deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-50296
Published: 2025-09-15
Description: In the Linux kernel, the following vulnerability has been resolved:

UM: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK

When CONFIG_CPUMASK_OFFSTACK and CONFIG_DEBUG_PER_CPU_MAPS is selected,
cpu_max_bits_warn() generates a runtime warning similar as below while
we show /proc/cpuinfo. Fix this by using nr_cpu_ids (the runtime limit)
instead of NR_CPUS to iterate CPUs.

[    3.052463] ------------[ cut here ]------------
[    3.059679] WARNING: CPU: 3 PID: 1 at include/linux/cpumask.h:108 show_cpuinfo+0x5e8/0x5f0
[    3.070072] Modules linked in: efivarfs autofs4
[    3.076257] CPU: 0 PID: 1 Comm: systemd Not tainted 5.19-rc5+ #1052
[    3.099465] Stack :[PII_REDACTED]157b08[PII_REDACTED]f18[PII_REDACTED]000cf846c [PII_REDACTED]
[    3.109127]        [PII_REDACTED]157a50 [PII_REDACTED][PII_REDACTED]157a58[PII_REDACTED]ef7430
[    3.118774]        [PII_REDACTED]1578e8 [PII_REDACTED] [PII_REDACTED] ffffffffffffffff
[    3.128412]        [PII_REDACTED]aaaaaa 1ab25f00eec96a37[PII_REDACTED]21de80[PII_REDACTED]01c890
[    3.138056]         [PII_REDACTED] [PII_REDACTED] [PII_REDACTED][PII_REDACTED]aaaaaa
[    3.147711]         ffff8000339dc220 [PII_REDACTED][PII_REDACTED]ab4000 [PII_REDACTED]
[    3.157364]        [PII_REDACTED]01c998 [PII_REDACTED][PII_REDACTED]ef7430 [PII_REDACTED]
[    3.167012]         [PII_REDACTED][PII_REDACTED]00006c [PII_REDACTED] [PII_REDACTED]
[    3.176641]        [PII_REDACTED]d3de08 [PII_REDACTED][PII_REDACTED]2086d8 00007ffff0080286
[    3.186260]        [PII_REDACTED]0000b0 [PII_REDACTED] [PII_REDACTED][PII_REDACTED]071c1c
[    3.195868]         ...
[    3.199917] Call Trace:
[    3.203941] [<[PII_REDACTED]2086d8>] show_stack+0x38/0x14c
[    3.210666] [<[PII_REDACTED]cf846c>] dump_stack_lvl+0x60/0x88
[    3.217625] [<[PII_REDACTED]23d268>] __warn+0xd0/0x100
[    3.223958] [<[PII_REDACTED]cf3c90>] warn_slowpath_fmt+0x7c/0xcc
[    3.231150] [<[PII_REDACTED]>] show_cpuinfo+0x5e8/0x5f0
[    3.238080] [<[PII_REDACTED]4f578c>] seq_read_iter+0x354/0x4b4
[    3.245098] [<[PII_REDACTED]4c2e90>] new_sync_read+0x17c/0x1c4
[    3.252114] [<[PII_REDACTED]4c5174>] vfs_read+0x138/0x1d0
[    3.258694] [<[PII_REDACTED]4c55f8>] ksys_read+0x70/0x100
[    3.265265] [<[PII_REDACTED]cfde9c>] do_syscall+0x7c/0x94
[    3.271820] [<[PII_REDACTED]202fe4>] handle_syscall+0xc4/0x160
[    3.281824] ---[ end trace 8b484262b4b8c24c ]---
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/16c546e148fa6d14a019431436a6f7b4087dbccd; https://git.kernel.org/stable/c/2e3863cc02c156b51b50592d43ffa6a13b680b0d; https://git.kernel.org/stable/c/5177bdc38eaa1c1ca6302214ab06913540cd00a2
CVE: CVE-2022-50297
Published: 2025-09-15
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: ath9k: verify the expected usb_endpoints are present

The bug arises when a USB device claims to be an ATH9K but doesn't
have the expected endpoints. (In this case there was an interrupt
endpoint where the driver expected a bulk endpoint.) The kernel
needs to be able to handle such devices without getting an internal error.

