deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-49649
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

xen/netback: avoid entering xenvif_rx_next_skb() with an empty rx queue

xenvif_rx_next_skb() is expecting the rx queue not being empty, but
in case the loop in xenvif_rx_action() is doing multiple iterations,
the availability of another skb in the rx queue is not being checked.

This can lead to crashes:

[40072.537261] BUG: unable to handle kernel NULL pointer dereference at [PII_REDACTED]
[40072.537407] IP: xenvif_rx_skb+0x23/0x590 [xen_netback]
[40072.537534] PGD 0 P4D 0
[40072.537644] Oops: 0000 [#1] SMP NOPTI
[40072.537749] CPU: 0 PID: 12505 Comm: v1-c40247-q2-gu Not tainted 4.12.14-122.121-default #1 SLE12-SP5
[40072.537867] Hardware name: HP ProLiant DL580 Gen9/ProLiant DL580 Gen9, BIOS U17 11/23/2021
[40072.537999] task: ffff880433b38100 task.stack: ffffc90043d40000
[40072.538112] RIP: e030:xenvif_rx_skb+0x23/0x590 [xen_netback]
[40072.538217] RSP: e02b:ffffc90043d43de0 EFLAGS: 00010246
[40072.538319] RAX: [PII_REDACTED] RBX: ffffc90043cd7cd0 RCX:[PII_REDACTED]0000f7
[40072.538430] RDX: [PII_REDACTED] RSI: [PII_REDACTED] RDI: ffffc90043d43df8
[40072.538531] RBP:[PII_REDACTED]00003f R08: 000077ff80000000 R09: [PII_REDACTED]
[40072.538644] R10:[PII_REDACTED]007ff0 R11:[PII_REDACTED]0008f6 R12: ffffc90043ce2708
[40072.538745] R13: [PII_REDACTED] R14: ffffc90043d43ed0 R15: ffff88043ea748c0
[40072.538861] FS: [PII_REDACTED](0000) GS:ffff[PII_REDACTED]00(0000) knlGS:[PII_REDACTED]
[40072.538988] CS: e033 DS: 0000 ES: 0000 CR0: [PII_REDACTED]
[40072.539088] CR2: [PII_REDACTED] CR3:[PII_REDACTED]ac8000 CR4: [PII_REDACTED]
[40072.539211] Call Trace:
[40072.539319] xenvif_rx_action+0x71/0x90 [xen_netback]
[40072.539429] xenvif_kthread_guest_rx+0x14a/0x29c [xen_netback]

Fix that by stopping the loop in case the rx queue becomes empty.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/5a071aefd6414af5a20321ab58a0557b81993687; https://git.kernel.org/stable/c/7425479d20f9e96f7c3ec8e8a93fe0d7478724cb; https://git.kernel.org/stable/c/94e[PII_REDACTED]ab428e68acadf042de723f094b9
CVE: CVE-2022-49650
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

dmaengine: qcom: bam_dma: fix runtime PM underflow

Commit dbad41e7bb5f ("dmaengine: qcom: bam_dma: check if the runtime pm enabled")
caused unbalanced pm_runtime_get/put() calls when the bam is
controlled remotely. This commit reverts it and just enables pm_runtime
in all cases, the clk_* functions already just nop when the clock is NULL.

Also clean up a bit by removing unnecessary bamclk null checks.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-191
References: https://git.kernel.org/stable/c/0ac9c3dd0d6fe293cd5044cfad10bec27d171e4e; https://git.kernel.org/stable/c/2f6ded79068cac8cff41d5d[PII_REDACTED]d98ee12; https://git.kernel.org/stable/c/b702a1077b51fcb39507cc3bd39206f539319a96
CVE: CVE-2022-49651
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

srcu: Tighten cleanup_srcu_struct() GP checks

Currently, cleanup_srcu_struct() checks for a grace period in progress,
but it does not check for a grace period that has not yet started but
which might start at any time.  Such a situation could result in a
use-after-free bug, so this commit adds a check for a grace period that
is needed but not yet started to cleanup_srcu_struct().
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/8ed00760203d8018bee042fbfe8e076579be2c2b; https://git.kernel.org/stable/c/e997dda6502eefbc1032d6b0da7b353c53344b07
CVE: CVE-2022-49652
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

dmaengine: ti: Fix refcount leak in ti_dra7_xbar_route_allocate

of_parse_phandle() returns a node pointer with refcount
incremented, we should use of_node_put() on it when not needed anymore.

