huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2022-50093: kernel: iommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE)
Component: kernel
Severity: Moderate
CVSS v3: 4.1 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-06-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

iommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE)

KASAN reports:

[ 4.668325][ T0] BUG: KASAN: wild-memory-access in dmar_parse_one_rhsa (arch/x86/include/asm/bitops.h:214 arch/x86/include/asm/bitops.h:226 include/asm-generic/bitops/instrumented-non-atomic.h:142 include/linux/nodemask.h:415 drivers/iommu/intel/dmar.c:497)
[    4.676149][    T0] Read of size 8 at addr 1fffffff85115558 by task swapper/0/0
[    4.683454][    T0]
[    4.685638][    T0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.19.0-rc3-00004-g0e862838f290 #1
[    4.694331][    T0] Hardware name: Supermicro SYS-5018D-FN4T/X10SDV-8C-TLN4F, BIOS 1.1 03/02/2016
[    4.703196][    T0] Call Trace:
[    4.706334][    T0]  <TASK>
[ 4.709133][ T0] ? dmar_parse_one_rhsa (arch/x86/include/asm/bitops.h:214 arch/x86/include/asm/bitops.h:226 include/asm-generic/bitops/instrumented-non-atomic.h:142 include/linux/nodemask.h:415 drivers/iommu/intel/dmar.c:497)

after converting the type of the first argument (@nr, bit number)
of arch_test_bit() from `long` to `unsigned long`[0].

Under certain conditions (for example, when ACPI NUMA is disabled
via command line), pxm_to_node() can return %NUMA_NO_NODE (-1).
It is valid 'magic' number of NUMA node, but not valid bit number
to use in bitops.
node_online() eventually descends to test_bit() without checking
for the input, assuming it's on caller side (which might be good
for perf-critical tasks). There, -1 becomes %ULONG_MAX which leads
to an insane array index when calculating bit position in memory.

For now, add an explicit check for @node being not %NUMA_NO_NODE
before calling test_bit(). The actual logics didn't change here
at all.

[0] https://github.com/norov/linux/commit/0e862838f290147ea9c16db852d8d494b552d38d

Statement: This issue can be triggered during early IOMMU initialization when acpi_map_pxm_to_node() returns NUMA_NO_NODE (i.e., -1). Without a proper check, node_online() accesses an invalid memory address due to the out-of-bounds bit index. High privileges are required (root or kernel mode), and the issue results in a kernel crash.

Affected upstream versions: 2.6.33
Fixed upstream versions: 0, 5.10.137, 5.15.61, 5.18.18, 5.19.2, 5.4.211, 6.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: b12304984654d8e58a2b22ff94c4410906d6267f
CVE-2022-50095: kernel: posix-cpu-timers: Cleanup CPU timers before freeing them during exec
Component: kernel
Severity: Moderate
CWE: CWE-459 (Incomplete Cleanup)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-06-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

posix-cpu-timers: Cleanup CPU timers before freeing them during exec

Commit 55e8c8eb2c7b ("posix-cpu-timers: Store a reference to a pid not a
task") started looking up tasks by PID when deleting a CPU timer.

When a non-leader thread calls execve, it will switch PIDs with the leader
process. Then, as it calls exit_itimers, posix_cpu_timer_del cannot find
the task because the timer still points out to the old PID.

That means that armed timers won't be disarmed, that is, they won't be
removed from the timerqueue_list. exit_itimers will still release their
memory, and when that list is later processed, it leads to a
use-after-free.

Clean up the timers from the de-threaded task before freeing them. This
prevents a reported use-after-free.


Affected upstream versions: 5.7
Fixed upstream versions: 0, 5.10.137, 5.15.61, 5.18.18, 5.19.2, 6.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 541840859ace9c2ccebc32fa9e376c7bd3def490
CVE-2022-50096: kernel: x86/kprobes: Update kcb status flag after singlestepping
Component: kernel
Severity: Moderate
CWE: CWE-393 (Return of Wrong Status Code)
CVSS v3: 4.1 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-06-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

x86/kprobes: Update kcb status flag after singlestepping

Fix kprobes to update kcb (kprobes control block) status flag to
KPROBE_HIT_SSDONE even if the kp->post_handler is not set.

