
[   51.701938]  ___sys_sendmsg+0x7c/0xc0
[   51.708148]  __sys_sendmsg+0x68/0xd0
[   51.714254]  __arm64_sys_sendmsg+0x28/0x40
[   51.720900]  invoke_syscall+0x48/0x120

Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362
References: https://git.kernel.org/stable/c/307ce58270b3b50ca21cfcc910568429b06803f7; https://git.kernel.org/stable/c/a2c45f8c3d18269e641f0c7da2dde47ef8414034; https://git.kernel.org/stable/c/abb7dc8fbb27c15dcc927df56190f3c5ede58bd5
CVE: CVE-2022-50188
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/meson: Fix refcount leak in meson_encoder_hdmi_init

of_find_device_by_node() takes reference, we should use put_device()
to release it when not need anymore.
Add missing put_device() in error path to avoid refcount
leak.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/50446ac34545580d073ff0dd154b[PII_REDACTED]68; https://git.kernel.org/stable/c/[PII_REDACTED]586528e2a812a709e[PII_REDACTED]a99; https://git.kernel.org/stable/c/79b15eb0aa059b3a5bc60364ce82eb2cefac80db
CVE: CVE-2022-50189
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

tools/power turbostat: Fix file pointer leak

Currently if a fscanf fails then an early return leaks an open
file pointer. Fix this by fclosing the file before the return.
Detected using static analysis with cppcheck:

tools/power/x86/turbostat/turbostat.c:2039:3: error: Resource leak: fp [resourceLeak]
CVSS Score: 7.1 (HIGH)
CWE: CWE-772
References: https://git.kernel.org/stable/c/2ebf6f5946817f33fb33e613e359229e98164eb3; https://git.kernel.org/stable/c/5e5fd36c58d6c820f7292ee492c3731c9a104a41
CVE: CVE-2022-50190
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

spi: Fix simplification of devm_spi_register_controller

This reverts commit 59ebbe40fb51 ("spi: simplify
devm_spi_register_controller").

If devm_add_action() fails in devm_add_action_or_reset(),
devm_spi_unregister() will be called, it decreases the
refcount of 'ctlr->dev' to 0, then it will cause uaf in
the drivers that calling spi_put_controller() in error path.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/34bab623ebfc08398499e463396b81abb4abe01e; https://git.kernel.org/stable/c/3c6bd448442b6c3f6843ac70d57201a13478dd47; https://git.kernel.org/stable/c/43cc5a0afe4184a7fafe1eba32b5a11bb69c9ce0
CVE: CVE-2022-50191
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

regulator: of: Fix refcount leak bug in of_get_regulation_constraints()

We should call the of_node_put() for the reference returned by
of_get_child_by_name() which has increased the refcount.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/11ecb4f8735b0230d54a82c18b21ea778b695d61; https://git.kernel.org/stable/c/332e555dca074c4eb[PII_REDACTED]c[PII_REDACTED]c3; https://git.kernel.org/stable/c/35f9e861d9b9434903a8ede37a3561f78985826d
CVE: CVE-2022-50192
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

spi: tegra20-slink: fix UAF in tegra_slink_remove()

After calling spi_unregister_master(), the refcount of master will
be decrease to 0, and it will be freed in spi_controller_release(),
the device data also will be freed, so it will lead a UAF when using
'tspi'. To fix this, get the master before unregister and put it when
finish using it.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/415b4ce61308f24583912d887772dfcbf97f1d20; https://git.kernel.org/stable/c/67f[PII_REDACTED]0482fdafc03b[PII_REDACTED]701e5; https://git.kernel.org/stable/c/7e9984d183bb1e99e766c5c2b950ff21f7f7b6c0
CVE: CVE-2022-50193
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

erofs: wake up all waiters after z_erofs_lzma_head ready

When the user mounts the erofs second times, the decompression thread
may hung. The problem happens due to a sequence of steps like the
following:

1) Task A called z_erofs_load_lzma_config which obtain all of the node
   from the z_erofs_lzma_head.

2) At this time, task B called the z_erofs_lzma_decompress and wanted to
   get a node. But the z_erofs_lzma_head was empty, the Task B had to
   sleep.

3) Task A release nodes and push nodes into the z_erofs_lzma_head. But
   task B was still sleeping.

