huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2022-50006: kernel: NFSv4.2 fix problems with __nfs42_ssc_open
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-06-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

NFSv4.2 fix problems with __nfs42_ssc_open

A destination server while doing a COPY shouldn't accept using the
passed in filehandle if its not a regular filehandle.

If alloc_file_pseudo() has failed, we need to decrement a reference
on the newly created inode, otherwise it leaks.


Affected upstream versions: 5.5
Fixed upstream versions: 0, 5.10.140, 5.15.64, 5.19.6, 6.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 5e49ea099850feadcbf33c74b4f514a3e8049b91
CVE-2022-50007: kernel: xfrm: fix refcount leak in __xfrm_policy_check()
Component: kernel
Severity: Low
CWE: CWE-911 (Improper Update of Reference Count)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-06-18T00:00:00+00:00

A flaw was found in the XFRM subsystem in the Linux kernel. A missing decrement of the reference count when an error occurs will cause a memory leak, potentially impacting system performance and resulting in a denial of service.

Statement: This issue has been fixed in Red Hat Enterprise Linux 8.8 and 9.2 via RHSA-2023:2951 [1] and RHSA-2023:2458 [2], respectively.

[1]. https://access.redhat.com/errata/RHSA-2023:2951

[2]. https://access.redhat.com/errata/RHSA-2023:2458

Affected upstream versions: 2.6.19
Fixed upstream versions: 0, 4.14.292, 4.19.257, 4.9.327, 5.10.140, 5.15.64, 5.19.6, 5.4.212, 6.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 18e6b6e2555c93f5ca09f2b85ef1fa025c8accea
CVE-2022-50015: kernel: ASoC: SOF: Intel: hda-ipc: Do not process IPC reply before firmware boot
Component: kernel
Severity: Moderate
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-06-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ASoC: SOF: Intel: hda-ipc: Do not process IPC reply before firmware boot

It is not yet clear, but it is possible to create a firmware so broken
that it will send a reply message before a FW_READY message (it is not
yet clear if FW_READY will arrive later).
Since the reply_data is allocated only after the FW_READY message, this
will lead to a NULL pointer dereference if not filtered out.

The issue was reported with IPC4 firmware but the same condition is present
for IPC3.


Affected upstream versions: 5.2
Fixed upstream versions: 0, 5.19.4, 6.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 48945246cf802b9866f3a821103f1a7a196baf68
CVE-2022-50016: kernel: ASoC: SOF: Intel: cnl: Do not process IPC reply before firmware boot
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 4.1 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-06-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ASoC: SOF: Intel: cnl: Do not process IPC reply before firmware boot

It is not yet clear, but it is possible to create a firmware so broken
that it will send a reply message before a FW_READY message (it is not
yet clear if FW_READY will arrive later).
Since the reply_data is allocated only after the FW_READY message, this
will lead to a NULL pointer dereference if not filtered out.

The issue was reported with IPC4 firmware but the same condition is present
for IPC3.


Affected upstream versions: 5.2
Fixed upstream versions: 0, 5.19.4, 6.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 230f646085d17a008b609eb8fe8befb8811868f0
CVE-2022-50019: kernel: tty: serial: Fix refcount leak bug in ucc_uart.c
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-06-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

tty: serial: Fix refcount leak bug in ucc_uart.c

In soc_info(), of_find_node_by_type() will return a node pointer
with refcount incremented. We should use of_node_put() when it is
not used anymore.


Affected upstream versions: 2.6.25
Fixed upstream versions: 0, 4.14.291, 4.19.256, 4.9.326, 5.10.138, 5.15.63, 5.19.4, 5.4.211, 6.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 8245e7d1d7f75a9255ad1e8146752e5051d528b8
CVE-2022-50020: kernel: ext4: avoid resizing to a partial cluster size
Component: kernel
Severity: Moderate
CWE: CWE-1284 (Improper Validation of Specified Quantity in Input)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-06-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ext4: avoid resizing to a partial cluster size

This patch avoids an attempt to resize the filesystem to an
unaligned cluster boundary.  An online resize to a size that is not
integral to cluster size results in the last iteration attempting to
grow the fs by a negative amount, which trips a BUG_ON and leaves the fs
with a corrupted in-memory superblock.