This bug may cause a kernel panic if another INT3 user runs right
after kprobes because kprobe_int3_handler() misunderstands the
INT3 is kprobe's single stepping INT3.


Affected upstream versions: 5.13
Fixed upstream versions: 0, 5.15.61, 5.18.18, 5.19.2, 6.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: edc2ac7c7265b33660fa0190898966b49966b855
CVE-2022-50100: kernel: sched/core: Do not requeue task on CPU excluded from cpus_mask
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-06-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

sched/core: Do not requeue task on CPU excluded from cpus_mask

The following warning was triggered on a large machine early in boot on
a distribution kernel but the same problem should also affect mainline.

   WARNING: CPU: 439 PID: 10 at ../kernel/workqueue.c:2231 process_one_work+0x4d/0x440
   Call Trace:
    <TASK>
    rescuer_thread+0x1f6/0x360
    kthread+0x156/0x180
    ret_from_fork+0x22/0x30
    </TASK>

Commit c6e7bd7afaeb ("sched/core: Optimize ttwu() spinning on p->on_cpu")
optimises ttwu by queueing a task that is descheduling on the wakelist,
but does not check if the task descheduling is still allowed to run on that CPU.

In this warning, the problematic task is a workqueue rescue thread which
checks if the rescue is for a per-cpu workqueue and running on the wrong CPU.
While this is early in boot and it should be possible to create workers,
the rescue thread may still used if the MAYDAY_INITIAL_TIMEOUT is reached
or MAYDAY_INTERVAL and on a sufficiently large machine, the rescue
thread is being used frequently.

Tracing confirmed that the task should have migrated properly using the
stopper thread to handle the migration. However, a parallel wakeup from udev
running on another CPU that does not share CPU cache observes p->on_cpu and
uses task_cpu(p), queues the task on the old CPU and triggers the warning.

Check that the wakee task that is descheduling is still allowed to run
on its current CPU and if not, wait for the descheduling to complete
and select an allowed CPU.


Affected upstream versions: 5.8
Fixed upstream versions: 0, 5.15.61, 5.18.18, 5.19.2, 6.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 748d2e9585ae53cb6be48e84f93d2f082ae1d135
CVE-2022-50110: kernel: watchdog: sp5100_tco: Fix a memory leak of EFCH MMIO resource
Component: kernel
Severity: Low
CWE: CWE-401 (Missing Release of Memory after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-06-18T00:00:00+00:00

A flaw was found in the sp5100_tco module in the Linux kernel. A missing release of allocated memory for the EFCH MMIO resource will cause a memory leak, potentially impacting system performance and resulting in a denial of service.

Statement: This issue has been fixed in Red Hat Enterprise Linux 8.7 and 9.3 via RHSA-2022:7683 [1] and RHSA-2023:6583 [2], respectively.

[1]. https://access.redhat.com/errata/RHSA-2022:7683

[2]. https://access.redhat.com/errata/RHSA-2023:6583

Affected upstream versions: 5.15.42 < 5.15.61, 5.17.10 < 5.18, 5.18
Fixed upstream versions: 0, 5.15.61, 5.18, 5.18.18, 5.19.2, 6.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 84ddf527f90755beec6b55ce2e31331f5ccd4e37
CVE-2022-50111: kernel: ASoC: mt6359: Fix refcount leak bug
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-06-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ASoC: mt6359: Fix refcount leak bug

In mt6359_parse_dt() and mt6359_accdet_parse_dt(), we should call
of_node_put() for the reference returned by of_get_child_by_name()
which has increased the refcount.


Affected upstream versions: 5.10
Fixed upstream versions: 0, 5.15.61, 5.18.18, 5.19.2, 6.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 3d69d86b3e9d82f524e7e1906adcbbe939dc836e
CVE-2022-50112: kernel: rpmsg: qcom_smd: Fix refcount leak in qcom_smd_parse_edge
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-06-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

rpmsg: qcom_smd: Fix refcount leak in qcom_smd_parse_edge

of_parse_phandle() returns a node pointer with refcount
incremented, we should use of_node_put() on it when done.