One example report when the hung happens:
task:kworker/u3:1 state:D stack:14384 pid: 86 ppid: 2 flags:0x00004000
Workqueue: erofs_unzipd z_erofs_decompressqueue_work
Call Trace:
 <TASK>
 __schedule+0x281/0x760
 schedule+0x49/0xb0
 z_erofs_lzma_decompress+0x4bc/0x580
 ? cpu_core_flags+0x10/0x10
 z_erofs_decompress_pcluster+0x49b/0xba0
 ? __update_load_avg_se+0x2b0/0x330
 ? __update_load_avg_se+0x2b0/0x330
 ? update_load_avg+0x5f/0x690
 ? update_load_avg+0x5f/0x690
 ? set_next_entity+0xbd/0x110
 ? _raw_spin_unlock+0xd/0x20
 z_erofs_decompress_queue.isra.0+0x2e/0x50
 z_erofs_decompressqueue_work+0x30/0x60
 process_one_work+0x1d3/0x3a0
 worker_thread+0x45/0x3a0
 ? process_one_work+0x3a0/0x3a0
 kthread+0xe2/0x110
 ? kthread_complete_and_exit+0x20/0x20
 ret_from_fork+0x22/0x30
 </TASK>
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/2478e36ec437a27f8a05bea9e4269a68c554e21f; https://git.kernel.org/stable/c/2df7c4bd7c1d2bc5ece5e9ed19dbd386810c2a65; https://git.kernel.org/stable/c/96aa2a6a89618d850ef082e4268007e840c28769
CVE: CVE-2022-50194
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

soc: qcom: aoss: Fix refcount leak in qmp_cooling_devices_register

Every iteration of for_each_available_child_of_node() decrements
the reference count of the previous node.
When breaking early from a for_each_available_child_of_node() loop,
we need to explicitly call of_node_put() on the child node.
Add missing of_node_put() to avoid refcount leak.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/053543ac1d095132fcfd1263805d6e25afbdc6a8; https://git.kernel.org/stable/c/591f0697ccbac33760d3bb1ad96a5ba2b76ae9f0; https://git.kernel.org/stable/c/97713ed9b6cc4abaa2dcc8357113c56520dc6d7f
CVE: CVE-2022-50195
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

ARM: dts: qcom: replace gcc PXO with pxo_board fixed clock

Replace gcc PXO phandle to pxo_board fixed clock declared in the dts.
gcc driver doesn't provide PXO_SRC as it's a fixed-clock. This cause a
kernel panic if any driver actually try to use it.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/0a4fa4ce697987b71eafce17bb198961ed9070bd; https://git.kernel.org/stable/c/eb9e93937756a[PII_REDACTED]5830c0dc482cb57e0
CVE: CVE-2022-50196
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

soc: qcom: ocmem: Fix refcount leak in of_get_ocmem

of_parse_phandle() returns a node pointer with refcount
incremented, we should use of_node_put() on it when not need anymore.
Add missing of_node_put() to avoid refcount leak.
of_node_put() will check NULL pointer.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/07aea6819d569d1e[PII_REDACTED]5e4fb5bd4cdb9; https://git.kernel.org/stable/c/84a928b44cb303d5756e3bff2734921de8dce4f6; https://git.kernel.org/stable/c/92a563fcf14b3093226fb36f12e9b5cf630c5a5d
CVE: CVE-2022-50197
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

cpufreq: zynq: Fix refcount leak in zynq_get_revision

of_find_compatible_node() returns a node pointer with refcount
incremented, we should use of_node_put() on it when done.
Add missing of_node_put() to avoid refcount leak.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/179034fb108e3655142f2af0c309cef171c34d68; https://git.kernel.org/stable/c/22e6d8bcde8e66b64f46bf9bd2d3d0f88d40c39f; https://git.kernel.org/stable/c/3b01353f1825151a29d08e0868b2bf01e1116ab5
CVE: CVE-2022-50198
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

ARM: OMAP2+: Fix refcount leak in omap3xxx_prm_late_init

of_find_matching_node() returns a node pointer with refcount
incremented, we should use of_node_put() on it when not need anymore.
Add missing of_node_put() to avoid refcount leak.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/1bf747824a8ca4008879fd7d2ce6b03d7b428858; https://git.kernel.org/stable/c/942228fbf5d[PII_REDACTED]b93d41225be7c0dd9de; https://git.kernel.org/stable/c/c4f92af7fc8cecb8eb426ad187e39c7bcc6679c7
CVE: CVE-2022-50199
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

