huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2022-50783: kernel: mptcp: use proper req destructor for IPv6
Component: kernel
Severity: Moderate
CWE: CWE-401 (Missing Release of Memory after Effective Lifetime)
CVSS v3: 6.6 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-12-24T00:00:00+00:00

A flaw was discovered in the Linux kernel’s Multipath TCP (MPTCP) implementation where the wrong destructor function was used for IPv6 subflow request sockets. Previously, even when handling IPv6 MPTCP subflows, only the IPv4 request socket destructor was invoked, leaving IPv6-specific fields unmanaged. Under certain conditions advanced IPv6 usage scenarios—such as subflows containing IPv6 options—this can lead to memory not being released properly (memory leaks), and long-running systems may experience degraded performance or instability.


Affected upstream versions: 5.6
Fixed upstream versions: 0, 5.10.163, 5.15.87, 6.0.18, 6.1.4, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 6eb02c596ec02e5897ae377e065cb7df55337a96
CVE-2022-50784: kernel: wifi: fix potential NULL-ptr deref after clone
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.3 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H)
Public date: 2025-12-30T00:00:00+00:00

A flaw was found in the Linux kernel’s iwlwifi mei driver. When the driver attempts to clone a socket bufferand that operation fails, it may erroneously dereference a NULL pointer, leading to a kernel crash or denial of service. An unprivileged local user may be able to trigger this flaw by initiating conditions where skb cloning fails


Affected upstream versions: 5.17
Fixed upstream versions: 0, 6.0.16, 6.1.2, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 8b8e25073f3dab93554ee3d5b264f7c013ebd92a
CVE-2022-50809: kernel: Linux kernel xHCI DbC: Denial of Service via memory leak
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-30T00:00:00+00:00

A flaw was found in the Linux kernel's xHCI Debug Capability (DbC) module. A local user with low privileges could exploit a memory leak in the xhci_alloc_dbc() function. This occurs when the DbC is already in use, and allocated memory for the xhci_dbc structure is not properly released. This vulnerability can lead to a denial of service (DoS) due to resource exhaustion.


Affected upstream versions: 5.15.58 < 5.15.75, 5.18
Fixed upstream versions: 0, 5.15.75, 5.19.17, 6.0.3, 6.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 103b459590e1eb4d80b02761eb36c7cae1d9b58e
CVE-2022-50811: kernel: erofs: fix missing unmap if z_erofs_get_extent_compressedlen() fails
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-12-30T00:00:00+00:00

A resource leak flaw was found in the Linux kernel's EROFS filesystem. When z_erofs_get_extent_compressedlen() fails, the corresponding meta buffer is not properly unmapped, leading to a memory leak over time.

Statement: This is a minor memory leak in the EROFS filesystem that requires mounting a malformed EROFS image to trigger. The leak occurs only on error paths and does not lead to crashes or data exposure, limiting practical impact.

Affected upstream versions: 5.13
Fixed upstream versions: 0, 6.0.16, 6.1.2, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 091a8ca572a2e48554427feda78aa503e98c1028
CVE-2022-50816: kernel: ipv6: ensure sane device mtu in tunnels
Component: kernel
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-30T00:00:00+00:00

A flaw was found in the Linux kernel’s IPv6 networking code affecting the handling of IPv6 GRE tunnels. Under certain conditions, an IPv6 tunnel configuration could result in an invalid MTU (Maximum Transmission Unit) value being written to a network device without sanitization. Because the MTU value was not validated before being published to device state, concurrent or lockless readers in the IPv6 multicast code path could observe malformed MTU values, potentially leading to a kernel BUG or panic and resulting in loss of network connectivity or system instability. A local user with privileges to create or configure IPv6 GRE tunnels may trigger this condition


Affected upstream versions: 3.7
Fixed upstream versions: 0, 4.14.305, 4.19.272, 5.10.153, 5.15.77, 5.4.231, 6.0.7, 6.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 2bab6fa449d16af36d9c9518865f783a15f446c7
CVE-2022-50819: kernel: udmabuf: Set ubuf->sg = NULL if the creation of sg table fails
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 4.9 (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2025-12-30T00:00:00+00:00

