huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2022-50386: kernel: Bluetooth: L2CAP: Fix user-after-free
Component: kernel
Severity: Moderate
CVSS v3: 7.6 (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H)
Public date: 2025-09-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: Fix user-after-free

This uses l2cap_chan_hold_unless_zero() after calling
__l2cap_get_chan_blah() to prevent the following trace:

Bluetooth: l2cap_core.c:static void l2cap_chan_destroy(struct kref
*kref)
Bluetooth: chan 0000000023c4974d
Bluetooth: parent 00000000ae861c08
==================================================================
BUG: KASAN: use-after-free in __mutex_waiter_is_first
kernel/locking/mutex.c:191 [inline]
BUG: KASAN: use-after-free in __mutex_lock_common
kernel/locking/mutex.c:671 [inline]
BUG: KASAN: use-after-free in __mutex_lock+0x278/0x400
kernel/locking/mutex.c:729
Read of size 8 at addr ffff888006a49b08 by task kworker/u3:2/389

Statement: A use-after-free in the Bluetooth L2CAP subsystem could occur when handling channel responses in l2cap_connect_create_rsp(), due to missing reference checks. This condition can be triggered during race conditions between channel creation and teardown, leading to kernel crashes. Exploitation is most practical as a local or adjacent denial of service over Bluetooth.

L2CAP underpins many Bluetooth profiles and services (BLE ATT/GATT, RFCOMM, A2DP/AVRCP, HID, PAN, SDP, OBEX, etc.). Any profile that creates logical L2CAP channels may be involved. Common real-world triggers include BLE GATT interactions, audio profiles, HID devices, and tethering/PAN connections.

An attacker within radio range can attempt to repeatedly open/close or otherwise race L2CAP channels to increase likelihood of the race (fast connect/disconnect storms or parallel requests).

Most realistic impact is a local/adjacent attacker (in Bluetooth radio range) who can actively interact with the target Bluetooth stack.

The CIA=HHH for CVSS is a conservative/precautionary assessment. In practical terms, successful privilege escalation or remote compromise is unlikely but theoretically possible: to do so an attacker would need to craft a sequence that causes controlled memory corruption and further exploit kernel memory layout — substantially harder than causing a crash.

Affected upstream versions: 3.4
Fixed upstream versions: 0, 4.14.296, 4.19.262, 4.9.331, 5.10.150, 5.15.75, 5.19.17, 5.4.220, 6.0.3, 6.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 11e40d6c0823f699d8ad501e48d1c3ae4be386cd
CVE-2022-50389: kernel: tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-09-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak

In crb_acpi_add(), we get the TPM2 table to retrieve information
like start method, and then assign them to the priv data, so the
TPM2 table is not used after the init, should be freed, call
acpi_put_table() to fix the memory leak.


Affected upstream versions: 4.0
Fixed upstream versions: 0, 4.14.303, 4.19.270, 5.10.163, 5.15.87, 5.4.229, 6.0.17, 6.1.3, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 08fd965521d0e172d540cf945517810895fcb199
CVE-2022-50390: kernel: Linux kernel: Denial of Service and information disclosure via undefined bit shift in drm/ttm
Component: kernel
Severity: Moderate
CWE: CWE-1335 (Incorrect Bitwise Shift of Integer)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L)
Public date: 2025-09-18T00:00:00+00:00

A flaw was found in the Linux kernel's `drm/ttm` component. A local user could exploit an undefined behavior in bit shifting, specifically when a signed 32-bit value is shifted by 31 bits, which cannot be represented in an 'int' type. This vulnerability could lead to local information disclosure, potentially revealing sensitive system details. Additionally, it can result in a kernel warning or panic, causing a Denial of Service (DoS) for the affected system.

Statement: This vulnerability is rated Low for Red Hat. The flaw in the Linux kernel's drm/ttm component, specifically an undefined behavior in bit shifting, could lead to local information disclosure and denial of service. This vulnerability could theoretically affect integrity, though it is unlikely and non-deterministic. Similarly, availability may be affected as the flaw can result in a kernel warning or panic.

