xamxte/cve-to-cwe huggingface dataset:
CVE-2022-49818: In the Linux kernel, the following vulnerability has been resolved:  mISDN: fix misuse of put_device() in mISDN_register_device()  We should not release reference by put_device() before calling device_initialize().
CVE-2022-49829: In the Linux kernel, the following vulnerability has been resolved:  drm/scheduler: fix fence ref counting  We leaked dependency fences when processes were beeing killed.  Additional to that grab a reference to the last scheduled fence.
CVE-2022-49847: In the Linux kernel, the following vulnerability has been resolved:  net: ethernet: ti: am65-cpsw: Fix segmentation fault at module unload  Move am65_cpsw_nuss_phylink_cleanup() call to after am65_cpsw_nuss_cleanup_ndev() so phylink is still valid to prevent the below Segmentation fault on module remove when first slave link is up.  [   31.652944] Unable to handle kernel paging request at virtual address 00040008000005f4 [   31.684627] Mem abort info: [   31.687446]   ESR = 0x0000000096000004 [   31.704614]   EC = 0x25: DABT (current EL), IL = 32 bits [   31.720663]   SET = 0, FnV = 0 [   31.723729]   EA = 0, S1PTW = 0 [   31.740617]   FSC = 0x04: level 0 translation fault [   31.756624] Data abort info: [   31.759508]   ISV = 0, ISS = 0x00000004 [   31.776705]   CM = 0, WnR = 0 [   31.779695] [00040008000005f4] address between user and kernel address ranges [   31.808644] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP [   31.814928] Modules linked in: wlcore_sdio wl18xx wlcore mac80211 libarc4 cfg80211 rfkill crct10dif_ce phy_gmii_sel ti_am65_cpsw_nuss(-) sch_fq_codel ipv6 [   31.828776] CPU: 0 PID: 1026 Comm: modprobe Not tainted 6.1.0-rc2-00012-gfabfcf7dafdb-dirty #160 [   31.837547] Hardware name: Texas Instruments AM625 (DT) [   31.842760] pstate: 40000005 (nZcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [   31.849709] pc : phy_stop+0x18/0xf8 [   31.853202] lr : phylink_stop+0x38/0xf8 [   31.857031] sp : ffff80000a0839f0 [   31.860335] x29: ffff80000a0839f0 x28: ffff000000de1c80 x27: 0000000000000000 [   31.867462] x26: 0000000000000000 x25: 0000000000000000 x24: ffff80000a083b98 [   31.874589] x23: 0000000000000800 x22: 0000000000000001 x21: ffff000001bfba90 [   31.881715] x20: ffff0000015ee000 x19: 0004000800000200 x18: 0000000000000000 [   31.888842] x17: ffff800076c45000 x16: ffff800008004000 x15: 000058e39660b106 [   31.895969] x14: 0000000000000144 x13: 0000000000000144 x12: 0000000000000000 [   31.903095] x11: 000000000000275f x10: 00000000000009e0 x9 : ffff80000a0837d0 [   31.910222] x8 : ffff000000de26c0 x7 : ffff00007fbd6540 x6 : ffff00007fbd64c0 [   31.917349] x5 : ffff00007fbd0b10 x4 : ffff00007fbd0b10 x3 : ffff00007fbd3920 [   31.924476] x2 : d0a07fcff8b8d500 x1 : 0000000000000000 x0 : 0004000800000200 [   31.931603] Call trace: [   31.934042]  phy_stop+0x18/0xf8 [   31.937177]  phylink_stop+0x38/0xf8 [   31.940657]  am65_cpsw_nuss_ndo_slave_stop+0x28/0x1e0 [ti_am65_cpsw_nuss] [   31.947452]  __dev_close_many+0xa4/0x140 [   31.951371]  dev_close_many+0x84/0x128 [   31.955115]  unregister_netdevice_many+0x130/0x6d0 [   31.959897]  unregister_netdevice_queue+0x94/0xd8 [   31.964591]  unregister_netdev+0x24/0x38 [   31.968504]  am65_cpsw_nuss_cleanup_ndev.isra.0+0x48/0x70 [ti_am65_cpsw_nuss] [   31.975637]  am65_cpsw_nuss_remove+0x58/0xf8 [ti_am65_cpsw_nuss]
CVE-2022-49852: In the Linux kernel, the following vulnerability has been resolved:  riscv: process: fix kernel info leakage  thread_struct's s[12] may contain random kernel memory content, which may be finally leaked to userspace. This is a security hole. Fix it by clearing the s[12] array in thread_struct when fork.  As for kthread case, it's better to clear the s[12] array as well.
