huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2022-50583: kernel: md/raid0, raid10: Don't set discard sectors for request queue
Component: kernel
Severity: Low
CWE: CWE-628 (Function Call with Incorrectly Specified Arguments)
CVSS v3: 2.3 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-12-08T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

md/raid0, raid10: Don't set discard sectors for request queue

It should use disk_stack_limits to get a proper max_discard_sectors
rather than setting a value by stack drivers.

And there is a bug. If all member disks are rotational devices,
raid0/raid10 set max_discard_sectors. So the member devices are
not ssd/nvme, but raid0/raid10 export the wrong value. It reports
warning messages in function __blkdev_issue_discard when mkfs.xfs
like this:

[ 4616.022599] ------------[ cut here ]------------
[ 4616.027779] WARNING: CPU: 4 PID: 99634 at block/blk-lib.c:50 __blkdev_issue_discard+0x16a/0x1a0
[ 4616.140663] RIP: 0010:__blkdev_issue_discard+0x16a/0x1a0
[ 4616.146601] Code: 24 4c 89 20 31 c0 e9 fe fe ff ff c1 e8 09 8d 48 ff 4c 89 f0 4c 09 e8 48 85 c1 0f 84 55 ff ff ff b8 ea ff ff ff e9 df fe ff ff <0f> 0b 48 8d 74 24 08 e8 ea d6 00 00 48 c7 c6 20 1e 89 ab 48 c7 c7
[ 4616.167567] RSP: 0018:ffffaab88cbffca8 EFLAGS: 00010246
[ 4616.173406] RAX: ffff9ba1f9e44678 RBX: 0000000000000000 RCX: ffff9ba1c9792080
[ 4616.181376] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff9ba1c9792080
[ 4616.189345] RBP: 0000000000000cc0 R08: ffffaab88cbffd10 R09: 0000000000000000
[ 4616.197317] R10: 0000000000000012 R11: 0000000000000000 R12: 0000000000000000
[ 4616.205288] R13: 0000000000400000 R14: 0000000000000cc0 R15: ffff9ba1c9792080
[ 4616.213259] FS:  00007f9a5534e980(0000) GS:ffff9ba1b7c80000(0000) knlGS:0000000000000000
[ 4616.222298] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 4616.228719] CR2: 000055a390a4c518 CR3: 0000000123e40006 CR4: 00000000001706e0
[ 4616.236689] Call Trace:
[ 4616.239428]  blkdev_issue_discard+0x52/0xb0
[ 4616.244108]  blkdev_common_ioctl+0x43c/0xa00
[ 4616.248883]  blkdev_ioctl+0x116/0x280
[ 4616.252977]  __x64_sys_ioctl+0x8a/0xc0
[ 4616.257163]  do_syscall_64+0x5c/0x90
[ 4616.261164]  ? handle_mm_fault+0xc5/0x2a0
[ 4616.265652]  ? do_user_addr_fault+0x1d8/0x690
[ 4616.270527]  ? do_syscall_64+0x69/0x90
[ 4616.274717]  ? exc_page_fault+0x62/0x150
[ 4616.279097]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 4616.284748] RIP: 0033:0x7f9a55398c6b


Affected upstream versions: 5.19
Fixed upstream versions: 0, 6.0.16, 6.1.2, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: e80bef070699d2e791badefccb1ddabd6998d468
CVE-2022-50614: kernel: Kernel: Denial of Service in pci_endpoint_test due to zero-length DMA mapping
Component: kernel
Severity: Moderate
CWE: CWE-130 (Improper Handling of Length Parameter Inconsistency)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-08T00:00:00+00:00

A flaw was found in the Linux kernel's `pci_endpoint_test` module. A local attacker with low privileges could exploit this vulnerability by providing a zero-length Direct Memory Access (DMA) mapping to the `dma_map_single()` function. This improper input validation can lead to a kernel panic, resulting in a Denial of Service (DoS) on the affected system.