Affected upstream versions: 5.10
Fixed upstream versions: 0, 5.15.199, 6.0.16, 6.1.2, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: c4079a34c0adef9f35a16783fb13a9084406f96d
CVE-2022-50392: kernel: Linux kernel: Denial of Service in ASoC Mediatek due to refcount leak
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-09-18T00:00:00+00:00

A flaw was found in the Linux kernel. A local user could exploit a refcount leak in the Audio System on Chip (ASoC) Mediatek component, specifically within the `mt8183_mt6358_ts3a227_max98357_dev_probe()` function. This vulnerability could lead to a Denial of Service (DoS) due to resource exhaustion.


Affected upstream versions: 5.2
Fixed upstream versions: 0, 5.15.86, 6.0.16, 6.1.2, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 82f7c814edda353b4781f356d3ab90e943d5eac4
CVE-2022-50393: kernel: drm/amdgpu: SDMA update use unlocked iterator
Component: kernel
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-09-18T00:00:00+00:00

A denial of service exists in the linux kernel such that there is a SDMA update page table may be called from an unlocked context, leading to damage to system availability and integrity.


Affected upstream versions: 4.2
Fixed upstream versions: 0, 5.19.17, 6.0.3, 6.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: b892c57a3a04c8de247ab9ee08a0a8cf53290e19
CVE-2022-50402: kernel: drivers/md/md-bitmap: check the return value of md_bitmap_get_counter()
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.2 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H)
Public date: 2025-09-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drivers/md/md-bitmap: check the return value of md_bitmap_get_counter()

Check the return value of md_bitmap_get_counter() in case it returns
NULL pointer, which will result in a null pointer dereference.

v2: update the check to include other dereference


Affected upstream versions: 3.5
Fixed upstream versions: 0, 4.19.270, 5.10.163, 5.15.86, 5.4.229, 6.0.16, 6.1.2, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 21e9aac9a74d30907d44bae0d24c036cb3819406
CVE-2022-50408: kernel: wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit()
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-09-18T00:00:00+00:00

A use after free exists in the wifi module of the linux kernel in the function brcmf_netdev_start_xmit(),thereby leading to damage to system availability and integrity.

Statement: A Use-After-Free vulnerability was found in brcmf_netdev_start_xmit() in the Broadcom brcmfmac driver.
The function updated ndev->stats.tx_bytes after calling brcmf_proto_tx_queue_data(), which may complete asynchronously and free the skb object before accessing it.
The patch stores skb->len in a local variable before the transmission call to prevent dereferencing freed memory.
Privilege required is low (PR:L) since the issue is triggered during normal packet transmission from a network interface, accessible to local processes using networking APIs.

Affected upstream versions: 3.9
Fixed upstream versions: 0, 4.14.296, 4.19.262, 5.10.150, 5.15.75, 5.19.17, 5.4.220, 6.0.3, 6.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 1613a7b24f1a7467cb727ba3ec77c9a808383560
CVE-2022-50410: kernel: NFSD: Protect against send buffer overflow in NFSv2 READ
Component: kernel
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 7.1 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H)
Public date: 2025-09-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Protect against send buffer overflow in NFSv2 READ

Since before the git era, NFSD has conserved the number of pages
held by each nfsd thread by combining the RPC receive and send
buffers into a single array of pages. This works because there are
no cases where an operation needs a large RPC Call message and a
large RPC Reply at the same time.

Once an RPC Call has been received, svc_process() updates
svc_rqst::rq_res to describe the part of rq_pages that can be
used for constructing the Reply. This means that the send buffer
(rq_res) shrinks when the received RPC record containing the RPC
Call is large.

A client can force this shrinkage on TCP by sending a correctly-
formed RPC Call header contained in an RPC record that is
excessively large. The full maximum payload size cannot be
constructed in that case.

Statement: A logic flaw in the NFSv2 server implementation could allow a remote NFS client to trigger a send-buffer overflow by sending a valid but excessively large RPC Call header, resulting in an oversized READ request exceeding the available response buffer. Successful exploitation could lead to memory corruption and potential denial of service (kernel crash).