Affected upstream versions: 4.15
Fixed upstream versions: 0, 4.19.256, 5.10.138, 5.15.63, 5.19.4, 5.4.211, 6.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 7bdfb01fc5f6b3696728aeb527c50386e0ee09a1
CVE-2022-50021: kernel: ext4: block range must be validated before use in ext4_mb_clear_bb()
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-06-18T00:00:00+00:00

A use-after-free vulnerability exists in the linux kernel, such thatthe  Block range to free is validated in ext4_free_blocks() using ext4_inode_block_valid() and then it's passed to ext4_mb_clear_bb().However, in some situations on bigalloc file system the range might be adjusted after the validation in ext4_free_blocks() which can lead to corrupted file systems


Affected upstream versions: 3.2
Fixed upstream versions: 0, 5.10.175, 5.15.103, 5.19.4, 6.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 7550aade978371ac582f6d43b14c4cb89ca54463
CVE-2022-50022: kernel: drivers:md:fix a potential use-after-free bug
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-06-18T00:00:00+00:00

A use-after-free bug exists in the linux kernel such that in the line  "raid5_release_stripe(sh);" drops the reference to sh and
may cause sh to be released. However, sh is subsequently used in lines "if (sh->batch_head && sh != sh->batch_head)" resulting in a minor application crash.


Affected upstream versions: 4.1
Fixed upstream versions: 0, 4.14.291, 4.19.256, 4.9.326, 5.10.138, 5.15.63, 5.19.4, 5.4.211, 6.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 7470a4314b239e9a9580f248fdf4c9a92805490e
CVE-2022-50027: kernel: scsi: lpfc: Fix possible memory leak when failing to issue CMF WQE
Component: kernel
Severity: Low
CWE: CWE-401 (Missing Release of Memory after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-06-18T00:00:00+00:00

A flaw was found in the lpfc module in the Linux kernel. A missing release of allocated memory when an error occurs will cause a memory leak, potentially impacting system performance and resulting in a denial of service.

Statement: This issue has been fixed in Red Hat Enterprise Linux 8.7 and 9.1 via RHSA-2022:7683 [1] and RHSA-2022:8267 [2], respectively.

[1]. https://access.redhat.com/errata/RHSA-2022:7683

[2]. https://access.redhat.com/errata/RHSA-2022:8267

Affected upstream versions: 5.15
Fixed upstream versions: 0, 5.15.63, 5.19.4, 6.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 9c8e2e607270a368834a0ef72aa82d970f89c596
CVE-2022-50028: kernel: gadgetfs: ep_io - wait until IRQ finishes
Component: kernel
Severity: Moderate
CWE: CWE-121 (Stack-based Buffer Overflow)
CVSS v3: 5.3 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H)
Public date: 2025-06-18T00:00:00+00:00

A flaw was found in the gadgetfs module in the Linux kernel. If the wait_for_completion_interruptible() function is interrupted, the driver does not wait for the interrupt to finish, causing stack corruption and resulting in a denial of service.

Statement: This issue has been fixed in Red Hat Enterprise Linux 9.2 via RHSA-2023:2458 [1].

[1]. https://access.redhat.com/errata/RHSA-2023:2458

Affected upstream versions: 2.6.12
Fixed upstream versions: 0, 4.14.291, 4.19.256, 4.9.326, 5.10.138, 5.15.63, 5.19.4, 5.4.211, 6.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 67a4874461422e633236a0286a01b483cd647113
CVE-2022-50030: kernel: scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input
Component: kernel
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-06-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input

Malformed user input to debugfs results in buffer overflow crashes.  Adapt
input string lengths to fit within internal buffers, leaving space for NULL
terminators.


Affected upstream versions: 4.11
Fixed upstream versions: 0, 5.10.138, 5.15.63, 5.19.4, 5.4.211, 6.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 927907f1cbb3408cadde637fccfc17bb6b10a87d
CVE-2022-50032: kernel: usb: renesas: Fix refcount leak bug
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-06-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

usb: renesas: Fix refcount leak bug

In usbhs_rza1_hardware_init(), of_find_node_by_name() will return
a node pointer with refcount incremented. We should use of_node_put()
when it is not used anymore.


Affected upstream versions: 4.16
Fixed upstream versions: 0, 4.19.256, 5.10.138, 5.15.63, 5.19.4, 5.4.211, 6.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 36b18b777dece704b7c2e9e7947ca41a9b0fb009
CVE-2022-50033: kernel: usb: host: ohci-ppc-of: Fix refcount leak bug
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-06-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

usb: host: ohci-ppc-of: Fix refcount leak bug

In ohci_hcd_ppc_of_probe(), of_find_compatible_node() will return
a node pointer with refcount incremented. We should use of_node_put()
when it is not used anymore.


Affected upstream versions: 2.6.29
Fixed upstream versions: 0, 4.14.291, 4.19.256, 4.9.326, 5.10.138, 5.15.63, 5.19.4, 5.4.211, 6.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: fe6fe64403710287f0ae61a516954d8a4f7c9e3f
CVE-2022-50034: kernel: usb: cdns3 fix use-after-free at workaround 2
Component: kernel
Severity: Moderate
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-06-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

usb: cdns3 fix use-after-free at workaround 2

BUG: KFENCE: use-after-free read in __list_del_entry_valid+0x10/0xac

cdns3_wa2_remove_old_request()
{
	...
	kfree(priv_req->request.buf);
	cdns3_gadget_ep_free_request(&priv_ep->endpoint, &priv_req->request);
	list_del_init(&priv_req->list);
	^^^ use after free
	...
}

cdns3_gadget_ep_free_request() free the space pointed by priv_req,
but priv_req is used in the following list_del_init().