Affected upstream versions: 4.15
Fixed upstream versions: 0, 5.10.148, 5.15.74, 5.19.16, 6.0.2, 6.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 0df206bdc6204b758585bbe159a55e23e7917b13
CVE-2022-50615: kernel: perf/x86/intel/uncore: Fix reference count leak in snr_uncore_mmio_map()
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-08T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

perf/x86/intel/uncore: Fix reference count leak in snr_uncore_mmio_map()

pci_get_device() will increase the reference count for the returned
pci_dev, so snr_uncore_get_mc_dev() will return a pci_dev with its
reference count increased. We need to call pci_dev_put() to decrease the
reference count. Let's add the missing pci_dev_put().


Affected upstream versions: 5.3
Fixed upstream versions: 0, 5.10.163, 5.15.86, 6.0.16, 6.1.2, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d2afced51108813256d8072c6e464b0c9f0bb890
CVE-2022-50617: kernel: drm/amdgpu/powerplay/psm: Fix memory leak in power state init
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-08T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu/powerplay/psm: Fix memory leak in power state init

Commit 902bc65de0b3 ("drm/amdgpu/powerplay/psm: return an error in power
state init") made the power state init function return early in case of
failure to get an entry from the powerplay table, but it missed to clean up
the allocated memory for the current power state before returning.


Affected upstream versions: 5.11
Fixed upstream versions: 0, 5.15.86, 6.0.16, 6.1.2, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 1caed03305b560bafea8eaa57f1847791658b3ff
CVE-2022-50619: kernel: drm/amdkfd: Fix memory leak in kfd_mem_dmamap_userptr()
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-08T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: Fix memory leak in kfd_mem_dmamap_userptr()

If the number of pages from the userptr BO differs from the SG BO then the
allocated memory for the SG table doesn't get freed before returning
-EINVAL, which may lead to a memory leak in some error paths. Fix this by
checking the number of pages before allocating memory for the SG table.


Affected upstream versions: 5.14
Fixed upstream versions: 0, 5.15.77, 6.0.7, 6.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 304a10161696d86300ceab1cbe72b2d74b8cdd94
CVE-2022-50622: kernel: Linux kernel (ext4): Memory leak due to improper handling of krealloc failure
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-08T00:00:00+00:00

A flaw was found in the Linux kernel's ext4 filesystem. This vulnerability occurs due to improper handling of memory allocation failures when the `krealloc` function returns NULL within `ext4_fc_record_modified_inode()`. A local user could potentially exploit this flaw, leading to a memory leak. This memory leak can ultimately result in a Denial of Service (DoS) condition on the affected system.


Affected upstream versions: 5.10
Fixed upstream versions: 0, 5.10.150, 5.15.75, 5.19.17, 6.0.3, 6.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: c9ce7766dc4e88e624c62a68221a3bbe8f06e856
CVE-2022-50625: kernel: serial: amba-pl011: avoid SBSA UART accessing DMACR register
Component: kernel
Severity: Moderate
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 5.8 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H)
Public date: 2025-12-08T00:00:00+00:00

A flaw was found in the Linux kernel’s AMBA-PL011 serial driver used on ARM Server Base System Architecture platforms. The existing stop_rx operation shared between generic SBSA UARTs and AMBA-PL011 UARTs invoked pl011_dma_rx_stop, which attempts to access the DMA Control Register (DMACR). SBSA generic UART hardware does not support DMA, and accessing the DMACR register on such hardwarecan trigger an unhandled data abort, causing a segmentation fault or crash.


Affected upstream versions: 4.2
Fixed upstream versions: 0, 4.14.303, 4.19.270, 4.9.337, 5.10.163, 5.15.86, 5.4.229, 6.0.16, 6.1.2, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 1c5f0d3f480abd8c26761b6b1f486822e77faea3
CVE-2022-50627: kernel: wifi: ath11k: fix monitor mode bringup crash
Component: kernel
Severity: Moderate
CWE: CWE-237 (Improper Handling of Structural Elements)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-08T00:00:00+00:00

A null pointer dereference vulnerability was found in the ath11k wireless driver in the Linux kernel. When an interface is brought up in monitor mode, the driver attempts to extract packet type from RAW monitor ring packets, which lack the expected structure. This causes a kernel crash due to dereferencing a null pointer during SKB processing.