CVE-2022-49854: In the Linux kernel, the following vulnerability has been resolved:  mctp: Fix an error handling path in mctp_init()  If mctp_neigh_init() return error, the routes resources should be released in the error handling path. Otherwise some resources leak.
CVE-2022-49861: In the Linux kernel, the following vulnerability has been resolved:  dmaengine: mv_xor_v2: Fix a resource leak in mv_xor_v2_remove()  A clk_prepare_enable() call in the probe is not balanced by a corresponding clk_disable_unprepare() in the remove function.  Add the missing call.
CVE-2022-49887: In the Linux kernel, the following vulnerability has been resolved:  media: meson: vdec: fix possible refcount leak in vdec_probe()  v4l2_device_unregister need to be called to put the refcount got by v4l2_device_register when vdec_probe fails or vdec_remove is called.
CVE-2022-49896: In the Linux kernel, the following vulnerability has been resolved:  cxl/pmem: Fix cxl_pmem_region and cxl_memdev leak  When a cxl_nvdimm object goes through a ->remove() event (device physically removed, nvdimm-bridge disabled, or nvdimm device disabled), then any associated regions must also be disabled. As highlighted by the cxl-create-region.sh test [1], a single device may host multiple regions, but the driver was only tracking one region at a time. This leads to a situation where only the last enabled region per nvdimm device is cleaned up properly. Other regions are leaked, and this also causes cxl_memdev reference leaks.  Fix the tracking by allowing cxl_nvdimm objects to track multiple region associations.
CVE-2022-49907: In the Linux kernel, the following vulnerability has been resolved:  net: mdio: fix undefined behavior in bit shift for __mdiobus_register  Shifting signed 32-bit value by 31 bits is undefined, so changing significant bit to unsigned. The UBSAN warning calltrace like below:  UBSAN: shift-out-of-bounds in drivers/net/phy/mdio_bus.c:586:27 left shift of 1 by 31 places cannot be represented in type 'int' Call Trace:  <TASK>  dump_stack_lvl+0x7d/0xa5  dump_stack+0x15/0x1b  ubsan_epilogue+0xe/0x4e  __ubsan_handle_shift_out_of_bounds+0x1e7/0x20c  __mdiobus_register+0x49d/0x4e0  fixed_mdio_bus_init+0xd8/0x12d  do_one_initcall+0x76/0x430  kernel_init_freeable+0x3b3/0x422  kernel_init+0x24/0x1e0  ret_from_fork+0x1f/0x30  </TASK>
CVE-2022-49911: In the Linux kernel, the following vulnerability has been resolved:  netfilter: ipset: enforce documented limit to prevent allocating huge memory  Daniel Xu reported that the hash:net,iface type of the ipset subsystem does not limit adding the same network with different interfaces to a set, which can lead to huge memory usage or allocation failure.  The quick reproducer is  $ ipset create ACL.IN.ALL_PERMIT hash:net,iface hashsize 1048576 timeout 0 $ for i in $(seq 0 100); do /sbin/ipset add ACL.IN.ALL_PERMIT 0.0.0.0/0,kaf_$i timeout 0 -exist; done  The backtrace when vmalloc fails:          [Tue Oct 25 00:13:08 2022] ipset: vmalloc error: size 1073741848, exceeds total pages         <...>         [Tue Oct 25 00:13:08 2022] Call Trace:         [Tue Oct 25 00:13:08 2022]  <TASK>         [Tue Oct 25 00:13:08 2022]  dump_stack_lvl+0x48/0x60         [Tue Oct 25 00:13:08 2022]  warn_alloc+0x155/0x180         [Tue Oct 25 00:13:08 2022]  __vmalloc_node_range+0x72a/0x760         [Tue Oct 25 00:13:08 2022]  ? hash_netiface4_add+0x7c0/0xb20         [Tue Oct 25 00:13:08 2022]  ? __kmalloc_large_node+0x4a/0x90         [Tue Oct 25 00:13:08 2022]  kvmalloc_node+0xa6/0xd0         [Tue Oct 25 00:13:08 2022]  ? hash_netiface4_resize+0x99/0x710         <...>  The fix is to enforce the limit documented in the ipset(8) manpage:  >  The internal restriction of the hash:net,iface set type is that the same >  network prefix cannot be stored with more than 64 different interfaces >  in a single set.