usb 1-1: BOGUS urb xfer, pipe 3 != type 1
WARNING: CPU: 3 PID: 500 at drivers/usb/core/urb.c:493 usb_submit_urb+0xce2/0x1430 drivers/usb/core/urb.c:493
Modules linked in:
CPU: 3 PID: 500 Comm: kworker/3:2 Not tainted 5.10.135-syzkaller #0
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
Workqueue: events request_firmware_work_func
RIP: 0010:usb_submit_urb+0xce2/0x1430 drivers/usb/core/urb.c:493
Call Trace:
 ath9k_hif_usb_alloc_rx_urbs drivers/net/wireless/ath/ath9k/hif_usb.c:908 [inline]
 ath9k_hif_usb_alloc_urbs+0x75e/0x1010 drivers/net/wireless/ath/ath9k/hif_usb.c:1019
 ath9k_hif_usb_dev_init drivers/net/wireless/ath/ath9k/hif_usb.c:1109 [inline]
 ath9k_hif_usb_firmware_cb+0x142/0x530 drivers/net/wireless/ath/ath9k/hif_usb.c:1242
 request_firmware_work_func+0x12e/0x240 drivers/base/firmware_loader/main.c:1097
 process_one_work+0x9af/0x1600 kernel/workqueue.c:2279
 worker_thread+0x61d/0x12f0 kernel/workqueue.c:2425
 kthread+0x3b4/0x4a0 kernel/kthread.c:313
 ret_from_fork+0x22/0x30 arch/x86/entry/entry_64.S:299

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/0b7e6d681e00a96cde2b32a15ffa70e1be2e3209; https://git.kernel.org/stable/c/16ef02bad239f11f322df8425d302be62f0443ce; https://git.kernel.org/stable/c/1824ccabee5445347b83642e4087cc2eca070343
CVE: CVE-2022-50298
Published: 2025-09-15
Description: In the Linux kernel, the following vulnerability has been resolved:

slimbus: qcom-ngd: cleanup in probe error path

Add proper error path in probe() to cleanup resources previously
acquired/allocated to fix warnings visible during probe deferral:

  notifier callback qcom_slim_ngd_ssr_notify already registered
  WARNING: CPU: 6 PID: 70 at kernel/notifier.c:28 notifier_chain_register+0x5c/0x90
  Modules linked in:
  CPU: 6 PID: 70 Comm: kworker/u16:1 Not tainted 6.0.0-rc3-next-20220830 #380
  Call trace:
   notifier_chain_register+0x5c/0x90
   srcu_notifier_chain_register+0x44/0x90
   qcom_register_ssr_notifier+0x38/0x4c
   qcom_slim_ngd_ctrl_probe+0xd8/0x400
   platform_probe+0x6c/0xe0
   really_probe+0xbc/0x2d4
   __driver_probe_device+0x78/0xe0
   driver_probe_device+0x3c/0x12c
   __device_attach_driver+0xb8/0x120
   bus_for_each_drv+0x78/0xd0
   __device_attach+0xa8/0x1c0
   device_initial_probe+0x18/0x24
   bus_probe_device+0xa0/0xac
   deferred_probe_work_func+0x88/0xc0
   process_one_work+0x1d4/0x320
   worker_thread+0x2cc/0x44c
   kthread+0x110/0x114
   ret_from_fork+0x10/0x20
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/0c76110a3129c8d56d8fb7b6270dcc0c5c2f1a41; https://git.kernel.org/stable/c/16f14551d0df9e7cd283545d7d748829594d912f; https://git.kernel.org/stable/c/1d567179f27788925dc90fe5e905cdabfce7d190
CVE: CVE-2022-50299
Published: 2025-09-15
Description: In the Linux kernel, the following vulnerability has been resolved:

md: Replace snprintf with scnprintf

Current code produces a warning as shown below when total characters
in the constituent block device names plus the slashes exceeds 200.
snprintf() returns the number of characters generated from the given
input, which could cause the expression “200 – len” to wrap around
to a large positive number. Fix this by using scnprintf() instead,
which returns the actual number of characters written into the buffer.