A flaw was found in the Linux kernel’s udmabuf subsystem where the scatter-gather (sg) pointer was not properly set to NULL if creation of the sg table failed. If userspace attempts to map a dmabuf and the sg table allocation fails (e.g., due to memory exhaustion), the kernel later attempts to free an invalid sg pointer during dmabuf release, causing a NULL pointer dereference and kernel crash


Affected upstream versions: 5.6
Fixed upstream versions: 0, 5.10.150, 5.15.75, 5.19.17, 6.0.3, 6.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: bbe2f6f90310b3a0b5de4e0dc022b36faabfd718
CVE-2022-50822: kernel: Linux kernel: Memory leak in RDMA restrack leads to Denial of Service
Component: kernel
Severity: Moderate
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-30T00:00:00+00:00

A flaw was found in the Linux kernel, specifically within the Remote Direct Memory Access (RDMA) restrack component. A local user could exploit this vulnerability due to a failure to properly release the Memory Region (MR) restrack when it is deleted. This oversight leads to a memory leak, which can result in a Denial of Service (DoS) condition on the system.


Affected upstream versions: 5.10
Fixed upstream versions: 0, 5.15.86, 6.0.16, 6.1.2, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 13586753ae55146269a6dc8b216f17d86b81560c
CVE-2022-50824: kernel: tpm: tpm_tis: Add the missed acpi_put_table() to fix memory leak
Component: kernel
Severity: Low
CWE: CWE-911 (Improper Update of Reference Count)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-12-30T00:00:00+00:00

A memory leak flaw was found in the Linux kernel's TPM TIS driver. The check_acpi_tpm2() function retrieves the TPM2 ACPI table to verify its presence but fails to release the table reference via acpi_put_table(), resulting in a memory leak each time the function is called during driver initialization.

Statement: This is a one-time memory leak that occurs during TPM driver initialization. The leaked memory is small and does not grow over time during normal system operation. Systems without TPM hardware or not using TPM are unaffected.

Affected upstream versions: 4.13
Fixed upstream versions: 0, 4.14.303, 4.19.270, 5.10.163, 5.15.87, 5.4.229, 6.0.17, 6.1.3, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 8bc6c10d3f389693410adb14b4e9deec01ff6334
CVE-2022-50829: kernel: wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb()
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 6.2 (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H)
Public date: 2025-12-30T00:00:00+00:00

A flaw was found in the ath9k USB Wi-Fi driver in the Linux kernel. In certain conditions within the ath9k_hif_usb_reg_in_cb() path, a socket buffer (skb) may be freed prematurely and then freed again on an error path, leading to a use-after-free condition. Additionally, failure to allocate a new skb can result in the URB context becoming NULL, with the associated buffer not being released, causing a memory leak.


Affected upstream versions: 3.0
Fixed upstream versions: 0, 4.14.303, 4.19.270, 4.9.337, 5.10.163, 5.15.86, 5.4.229, 6.0.16, 6.1.2, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 5e8751a977a49a6e00cce1a8da5ca16da83f9c8c
CVE-2022-50833: kernel: Bluetooth: use hdev->workqueue when queuing hdev->{cmd,ncmd}_timer works
Component: kernel
Severity: Moderate
CWE: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'))
CVSS v3: 6.6 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H)
Public date: 2025-12-30T00:00:00+00:00

n the Linux kernel’s Bluetooth subsystem there is a flaw in the way Bluetooth HCI work items are queued. Under certain conditions, work associated with command timeouts (hdev->{cmd,ncmd}_timer) could be scheduled on the wrong workqueue while the intended workqueue is being drained. This occurs because the queuing logic did not fully account for workqueue destruction and lacked proper synchronization. An unprivileged local user interacting with Bluetooth interfaces may be able to trigger a system crash or denial of service by causing this improper scheduling