ARM: OMAP2+: Fix refcount leak in omapdss_init_of

omapdss_find_dss_of_node() calls of_find_compatible_node() to get device
node. of_find_compatible_node() returns a node pointer with refcount
incremented, we should use of_node_put() on it when done.
Add missing of_node_put() in later error path and normal path.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/14bac0c7035bf920e190a63c7e1b113c72eadbf4; https://git.kernel.org/stable/c/230ad40a59c9a9ee8f3822b9a7bec09404102ebc; https://git.kernel.org/stable/c/507159facf002d113c4878fec67f37d62f187887
CVE: CVE-2022-50200
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

selinux: Add boundary check in put_entry()

Just like next_entry(), boundary check is necessary to prevent memory
out-of-bound access.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://git.kernel.org/stable/c/15ec76fb29be31df2bccb30fc09875274cba2776; https://git.kernel.org/stable/c/2dabe6a872a[PII_REDACTED]eb30ea51e8ccd21305a; https://git.kernel.org/stable/c/477722f31ad73aa779154d1d7e[PII_REDACTED]9f76
CVE: CVE-2022-50201
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

selinux: fix memleak in security_read_state_kernel()

In this function, it directly returns the result of __security_read_policy
without freeing the allocated memory in *data, cause memory leak issue,
so free the memory if __security_read_policy failed.

[PM: subject line tweak]
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/1fc1f72aad2070d34022d0823e4cf09706b53f25; https://git.kernel.org/stable/c/73de1befcc53a7c68b0c5e76b9b5ac41c517760f; https://git.kernel.org/stable/c/c877c5217145bda8fd95f506bf42f8d981afa57d
CVE: CVE-2022-50202
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

PM: hibernate: defer device probing when resuming from hibernation

syzbot is reporting hung task at misc_open() [1], for there is a race
window of AB-BA deadlock which involves probe_count variable. Currently
wait_for_device_probe() from snapshot_open() from misc_open() can sleep
forever with misc_mtx held if probe_count cannot become 0.

When a device is probed by hub_event() work function, probe_count is
incremented before the probe function starts, and probe_count is
decremented after the probe function completed.

There are three cases that can prevent probe_count from dropping to 0.

  (a) A device being probed stopped responding (i.e. broken/malicious
      hardware).

  (b) A process emulating a USB device using /dev/raw-gadget interface
      stopped responding for some reason.

  (c) New device probe requests keeps coming in before existing device
      probe requests complete.

The phenomenon syzbot is reporting is (b). A process which is holding
system_transition_mutex and misc_mtx is waiting for probe_count to become
0 inside wait_for_device_probe(), but the probe function which is called
 from hub_event() work function is waiting for the processes which are
blocked at mutex_lock(&misc_mtx) to respond via /dev/raw-gadget interface.

This patch mitigates (b) by deferring wait_for_device_probe() from
snapshot_open() to snapshot_write() and snapshot_ioctl(). Please note that
the possibility of (b) remains as long as any thread which is emulating a
USB device via /dev/raw-gadget interface can be blocked by uninterruptible
blocking operations (e.g. mutex_lock()).

Please also note that (a) and (c) are not addressed. Regarding (c), we
should change the code to wait for only one device which contains the
image for resuming from hibernation. I don't know how to address (a), for
use of timeout for wait_for_device_probe() might result in loss of user
data in the image. Maybe we should require the userland to wait for the
image device before opening /dev/snapshot interface.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/003a456ae6f70bb97e436e02fc5105be577c1570; https://git.kernel.org/stable/c/2f0e18e0db42f4f8bc87d3d[PII_REDACTED]5ceeff8; https://git.kernel.org/stable/c/3c48d3067eaf878642276f053575a5c642600a50
CVE: CVE-2022-50203
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

ARM: OMAP2+: display: Fix refcount leak bug

In omapdss_init_fbdev(), of_find_node_by_name() will return a node
pointer with refcount incremented. We should use of_node_put() when
it is not used anymore.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/0b4f96b47ff8dc2fa35d03c[PII_REDACTED]796d9af; https://git.kernel.org/stable/c/2629d171f3d[PII_REDACTED]d8d10d14ac6da37a7be; https://git.kernel.org/stable/c/3e505298a75f0bbdc96e923e76e5d45d6c8f64a7
CVE: CVE-2022-50204
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