This patch move list_del_init() before cdns3_gadget_ep_free_request().


Affected upstream versions: 5.3
Fixed upstream versions: 0, 5.10.138, 5.15.63, 5.19.4, 5.4.211, 6.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: e65d9b7147d7be3504893ca7dfb85286bda83d40
CVE-2022-50037: kernel: drm/i915/ttm: don't leak the ccs state
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-06-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/i915/ttm: don't leak the ccs state

The kernel only manages the ccs state with lmem-only objects, however
the kernel should still take care not to leak the CCS state from the
previous user.

(cherry picked from commit 353819d85f87be46aeb9c1dd929d445a006fc6ec)


Affected upstream versions: 5.19
Fixed upstream versions: 0, 5.19.4, 6.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: b431cffb4883b9e90d48f0c408674c50fef428a5
CVE-2022-50039: kernel: stmmac: intel: Add a missing clk_disable_unprepare() call in intel_eth_pci_remove()
Component: kernel
Severity: Moderate
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-06-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

stmmac: intel: Add a missing clk_disable_unprepare() call in intel_eth_pci_remove()

Commit 09f012e64e4b ("stmmac: intel: Fix clock handling on error and remove
paths") removed this clk_disable_unprepare()

This was partly revert by commit ac322f86b56c ("net: stmmac: Fix clock
handling on remove path") which removed this clk_disable_unprepare()
because:
"
   While unloading the dwmac-intel driver, clk_disable_unprepare() is
   being called twice in stmmac_dvr_remove() and
   intel_eth_pci_remove(). This causes kernel panic on the second call.
"

However later on, commit 5ec55823438e8 ("net: stmmac: add clocks management
for gmac driver") has updated stmmac_dvr_remove() which do not call
clk_disable_unprepare() anymore.

So this call should now be called from intel_eth_pci_remove().


Affected upstream versions: 5.10.81 < 5.10.138, 5.13
Fixed upstream versions: 0, 5.10.138, 5.15.63, 5.19.4, 6.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 02f3642d8e657c05f382729c165bed46745dc18c
CVE-2022-50042: kernel: net: genl: fix error path memory leak in policy dumping
Component: kernel
Severity: Low
CWE: CWE-401 (Missing Release of Memory after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-06-18T00:00:00+00:00

A flaw was found in the netlink driver in the Linux kernel. A memory leak can occur when allocated memory is not released in certain error cases, potentially impacting system performance and resulting in a denial of service.

Statement: This issue has been fixed in Red Hat Enterprise Linux 8.5, 9.2 and 9.3 via RHSA-2021:4356 [1], RHSA-2023:7370 [2] and RHSA-2023:6583 [3], respectively.

[1]. https://access.redhat.com/errata/RHSA-2021:4356

[2]. https://access.redhat.com/errata/RHSA-2023:7370

[3]. https://access.redhat.com/errata/RHSA-2023:6583

Affected upstream versions: 5.10
Fixed upstream versions: 0, 5.10.138, 5.15.63, 5.19.4, 6.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 83411c9f05d5a8b637293b3389eca3d378197c04
CVE-2022-50044: kernel: net: qrtr: start MHI channel after endpoit creation
Component: kernel
Severity: Moderate
CWE: CWE-908 (Use of Uninitialized Resource)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-06-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: qrtr: start MHI channel after endpoit creation

MHI channel may generates event/interrupt right after enabling.
It may leads to 2 race conditions issues.

1)
Such event may be dropped by qcom_mhi_qrtr_dl_callback() at check:

	if (!qdev || mhi_res->transaction_status)
		return;

Because dev_set_drvdata(&mhi_dev->dev, qdev) may be not performed at
this moment. In this situation qrtr-ns will be unable to enumerate
services in device.
---------------------------------------------------------------

2)
Such event may come at the moment after dev_set_drvdata() and
before qrtr_endpoint_register(). In this case kernel will panic with
accessing wrong pointer at qcom_mhi_qrtr_dl_callback():

	rc = qrtr_endpoint_post(&qdev->ep, mhi_res->buf_addr,
				mhi_res->bytes_xferd);

Because endpoint is not created yet.
--------------------------------------------------------------
So move mhi_prepare_for_transfer_autoqueue after endpoint creation
to fix it.