Add missing of_node_put() in to fix this.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/37147e22cd8dfc0412495cb[PII_REDACTED]57a4486; https://git.kernel.org/stable/c/3bd[PII_REDACTED]1807c1cebacee07d60ded1b1402; https://git.kernel.org/stable/c/452b9dfd7aca96befce22634fadb111737f22bbe
CVE: CVE-2022-49653
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

i2c: piix4: Fix a memory leak in the EFCH MMIO support

The recently added support for EFCH MMIO regions introduced a memory
leak in that code path. The leak is caused by the fact that
release_resource() merely removes the resource from the tree but does
not free its memory. We need to call release_mem_region() instead,
which does free the memory. As a nice side effect, this brings back
some symmetry between the legacy and MMIO paths.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://git.kernel.org/stable/c/8ad59b397f86a4d8014966fdc0552095a0c4fb2b; https://git.kernel.org/stable/c/a3263e4cf8265f0c9eb0ed8a9b50f132c7a42e19; https://git.kernel.org/stable/c/d2bf1a6480e8d44658a8ac3bdcec[PII_REDACTED]12
CVE: CVE-2022-49654
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

net: dsa: qca8k: reset cpu port on MTU change

It was discovered that the Documentation lacks of a fundamental detail
on how to correctly change the MAX_FRAME_SIZE of the switch.

In fact if the MAX_FRAME_SIZE is changed while the cpu port is on, the
switch panics and cease to send any packet. This cause the mgmt ethernet
system to not receive any packet (the slow fallback still works) and
makes the device not reachable. To recover from this a switch reset is
required.

To correctly handle this, turn off the cpu ports before changing the
MAX_FRAME_SIZE and turn on again after the value is applied.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/188c798f3c2554fa0d7147e9b97baf144b817019; https://git.kernel.org/stable/c/1993f5a06736ada59dd54b50dc96755a38796ee5; https://git.kernel.org/stable/c/386228c694bf1e7a7688e44412cb33500b0ac585
CVE: CVE-2022-49655
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

fscache: Fix invalidation/lookup race

If an NFS file is opened for writing and closed, fscache_invalidate() will
be asked to invalidate the file - however, if the cookie is in the
LOOKING_UP state (or the CREATING state), then request to invalidate
doesn't get recorded for fscache_cookie_state_machine() to do something
with.

Fix this by making __fscache_invalidate() set a flag if it sees the cookie
is in the LOOKING_UP state to indicate that we need to go to invalidation.
Note that this requires a count on the n_accesses counter for the state
machine, which that will release when it's done.

fscache_cookie_state_machine() then shifts to the INVALIDATING state if it
sees the flag.

Without this, an nfs file can get corrupted if it gets modified locally and
then read locally as the cache contents may not get updated.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362
References: https://git.kernel.org/stable/c/85e4ea1049c70fb99de5c6057e835d151fb647da; https://git.kernel.org/stable/c/b1ae9f617f8a5c848d9205b8e228c6f0d1af754b
CVE: CVE-2022-49656
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

ARM: meson: Fix refcount leak in meson_smp_prepare_cpus

of_find_compatible_node() returns a node pointer with refcount
incremented, we should use of_node_put() on it when done.
Add missing of_node_put() to avoid refcount leak.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/2e1bcd33478ef44e63a[PII_REDACTED]0b5fe4118ad; https://git.kernel.org/stable/c/34d2cd3fccced12b958b8848e3eff0ee4296764c; https://git.kernel.org/stable/c/3cf8ece9113242c10f83c7675ea4f4f67959ee43
CVE: CVE-2022-49657
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

usbnet: fix memory leak in error case

usbnet_write_cmd_async() mixed up which buffers
need to be freed in which error case.

v2: add Fixes tag
v3: fix uninitialized buf pointer
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://git.kernel.org/stable/c/0085da9df3dced730027923a6b48f58e9016af91; https://git.kernel.org/stable/c/04894ab34faf40ab72a8a5ab5b404bb0606bbbff; https://git.kernel.org/stable/c/3eed421ca5c809da93456f69203d164d5220be3d
CVE: CVE-2022-49659
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

can: m_can: m_can_{read_fifo,echo_tx_event}(): shift timestamp to full 32 bits

In commit 1be37d3b0414 ("can: m_can: fix periph RX path: use
rx-offload to ensure skbs are sent from softirq context") the RX path
for peripheral devices was switched to RX-offload.