Affected upstream versions: 4.9
Fixed upstream versions: 0, 4.19.256, 5.10.137, 5.15.61, 5.18.18, 5.19.2, 5.4.211, 6.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: cb50423e46ea585620a6be307d7f7b71587936b7
CVE-2022-50113: kernel: ASoc: audio-graph-card2: Fix refcount leak bug in __graph_get_type()
Component: kernel
Severity: Moderate
CWE: CWE-911 (Improper Update of Reference Count)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-06-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ASoc: audio-graph-card2: Fix refcount leak bug in __graph_get_type()

We should call of_node_put() for the reference before its replacement
as it returned by of_get_parent() which has increased the refcount.
Besides, we should also call of_node_put() before return.


Affected upstream versions: 5.16
Fixed upstream versions: 0, 5.18.18, 5.19.2, 6.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 3bb0c0b5f0f866fc3785380e0860dc37ceacf342
CVE-2022-50115: kernel: ASoC: SOF: ipc3-topology: Prevent double freeing of ipc_control_data via load_bytes
Component: kernel
Severity: Moderate
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-06-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ASoC: SOF: ipc3-topology: Prevent double freeing of ipc_control_data via load_bytes

We have sanity checks for byte controls and if any of the fail the locally
allocated scontrol->ipc_control_data is freed up, but not set to NULL.

On a rollback path of the error the higher level code will also try to free
the scontrol->ipc_control_data which will eventually going to lead to
memory corruption as double freeing memory is not a good thing.


Affected upstream versions: 5.18
Fixed upstream versions: 0, 5.18.18, 5.19.2, 6.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 8463986b54295e6b65ddf2b7c65627d01ce7643b
CVE-2022-50120: kernel: remoteproc: imx_rproc: Fix refcount leak in imx_rproc_addr_init
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-06-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

remoteproc: imx_rproc: Fix refcount leak in imx_rproc_addr_init

of_parse_phandle() returns a node pointer with refcount
incremented, we should use of_node_put() on it when not needed anymore.
This function has two paths missing of_node_put().


Affected upstream versions: 4.14
Fixed upstream versions: 0, 5.15.61, 5.18.18, 5.19.2, 6.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 0dc1663e3fc22c72e1ab33be7701a0d51cca84ef
CVE-2022-50121: kernel: remoteproc: k3-r5: Fix refcount leak in k3_r5_cluster_of_init
Component: kernel
Severity: Moderate
CWE: CWE-911 (Improper Update of Reference Count)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-06-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

remoteproc: k3-r5: Fix refcount leak in k3_r5_cluster_of_init

Every iteration of for_each_available_child_of_node() decrements
the reference count of the previous node.
When breaking early from a for_each_available_child_of_node() loop,
we need to explicitly call of_node_put() on the child node.
Add missing of_node_put() to avoid refcount leak.


Affected upstream versions: 5.10
Fixed upstream versions: 0, 5.10.137, 5.15.61, 5.18.18, 5.19.2, 6.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 75358732af9b26acfe3e609943290bcba13330fc
CVE-2022-50122: kernel: ASoC: mediatek: mt8173-rt5650: Fix refcount leak in mt8173_rt5650_dev_probe
Component: kernel
Severity: Low
CWE: CWE-911 (Improper Update of Reference Count)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-06-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ASoC: mediatek: mt8173-rt5650: Fix refcount leak in mt8173_rt5650_dev_probe

of_parse_phandle() returns a node pointer with refcount
incremented, we should use of_node_put() on it when not need anymore.
Fix refcount leak in some error paths.


Affected upstream versions: 4.6
Fixed upstream versions: 0, 4.14.291, 4.19.256, 5.10.137, 5.15.61, 5.18.18, 5.19.2, 5.4.211, 6.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 06ace427953f5036b64aed658f0055f65d76fd27
CVE-2022-50123: kernel: ASoC: mediatek: mt8173: Fix refcount leak in mt8173_rt5650_rt5676_dev_probe
Component: kernel
Severity: Low
CWE: CWE-911 (Improper Update of Reference Count)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-06-18T00:00:00+00:00

A flaw was found in the mt8173-rt5650-rt5676 module in the Linux kernel. A missing decrement of the reference count when an error occurs will cause a memory leak, potentially impacting system performance and resulting in a denial of service.

Statement: This issue has been fixed in Red Hat Enterprise Linux 9.2 via RHSA-2023:2458 [1].