Affected upstream versions: 5.19.2 < 5.19.15, 5.18.18 < 5.19, 6.0
Fixed upstream versions: 0, 5.19, 5.19.15, 6.0.1, 6.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: c4635cf3d845a7324c25c52d549b70c8bd7ad4c7
CVE-2022-50835: kernel: jbd2: add miss release buffer head in fc_do_one_pass()
Component: kernel
Severity: Low
CWE: CWE-911 (Improper Update of Reference Count)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-12-30T00:00:00+00:00

A reference count leak was found in the Linux kernel's JBD2 journaling subsystem. The fc_do_one_pass() function, used during fast commit replay, fails to release a buffer head after use. This results in a reference count leak that can prevent proper buffer memory cleanup over time.

Statement: This issue affects ext4 filesystems using the fast commit feature. The buffer head leak occurs during journal recovery operations, which typically happen at mount time. While repeated mount/unmount cycles could accumulate leaked references, the practical security impact is limited as an attacker cannot easily trigger journal recovery without administrative access.

Affected upstream versions: 5.10
Fixed upstream versions: 0, 5.10.150, 5.15.75, 5.19.17, 6.0.3, 6.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: e65506ff181fc176088f32117d69b9cb1ddda777
CVE-2022-50839: kernel: jbd2: fix potential buffer head reference count leak
Component: kernel
Severity: Low
CWE: CWE-911 (Improper Update of Reference Count)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-12-30T00:00:00+00:00

A buffer head reference count leak was found in the JBD2 journaling layer (used by ext4). When jbd2_fc_wait_bufs() encounters a non-uptodate buffer and returns -EIO, the journal offset is not updated, causing subsequent buffer release to skip some buffer heads.

Statement: This affects ext4 filesystems using fast commit. The leak occurs only on I/O error paths during journaling and leads to gradual memory consumption rather than an immediate crash. Regular ext4 operation without I/O errors is unaffected.

Affected upstream versions: 5.10
Fixed upstream versions: 0, 5.10.150, 5.15.75, 5.19.17, 6.0.3, 6.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 7a33dde572fceb45d02d188e0213c47059401c93
CVE-2022-50842: kernel: drm/virtio: Check whether transferred 2D BO is shmem
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 4.5 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L)
Public date: 2025-12-30T00:00:00+00:00

A flaw was found in the Linux kernel networking subsystem. Under certain conditions, a pointer may be dereferenced without proper validation, resulting in a NULL pointer dereference. An unprivileged local user could trigger this flaw by exercising the affected networking functionality, causing a kernel crash and resulting in a denial of service.


Affected upstream versions: 5.7
Fixed upstream versions: 0, 5.10.150, 5.15.75, 5.19.17, 6.0.3, 6.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: f134f261d76ae3d5ecf68db642eaa746ceb84cfb
CVE-2022-50843: kernel: dm clone: Fix UAF in clone_dtr()
Component: kernel
Severity: Low
CWE: CWE-364 (Signal Handler Race Condition)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-30T00:00:00+00:00

A use-after-free vulnerability was found in the device-mapper clone target. When dm_resume() and dm_destroy() execute concurrently, a timer may fire after the clone target structure has been freed, leading to use-after-free.

Statement: Exploitation requires precise timing between device-mapper resume and destroy operations, which is difficult to achieve in practice. The vulnerability is in the dm-clone target which is not commonly used in enterprise deployments.

Affected upstream versions: 5.4
Fixed upstream versions: 0, 5.10.163, 5.15.87, 5.4.229, 6.0.18, 6.1.4, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 520b56cfd9faee7683f081c3a38f11a81b13a68e
CVE-2022-50844: kernel: drm/amdgpu: Fix type of second parameter in odn_edit_dpm_table() callback
Component: kernel
Severity: Low
CWE: CWE-843 (Access of Resource Using Incompatible Type ('Type Confusion'))
CVSS v3: 2.5 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-12-30T00:00:00+00:00

A function prototype mismatch was found in the AMD GPU driver's DPM table callbacks. When kCFI (Control Flow Integrity) is enabled, the mismatched types cause CFI validation failures, potentially crashing the kernel.