Statement: This flaw requires local access and specific hardware (Qualcomm ath11k-based WiFi adapters like QCN9074). Monitor mode is typically used for network analysis and requires elevated privileges to enable.

Affected upstream versions: 5.6
Fixed upstream versions: 0, 6.1.16, 6.2.3, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d6ea1ca1d456bb661e5a9d104e69d2c261161115
CVE-2022-50628: kernel: drm/gud: Fix UBSAN warning
Component: kernel
Severity: Moderate
CWE: CWE-908 (Use of Uninitialized Resource)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-12-08T00:00:00+00:00

A flaw was found in the GUD (Generic USB Display) driver in the Linux kernel. Uninitialized iosys_map variables on the stack contain garbage values in their is_iomem boolean field. When iosys_map_clear() checks this field, UBSAN flags it as an invalid boolean value, indicating potential undefined behavior.

Statement: While UBSAN reports this as undefined behavior, practical exploitation is unlikely. The issue manifests as a warning rather than memory corruption. GUD is a niche driver for USB-connected displays.

Affected upstream versions: 5.13
Fixed upstream versions: 0, 6.1.16, 6.2.3, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 832f861a46039d50536dcfda0a9fb334b48d0f8b
CVE-2022-50635: kernel: powerpc/kprobes: Fix null pointer reference in arch_prepare_kprobe()
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.8 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H)
Public date: 2025-12-09T00:00:00+00:00

A flaw was found in the Linux kernel in arch_prepare_kprobe(): where certain error conditions are not properly validated before dereferencing a pointer. Under specific circumstances, this can result in a NULL pointer dereference in kernel space. If triggered, the kernel may generate an oops or panic, causing the system to become unstable or crash.


Affected upstream versions: 5.8
Fixed upstream versions: 0, 5.15.75, 5.19.17, 6.0.3, 6.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 7f536a8cb62dd5c084f112373fc34cdb5168a813
CVE-2022-50637: kernel: cpufreq: qcom-hw: Fix memory leak in qcom_cpufreq_hw_read_lut()
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-09T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

cpufreq: qcom-hw: Fix memory leak in qcom_cpufreq_hw_read_lut()

If "cpu_dev" fails to get opp table in qcom_cpufreq_hw_read_lut(),
the program will return, resulting in "table" resource is not released.


Affected upstream versions: 5.9
Fixed upstream versions: 0, 5.10.163, 5.15.86, 6.0.16, 6.1.2, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 3ef12a4a8ef5553af9c3fd2719a616637a102568
CVE-2022-50638: kernel: ext4: fix bug_on in __es_tree_search caused by bad boot loader inode
Component: kernel
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-12-09T00:00:00+00:00

A flaw was identified in the ext4 filesystem implementation in the Linux kernel where a malformed or improperly initialized boot loader inode could trigger a BUG_ON() condition inside the __es_tree_search() function. This occurs when the inode’s mode (imode) is an unexpected type and the code does not properly handle it, leading to a deliberate kernel bug assertion and invalid opcode execution. Under certain conditions, this flaw can be triggered by local filesystem operations, causing a kernel crash


Affected upstream versions: 3.10
Fixed upstream versions: 0, 4.14.303, 4.19.270, 4.9.337, 5.10.163, 5.15.87, 5.4.229, 6.0.18, 6.1.4, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: e76ede9d2c9e0af4573342b56d7cdbf757c18084
CVE-2022-50640: kernel: mmc: core: Fix kernel panic when remove non-standard SDIO card
Component: kernel
Severity: Moderate
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 5.1 (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-09T00:00:00+00:00

A flaw in the Linux kernel mmc core driver was discovered that could lead to a kernel panic and memory corruption when a non-standard SDIO card is removed. The Vulnerability arises because SDIO tuples are only allocated for standard SDIO cards, resulting in an inconsistent reference count for the device structure. When the non-standard card is removed, the reference counter is decremented without the corresponding earlier increment, potentially triggering use of freed memory or panic conditions. A local user with access to the affected subsystem could trigger this behavior, causing the kernel to crash.


