huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2022-50733: kernel: usb: idmouse: fix an uninit-value in idmouse_open
Component: kernel
Severity: Low
CWE: CWE-824 (Access of Uninitialized Pointer)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

A use of uninitialized memory was found in the Linux kernel's idmouse USB fingerprint reader driver. In idmouse_create_image(), when any ftip_command() fails, control jumps to the reset label but leaves bulk_in_buffer data uninitialized. The subsequent check for a valid image then dereferences this uninitialized data, leading to undefined behavior.

Statement: This flaw was discovered by KMSAN (Kernel Memory Sanitizer) and affects systems with Siemens ID Mouse fingerprint readers. The uninitialized memory access occurs in an error handling path when USB commands fail. Exploitation requires physical access to connect a specific USB device and trigger the error condition.

Affected upstream versions: 2.6.13
Fixed upstream versions: 0, 4.14.296, 4.19.262, 4.9.331, 5.10.150, 5.15.75, 5.19.17, 5.4.220, 6.0.3, 6.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: b3304a6df957cc89a0590cb505388d659bf3db4c
CVE-2022-50735: kernel: wifi: mt76: do not run mt76u_status_worker if the device is not running
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.1 (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

A flaw was discovered in the Linux kernel’s mt76 Wi-Fi driver, where the mt76u_status_worker thread could be scheduled even when the underlying device was not yet in a running state. Under certain conditions, this could lead to a NULL pointer dereference in the worker routine, resulting in a kernel panic or denial of service.


Affected upstream versions: 5.11
Fixed upstream versions: 0, 5.15.86, 6.0.16, 6.1.2, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 69346de0eb956fb92949b9473de4647d9c34a54f
CVE-2022-50736: kernel: Linux kernel: Privilege escalation via out-of-bounds write in RDMA/siw
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L)
Public date: 2025-12-24T00:00:00+00:00

A flaw was identified in the Linux kernel RDMA (siw) implementation where an undefined opcode value could be used during immediate work request flushing while in an error state. The send queue element opcode was not correctly set, which could lead to an out-of-bounds access when mapping between the SoftiWARP internal representation and the RDMA core representation in work completion generation. On some test configurations (e.g., NFSoRDMA testing), this resulted in a KASAN BUG report of type global-out-of-bounds. Additionally, a malicious local user with access to a memory-mapped completion queue (CQ) could supply undefined values for completion queue element status or opcode, leading to similar out-of-bounds array access.


Affected upstream versions: 5.3
Fixed upstream versions: 0, 5.10.163, 5.15.86, 5.4.229, 6.0.16, 6.1.2, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 6af043089d3f1210776d19b6fdabea610d4c7699
CVE-2022-50738: kernel: Linux kernel: vhost-vdpa memory leak leading to Denial of Service
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

A flaw was found in the Linux kernel's vhost-vdpa component. This memory leak vulnerability occurs when an application using vhost-vdpa fails to properly invalidate I/O Translation Lookaside Buffer (IOTLB) entries or crashes. A local attacker or application could exploit this flaw, leading to memory exhaustion and potentially a Denial of Service (DoS) on the affected system.


Affected upstream versions: 5.19
Fixed upstream versions: 0, 6.0.19, 6.1.5, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 4e92cb33bfb51eee5f28bb10846c46f266a4bb67
CVE-2022-50740: kernel: Linux kernel: Denial of Service in ath9k Wi-Fi driver due to URB memory leak
Component: kernel
Severity: Moderate
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

A flaw was found in the Linux kernel's ath9k Wi-Fi driver. This memory leak vulnerability occurs because Universal Serial Bus (USB) request blocks (URBs) are allocated but not properly freed when certain conditions are met during USB device handling. A local attacker could exploit this by triggering the specific USB device handling, leading to a denial of service due to resource exhaustion.