[ 1513.267938] ------------[ cut here ]------------
[ 1513.267943] WARNING: CPU: 15 PID: 37247 at <snip>/lib/vsprintf.c:2509 vsnprintf+0x2c8/0x510
[ 1513.267944] Modules linked in:  <snip>
[ 1513.267969] CPU: 15 PID: 37247 Comm: mdadm Not tainted 5.4.0-1085-azure #90~18.04.1-Ubuntu
[ 1513.267969] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 05/09/2022
[ 1513.267971] RIP: 0010:vsnprintf+0x2c8/0x510
<-snip->
[ 1513.267982] Call Trace:
[ 1513.267986]  snprintf+0x45/0x70
[ 1513.267990]  ? disk_name+0x71/0xa0
[ 1513.267993]  dump_zones+0x114/0x240 [raid0]
[ 1513.267996]  ? _cond_resched+0x19/0x40
[ 1513.267998]  raid0_run+0x19e/0x270 [raid0]
[ 1513.268000]  md_run+0x5e0/0xc50
[ 1513.268003]  ? security_capable+0x3f/0x60
[ 1513.268005]  do_md_run+0x19/0x110
[ 1513.268006]  md_ioctl+0x195e/0x1f90
[ 1513.268007]  blkdev_ioctl+0x91f/0x9f0
[ 1513.268010]  block_ioctl+0x3d/0x50
[ 1513.268012]  do_vfs_ioctl+0xa9/0x640
[ 1513.268014]  ? __fput+0x162/0x260
[ 1513.268016]  ksys_ioctl+0x75/0x80
[ 1513.268017]  __x64_sys_ioctl+0x1a/0x20
[ 1513.268019]  do_syscall_64+0x5e/0x200
[ 1513.268021]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/1727fd5015d8f93474148f94e34cda5aa6ad4a43; https://git.kernel.org/stable/c/3b0a2bd51f60418ecd67493586a2bb2174199de3; https://git.kernel.org/stable/c/41ca95033a0c47cd6dace1f0a36a6eb5ebe799e6
CVE: CVE-2022-50300
Published: 2025-09-15
Description: In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix extent map use-after-free when handling missing device in read_one_chunk

Store the error code before freeing the extent_map. Though it's
reference counted structure, in that function it's the first and last
allocation so this would lead to a potential use-after-free.

The error can happen eg. when chunk is stored on a missing device and
the degraded mount option is missing.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=216721
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/169a4cf46882974d4db6d85eb623ec898e51bbc0; https://git.kernel.org/stable/c/1742e1c90c3da344f3bb9b1f1309b3f47482756a; https://git.kernel.org/stable/c/b8e7ed42bc3ca0d0e4191ee394d34962d3624c22
CVE: CVE-2022-50301
Published: 2025-09-15
Description: In the Linux kernel, the following vulnerability has been resolved:

iommu/omap: Fix buffer overflow in debugfs

There are two issues here:

1) The "len" variable needs to be checked before the very first write.
   Otherwise if omap2_iommu_dump_ctx() with "bytes" less than 32 it is a
   buffer overflow.
2) The snprintf() function returns the number of bytes that *would* have
   been copied if there were enough space.  But we want to know the
   number of bytes which were *actually* copied so use scnprintf()
   instead.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://git.kernel.org/stable/c/0c7043a5b5c3b35f5dc8875757f71e7f491d64d4; https://git.kernel.org/stable/c/184233a5202786b20220acd2d04ddf909ef18f29; https://git.kernel.org/stable/c/2fee0dbfaeaaa4bda04279ce772c4572b1429d04
CVE: CVE-2022-50302
Published: 2025-09-15
Description: In the Linux kernel, the following vulnerability has been resolved:

lockd: set other missing fields when unlocking files

vfs_lock_file() expects the struct file_lock to be fully initialised by
the caller. Re-exported NFSv3 has been seen to Oops if the fl_file field
is NULL.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/18ebd35b61b4693a0ddc270b6d4f18def232e770; https://git.kernel.org/stable/c/31c93ee5f1e4dc278b562e20f3c3274ac34997f3; https://git.kernel.org/stable/c/688575aef211b0986fc51010116f5888a99d76a2
CVE: CVE-2022-50303
Published: 2025-09-15
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: Fix double release compute pasid