CVE-2023-53035: In the Linux kernel, the following vulnerability has been resolved:  nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy()  The ioctl helper function nilfs_ioctl_wrap_copy(), which exchanges a metadata array to/from user space, may copy uninitialized buffer regions to user space memory for read-only ioctl commands NILFS_IOCTL_GET_SUINFO and NILFS_IOCTL_GET_CPINFO.  This can occur when the element size of the user space metadata given by the v_size member of the argument nilfs_argv structure is larger than the size of the metadata element (nilfs_suinfo structure or nilfs_cpinfo structure) on the file system side.  KMSAN-enabled kernels detect this issue as follows:   BUG: KMSAN: kernel-infoleak in instrument_copy_to_user  include/linux/instrumented.h:121 [inline]  BUG: KMSAN: kernel-infoleak in _copy_to_user+0xc0/0x100 lib/usercopy.c:33   instrument_copy_to_user include/linux/instrumented.h:121 [inline]   _copy_to_user+0xc0/0x100 lib/usercopy.c:33   copy_to_user include/linux/uaccess.h:169 [inline]   nilfs_ioctl_wrap_copy+0x6fa/0xc10 fs/nilfs2/ioctl.c:99   nilfs_ioctl_get_info fs/nilfs2/ioctl.c:1173 [inline]   nilfs_ioctl+0x2402/0x4450 fs/nilfs2/ioctl.c:1290   nilfs_compat_ioctl+0x1b8/0x200 fs/nilfs2/ioctl.c:1343   __do_compat_sys_ioctl fs/ioctl.c:968 [inline]   __se_compat_sys_ioctl+0x7dd/0x1000 fs/ioctl.c:910   __ia32_compat_sys_ioctl+0x93/0xd0 fs/ioctl.c:910   do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]   __do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178   do_fast_syscall_32+0x37/0x80 arch/x86/entry/common.c:203   do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:246   entry_SYSENTER_compat_after_hwframe+0x70/0x82   Uninit was created at:   __alloc_pages+0x9f6/0xe90 mm/page_alloc.c:5572   alloc_pages+0xab0/0xd80 mm/mempolicy.c:2287   __get_free_pages+0x34/0xc0 mm/page_alloc.c:5599   nilfs_ioctl_wrap_copy+0x223/0xc10 fs/nilfs2/ioctl.c:74   nilfs_ioctl_get_info fs/nilfs2/ioctl.c:1173 [inline]   nilfs_ioctl+0x2402/0x4450 fs/nilfs2/ioctl.c:1290   nilfs_compat_ioctl+0x1b8/0x200 fs/nilfs2/ioctl.c:1343   __do_compat_sys_ioctl fs/ioctl.c:968 [inline]   __se_compat_sys_ioctl+0x7dd/0x1000 fs/ioctl.c:910   __ia32_compat_sys_ioctl+0x93/0xd0 fs/ioctl.c:910   do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]   __do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178   do_fast_syscall_32+0x37/0x80 arch/x86/entry/common.c:203   do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:246   entry_SYSENTER_compat_after_hwframe+0x70/0x82   Bytes 16-127 of 3968 are uninitialized  ...  This eliminates the leak issue by initializing the page allocated as buffer using get_zeroed_page().
CVE-2023-53040: In the Linux kernel, the following vulnerability has been resolved:  ca8210: fix mac_len negative array access  This patch fixes a buffer overflow access of skb->data if ieee802154_hdr_peek_addrs() fails.
CVE-2023-53059: In the Linux kernel, the following vulnerability has been resolved:  platform/chrome: cros_ec_chardev: fix kernel data leak from ioctl  It is possible to peep kernel page's data by providing larger `insize` in struct cros_ec_command[1] when invoking EC host commands.  Fix it by using zeroed memory.  [1]: https://elixir.bootlin.com/linux/v6.2/source/include/linux/platform_data/cros_ec_proto.h#L74
CVE-2023-53061: In the Linux kernel, the following vulnerability has been resolved:  ksmbd: fix possible refcount leak in smb2_open()  Reference count of acls will leak when memory allocation fails. Fix this by adding the missing posix_acl_release().