Received CAN frames are pushed to RX-offload together with a
timestamp. RX-offload is designed to handle overflows of the timestamp
correctly, if 32 bit timestamps are provided.

The timestamps of m_can core are only 16 bits wide. So this patch
shifts them to full 32 bit before passing them to RX-offload.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/2a2914a5bd7f38efe55a[PII_REDACTED]de82e0bce9; https://git.kernel.org/stable/c/4c3333693f07313f5f0145a922f14a7d3c0f4f21; https://git.kernel.org/stable/c/c7333f79888497bfd75dcd02a94eaf836dd1042c
CVE: CVE-2022-49660
Published: 2025-02-26
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2022-49661
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

can: gs_usb: gs_usb_open/close(): fix memory leak

The gs_usb driver appears to suffer from a malady common to many USB
CAN adapter drivers in that it performs usb_alloc_coherent() to
allocate a number of USB request blocks (URBs) for RX, and then later
relies on usb_kill_anchored_urbs() to free them, but this doesn't
actually free them. As a result, this may be leaking DMA memory that's
been used by the driver.

This commit is an adaptation of the techniques found in the esd_usb2
driver where a similar design pattern led to a memory leak. It
explicitly frees the RX URBs and their DMA memory via a call to
usb_free_coherent(). Since the RX URBs were allocated in the
gs_can_open(), we remove them in gs_can_close() rather than in the
disconnect function as was done in esd_usb2.

For more information, see the 928150fad41b ("can: esd_usb2: fix memory
leak").
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/0e60230bc64355c80abe993d1719fdb318094e20; https://git.kernel.org/stable/c/2bda24ef95c0311ab93bda00db40486acf30bd0a; https://git.kernel.org/stable/c/339fa9f80d3b94177a7a459c6d115d3b56007d5a
CVE: CVE-2022-49662
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

ipv6: fix lockdep splat in in6_dump_addrs()

As reported by syzbot, we should not use rcu_dereference()
when rcu_read_lock() is not held.

WARNING: suspicious RCU usage
5.19.0-rc2-syzkaller #0 Not tainted

net/ipv6/addrconf.c:5175 suspicious rcu_dereference_check() usage!

other info that might help us debug this:

rcu_scheduler_active = 2, debug_locks = 1
1 lock held by syz-executor326/3617:
 #0: ffffffff8d5848e8 (rtnl_mutex){+.+.}-{3:3}, at: netlink_dump+0xae/0xc20 net/netlink/af_netlink.c:2223

stack backtrace:
CPU: 0 PID: 3617 Comm: syz-executor326 Not tainted 5.19.0-rc2-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
 in6_dump_addrs+0x12d1/0x1790 net/ipv6/addrconf.c:5175
 inet6_dump_addr+0x9c1/0xb50 net/ipv6/addrconf.c:5300
 netlink_dump+0x541/0xc20 net/netlink/af_netlink.c:2275
 __netlink_dump_start+0x647/0x900 net/netlink/af_netlink.c:2380
 netlink_dump_start include/linux/netlink.h:245 [inline]
 rtnetlink_rcv_msg+0x73e/0xc90 net/core/rtnetlink.c:6046
 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2501
 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
 netlink_unicast+0x543/0x7f0 net/netlink/af_netlink.c:1345
 netlink_sendmsg+0x917/0xe10 net/netlink/af_netlink.c:1921
 sock_sendmsg_nosec net/socket.c:714 [inline]
 sock_sendmsg+0xcf/0x120 net/socket.c:734
 ____sys_sendmsg+0x6eb/0x810 net/socket.c:2492
 ___sys_sendmsg+0xf3/0x170 net/socket.c:2546
 __sys_sendmsg net/socket.c:2575 [inline]
 __do_sys_sendmsg net/socket.c:2584 [inline]
 __se_sys_sendmsg net/socket.c:2582 [inline]
 __x64_sys_sendmsg+0x132/0x220 net/socket.c:2582
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x46/0xb0
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/2930ee1a166df0e12fe9fec4b79cc3dc9634ae45; https://git.kernel.org/stable/c/4e43e64d0f1332fcc503babad4dc31aead7131ca; https://git.kernel.org/stable/c/b39fda51c32dd879451e0119881f31493bf83283
CVE: CVE-2022-49664
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

tipc: move bc link creation back to tipc_node_create

Shuang Li reported a NULL pointer dereference crash:

  [] BUG: kernel NULL pointer dereference, address: [PII_REDACTED]
  [] RIP: 0010:tipc_link_is_up+0x5/0x10 [tipc]
  [] Call Trace:
  []  <IRQ>
  []  tipc_bcast_rcv+0xa2/0x190 [tipc]
  []  tipc_node_bc_rcv+0x8b/0x200 [tipc]
  []  tipc_rcv+0x3af/0x5b0 [tipc]
  []  tipc_udp_recv+0xc7/0x1e0 [tipc]

It was caused by the 'l' passed into tipc_bcast_rcv() is NULL. When it
creates a node in tipc_node_check_dest(), after inserting the new node
into hashtable in tipc_node_create(), it creates the bc link. However,
there is a gap between this insert and bc link creation, a bc packet
may come in and get the node from the hashtable then try to dereference
its bc link, which is NULL.

This patch is to fix it by moving the bc link creation before inserting
into the hashtable.

Note that for a preliminary node becoming "real", the bc link creation
should also be called before it's rehashed, as we don't create it for
preliminary nodes.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/35fcb2ba35b4d9b592b558c3bcc6e0d90e213588; https://git.kernel.org/stable/c/456bc338871c4a52117dd5ef29cce3745456d248; https://git.kernel.org/stable/c/cb8092d70a6f5f01ec1490fce4d35efed3ed996c
CVE: CVE-2022-49665
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

platform/x86: thinkpad_acpi: Fix a memory leak of EFCH MMIO resource

Unlike release_mem_region(), a call to release_resource() does not
free the resource, so it has to be freed explicitly to avoid a memory
leak.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/3884bf75fa044c73e843d95dd71a424e80ebb095; https://git.kernel.org/stable/c/d2f33f0c3ad7b0d5262d9b986f1353265fad7a08
CVE: CVE-2022-49666
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

powerpc/memhotplug: Add add_pages override for PPC

With commit ffa0b64e3be5 ("powerpc: Fix virt_addr_valid() for 64-bit Book3E & 32-bit")
the kernel now validate the addr against high_memory value. This results
in the below BUG_ON with dax pfns.

[  635.798741][T26531] kernel BUG at mm/page_alloc.c:5521!
1:mon> e
cpu 0x1: Vector: 700 (Program Check) at [c[PII_REDACTED]87630]
    pc: c[PII_REDACTED]5ed48: free_pages.part.0+0x48/0x110
    lr: c[PII_REDACTED]3ca70: tlb_finish_mmu+0x80/0xd0
    sp: c[PII_REDACTED]878d0
   msr:[PII_REDACTED]82b033
  current = 0xc00000000afabe00
  paca    = 0xc00000037ffff300   irqmask: 0x03   irq_happened: 0x05
    pid   = 26531, comm = 50-landscape-sy
kernel BUG at :5521!
Linux version 5.19.0-rc3-14659-g4ec05be7c2e1 (kvaneesh@ltc-boston8) (gcc (Ubuntu 9.4.0-1ubuntu1~20.04.1) 9.4.0, GNU ld (GNU Binutils for Ubuntu) 2.34) #625 SMP Thu Jun 23 00:35:43 CDT 2022
1:mon> t
[link register   ] c[PII_REDACTED]3ca70 tlb_finish_mmu+0x80/0xd0
[c[PII_REDACTED]878d0] c[PII_REDACTED]3ca54 tlb_finish_mmu+0x64/0xd0 (unreliable)
[c[PII_REDACTED]87900] c[PII_REDACTED]39424 exit_mmap+0xe4/0x2a0
[c[PII_REDACTED]879e0] c[PII_REDACTED]9fc1c mmput+0xcc/0x210
[c[PII_REDACTED]87a20] c[PII_REDACTED]29230 begin_new_exec+0x5e0/0xf40
[c[PII_REDACTED]87ae0] c[PII_REDACTED]0b3cc load_elf_binary+0x3ac/0x1e00
[c[PII_REDACTED]87c10] c[PII_REDACTED]27af0 bprm_execve+0x3b0/0xaf0
[c[PII_REDACTED]87cd0] c[PII_REDACTED]28414 do_execveat_common.isra.0+0x1e4/0x310
[c[PII_REDACTED]87d80] c[PII_REDACTED]2858c sys_execve+0x4c/0x60
[c[PII_REDACTED]87db0] c[PII_REDACTED]2c1b0 system_call_exception+0x160/0x2c0
[c[PII_REDACTED]87e10] c[PII_REDACTED]0c53c system_call_common+0xec/0x250