Affected upstream versions: 4.9.241 < 4.9.337, 4.14.203 < 4.14.303, 4.19.154 < 4.19.270, 5.4.73 < 5.4.229, 4.4.241 < 4.5, 5.8.17 < 5.9, 5.9.2 < 5.10, 5.10
Fixed upstream versions: 0, 4.14.303, 4.19.270, 4.5, 4.9.337, 5.10, 5.10.163, 5.15.86, 5.4.229, 5.9, 6.0.16, 6.1.2, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 134ae5eba41294eff76e4be20d6001b8f0192207
CVE-2022-50743: kernel: Linux kernel: Denial of Service in erofs due to memory leak
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

A flaw was found in the Linux kernel's erofs filesystem. A local user can trigger a memory leak by exploiting a condition in the `z_erofs_register_pcluster()` function where a pcluster's block address is zero, leading to an unreleased reference count. This vulnerability can result in resource exhaustion, causing a Denial of Service (DoS) on the system.


Affected upstream versions: 5.17
Fixed upstream versions: 0, 6.0.16, 6.1.2, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: ac54c1f7b288d83b6ba1e320efff24ecc21309cd
CVE-2022-50744: kernel: Linux kernel: Hard lockup in lpfc driver leads to Denial of Service
Component: kernel
Severity: Moderate
CWE: CWE-413 (Improper Resource Locking)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

A flaw was found in the Linux kernel. A local user could trigger a hard lockup by concurrently reading the `rx_monitor` from `debugfs` during I/O operations in the `lpfc` driver. This concurrency issue, caused by insufficient spin lock protection, leads to a system crash and results in a Denial of Service (DoS).


Affected upstream versions: 5.15.78 < 5.15.86, 6.0.3 < 6.0.16, 5.19.17 < 5.20, 6.1
Fixed upstream versions: 0, 5.15.86, 5.20, 6.0.16, 6.1.2, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 2cf66428a2545bb33beb9624124a2377468bb478
CVE-2022-50748: kernel: Kernel: Denial of Service via memory leak in mqueue component
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

A flaw was found in the Linux kernel's mqueue (message queue) component. A local attacker with low privileges could exploit a memory leak in the `init_mqueue_fs()` function. This vulnerability occurs when `retire_mq_sysctls` is not called after `setup_mq_sysctls` fails, leading to resource exhaustion. This could result in a Denial of Service (DoS) condition, making the system unavailable.


Affected upstream versions: 5.19
Fixed upstream versions: 0, 5.19.17, 6.0.3, 6.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: a1f321051e0dcf2415fb94f81fdc5044cad4c1d6
CVE-2022-50750: kernel: drm/panel/panel-sitronix-st7701: Remove panel on DSI attach failure
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-12-24T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/panel/panel-sitronix-st7701: Remove panel on DSI attach failure

In case mipi_dsi_attach() fails, call drm_panel_remove() to
avoid memory leak.


Affected upstream versions: 5.1
Fixed upstream versions: 0, 5.10.163, 5.15.86, 5.4.229, 6.0.16, 6.1.2, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 0b7c47b7f358f932159a9d5beec9616ef8a0c6b4
CVE-2022-50752: kernel: md/raid5: Remove unnecessary bio_put() in raid5_read_one_chunk()
Component: kernel
Severity: Low
CWE: CWE-1341 (Multiple Releases of Same Resource or Handle)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

A double-free vulnerability was found in the Linux kernel's MD RAID5 driver. In raid5_read_one_chunk(), when encountering badblocks during chunk-sized reads, an unnecessary bio_put() is called. Since the bio is also freed by the common I/O completion path, this results in a double-free condition that can cause kernel crashes and memory corruption.

Statement: This flaw affects RAID5 arrays with disks that have recorded badblocks. The double-free occurs during read operations that encounter bad sectors, which triggers the error path containing the extraneous bio_put(). Systems using MD RAID5 with degraded or failing disks are more likely to encounter this issue.

Affected upstream versions: 5.14
Fixed upstream versions: 0, 5.15.75, 5.19.17, 6.0.3, 6.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 7a37c58ee72e1fadd22c4ee990cb74c2ca2280e7
CVE-2022-50760: kernel: Linux kernel: Resource exhaustion in amdgpu due to PCI device reference count leak
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

A flaw was found in the Linux kernel's `drm/amdgpu` component. A missing call to `pci_dev_put()` in the `amdgpu_atrm_get_bios()` function leads to a PCI device reference count leak. A local attacker could exploit this to cause resource exhaustion, potentially resulting in a Denial of Service (DoS).