Affected upstream versions: 2.6.36
Fixed upstream versions: 0, 4.14.298, 4.19.264, 4.9.332, 5.10.153, 5.15.77, 5.4.223, 6.0.7, 6.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: b8b2965932e702b21e335ff30e1bb550f5a23b6f
CVE-2022-50642: kernel: platform/chrome: cros_ec_typec: zero out stale pointers
Component: kernel
Severity: Moderate
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-09T00:00:00+00:00

A use-after-free vulnerability exists in the Chrome EC Type-C driver in the Linux kernel. When cros_typec_get_switch_handles() fails to obtain switch handles, it frees allocated pointers but doesn't zero them out. These stale pointers can later be dereferenced, causing use-after-free or double-free conditions.

Statement: This vulnerability is specific to ChromeOS/Chromebook hardware using the Chrome Embedded Controller for USB Type-C management. Standard Linux systems without this hardware are unaffected.

Affected upstream versions: 5.9
Fixed upstream versions: 0, 5.15.86, 6.0.16, 6.1.2, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 0ceadb5a3e45f1b81cf54bd496b40a5e50b6bd40
CVE-2022-50645: kernel: EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper()
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-09T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper()

As the comment of pci_get_domain_bus_and_slot() says, it returns
a PCI device with refcount incremented, so it doesn't need to
call an extra pci_dev_get() in pci_get_dev_wrapper(), and the PCI
device needs to be put in the error path.


Affected upstream versions: 5.1
Fixed upstream versions: 0, 5.10.163, 5.15.86, 5.4.229, 6.0.16, 6.1.2, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: e6e295a434d1c917a017980389aec88bf35cc81b
CVE-2022-50653: kernel: mmc: atmel-mci: fix return value check of mmc_add_host()
Component: kernel
Severity: Low
CWE: CWE-252 (Unchecked Return Value)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-09T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

mmc: atmel-mci: fix return value check of mmc_add_host()

mmc_add_host() may return error, if we ignore its return value,
it will lead two issues:
1. The memory that allocated in mmc_alloc_host() is leaked.
2. In the remove() path, mmc_remove_host() will be called to
   delete device, but it's not added yet, it will lead a kernel
   crash because of null-ptr-deref in device_del().

So fix this by checking the return value and calling mmc_free_host()
in the error path.


Affected upstream versions: 2.6.27
Fixed upstream versions: 0, 4.19.270, 5.10.163, 5.15.86, 5.4.229, 6.0.16, 6.1.2, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 99a6cdfa2cf05028b52f6d8ee85ccc5f8b71b4a2
CVE-2022-50661: kernel: seccomp: Move copy_seccomp() to no failure path
Component: kernel
Severity: Low
CWE: CWE-911 (Improper Update of Reference Count)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-09T00:00:00+00:00

A memory leak flaw was found in the Linux kernel's seccomp subsystem. When a process using seccomp filters is interrupted by a fatal signal during clone(), the seccomp_filter structure and associated BPF program memory are not properly freed. This occurs because copy_seccomp() is called before the fatal_signal_pending() check, leaving allocated resources unreleased on the error path.

Statement: Triggering this leak requires precise timing between signal delivery and clone() execution. While repeated exploitation could lead to memory exhaustion, practical impact is limited.

Affected upstream versions: 5.9
Fixed upstream versions: 0, 5.10.180, 5.15.86, 6.0.16, 6.1.2, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d4a895e924b486f2a38463114509e1088ef4d7f5
CVE-2022-50663: kernel: net: stmmac: fix possible memory leak in stmmac_dvr_probe()
Component: kernel
Severity: Moderate
CWE: CWE-771 (Missing Reference to Active Allocated Resource)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-09T00:00:00+00:00

A memory leak vulnerability was found in the stmmac network driver in the Linux kernel. When create_singlethread_workqueue() fails during probe, the previously allocated bitmap (priv->af_xdp_zc_qps) is not freed. This can lead to memory resource exhaustion if the error condition is repeatedly triggered.

Statement: This is a memory leak in the stmmac Ethernet driver's probe function. The leak occurs only when workqueue creation fails, which is an uncommon error condition. The impact is limited as it requires specific failure conditions during driver initialization.