Affected upstream versions: 2.6.19
Fixed upstream versions: 0, 5.10.220, 5.15.75, 5.19.17, 6.0.3, 6.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 2007867c5874134f2271eb276398208070049dd3
CVE-2022-50412: kernel: drm: bridge: adv7511: unregister cec i2c device after cec adapter
Component: kernel
Severity: Moderate
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 5.7 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H)
Public date: 2025-09-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm: bridge: adv7511: unregister cec i2c device after cec adapter

cec_unregister_adapter() assumes that the underlying adapter ops are
callable. For example, if the CEC adapter currently has a valid physical
address, then the unregistration procedure will invalidate the physical
address by setting it to f.f.f.f. Whence the following kernel oops
observed after removing the adv7511 module:

    Unable to handle kernel execution of user memory at virtual address 0000000000000000
    Internal error: Oops: 86000004 [#1] PREEMPT_RT SMP
    Call trace:
     0x0
     adv7511_cec_adap_log_addr+0x1ac/0x1c8 [adv7511]
     cec_adap_unconfigure+0x44/0x90 [cec]
     __cec_s_phys_addr.part.0+0x68/0x230 [cec]
     __cec_s_phys_addr+0x40/0x50 [cec]
     cec_unregister_adapter+0xb4/0x118 [cec]
     adv7511_remove+0x60/0x90 [adv7511]
     i2c_device_remove+0x34/0xe0
     device_release_driver_internal+0x114/0x1f0
     driver_detach+0x54/0xe0
     bus_remove_driver+0x60/0xd8
     driver_unregister+0x34/0x60
     i2c_del_driver+0x2c/0x68
     adv7511_exit+0x1c/0x67c [adv7511]
     __arm64_sys_delete_module+0x154/0x288
     invoke_syscall+0x48/0x100
     el0_svc_common.constprop.0+0x48/0xe8
     do_el0_svc+0x28/0x88
     el0_svc+0x1c/0x50
     el0t_64_sync_handler+0xa8/0xb0
     el0t_64_sync+0x15c/0x160
    Code: bad PC value
    ---[ end trace 0000000000000000 ]---

Protect against this scenario by unregistering i2c_cec after
unregistering the CEC adapter. Duly disable the CEC clock afterwards
too.


Affected upstream versions: 4.15
Fixed upstream versions: 0, 5.10.234, 5.15.75, 5.19.17, 6.0.3, 6.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 3747465c5da7a11957a34bbb9485d9fc253b91cc
CVE-2022-50418: kernel: wifi: ath11k: mhi: fix potential memory leak in ath11k_mhi_register()
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-09-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath11k: mhi: fix potential memory leak in ath11k_mhi_register()

mhi_alloc_controller() allocates a memory space for mhi_ctrl. When gets
some error, mhi_ctrl should be freed with mhi_free_controller(). But
when ath11k_mhi_read_addr_from_dt() fails, the function returns without
calling mhi_free_controller(), which will lead to a memory leak.

We can fix it by calling mhi_free_controller() when
ath11k_mhi_read_addr_from_dt() fails.


Affected upstream versions: 5.6
Fixed upstream versions: 0, 5.19.17, 6.0.3, 6.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 72ef896e80b6ec7cdc1dd42577045f8e7c9c32b3
CVE-2022-50421: kernel: rpmsg: char: Avoid double destroy of default endpoint
Component: kernel
Severity: Moderate
CWE: CWE-1341 (Multiple Releases of Same Resource or Handle)
CVSS v3: 5.7 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H)
Public date: 2025-10-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

rpmsg: char: Avoid double destroy of default endpoint

The rpmsg_dev_remove() in rpmsg_core is the place for releasing
this default endpoint.

So need to avoid destroying the default endpoint in
rpmsg_chrdev_eptdev_destroy(), this should be the same as
rpmsg_eptdev_release(). Otherwise there will be double destroy
issue that ept->refcount report warning:

refcount_t: underflow; use-after-free.

Call trace:
 refcount_warn_saturate+0xf8/0x150
 virtio_rpmsg_destroy_ept+0xd4/0xec
 rpmsg_dev_remove+0x60/0x70

The issue can be reproduced by stopping remoteproc before
closing the /dev/rpmsgX.


Affected upstream versions: 5.18
Fixed upstream versions: 0, 5.19.17, 6.0.3, 6.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: ef828a39d6a7028836eaf37df3ad568c8c2dd6f9
CVE-2022-50423: kernel: Linux kernel: Information disclosure and denial of service via use-after-free in ACPI subsystem
Component: kernel
Severity: Moderate
CWE: CWE-763 (Release of Invalid Pointer or Reference)
CVSS v3: 6.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H)
Public date: 2025-10-01T00:00:00+00:00

A flaw was found in the Linux kernel. This use-after-free vulnerability exists within the Advanced Configuration and Power Interface (ACPI) subsystem. A local attacker with low privileges could exploit this flaw, leading to memory corruption. This could result in information disclosure or a denial of service (DoS) on the system.