The fix is to make sure we update high_memory on memory hotplug.
This is similar to what x86 does in commit 3072e413e305 ("mm/memory_hotplug: introduce add_pages")
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/84d146fd35a01b08e9515041de60f0f915a417d5; https://git.kernel.org/stable/c/89296ac435e2cf8a5101f7fab8f0c7b754b92052; https://git.kernel.org/stable/c/ac790d09885d36143076e7e02825c541e8eee899
CVE: CVE-2022-49667
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

net: bonding: fix use-after-free after 802.3ad slave unbind

commit 0622cab0341c ("bonding: fix 802.3ad aggregator reselection"),
resolve case, when there is several aggregation groups in the same bond.
bond_3ad_unbind_slave will invalidate (clear) aggregator when
__agg_active_ports return zero. So, ad_clear_agg can be executed even, when
num_of_ports!=0. Than bond_3ad_unbind_slave can be executed again for,
previously cleared aggregator. NOTE: at this time bond_3ad_unbind_slave
will not update slave ports list, because lag_ports==NULL. So, here we
got slave ports, pointing to freed aggregator memory.

Fix with checking actual number of ports in group (as was before
commit 0622cab0341c ("bonding: fix 802.3ad aggregator reselection") ),
before ad_clear_agg().

The KASAN logs are as follows:

[  767.617392] ==================================================================
[  767.630776] BUG: KASAN: use-after-free in bond_3ad_state_machine_handler+0x13dc/0x1470
[  767.638764] Read of size 2 at addr ffff00011ba9d430 by task kworker/u8:7/767
[  767.647361] CPU: 3 PID: 767 Comm: kworker/u8:7 Tainted: G           O 5.15.11 #15
[  767.655329] Hardware name: DNI AmazonGo1 A7040 board (DT)
[  767.660760] Workqueue: lacp_1 bond_3ad_state_machine_handler
[  767.666468] Call trace:
[  767.668930]  dump_backtrace+0x0/0x2d0
[  767.672625]  show_stack+0x24/0x30
[  767.675965]  dump_stack_lvl+0x68/0x84
[  767.679659]  print_address_description.constprop.0+0x74/0x2b8
[  767.685451]  kasan_report+0x1f0/0x260
[  767.689148]  __asan_load2+0x94/0xd0
[  767.692667]  bond_3ad_state_machine_handler+0x13dc/0x1470
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/050133e1aa2cb49bb17be847d48a4431598ef562; https://git.kernel.org/stable/c/2765749def4765c5052a4c66445cf4c96fcccdbc; https://git.kernel.org/stable/c/63b2fe509f69b90168a75e04e14573dccf7984e6
CVE: CVE-2022-49668
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

PM / devfreq: exynos-ppmu: Fix refcount leak in of_get_devfreq_events

of_get_child_by_name() returns a node pointer with refcount
incremented, we should use of_node_put() on it when done.
This function only calls of_node_put() in normal path,
missing it in error paths.
Add missing of_node_put() to avoid refcount leak.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/01121e39ef537289926ae6f5374dce92c796d863; https://git.kernel.org/stable/c/194781229d4cbc804b8ded13156eb8addce87d6c; https://git.kernel.org/stable/c/bdecd912e99acfd61507f1720d3f4eed1b3418d8
CVE: CVE-2022-49669
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

mptcp: fix race on unaccepted mptcp sockets

When the listener socket owning the relevant request is closed,
it frees the unaccepted subflows and that causes later deletion
of the paired MPTCP sockets.

The mptcp socket's worker can run in the time interval between such delete
operations. When that happens, any access to msk->first will cause an UaF
access, as the subflow cleanup did not cleared such field in the mptcp
socket.

Address the issue explicitly traversing the listener socket accept
queue at close time and performing the needed cleanup on the pending
msk.

Note that the locking is a bit tricky, as we need to acquire the msk
socket lock, while still owning the subflow socket one.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/6aeed9045071f2252ff4e98fc13d1e304f33e5b0; https://git.kernel.org/stable/c/a8a3e95c74e48c2c9b07b81fafda9122993f2e12
CVE: CVE-2022-49670
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

linux/dim: Fix divide by 0 in RDMA DIM

Fix a divide 0 error in rdma_dim_stats_compare() when prev->cpe_ratio ==
0.