Statement: This issue only manifests when CONFIG_CFI_CLANG is enabled, which is not a common configuration in most distributions. Without CFI enabled, the type mismatch has no runtime impact due to compatible ABI representation.

Affected upstream versions: 5.13
Fixed upstream versions: 0, 5.15.86, 6.0.16, 6.1.2, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: f9084e9930db562bdcd47fa199a66fb45e16dab5
CVE-2022-50845: kernel: Linux kernel (ext4): Denial of Service due to inode leak via failed extended attribute creation
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-30T00:00:00+00:00

A flaw was found in the Linux kernel's ext4 filesystem. A local user can exploit this vulnerability by performing a setxattr operation with an injected fault, specifically when ext4_mark_inode_dirty() fails within the ext4_xattr_inode_create() function. This can lead to an inode leak, resulting in filesystem errors and a potential Denial of Service (DoS) due to resource exhaustion.


Affected upstream versions: 4.13
Fixed upstream versions: 0, 4.14.303, 4.19.270, 5.10.163, 5.15.87, 5.4.229, 6.0.18, 6.1.4, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 0f709e08caffb41bbc9b38b9a4c1bd0769794007
CVE-2022-50846: kernel: mmc: via-sdmmc: fix return value check of mmc_add_host()
Component: kernel
Severity: Low
CWE: CWE-390 (Detection of Error Condition Without Action)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-12-30T00:00:00+00:00

A flaw was found in the VIA SD/MMC host controller driver. When mmc_add_host() fails, the error is not checked, leading to memory leaks and potential null pointer dereference during driver removal.

Statement: This affects systems with VIA SD/MMC controllers only. The crash can occur during module unload if mmc_add_host() failed during probe, which is an uncommon error scenario requiring hardware or resource issues.

Affected upstream versions: 2.6.31
Fixed upstream versions: 0, 4.14.303, 4.19.270, 4.9.337, 5.10.163, 5.15.86, 5.4.229, 6.0.16, 6.1.2, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 076bcd2c93e16b05c10564e299d6e5d26a766d00
CVE-2022-50847: kernel: drm/bridge: it6505: Initialize AUX channel in it6505_i2c_probe
Component: kernel
Severity: Low
CWE: CWE-824 (Access of Uninitialized Pointer)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-30T00:00:00+00:00

A NULL pointer dereference was found in the IT6505 DisplayPort bridge driver. If an HPD interrupt fires before the DRM bridge registration completes, the driver attempts to access an uninitialized AUX channel, causing a kernel crash.

Statement: This affects systems using IT6505 DisplayPort bridges with specific timing conditions during boot. The race window is narrow and requires the display hotplug signal to arrive at a precise moment during driver initialization.

Affected upstream versions: 5.18
Fixed upstream versions: 0, 6.0.16, 6.1.2, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 8ed8505803774fc3f36a432718036c21cc51e2ba
CVE-2022-50855: kernel: bpf: prevent leak of lsm program after failed attach
Component: kernel
Severity: Low
CWE: CWE-911 (Improper Update of Reference Count)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-12-30T00:00:00+00:00

A reference count leak was found in the BPF subsystem. When attaching a BPF LSM program to a cgroup fails validation, the program's reference count is not decremented, causing the BPF program to remain loaded indefinitely.

Statement: This requires CAP_BPF or CAP_SYS_ADMIN to trigger, as loading BPF programs is a privileged operation. The leak accumulates memory over repeated failed attach attempts but does not provide privilege escalation.

Affected upstream versions: 6.0
Fixed upstream versions: 0, 6.0.16, 6.1.2, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 82b39df5ddb298daaf6dc504032ff7eb027fa106
CVE-2022-50856: kernel: cifs: Fix xid leak in cifs_ses_add_channel()
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-12-30T00:00:00+00:00

A transaction ID (xid) leak was found in the CIFS/SMB filesystem. When adding a new channel fails, the allocated xid is not freed, leading to gradual exhaustion of the xid pool.

Statement: This is a minor resource leak in CIFS multichannel operations. The xid pool is limited but typically large enough that exhaustion would require many repeated failures over an extended period.