If kfd_process_device_init_vm returns failure after vm is converted to
compute vm and vm->pasid set to compute pasid, KFD will not take
pdd->drm_file reference. As a result, drm close file handler maybe
called to release the compute pasid before KFD process destroy worker to
release the same pasid and set vm->pasid to zero, this generates below
WARNING backtrace and NULL pointer access.

Add helper amdgpu_amdkfd_gpuvm_set_vm_pasid and call it at the last step
of kfd_process_device_init_vm, to ensure vm pasid is the original pasid
if acquiring vm failed or is the compute pasid with pdd->drm_file
reference taken to avoid double release same pasid.

 amdgpu: Failed to create process VM object
 ida_free called for id=32770 which is not allocated.
 WARNING: CPU: 57 PID: 72542 at ../lib/idr.c:522 ida_free+0x96/0x140
 RIP: 0010:ida_free+0x96/0x140
 Call Trace:
  amdgpu_pasid_free_delayed+0xe1/0x2a0 [amdgpu]
  amdgpu_driver_postclose_kms+0x2d8/0x340 [amdgpu]
  drm_file_free.part.13+0x216/0x270 [drm]
  drm_close_helper.isra.14+0x60/0x70 [drm]
  drm_release+0x6e/0xf0 [drm]
  __fput+0xcc/0x280
  ____fput+0xe/0x20
  task_work_run+0x96/0xc0
  do_exit+0x3d0/0xc10

 BUG: kernel NULL pointer dereference, address: [PII_REDACTED]
 RIP: 0010:ida_free+0x76/0x140
 Call Trace:
  amdgpu_pasid_free_delayed+0xe1/0x2a0 [amdgpu]
  amdgpu_driver_postclose_kms+0x2d8/0x340 [amdgpu]
  drm_file_free.part.13+0x216/0x270 [drm]
  drm_close_helper.isra.14+0x60/0x70 [drm]
  drm_release+0x6e/0xf0 [drm]
  __fput+0xcc/0x280
  ____fput+0xe/0x20
  task_work_run+0x96/0xc0
  do_exit+0x3d0/0xc10
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: https://git.kernel.org/stable/c/1a799c4c190ea9f0e81028e3eb3037ed0ab17ff5; https://git.kernel.org/stable/c/89f0d766c9e3fdeafbed6f855d433c2768cde862; https://git.kernel.org/stable/c/a02c07b[PII_REDACTED]84fde06f951530438a3512d
CVE: CVE-2022-50304
Published: 2025-09-15
Description: In the Linux kernel, the following vulnerability has been resolved:

mtd: core: fix possible resource leak in init_mtd()

I got the error report while inject fault in init_mtd():

sysfs: cannot create duplicate filename '/devices/virtual/bdi/mtd-0'
Call Trace:
 <TASK>
 dump_stack_lvl+0x67/0x83
 sysfs_warn_dup+0x60/0x70
 sysfs_create_dir_ns+0x109/0x120
 kobject_add_internal+0xce/0x2f0
 kobject_add+0x98/0x110
 device_add+0x179/0xc00
 device_create_groups_vargs+0xf4/0x100
 device_create+0x7b/0xb0
 bdi_register_va.part.13+0x58/0x2d0
 bdi_register+0x9b/0xb0
 init_mtd+0x62/0x171 [mtd]
 do_one_initcall+0x6c/0x3c0
 do_init_module+0x58/0x222
 load_module+0x268e/0x27d0
 __do_sys_finit_module+0xd5/0x140
 do_syscall_64+0x37/0x90
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
 </TASK>
kobject_add_internal failed for mtd-0 with -EEXIST, don't try to register
	things with the same name in the same directory.
Error registering mtd class or bdi: -17