Affected upstream versions: 5.11
Fixed upstream versions: 0, 5.15.63, 5.19.4, 6.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: c682fb70a7dfc25b848a4ff3a385b0471b470606
CVE-2022-50046: kernel: net/sunrpc: fix potential memory leaks in rpc_sysfs_xprt_state_change()
Component: kernel
Severity: Low
CWE: CWE-911 (Improper Update of Reference Count)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-06-18T00:00:00+00:00

A flaw was found in the sunrpc module in the Linux kernel. A missing decrement of the reference count when an error occurs can cause a memory leak, and a missing check can cause a NULL pointer dereference, potentially resulting in a denial of service.

Statement: This issue has been fixed in Red Hat Enterprise Linux 8.9 and 9.2 via RHSA-2023:7077 [1] and RHSA-2023:2458 [2], respectively.

[1]. https://access.redhat.com/errata/RHSA-2023:7077

[2]. https://access.redhat.com/errata/RHSA-2023:2458

Affected upstream versions: 5.14
Fixed upstream versions: 0, 5.15.63, 5.19.4, 6.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: c0434f0e058648649250b8ed6078b66d773de723
CVE-2022-50048: kernel: netfilter: nf_tables: possible module reference underflow in error path
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-06-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: possible module reference underflow in error path

dst->ops is set on when nft_expr_clone() fails, but module refcount has
not been bumped yet, therefore nft_expr_destroy() leads to module
reference underflow.


Affected upstream versions: 5.11
Fixed upstream versions: 0, 5.15.63, 5.19.4, 6.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: b59bee8b05b0e789b5a298cacb09e8aaa3367a29
CVE-2022-50049: kernel: ASoC: DPCM: Don't pick up BE without substream
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.3 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H)
Public date: 2025-06-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ASoC: DPCM: Don't pick up BE without substream

When DPCM tries to add valid BE connections at dpcm_add_paths(), it
doesn't check whether the picked BE actually supports for the given
stream direction.  Due to that, when an asymmetric BE stream is
present, it picks up wrongly and this may result in a NULL dereference
at a later point where the code assumes the existence of a
corresponding BE substream.

This patch adds the check for the presence of the substream for the
target BE for avoiding the problem above.

Note that we have already some fix for non-existing BE substream at
commit 6246f283d5e0 ("ASoC: dpcm: skip missing substream while
applying symmetry").  But the code path we've hit recently is rather
happening before the previous fix.  So this patch tries to fix at
picking up a BE instead of parsing BE lists.


Affected upstream versions: 5.17
Fixed upstream versions: 0, 5.19.4, 6.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: aa803e6ecac78e93b24ebefa17c207d6392d8ad4
CVE-2022-50050: kernel: ASoC: SOF: Intel: hda: Fix potential buffer overflow by snprintf()
Component: kernel
Severity: Moderate
CWE: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'))
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-06-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ASoC: SOF: Intel: hda: Fix potential buffer overflow by snprintf()

snprintf() returns the would-be-filled size when the string overflows
the given buffer size, hence using this value may result in the buffer
overflow (although it's unrealistic).

This patch replaces with a safer version, scnprintf() for papering
over such a potential issue.


Affected upstream versions: 5.10
Fixed upstream versions: 0, 5.15.63, 5.19.4, 6.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 6ee1310f4d148dbf04c4159b88afd0b941018903
CVE-2022-50051: kernel: ASoC: SOF: debug: Fix potential buffer overflow by snprintf()
Component: kernel
Severity: Moderate
CWE: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'))
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-06-18T00:00:00+00:00

A potential classic buffer overflow exists in the linux kernel, such that when snprintf() returns the would-be-filled size when the string overflows the given buffer size, hence using this value may result in the buffer overflow.


Affected upstream versions: 5.11
Fixed upstream versions: 0, 5.15.63, 5.19.4, 6.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: b318b9dd2ac67f39d0338ce563879d1f59a0347a
CVE-2022-50052: kernel: ASoC: Intel: avs: Fix potential buffer overflow by snprintf()
Component: kernel
Severity: Moderate
CWE: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'))
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-06-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ASoC: Intel: avs: Fix potential buffer overflow by snprintf()

snprintf() returns the would-be-filled size when the string overflows
the given buffer size, hence using this value may result in a buffer
overflow (although it's unrealistic).

This patch replaces it with a safer version, scnprintf() for papering
over such a potential issue.


Affected upstream versions: 5.19
Fixed upstream versions: 0, 5.19.4, 6.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 840311a09f75632b9d41fbc1cd5c7aea94ce5f7e
CVE-2022-50053: kernel: iavf: Fix reset error handling
Component: kernel
Severity: Moderate
CWE: CWE-833 (Deadlock)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-06-18T00:00:00+00:00

A deadlock condition exists in the linux kernel such that when calling iavf_close in iavf_reset_task error handling,doing so can
lead to double call of napi_disable thereby leading to a denial of service due to the deadlock.


Affected upstream versions: 4.14
Fixed upstream versions: 0, 5.15.63, 5.19.4, 6.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 743dc4377bbac06a6fe44c3c5baf75a49439678a