Affected upstream versions: 4.2
Fixed upstream versions: 0, 4.14.303, 4.19.270, 4.9.337, 5.10.163, 5.15.86, 5.4.229, 6.0.16, 6.1.2, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 6611feef35c0c8c4d297b28a7fc6ab3a2c47eca7
CVE-2022-50761: kernel: Linux kernel (x86/xen): Memory leak in CPU lock initialization leading to denial of service.
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

A flaw was found in the Linux kernel's x86/xen component. A local user could exploit a memory leak vulnerability during the initialization of the CPU lock in the `xen_init_lock_cpu()` function. If a specific internal function fails after memory allocation, the allocated memory is not properly released. This can lead to resource exhaustion and a Denial of Service (DoS) condition on the affected system.


Affected upstream versions: 2.6.27
Fixed upstream versions: 0, 4.14.303, 4.19.270, 4.9.337, 5.10.163, 5.15.86, 5.4.229, 6.0.16, 6.1.2, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 9278bdbb566656b3704704f8dd6cbc24a6fcc569
CVE-2022-50768: kernel: scsi: smartpqi: Correct device removal for multi-actuator devices
Component: kernel
Severity: Moderate
CWE: CWE-911 (Improper Update of Reference Count)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

scsi: smartpqi: Correct device removal for multi-actuator devices

Correct device count for multi-actuator drives which can cause kernel
panics.

Statement: smartpqi device removal for multi actuator drives could crash the kernel because the driver used an incorrect LUN count and could treat a device as having zero LUNs. This breaks the removal and pending IO wait logic and can result in premature teardown of shared device structures while other logical units still exist. The CVSS has a PR:L and assumes a local user can trigger device rescan or removal events through storage management interfaces in some environments. In most deployments such operations require administrative privileges. The issue is tied to local storage controller events such as hot remove, reset, or device reenumeration.

Affected upstream versions: 6.0
Fixed upstream versions: 0, 6.0.16, 6.1.2, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: e8e9e0c28901d34beb193b5ece52eb7c656f4042
CVE-2022-50769: kernel: mmc: mxcmmc: fix return value check of mmc_add_host()
Component: kernel
Severity: Low
CWE: CWE-252 (Unchecked Return Value)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-12-24T00:00:00+00:00

A flaw was found in the Linux kernel's Freescale MXC MMC driver. The mxcmmc driver fails to check the return value of mmc_add_host(). If this function fails, memory allocated by mmc_alloc_host() is leaked, and a subsequent driver removal will crash the kernel when attempting to delete a device that was never successfully added.

Statement: This flaw affects embedded systems with Freescale i.MX SoCs using the mxcmmc driver. The issue only manifests when mmc_add_host() fails during driver initialization, which is an uncommon error condition. The memory leak and crash require both specific hardware and an initialization failure to trigger.

Affected upstream versions: 2.6.29
Fixed upstream versions: 0, 4.14.303, 4.19.270, 4.9.337, 5.10.163, 5.15.86, 5.4.229, 6.0.16, 6.1.2, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 5f35c038c9f4d258b3cf77885a2730f1417d63e7
CVE-2022-50773: kernel: Linux kernel ALSA mts64 module: Denial of Service via null pointer dereference
Component: kernel
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

A flaw was found in the Linux kernel's ALSA (Advanced Linux Sound Architecture) mts64 module. A local user can trigger a null pointer dereference in the `snd_mts64_interrupt` function by repeatedly loading and unloading the `snd-mts64` module. This can lead to a kernel panic, resulting in a Denial of Service (DoS) on the system.