If init_mtdchar() fails in init_mtd(), mtd_bdi will not be unregistered,
as a result, we can't load the mtd module again, to fix this by calling
bdi_unregister(mtd_bdi) after out_procfs label.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/1aadf01e5076b9ab6bf294b9622335c651314895; https://git.kernel.org/stable/c/26c304a3f136009c5a2a04e2bf3ac6aa25aabcb4; https://git.kernel.org/stable/c/[PII_REDACTED]0cbd8e6836df9f58cc4fbb8b262f1c
CVE: CVE-2022-50305
Published: 2025-09-15
Description: In the Linux kernel, the following vulnerability has been resolved:

ASoC: sof_es8336: fix possible use-after-free in sof_es8336_remove()

sof_es8336_remove() calls cancel_delayed_work(). However, that
function does not wait until the work function finishes. This
means that the callback function may still be running after
the driver's remove function has finished, which would result
in a use-after-free.

Fix by calling cancel_delayed_work_sync(), which ensures that
the work is properly cancelled, no longer running, and unable
to re-schedule itself.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/1b41beaa7a58467505ec3023af8aad74f878b888; https://git.kernel.org/stable/c/390a1a98288a53b2e7555097d83c6e55d579b166; https://git.kernel.org/stable/c/b85102a3aa3810a09eb55692e8cd6ffbb304e57d
CVE: CVE-2022-50306
Published: 2025-09-15
Description: In the Linux kernel, the following vulnerability has been resolved:

ext4: fix potential out of bound read in ext4_fc_replay_scan()

For scan loop must ensure that at least EXT4_FC_TAG_BASE_LEN space. If remain
space less than EXT4_FC_TAG_BASE_LEN which will lead to out of bound read
when mounting corrupt file system image.
ADD_RANGE/HEAD/TAIL is needed to add extra check when do journal scan, as this
three tags will read data during scan, tag length couldn't less than data length
which will read.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://git.kernel.org/stable/c/1b45cc5c7b920fd8bf72e5a888ec7abeadf41e09; https://git.kernel.org/stable/c/6969367c1500c15eddc38fda12f6d15518ad6d03; https://git.kernel.org/stable/c/f234294812c9b68d603650d28743eafb718e7ad5
CVE: CVE-2022-50307
Published: 2025-09-15
Description: In the Linux kernel, the following vulnerability has been resolved:

s390/cio: fix out-of-bounds access on cio_ignore free

The channel-subsystem-driver scans for newly available devices whenever
device-IDs are removed from the cio_ignore list using a command such as:

  echo free >/proc/cio_ignore

Since an I/O device scan might interfer with running I/Os, commit
172da89ed0ea ("s390/cio: avoid excessive path-verification requests")
introduced an optimization to exclude online devices from the scan.

The newly added check for online devices incorrectly assumes that
an I/O-subchannel's drvdata points to a struct io_subchannel_private.
For devices that are bound to a non-default I/O subchannel driver, such
as the vfio_ccw driver, this results in an out-of-bounds read access
during each scan.

Fix this by changing the scan logic to rely on a driver-independent
online indication. For this we can use struct subchannel->config.ena,
which is the driver's requested subchannel-enabled state. Since I/Os
can only be started on enabled subchannels, this matches the intent
of the original optimization of not scanning devices where I/O might
be running.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://git.kernel.org/stable/c/0e501fd0f38e42304bfa0d46a812d93f80294a87; https://git.kernel.org/stable/c/106ab66cf5467726ca5ead51623043d37c06820a; https://git.kernel.org/stable/c/1b[PII_REDACTED]f65ece71b0f299ca5a6a887d2db6
CVE: CVE-2022-50308
Published: 2025-09-15
Description: In the Linux kernel, the following vulnerability has been resolved:

ASoC: qcom: Add checks for devm_kcalloc

As the devm_kcalloc may return NULL, the return value needs to be checked
to avoid NULL poineter dereference.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/1bf5ee979076ceb121ee51c95197d890b1cee7f4; https://git.kernel.org/stable/c/4518d7cc38b7d1a7ce5a7878ca601c91e19fe47d; https://git.kernel.org/stable/c/7830e2289eb4b74970b6cd1b6cc68dcd021c2281
CVE: CVE-2022-50309
Published: 2025-09-15
Description: In the Linux kernel, the following vulnerability has been resolved:

media: xilinx: vipp: Fix refcount leak in xvip_graph_dma_init

of_get_child_by_name() returns a node pointer with refcount
incremented, we should use of_node_put() on it when not need anymore.
Add missing of_node_put() to avoid refcount leak.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/1c78f19c3a0ea312a8178a6bfd8934eb93e9b10a; https://git.kernel.org/stable/c/22b93530bbe6af9dce8e520bb6e978d1bda39d2b; https://git.kernel.org/stable/c/2630cc88327a5557aa0d9cc63be95e3c6e0a55b3
CVE: CVE-2022-50310
Published: 2025-09-15
Description: In the Linux kernel, the following vulnerability has been resolved:

ip6mr: fix UAF issue in ip6mr_sk_done() when addrconf_init_net() failed

If the initialization fails in calling addrconf_init_net(), devconf_all is
the pointer that has been released. Then ip6mr_sk_done() is called to
release the net, accessing devconf->mc_forwarding directly causes invalid
pointer access.

The process is as follows:
setup_net()
	ops_init()
		addrconf_init_net()
		all = kmemdup(...)           ---> alloc "all"
		...
		net->ipv6.devconf_all = all;
		__addrconf_sysctl_register() ---> failed
		...
		kfree(all);                  ---> ipv6.devconf_all invalid
		...
	ops_exit_list()
		...
		ip6mr_sk_done()
			devconf = net->ipv6.devconf_all;
			//devconf is invalid pointer
			if (!devconf || !atomic_read(&devconf->mc_forwarding))

The following is the Call Trace information:
BUG: KASAN: use-after-free in ip6mr_sk_done+0x112/0x3a0
Read of size 4 at addr ffff888075508e88 by task ip/14554
Call Trace:
<TASK>
dump_stack_lvl+0x8e/0xd1
print_report+0x155/0x454
kasan_report+0xba/0x1f0
kasan_check_range+0x35/0x1b0
ip6mr_sk_done+0x112/0x3a0
rawv6_close+0x48/0x70
inet_release+0x109/0x230
inet6_release+0x4c/0x70
sock_release+0x87/0x1b0
igmp6_net_exit+0x6b/0x170
ops_exit_list+0xb0/0x170
setup_net+0x7ac/0xbd0
copy_net_ns+0x2e6/0x6b0
create_new_namespaces+0x382/0xa50
unshare_nsproxy_namespaces+0xa6/0x1c0
ksys_unshare+0x3a4/0x7e0
__x64_sys_unshare+0x2d/0x40
do_syscall_64+0x35/0x80
entry_SYSCALL_64_after_hwframe+0x46/0xb0
RIP: 0033:0x7f[PII_REDACTED]

</TASK>
Allocated by task 14554:
kasan_save_stack+0x1e/0x40
kasan_set_track+0x21/0x30
__kasan_kmalloc+0xa1/0xb0
__kmalloc_node_track_caller+0x4a/0xb0
kmemdup+0x28/0x60
addrconf_init_net+0x1be/0x840
ops_init+0xa5/0x410
setup_net+0x5aa/0xbd0
copy_net_ns+0x2e6/0x6b0
create_new_namespaces+0x382/0xa50
unshare_nsproxy_namespaces+0xa6/0x1c0
ksys_unshare+0x3a4/0x7e0
__x64_sys_unshare+0x2d/0x40
do_syscall_64+0x35/0x80
entry_SYSCALL_64_after_hwframe+0x46/0xb0