Affected upstream versions: 5.13
Fixed upstream versions: 0, 5.15.86, 6.0.16, 6.1.2, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 96e50897029f65222ef76cfe9bc802321fcea33b
CVE-2022-50667: kernel: drm/vmwgfx: Fix memory leak in vmw_mksstat_add_ioctl()
Component: kernel
Severity: Low
CWE: CWE-771 (Missing Reference to Active Allocated Resource)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-09T00:00:00+00:00

A memory leak vulnerability was found in the VMware graphics driver (vmwgfx) in the Linux kernel. In vmw_mksstat_add_ioctl(), when copying the description string from userspace fails with -EFAULT, the allocated page for the instance descriptor is not freed. This leads to memory leakage that can cause resource exhaustion.

Statement: This is a memory leak in the VMware graphics driver affecting systems running as VMware guests. The leak occurs only when copying data from userspace fails, which limits the attack surface to local users with graphics access.

Affected upstream versions: 5.15
Fixed upstream versions: 0, 5.15.75, 5.19.17, 6.0.3, 6.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: b47a37ad4a444d82f9caf153a79d090b79786ebb
CVE-2022-50668: kernel: ext4: fix deadlock due to mbcache entry corruption
Component: kernel
Severity: Moderate
CWE: CWE-821 (Incorrect Synchronization)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-09T00:00:00+00:00

A deadlock vulnerability was found in the ext4 filesystem in the Linux kernel. When manipulating extended attribute (xattr) blocks, a race condition in non-atomic bitfield updates can cause the mbcache entry state to become corrupted. This leads to an infinite loop in ext4_xattr_block_set() where the code repeatedly finds an xattr block for reuse but cannot use it due to an inconsistent reference count state, causing a system hang.

Statement: This is a deadlock issue in ext4 filesystem's extended attribute handling that can cause system hangs. The vulnerability requires local access and specific xattr operations to trigger but can result in complete system unavailability when exploited.

Affected upstream versions: 4.6
Fixed upstream versions: 0, 4.19.270, 5.10.163, 5.15.87, 5.4.229, 6.0.18, 6.1.4, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: efaa0ca678f56d47316a08030b2515678cebbc50
CVE-2022-50670: kernel: mmc: omap_hsmmc: fix return value check of mmc_add_host()
Component: kernel
Severity: Low
CWE: CWE-252 (Unchecked Return Value)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-09T00:00:00+00:00

A flaw was found in the OMAP HSMMC driver in the Linux kernel. The driver does not check the return value of mmc_add_host(), which can lead to a memory leak from mmc_alloc_host() and a null pointer dereference crash in mmc_remove_host() when attempting to remove a device that was never successfully added.

Statement: This issue only affects systems with OMAP hardware (primarily ARM-based embedded/mobile platforms). Standard x86 enterprise deployments are not impacted by this vulnerability.

Affected upstream versions: 2.6.29
Fixed upstream versions: 0, 5.10.163, 5.15.86, 5.4.229, 6.0.16, 6.1.2, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: f153c9e15f8961bdf38707853e15b42ea7c691d9
CVE-2022-50671: kernel: RDMA/rxe: Fix "kernel NULL pointer dereference" error
Component: kernel
Severity: Moderate
CWE: CWE-824 (Access of Uninitialized Pointer)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-09T00:00:00+00:00

A NULL pointer dereference vulnerability was found in the RXE (Soft-RoCE) RDMA driver in the Linux kernel. When rxe_queue_init() fails during queue pair initialization in rxe_qp_init_req(), the task function and argument pointers (qp->req.task.func and qp->req.task.arg) remain uninitialized. The cleanup function rxe_qp_do_cleanup() then attempts to use these uninitialized pointers when calling __rxe_do_task(), causing a kernel NULL pointer dereference.

Statement: This is a NULL pointer dereference in the Soft-RoCE RDMA driver that can cause a kernel crash. The vulnerability requires local access and the ability to create RDMA queue pairs, limiting the attack surface to users with RDMA access.

Affected upstream versions: 4.8
Fixed upstream versions: 0, 4.14.296, 4.19.262, 4.9.331, 5.10.150, 5.15.75, 5.19.17, 5.4.220, 6.0.3, 6.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 48cd7098e71735ccafa0b3cf27c53924f9cb5b2f