Affected upstream versions: 3.10.55 < 3.11, 3.12.29 < 3.13, 3.14.19 < 3.15, 3.16.3 < 3.17, 3.17
Fixed upstream versions: 0, 3.11, 3.13, 3.15, 3.17, 4.14.303, 4.19.270, 4.9.337, 5.10.163, 5.15.86, 5.4.229, 6.0.16, 6.1.2, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 133462d35dae95edb944af86b986d4c9dec59bd1
CVE-2022-50425: kernel: x86/fpu: Fix copy_xstate_to_uabi() to copy init states correctly
Component: kernel
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 4.1 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-10-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

x86/fpu: Fix copy_xstate_to_uabi() to copy init states correctly

When an extended state component is not present in fpstate, but in init
state, the function copies from init_fpstate via copy_feature().

But, dynamic states are not present in init_fpstate because of all-zeros
init states. Then retrieving them from init_fpstate will explode like this:

 BUG: kernel NULL pointer dereference, address: 0000000000000000
 ...
 RIP: 0010:memcpy_erms+0x6/0x10
  ? __copy_xstate_to_uabi_buf+0x381/0x870
  fpu_copy_guest_fpstate_to_uabi+0x28/0x80
  kvm_arch_vcpu_ioctl+0x14c/0x1460 [kvm]
  ? __this_cpu_preempt_check+0x13/0x20
  ? vmx_vcpu_put+0x2e/0x260 [kvm_intel]
  kvm_vcpu_ioctl+0xea/0x6b0 [kvm]
  ? kvm_vcpu_ioctl+0xea/0x6b0 [kvm]
  ? __fget_light+0xd4/0x130
  __x64_sys_ioctl+0xe3/0x910
  ? debug_smp_processor_id+0x17/0x20
  ? fpregs_assert_state_consistent+0x27/0x50
  do_syscall_64+0x3f/0x90
  entry_SYSCALL_64_after_hwframe+0x63/0xcd

Adjust the 'mask' to zero out the userspace buffer for the features that
are not available both from fpstate and from init_fpstate.

The dynamic features depend on the compacted XSAVE format. Ensure it is
enabled before reading XCOMP_BV in init_fpstate.


Affected upstream versions: 5.16
Fixed upstream versions: 0, 6.0.7, 6.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 6ff29642fd28965a8f8d6d326ac91bf6075f3113
CVE-2022-50427: kernel: ALSA: ac97: fix possible memory leak in snd_ac97_dev_register()
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-10-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ALSA: ac97: fix possible memory leak in snd_ac97_dev_register()

If device_register() fails in snd_ac97_dev_register(), it should
call put_device() to give up reference, or the name allocated in
dev_set_name() is leaked.


Affected upstream versions: 2.6.14
Fixed upstream versions: 0, 4.14.298, 4.19.264, 4.9.332, 5.10.153, 5.15.77, 5.4.223, 6.0.7, 6.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: a602ec9d88f177dba78bc97fb1adecc7a71ff279
CVE-2022-50431: kernel: ALSA: aoa: i2sbus: fix possible memory leak in i2sbus_add_dev()
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-10-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ALSA: aoa: i2sbus: fix possible memory leak in i2sbus_add_dev()

dev_set_name() in soundbus_add_one() allocates memory for name, it need be
freed when of_device_register() fails, call soundbus_dev_put() to give up
the reference that hold in device_initialize(), so that it can be freed in
kobject_cleanup() when the refcount hit to 0. And other resources are also
freed in i2sbus_release_dev(), so it can return 0 directly.