Freed by task 14554:
kasan_save_stack+0x1e/0x40
kasan_set_track+0x21/0x30
kasan_save_free_info+0x2a/0x40
____kasan_slab_free+0x155/0x1b0
slab_free_freelist_hook+0x11b/0x220
__kmem_cache_free+0xa4/0x360
addrconf_init_net+0x623/0x840
ops_init+0xa5/0x410
setup_net+0x5aa/0xbd0
copy_net_ns+0x2e6/0x6b0
create_new_namespaces+0x382/0xa50
unshare_nsproxy_namespaces+0xa6/0x1c0
ksys_unshare+0x3a4/0x7e0
__x64_sys_unshare+0x2d/0x40
do_syscall_64+0x35/0x80
entry_SYSCALL_64_after_hwframe+0x46/0xb0
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/1ca695207ed2271ecbf8ee6c641970f621c157cc; https://git.kernel.org/stable/c/22a68c3b9362eaac7b035eba09e95e6b3f7a912c
CVE: CVE-2022-50311
Published: 2025-09-15
Description: In the Linux kernel, the following vulnerability has been resolved:

cxl: Fix refcount leak in cxl_calc_capp_routing

of_get_next_parent() returns a node pointer with refcount incremented,
we should use of_node_put() on it when not need anymore.
This function only calls of_node_put() in normal path,
missing it in the error path.
Add missing of_node_put() to avoid refcount leak.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/1d09697ff22908ae487fc8c4fbde1811732be523; https://git.kernel.org/stable/c/2d7b6580384e6d65419933ddc525bd176095da54; https://git.kernel.org/stable/c/651e8bc9d0418c20a1989b7c078c64c2a6346fa3
CVE: CVE-2022-50312
Published: 2025-09-15
Description: In the Linux kernel, the following vulnerability has been resolved:

drivers: serial: jsm: fix some leaks in probe

This error path needs to unwind instead of just returning directly.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/1d5859ef229e381f4db38dce8ed58e4bf862006b; https://git.kernel.org/stable/c/3bf05c2650cf6b8d83bf0b0d808cc78c6ee7e84c; https://git.kernel.org/stable/c/3ea1fd63fdf0e83b491c2a9f25b395aa0e4bf6e8
CVE: CVE-2022-50313
Published: 2025-09-15
Description: In the Linux kernel, the following vulnerability has been resolved:

erofs: fix order >= MAX_ORDER warning due to crafted negative i_size

As syzbot reported [1], the root cause is that i_size field is a
signed type, and negative i_size is also less than EROFS_BLKSIZ.
As a consequence, it's handled as fast symlink unexpectedly.

Let's fall back to the generic path to deal with such unusual i_size.

[1] https://lore.kernel.org/r/[PII_REDACTED]00ac8efa05e7feaa1f@google.com
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/0ab621fcdff1a58ff4de51a8590fa92a0ecd34be; https://git.kernel.org/stable/c/17a0cdbd7b0cf0fc0d7ca4187a67f8f1c18c291f; https://git.kernel.org/stable/c/1dd73601a1cba37a0ed5f89a8662c90191df5873
CVE: CVE-2022-50314
Published: 2025-09-15
Description: In the Linux kernel, the following vulnerability has been resolved:

nbd: Fix hung when signal interrupts nbd_start_device_ioctl()

syzbot reported hung task [1].  The following program is a simplified
version of the reproducer:

int main(void)
{
	int sv[2], fd;

	if (socketpair(AF_UNIX, SOCK_STREAM, 0, sv) < 0)
		return 1;
	if ((fd = open("/dev/nbd0", 0)) < 0)
		return 1;
	if (ioctl(fd, NBD_SET_SIZE_BLOCKS, 0x81) < 0)
		return 1;
	if (ioctl(fd, NBD_SET_SOCK, sv[0]) < 0)
		return 1;
	if (ioctl(fd, NBD_DO_IT) < 0)
		return 1;
	return 0;
}

When signal interrupt nbd_start_device_ioctl() waiting the condition
atomic_read(&config->recv_threads) == 0, the task can hung because it
waits the completion of the inflight IOs.

This patch fixes the issue by clearing queue, not just shutdown, when
signal interrupt nbd_start_device_ioctl().
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/1de7c3cf48fc41cd95adb12bd1ea9033a917798a; https://git.kernel.org/stable/c/[PII_REDACTED]ea3b387b30dac1e69468a923c86caf; https://git.kernel.org/stable/c/35fb7d4a53d9e36d1b91161ea9870d9c6d57dccf