ARM: OMAP2+: pdata-quirks: Fix refcount leak bug

In pdata_quirks_init_clocks(), the loop contains
of_find_node_by_name() but without corresponding of_node_put().
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/37f0c89778576ce3d52f40c1e9e727fbddedb28e; https://git.kernel.org/stable/c/5cdbab96bab314c6f2f5e4e8b8a019181328bf5f; https://git.kernel.org/stable/c/75f23d72b6e0a34c8a0e8d275b69ba1e6dd0f15f
CVE: CVE-2022-50205
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

ext2: Add more validity checks for inode counts

Add checks verifying number of inodes stored in the superblock matches
the number computed from number of inodes per group. Also verify we have
at least one block worth of inodes per group. This prevents crashes on
corrupted filesystems.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/07303a9abe3a997d9864fb4315e34b5acfe8fc25; https://git.kernel.org/stable/c/0bcdc31094a12b4baf59e241feabc9787cf635fa; https://git.kernel.org/stable/c/5e63c5fe9123fa76ffaeff26c211308736ec3a07
CVE: CVE-2022-50206
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

arm64: fix oops in concurrently setting insn_emulation sysctls

emulation_proc_handler() changes table->data for proc_dointvec_minmax
and can generate the following Oops if called concurrently with itself:

 | Unable to handle kernel NULL pointer dereference at virtual address [PII_REDACTED]
 | Internal error: Oops: 96000006 [#1] SMP
 | Call trace:
 | update_insn_emulation_mode+0xc0/0x148
 | emulation_proc_handler+0x64/0xb8
 | proc_sys_call_handler+0x9c/0xf8
 | proc_sys_write+0x18/0x20
 | __vfs_write+0x20/0x48
 | vfs_write+0xe4/0x1d0
 | ksys_write+0x70/0xf8
 | __arm64_sys_write+0x20/0x28
 | el0_svc_common.constprop.0+0x7c/0x1c0
 | el0_svc_handler+0x2c/0xa0
 | el0_svc+0x8/0x200

To fix this issue, keep the table->data as &insn->current_mode and
use container_of() to retrieve the insn pointer. Another mutex is
used to protect against the current_mode update but not for retrieving
insn_emulation as table->data is no longer changing.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/04549063d[PII_REDACTED]d8c2bfda3d3a8cbf0409f; https://git.kernel.org/stable/c/07022e07017ee5540f5559b0aeb916e8383c1e1a; https://git.kernel.org/stable/c/353b4673d01c512303c45cf2346f630cda73b5c9
CVE: CVE-2022-50207
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

ARM: bcm: Fix refcount leak in bcm_kona_smc_init

of_find_matching_node() returns a node pointer with refcount
incremented, we should use of_node_put() on it when not need anymore.
Add missing of_node_put() to avoid refcount leak.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/02b658bfb26452f2c13e4577a13ab802f89a6642; https://git.kernel.org/stable/c/5afe042c889437de83f38a9d73d145742fb4f65f; https://git.kernel.org/stable/c/62d719d31ec667276d7375b64542b080cf187797
CVE: CVE-2022-50208
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

soc: amlogic: Fix refcount leak in meson-secure-pwrc.c

In meson_secure_pwrc_probe(), there is a refcount leak in one fail
path.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/5509d07a9364b75b28055bf2d89289e4e5269929; https://git.kernel.org/stable/c/80c469e63bfa9a5a8114952bffc6a7d241e7497e; https://git.kernel.org/stable/c/d18529a4c12f66d83daac78045ea54063bd43257
CVE: CVE-2022-50209
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

meson-mx-socinfo: Fix refcount leak in meson_mx_socinfo_init

of_find_matching_node() returns a node pointer with refcount
incremented, we should use of_node_put() on it when not need anymore.
Add missing of_node_put() to avoid refcount leak.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/0c1757480a6a61b8c3164ed371c359edb3928f12; https://git.kernel.org/stable/c/2691b8780f88e1b8b3578a5bc78a0011741bbd74; https://git.kernel.org/stable/c/69a64c77aafcf3c772264a[PII_REDACTED]4e31ad82
CVE: CVE-2022-50210
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

MIPS: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK

When CONFIG_CPUMASK_OFFSTACK and CONFIG_DEBUG_PER_CPU_MAPS is selected,
cpu_max_bits_warn() generates a runtime warning similar as below while
we show /proc/cpuinfo. Fix this by using nr_cpu_ids (the runtime limit)
instead of NR_CPUS to iterate CPUs.