Affected upstream versions: 2.6.18
Fixed upstream versions: 0, 4.14.298, 4.19.264, 4.9.332, 5.10.153, 5.15.77, 5.4.223, 6.0.7, 6.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: fd410d24665e4efb3c1796797181265efe553e9c
CVE-2022-50436: kernel: ext4: don't set up encryption key during jbd2 transaction
Component: kernel
Severity: Moderate
CWE: CWE-833 (Deadlock)
CVSS v3: 5.1 (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-10-01T00:00:00+00:00

A flaw exists in the ext4 filesystem implementation in the Linux kernel such that the function ext4_unlink() extended a journaling transaction too far so that it included a call to ext4_find_entry(). However, ext4_find_entry() may need to set up a directory’s encryption key — which can cause a deadlock when executed inside a transaction.


Affected upstream versions: 5.10
Fixed upstream versions: 0, 5.10.163, 5.15.87, 6.0.18, 6.1.4, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 23ad034760dd38e12b0e0e1b28b9629f330810a1
CVE-2022-50439: kernel: ASoC: mediatek: mt8173: Enable IRQ when pdata is ready
Component: kernel
Severity: Moderate
CWE: CWE-908 (Use of Uninitialized Resource)
CVSS v3: 5.3 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H)
Public date: 2025-10-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ASoC: mediatek: mt8173: Enable IRQ when pdata is ready

If the device does not come straight from reset, we might receive an IRQ
before we are ready to handle it.


[    2.334737] Unable to handle kernel read from unreadable memory at virtual address 00000000000001e4
[    2.522601] Call trace:
[    2.525040]  regmap_read+0x1c/0x80
[    2.528434]  mt8173_afe_irq_handler+0x40/0xf0
...
[    2.598921]  start_kernel+0x338/0x42c


Affected upstream versions: 4.2
Fixed upstream versions: 0, 5.10.163, 5.15.86, 5.4.229, 6.0.16, 6.1.2, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 190685ff4ee03eef8f12c71d8f626e414fa078a9
CVE-2022-50440: kernel: Linux kernel: Denial of Service in vmwgfx due to invalid DMA surface copies
Component: kernel
Severity: Moderate
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 5.8 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H)
Public date: 2025-10-01T00:00:00+00:00

A flaw was discovered in the Linux kernel’s DRM vmwgfx driver related to how cursor images are snooped and copied. When the dimensions of a DMA surface copybox were derived from untrusted userspace data without proper validation against the expected snooped cursor size, an invalid size could cause an oversized memcpy operation. This may lead to a buffer overflow condition and crash the kernel when rendering or handling VMware graphics cursor updates.


Affected upstream versions: 3.2
Fixed upstream versions: 0, 4.14.303, 4.19.270, 4.9.337, 5.10.163, 5.15.87, 5.4.229, 6.0.18, 6.1.4, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: ee8d31836cbe7c26e207bfa0a4a726f0a25cfcf6
CVE-2022-50447: kernel: Bluetooth: hci_conn: Fix crash on hci_create_cis_sync
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 6.5 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H)
Public date: 2025-10-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_conn: Fix crash on hci_create_cis_sync

When attempting to connect multiple ISO sockets without using
DEFER_SETUP may result in the following crash:

BUG: KASAN: null-ptr-deref in hci_create_cis_sync+0x18b/0x2b0
Read of size 2 at addr 0000000000000036 by task kworker/u3:1/50

CPU: 0 PID: 50 Comm: kworker/u3:1 Not tainted
6.0.0-rc7-02243-gb84a13ff4eda #4373
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009),
BIOS 1.16.0-1.fc36 04/01/2014
Workqueue: hci0 hci_cmd_sync_work
Call Trace:
 <TASK>
 dump_stack_lvl+0x19/0x27
 kasan_report+0xbc/0xf0
 ? hci_create_cis_sync+0x18b/0x2b0
 hci_create_cis_sync+0x18b/0x2b0
 ? get_link_mode+0xd0/0xd0
 ? __ww_mutex_lock_slowpath+0x10/0x10
 ? mutex_lock+0xe0/0xe0
 ? get_link_mode+0xd0/0xd0
 hci_cmd_sync_work+0x111/0x190
 process_one_work+0x427/0x650
 worker_thread+0x87/0x750
 ? process_one_work+0x650/0x650
 kthread+0x14e/0x180
 ? kthread_exit+0x50/0x50
 ret_from_fork+0x22/0x30
 </TASK>


Affected upstream versions: 6.0
Fixed upstream versions: 0, 6.0.16, 6.1.2, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: a190cd9dc62d6ebeb679c1abe9dda4162dfefc84