CallTrace:
  Hardware name: H3C R4900 G3/RS33M2C9S, BIOS 2.00.37P21 03/12/2020
  task: ffff880194b78000 task.stack: ffffc[PII_REDACTED]0
  RIP: 0010:backport_rdma_dim+0x10e/0x240 [mlx_compat]
  RSP: 0018:ffff880c10e83ec0 EFLAGS: 00010202
  RAX: [PII_REDACTED] RBX: ffff88096cd7f780 RCX: [PII_REDACTED]
  RDX: [PII_REDACTED] RSI: [PII_REDACTED] RDI: [PII_REDACTED]
  RBP: [PII_REDACTED] R08: [PII_REDACTED] R09: [PII_REDACTED]
  R10: [PII_REDACTED] R11: [PII_REDACTED] R12: 000000001d7c6c09
  R13: ffff88096cd7f780 R14: ffff880b174fe800 R15: [PII_REDACTED]
  FS:  [PII_REDACTED](0000) GS:ffff880c10e80000(0000)
  knlGS:[PII_REDACTED]
  CS:  0010 DS: 0000 ES: 0000 CR0: [PII_REDACTED]
  CR2: 00000000a0965b00 CR3:[PII_REDACTED]00a003 CR4:[PII_REDACTED]7606e0
  DR0: [PII_REDACTED] DR1: [PII_REDACTED] DR2: [PII_REDACTED]
  DR3: [PII_REDACTED] DR6: 00000000fffe0ff0 DR7: [PII_REDACTED]
  PKRU: 55555554
  Call Trace:
   <IRQ>
   ib_poll_handler+0x43/0x80 [ib_core]
   irq_poll_softirq+0xae/0x110
   __do_softirq+0xd1/0x28c
   irq_exit+0xde/0xf0
   do_IRQ+0x54/0xe0
   common_interrupt+0x8f/0x8f
   </IRQ>
   ? cpuidle_enter_state+0xd9/0x2a0
   ? cpuidle_enter_state+0xc7/0x2a0
   ? do_idle+0x170/0x1d0
   ? cpu_startup_entry+0x6f/0x80
   ? start_secondary+0x1b9/0x210
   ? secondary_startup_64+0xa5/0xb0
  Code: 0f 87 e1 00 00 00 8b 4c 24 14 44 8b 43 14 89 c8 4d 63 c8 44 29 c0 99 31 d0 29 d0 31 d2 48 98 48 8d 04 80 48 8d 04 80 48 c1 e0 02 <49> f7 f1 48 83 f8 0a 0f 86 c1 00 00 00 44 39 c1 7f 10 48 89 df
  RIP: backport_rdma_dim+0x10e/0x240 [mlx_compat] RSP: ffff880c10e83ec0
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-369, CWE-369
References: https://git.kernel.org/stable/c/0b6e0eb5c45e79e9095de2498cc0ca5ec563fc5e; https://git.kernel.org/stable/c/0fe3dbbefb74a8575f61d7801b08dbc50523d60d; https://git.kernel.org/stable/c/5af106f8e072aebd88b95e164a08fa320651a99a
CVE: CVE-2022-49671
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

RDMA/cm: Fix memory leak in ib_cm_insert_listen

cm_alloc_id_priv() allocates resource for the cm_id_priv. When
cm_init_listen() fails it doesn't free it, leading to memory leak.

Add the missing error unwind.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://git.kernel.org/stable/c/2990f223ffa7bb25422956b9f79f9176a5b38346; https://git.kernel.org/stable/c/2febf09a8a8ae4accf908f043f1bab[PII_REDACTED]; https://git.kernel.org/stable/c/889000874c1204e47c7f2a4945db262a47e7efc9
CVE: CVE-2022-49672
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

net: tun: unlink NAPI from device on destruction

Syzbot found a race between tun file and device destruction.
NAPIs live in struct tun_file which can get destroyed before
the netdev so we have to del them explicitly. The current
code is missing deleting the NAPI if the queue was detached
first.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/3b9bc84d311104906d2b4995a9a02d7b7ddab2db; https://git.kernel.org/stable/c/8145f77d38de4f88b8a69e1463f5c09ba189d77c; https://git.kernel.org/stable/c/82e729aee59acefe135fceffadcbc5b86dd4f1b9