Affected upstream versions: 2.6.19
Fixed upstream versions: 0, 4.14.303, 4.19.270, 4.9.337, 5.10.163, 5.15.86, 5.4.229, 6.0.16, 6.1.2, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 06ec592389f2be3199779ab823c4323dcfd2121f
CVE-2022-50774: kernel: crypto: qat - fix DMA transfer direction
Component: kernel
Severity: Moderate
CWE: CWE-628 (Function Call with Incorrectly Specified Arguments)
CVSS v3: 5.3 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H)
Public date: 2025-12-24T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

crypto: qat - fix DMA transfer direction

When CONFIG_DMA_API_DEBUG is selected, while running the crypto self
test on the QAT crypto algorithms, the function add_dma_entry() reports
a warning similar to the one below, saying that overlapping mappings
are not supported. This occurs in tests where the input and the output
scatter list point to the same buffers (i.e. two different scatter lists
which point to the same chunks of memory).

The logic that implements the mapping uses the flag DMA_BIDIRECTIONAL
for both the input and the output scatter lists which leads to
overlapped write mappings. These are not supported by the DMA layer.

Fix by specifying the correct DMA transfer directions when mapping
buffers. For in-place operations where the input scatter list
matches the output scatter list, buffers are mapped once with
DMA_BIDIRECTIONAL, otherwise input buffers are mapped using the flag
DMA_TO_DEVICE and output buffers are mapped with DMA_FROM_DEVICE.
Overlapping a read mapping with a write mapping is a valid case in
dma-coherent devices like QAT.
The function that frees and unmaps the buffers, qat_alg_free_bufl()
has been changed accordingly to the changes to the mapping function.

   DMA-API: 4xxx 0000:06:00.0: cacheline tracking EEXIST, overlapping mappings aren't supported
   WARNING: CPU: 53 PID: 4362 at kernel/dma/debug.c:570 add_dma_entry+0x1e9/0x270
   ...
   Call Trace:
   dma_map_page_attrs+0x82/0x2d0
   ? preempt_count_add+0x6a/0xa0
   qat_alg_sgl_to_bufl+0x45b/0x990 [intel_qat]
   qat_alg_aead_dec+0x71/0x250 [intel_qat]
   crypto_aead_decrypt+0x3d/0x70
   test_aead_vec_cfg+0x649/0x810
   ? number+0x310/0x3a0
   ? vsnprintf+0x2a3/0x550
   ? scnprintf+0x42/0x70
   ? valid_sg_divisions.constprop.0+0x86/0xa0
   ? test_aead_vec+0xdf/0x120
   test_aead_vec+0xdf/0x120
   alg_test_aead+0x185/0x400
   alg_test+0x3d8/0x500
   ? crypto_acomp_scomp_free_ctx+0x30/0x30
   ? __schedule+0x32a/0x12a0
   ? ttwu_queue_wakelist+0xbf/0x110
   ? _raw_spin_unlock_irqrestore+0x23/0x40
   ? try_to_wake_up+0x83/0x570
   ? _raw_spin_unlock_irqrestore+0x23/0x40
   ? __set_cpus_allowed_ptr_locked+0xea/0x1b0
   ? crypto_acomp_scomp_free_ctx+0x30/0x30
   cryptomgr_test+0x27/0x50
   kthread+0xe6/0x110
   ? kthread_complete_and_exit+0x20/0x20
   ret_from_fork+0x1f/0x30


Affected upstream versions: 3.17
Fixed upstream versions: 0, 5.10.150, 5.15.75, 5.19.17, 6.0.3, 6.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 426d5bc089e7731e36b514d1beca19e777a2d653
CVE-2022-50777: kernel: Kernel: Denial of Service due to reference count leak
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 4 (CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

A flaw was found in the Linux kernel. A local attacker with low privileges and physical access could exploit a reference count leak in the `xgmiitorgmii_probe` function. This vulnerability could lead to resource exhaustion, resulting in a Denial of Service (DoS), which means the system may become unresponsive or crash.


Affected upstream versions: 4.14.74 < 4.14.303, 4.9.131 < 4.10, 4.18.12 < 4.19, 4.19
Fixed upstream versions: 0, 4.10, 4.14.303, 4.19, 4.19.270, 5.10.163, 5.15.87, 5.4.229, 6.0.19, 6.1.5, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 53526dbc8aa6b95e9fc2ab1e29b1a9145721da24
CVE-2022-50778: kernel: fortify: Fix __compiletime_strlen() under UBSAN_BOUNDS_LOCAL
Component: kernel
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-12-24T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

fortify: Fix __compiletime_strlen() under UBSAN_BOUNDS_LOCAL

With CONFIG_FORTIFY=y and CONFIG_UBSAN_LOCAL_BOUNDS=y enabled, we observe
a runtime panic while running Android's Compatibility Test Suite's (CTS)
android.hardware.input.cts.tests. This is stemming from a strlen()
call in hidinput_allocate().