[1]. https://access.redhat.com/errata/RHSA-2023:2458

Affected upstream versions: 4.2
Fixed upstream versions: 0, 4.14.291, 4.19.256, 5.10.137, 5.15.61, 5.18.18, 5.19.2, 5.4.211, 6.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: aa668f8e93199cda8fa1612eb49ff70f5ecd8c92
CVE-2022-50124: kernel: ASoC: mt6797-mt6351: Fix refcount leak in mt6797_mt6351_dev_probe
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-06-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ASoC: mt6797-mt6351: Fix refcount leak in mt6797_mt6351_dev_probe

of_parse_phandle() returns a node pointer with refcount
incremented, we should use of_node_put() on it when not need anymore.
Add missing of_node_put() to avoid refcount leak.


Affected upstream versions: 4.18
Fixed upstream versions: 0, 4.19.256, 5.10.137, 5.15.61, 5.18.18, 5.19.2, 5.4.211, 6.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 1042353bb67cd1c9109d7481ea182c7794336458
CVE-2022-50125: kernel: ASoC: cros_ec_codec: Fix refcount leak in cros_ec_codec_platform_probe
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-06-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ASoC: cros_ec_codec: Fix refcount leak in cros_ec_codec_platform_probe

of_parse_phandle() returns a node pointer with refcount
incremented, we should use of_node_put() on it when not need anymore.
Add missing of_node_put() to avoid refcount leak.


Affected upstream versions: 5.5
Fixed upstream versions: 0, 5.10.137, 5.15.61, 5.18.18, 5.19.2, 6.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: bae95c5aee1f67da6608ceaebfb744d900e5ffbf
CVE-2022-50126: kernel: jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted
Component: kernel
Severity: Moderate
CWE: CWE-617 (Reachable Assertion)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-06-18T00:00:00+00:00

A flaw was found in the jbd2 module in the Linux kernel. An assertion failure can be triggered when a specific sequence of transactions and operations is performed due to incorrect synchronization, potentially resulting in a denial of service.

Statement: This issue has been fixed in Red Hat Enterprise Linux 8.10 and 9.2 via RHSA-2024:3138 [1] and RHSA-2023:2458 [2], respectively.

[1]. https://access.redhat.com/errata/RHSA-2024:3138

[2]. https://access.redhat.com/errata/RHSA-2023:2458

Affected upstream versions: 2.6.19
Fixed upstream versions: 0, 4.14.291, 4.19.256, 5.10.137, 5.15.61, 5.18.18, 5.19.2, 5.4.211, 6.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 0f61c6dc4b714be9d79cf0782ca02ba01c1b7ac3
CVE-2022-50127: kernel: RDMA/rxe: Fix error unwind in rxe_create_qp()
Component: kernel
Severity: Moderate
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-06-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

RDMA/rxe: Fix error unwind in rxe_create_qp()

In the function rxe_create_qp(), rxe_qp_from_init() is called to
initialize qp, internally things like the spin locks are not setup until
rxe_qp_init_req().

If an error occures before this point then the unwind will call
rxe_cleanup() and eventually to rxe_qp_do_cleanup()/rxe_cleanup_task()
which will oops when trying to access the uninitialized spinlock.

Move the spinlock initializations earlier before any failures.


Affected upstream versions: 4.8
Fixed upstream versions: 0, 4.14.291, 4.19.256, 5.10.137, 5.15.61, 5.18.18, 5.19.2, 5.4.211, 6.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 3c838ca6fbdb173102780d7bdf18f2f7d9e30979
CVE-2022-50129: kernel: RDMA/srpt: Fix a use-after-free
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-06-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

RDMA/srpt: Fix a use-after-free

Change the LIO port members inside struct srpt_port from regular members
into pointers. Allocate the LIO port data structures from inside
srpt_make_tport() and free these from inside srpt_make_tport(). Keep
struct srpt_device as long as either an RDMA port or a LIO target port is
associated with it. This patch decouples the lifetime of struct srpt_port
(controlled by the RDMA core) and struct srpt_port_id (controlled by LIO).
This patch fixes the following KASAN complaint:

  BUG: KASAN: use-after-free in srpt_enable_tpg+0x31/0x70 [ib_srpt]
  Read of size 8 at addr ffff888141cc34b8 by task check/5093