[    3.052463] ------------[ cut here ]------------
[    3.059679] WARNING: CPU: 3 PID: 1 at include/linux/cpumask.h:108 show_cpuinfo+0x5e8/0x5f0
[    3.070072] Modules linked in: efivarfs autofs4
[    3.076257] CPU: 0 PID: 1 Comm: systemd Not tainted 5.19-rc5+ #1052
[    3.084034] Hardware name: Loongson Loongson-3A4000-7A1000-1w-V0.1-CRB/Loongson-LS3A4000-7A1000-1w-EVB-V1.21, BIOS Loongson-UDK2018-V2.0.04082-beta7 04/27
[    3.099465] Stack :[PII_REDACTED]157b08[PII_REDACTED]f18[PII_REDACTED]000cf846c [PII_REDACTED]
[    3.109127]        [PII_REDACTED]157a50 [PII_REDACTED][PII_REDACTED]157a58[PII_REDACTED]ef7430
[    3.118774]        [PII_REDACTED]1578e8 [PII_REDACTED] [PII_REDACTED] ffffffffffffffff
[    3.128412]        [PII_REDACTED]aaaaaa 1ab25f00eec96a37[PII_REDACTED]21de80[PII_REDACTED]01c890
[    3.138056]         [PII_REDACTED] [PII_REDACTED] [PII_REDACTED][PII_REDACTED]aaaaaa
[    3.147711]         ffff8000339dc220 [PII_REDACTED][PII_REDACTED]ab4000 [PII_REDACTED]
[    3.157364]        [PII_REDACTED]01c998 [PII_REDACTED][PII_REDACTED]ef7430 [PII_REDACTED]
[    3.167012]         [PII_REDACTED][PII_REDACTED]00006c [PII_REDACTED] [PII_REDACTED]
[    3.176641]        [PII_REDACTED]d3de08 [PII_REDACTED][PII_REDACTED]2086d8 00007ffff0080286
[    3.186260]        [PII_REDACTED]0000b0 [PII_REDACTED] [PII_REDACTED][PII_REDACTED]071c1c
[    3.195868]         ...
[    3.199917] Call Trace:
[    3.203941] [<[PII_REDACTED]2086d8>] show_stack+0x38/0x14c
[    3.210666] [<[PII_REDACTED]cf846c>] dump_stack_lvl+0x60/0x88
[    3.217625] [<[PII_REDACTED]23d268>] __warn+0xd0/0x100
[    3.223958] [<[PII_REDACTED]cf3c90>] warn_slowpath_fmt+0x7c/0xcc
[    3.231150] [<[PII_REDACTED]>] show_cpuinfo+0x5e8/0x5f0
[    3.238080] [<[PII_REDACTED]4f578c>] seq_read_iter+0x354/0x4b4
[    3.245098] [<[PII_REDACTED]4c2e90>] new_sync_read+0x17c/0x1c4
[    3.252114] [<[PII_REDACTED]4c5174>] vfs_read+0x138/0x1d0
[    3.258694] [<[PII_REDACTED]4c55f8>] ksys_read+0x70/0x100
[    3.265265] [<[PII_REDACTED]cfde9c>] do_syscall+0x7c/0x94
[    3.271820] [<[PII_REDACTED]202fe4>] handle_syscall+0xc4/0x160
[    3.281824] ---[ end trace 8b484262b4b8c24c ]---
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/274e44e2123417e0924c90d4b4531913b5f3aa2e; https://git.kernel.org/stable/c/4cb392956ae392aec4aa06e661a0bb9146b0bace; https://git.kernel.org/stable/c/7d305823e02217b29d41fca67e3cef87fd7bd688
CVE: CVE-2022-50212
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: do not allow CHAIN_ID to refer to another table

When doing lookups for chains on the same batch by using its ID, a chain
from a different table can be used. If a rule is added to a table but
refers to a chain in a different table, it will be linked to the chain in
table2, but would have expressions referring to objects in table1.

Then, when table1 is removed, the rule will not be removed as its linked to
a chain in table2. When expressions in the rule are processed or removed,
that will lead to a use-after-free.

When looking for chains by ID, use the table that was used for the lookup
by name, and only return chains belonging to that same table.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/0f49613a213d918af790c1276f79da741968de11; https://git.kernel.org/stable/c/58e863f64ee3d0879297e5e53b646e4b91e59620; https://git.kernel.org/stable/c/[PII_REDACTED]6903077f91033fa5d2aa26cac399b2