__compiletime_strlen() is implemented in terms of __builtin_object_size(),
then does an array access to check for NUL-termination. A quirk of
__builtin_object_size() is that for strings whose values are runtime
dependent, __builtin_object_size(str, 1 or 0) returns the maximum size
of possible values when those sizes are determinable at compile time.
Example:

  static const char *v = "FOO BAR";
  static const char *y = "FOO BA";
  unsigned long x (int z) {
      // Returns 8, which is:
      // max(__builtin_object_size(v, 1), __builtin_object_size(y, 1))
      return __builtin_object_size(z ? v : y, 1);
  }

So when FORTIFY_SOURCE is enabled, the current implementation of
__compiletime_strlen() will try to access beyond the end of y at runtime
using the size of v. Mixed with UBSAN_LOCAL_BOUNDS we get a fault.

hidinput_allocate() has a local C string whose value is control flow
dependent on a switch statement, so __builtin_object_size(str, 1)
evaluates to the maximum string length, making all other cases fault on
the last character check. hidinput_allocate() could be cleaned up to
avoid runtime calls to strlen() since the local variable can only have
literal values, so there's no benefit to trying to fortify the strlen
call site there.

Perform a __builtin_constant_p() check against index 0 earlier in the
macro to filter out the control-flow-dependant case. Add a KUnit test
for checking the expected behavioral characteristics of FORTIFY_SOURCE
internals.


Affected upstream versions: 5.16
Fixed upstream versions: 0, 5.19.17, 6.0.3, 6.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: ed42391164e6839a48aaf4c53eefda516835e799
CVE-2022-50780: kernel: net: fix UAF issue in nfqnl_nf_hook_drop() when ops_init() failed
Component: kernel
Severity: Moderate
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

A use-after-free vulnerability was found in the Linux kernel's netfilter queue subsystem. When setting up a new network namespace, if ops->init() fails during ops_init(), the allocated data is freed but the pointer in net->gen remains pointing to the freed memory. When nfqnl_nf_hook_drop() is subsequently called during cleanup, it dereferences this invalid pointer, causing a use-after-free condition.

Statement: This flaw can be triggered by unprivileged users who have the ability to create network namespaces via the unshare() syscall. When namespace initialization fails, the cleanup path accesses freed memory, potentially causing a kernel crash. The vulnerability provides a local denial of service vector on systems where user namespaces are enabled.

Affected upstream versions: 2.6.33
Fixed upstream versions: 0, 4.19.264, 5.10.153, 5.15.77, 5.4.223, 6.0.7, 6.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 5a2ea549be94924364f6911227d99be86e8cf34a
CVE-2022-50781: kernel: amdgpu/pm: prevent array underflow in vega20_odn_edit_dpm_table()
Component: kernel
Severity: Low
CWE: CWE-839 (Numeric Range Comparison Without Minimum Check)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

An array underflow vulnerability was found in the Linux kernel's AMD GPU power management driver. In vega20_odn_edit_dpm_table(), the input_index variable is validated to be at most 2 but is not checked for negative values. Since this value is user-controlled via sysfs, a user can provide a negative value causing an out-of-bounds array read.

Statement: This flaw affects systems with AMD Vega 20 GPUs (Radeon VII) using the amdgpu driver. The vulnerability allows a local user with write access to the GPU's sysfs power management interface to trigger an out-of-bounds read by providing a negative index value. This requires access to GPU sysfs files, typically available to the GPU device owner.

Affected upstream versions: 4.20
Fixed upstream versions: 0, 5.10.163, 5.15.86, 5.4.229, 6.0.16, 6.1.2, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 4d3dc0de9c46d9f73be6bac026e40b893e37ea21