Affected upstream versions: 5.5
Fixed upstream versions: 0, 5.10.152, 5.15.76, 6.0.6, 6.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 7286f875510486fdc2fc426b7c826262e2283a65
CVE-2022-50858: kernel: mmc: alcor: fix return value check of mmc_add_host()
Component: kernel
Severity: Low
CWE: CWE-252 (Unchecked Return Value)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-12-30T00:00:00+00:00

A flaw was found in the Linux kernel's Alcor Micro MMC card reader driver. When mmc_add_host() fails, its return value is not checked, causing memory allocated by mmc_alloc_host() to leak. Additionally, the remove path may attempt to delete a device that was never added, leading to a kernel crash.

Statement: This bug manifests only when mmc_add_host() fails during driver initialization, which is an uncommon error condition. The memory leak and potential crash affect systems with Alcor Micro card readers encountering initialization failures, representing a limited attack surface that requires specific hardware.

Affected upstream versions: 5.0
Fixed upstream versions: 0, 5.10.163, 5.15.86, 5.4.229, 6.0.16, 6.1.2, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 289c964fe182ce755044a6cd57698072e12ffa6f
CVE-2022-50861: kernel: NFSD: Finish converting the NFSv2 GETACL result encoder
Component: kernel
Severity: Moderate
CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
CVSS v3: 6.3 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N)
Public date: 2025-12-30T00:00:00+00:00

A flaw was identified in the Linux kernel’s NFSD NFSv2 GETACL result encoder. During conversion to xdr_stream, leftover code erroneously set the page_len field of the send buffer. The XDR stream encoders are expected to manage buffer length automatically, and the incorrect manual setting can result in additional unused data beyond the legitimate response message being transmitted. Although most NFSv2 clients will ignore this extra data, it may contain stale kernel memory contents and can be observed on the network


Affected upstream versions: 5.13
Fixed upstream versions: 0, 5.15.86, 6.0.16, 6.1.2, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: a20b0abab966a189a79aba6ebf41f59024a3224d
CVE-2022-50863: kernel: Kernel: Denial of Service via memory leak in wifi power saving mode
Component: kernel
Severity: Moderate
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-30T00:00:00+00:00

A flaw was found in the Linux kernel's wifi driver. Under power saving mode, the driver fails to properly free unused socket buffers (skb), leading to a memory leak. A local attacker could exploit this vulnerability to cause a Denial of Service (DoS) by exhausting system memory.


Affected upstream versions: 5.19
Fixed upstream versions: 0, 5.19.17, 6.0.3, 6.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d4b4f6ff8ff1b87d25977423cf38fb61744d0023
CVE-2022-50865: kernel: tcp: fix a signed-integer-overflow bug in tcp_add_backlog()
Component: kernel
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-30T00:00:00+00:00

A flaw was found in the Linux kernel’s TCP implementation in the function tcp_add_backlog(). When calculating the maximum acceptable backlog for TCP sockets, the sum of the receive buffer (sk_rcvbuf), the send buffer (sk_sndbuf), and a fixed constant may exceed the maximum value of a signed integer due to both buffer values being of type int. This can result in a signed integer overflow, potentially leading to incorrect backlog limits and unexpected TCP behavior under certain workloads.

Statement: A signed integer overflow in tcp_add_backlog() could occur when computing the backlog limit from sk_rcvbuf and sk_sndbuf, potentially resulting in an incorrect, reduced limit. A remote peer can trigger this condition by sending network traffic that stresses the TCP backlog, leading to premature packet drops and degraded service availability.
This issue is a typical network robustness bug, as the integer overflow only affects internal backlog limit calculations and can at most cause packet drops or limited service degradation (DoS), without providing a realistic path to host crashes, memory corruption, privilege escalation, or code execution.

Affected upstream versions: 4.9
Fixed upstream versions: 0, 5.10.153, 5.15.77, 5.4.278, 6.0.7, 6.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 9d04b4d0feee12bce6bfe37f30d8e953d3c30368