  Call Trace:
   <TASK>
   show_stack+0x4e/0x53
   dump_stack_lvl+0x51/0x66
   print_address_description.constprop.0.cold+0xea/0x41e
   print_report.cold+0x90/0x205
   kasan_report+0xb9/0xf0
   __asan_load8+0x69/0x90
   srpt_enable_tpg+0x31/0x70 [ib_srpt]
   target_fabric_tpg_base_enable_store+0xe2/0x140 [target_core_mod]
   configfs_write_iter+0x18b/0x210
   new_sync_write+0x1f2/0x2f0
   vfs_write+0x3e3/0x540
   ksys_write+0xbb/0x140
   __x64_sys_write+0x42/0x50
   do_syscall_64+0x34/0x80
   entry_SYSCALL_64_after_hwframe+0x46/0xb0
   </TASK>


Affected upstream versions: 3.3
Fixed upstream versions: 0, 5.10.137, 5.15.61, 5.18.18, 5.19.2, 6.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: de95b52d9aabc979166aba81ccbe623aaf9c16a1
CVE-2022-50130: kernel: staging: fbtft: core: set smem_len before fb_deferred_io_init call
Component: kernel
Severity: Moderate
CWE: CWE-665 (Improper Initialization)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-06-18T00:00:00+00:00

A flaw was found in the fbtft module in the Linux kernel. An incorrect order of operations can cause an improper initialization of framebuffer devices, potentially impacting system stability and resulting in a denial of service.

Statement: This issue has been fixed in Red Hat Enterprise Linux 8.8 via RHSA-2023:2951 [1].

[1]. https://access.redhat.com/errata/RHSA-2023:2951

Affected upstream versions: 5.18.3 < 5.18.18, 5.19
Fixed upstream versions: 0, 5.18.18, 5.19.2, 6.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 4178bfa3fc9de556dfe248a6eabe29280f0ffda5
CVE-2022-50131: kernel: HID: mcp2221: prevent a buffer overflow in mcp_smbus_write()
Component: kernel
Severity: Moderate
CWE: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'))
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-06-18T00:00:00+00:00

A buffer overflow vulnerability has been found in the linux kernel, such that when calling  mcp_smbus_write(), a buffer of a smaller size is called when performing memcpy, resulting in damage to confidentiality, integrity, and availability of the system.


Affected upstream versions: 5.7
Fixed upstream versions: 0, 5.10.137, 5.15.61, 5.18.18, 5.19.2, 6.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 66c8e816f2f2ca4a61b406503bd10bad1b35f72f
CVE-2022-50132: kernel: usb: cdns3: change place of 'priv_ep' assignment in cdns3_gadget_ep_dequeue(), cdns3_gadget_ep_enable()
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-06-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

usb: cdns3: change place of 'priv_ep' assignment in cdns3_gadget_ep_dequeue(), cdns3_gadget_ep_enable()

If 'ep' is NULL, result of ep_to_cdns3_ep(ep) is invalid pointer
and its dereference with priv_ep->cdns3_dev may cause panic.

Found by Linux Verification Center (linuxtesting.org) with SVACE.


Affected upstream versions: 5.4
Fixed upstream versions: 0, 5.10.137, 5.15.61, 5.18.18, 5.19.2, 6.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 7af83bb516d7aa4f96835288e4aeda21d7aa2a17
CVE-2022-50135: kernel: RDMA/rxe: Fix BUG: KASAN: null-ptr-deref in rxe_qp_do_cleanup
Component: kernel
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-06-18T00:00:00+00:00

A flaw was found in the rdma_rxe module in the Linux kernel. A NULL pointer dereference can be triggered when an error occurs due to an improper check, resulting in a denial of service.

Statement: This issue has been fixed in Red Hat Enterprise Linux 8.8 and 9.3 via RHSA-2023:2951 [1] and RHSA-2023:6583 [2], respectively.

[1]. https://access.redhat.com/errata/RHSA-2023:2951

[2]. https://access.redhat.com/errata/RHSA-2023:6583

Affected upstream versions: 5.19
Fixed upstream versions: 0, 5.19.2, 6.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 8598b9d0a364c1663c96fc0fab9df0d36c809aea