CVE-2023-53064: In the Linux kernel, the following vulnerability has been resolved:  iavf: fix hang on reboot with ice  When a system with E810 with existing VFs gets rebooted the following hang may be observed.   Pid 1 is hung in iavf_remove(), part of a network driver:  PID: 1        TASK: ffff965400e5a340  CPU: 24   COMMAND: "systemd-shutdow"   #0 [ffffaad04005fa50] __schedule at ffffffff8b3239cb   #1 [ffffaad04005fae8] schedule at ffffffff8b323e2d   #2 [ffffaad04005fb00] schedule_hrtimeout_range_clock at ffffffff8b32cebc   #3 [ffffaad04005fb80] usleep_range_state at ffffffff8b32c930   #4 [ffffaad04005fbb0] iavf_remove at ffffffffc12b9b4c [iavf]   #5 [ffffaad04005fbf0] pci_device_remove at ffffffff8add7513   #6 [ffffaad04005fc10] device_release_driver_internal at ffffffff8af08baa   #7 [ffffaad04005fc40] pci_stop_bus_device at ffffffff8adcc5fc   #8 [ffffaad04005fc60] pci_stop_and_remove_bus_device at ffffffff8adcc81e   #9 [ffffaad04005fc70] pci_iov_remove_virtfn at ffffffff8adf9429  #10 [ffffaad04005fca8] sriov_disable at ffffffff8adf98e4  #11 [ffffaad04005fcc8] ice_free_vfs at ffffffffc04bb2c8 [ice]  #12 [ffffaad04005fd10] ice_remove at ffffffffc04778fe [ice]  #13 [ffffaad04005fd38] ice_shutdown at ffffffffc0477946 [ice]  #14 [ffffaad04005fd50] pci_device_shutdown at ffffffff8add58f1  #15 [ffffaad04005fd70] device_shutdown at ffffffff8af05386  #16 [ffffaad04005fd98] kernel_restart at ffffffff8a92a870  #17 [ffffaad04005fda8] __do_sys_reboot at ffffffff8a92abd6  #18 [ffffaad04005fee0] do_syscall_64 at ffffffff8b317159  #19 [ffffaad04005ff08] __context_tracking_enter at ffffffff8b31b6fc  #20 [ffffaad04005ff18] syscall_exit_to_user_mode at ffffffff8b31b50d  #21 [ffffaad04005ff28] do_syscall_64 at ffffffff8b317169  #22 [ffffaad04005ff50] entry_SYSCALL_64_after_hwframe at ffffffff8b40009b      RIP: 00007f1baa5c13d7  RSP: 00007fffbcc55a98  RFLAGS: 00000202      RAX: ffffffffffffffda  RBX: 0000000000000000  RCX: 00007f1baa5c13d7      RDX: 0000000001234567  RSI: 0000000028121969  RDI: 00000000fee1dead      RBP: 00007fffbcc55ca0   R8: 0000000000000000   R9: 00007fffbcc54e90      R10: 00007fffbcc55050  R11: 0000000000000202  R12: 0000000000000005      R13: 0000000000000000  R14: 00007fffbcc55af0  R15: 0000000000000000      ORIG_RAX: 00000000000000a9  CS: 0033  SS: 002b  During reboot all drivers PM shutdown callbacks are invoked. In iavf_shutdown() the adapter state is changed to __IAVF_REMOVE. In ice_shutdown() the call chain above is executed, which at some point calls iavf_remove(). However iavf_remove() expects the VF to be in one of the states __IAVF_RUNNING, __IAVF_DOWN or __IAVF_INIT_FAILED. If that's not the case it sleeps forever. So if iavf_shutdown() gets invoked before iavf_remove() the system will hang indefinitely because the adapter is already in state __IAVF_REMOVE.  Fix this by returning from iavf_remove() if the state is __IAVF_REMOVE, as we already went through iavf_shutdown().
CVE-2023-53080: In the Linux kernel, the following vulnerability has been resolved:  xsk: Add missing overflow check in xdp_umem_reg  The number of chunks can overflow u32. Make sure to return -EINVAL on overflow. Also remove a redundant u32 cast assigning umem->npgs.
CVE-2023-53083: In the Linux kernel, the following vulnerability has been resolved:  nfsd: don't replace page in rq_pages if it's a continuation of last page  The splice read calls nfsd_splice_actor to put the pages containing file data into the svc_rqst->rq_pages array. It's possible however to get a splice result that only has a partial page at the end, if (e.g.) the filesystem hands back a short read that doesn't cover the whole page.  nfsd_splice_actor will plop the partial page into its rq_pages array and return. Then later, when nfsd_splice_actor is called again, the remainder of the page may end up being filled out. At this point, nfsd_splice_actor will put the page into the array _again_ corrupting the reply. If this is done enough times, rq_next_page will overrun the array and corrupt the trailing fields -- the rq_respages and rq_next_page pointers themselves.  If we've already added the page to the array in the last pass, don't add it to the array a second time when dealing with a splice continuation. This was originally handled properly in nfsd_splice_actor, but commit 91e23b1c3982 ("NFSD: Clean up nfsd_splice_actor()") removed the check for it.
CVE-2023-53085: In the Linux kernel, the following vulnerability has been resolved:  drm/edid: fix info leak when failing to get panel id  Make sure to clear the transfer buffer before fetching the EDID to avoid leaking slab data to the logs on errors that leave the buffer unchanged.
CVE-2023-53087: In the Linux kernel, the following vulnerability has been resolved:  drm/i915/active: Fix misuse of non-idle barriers as fence trackers  Users reported oopses on list corruptions when using i915 perf with a number of concurrently running graphics applications.  Root cause analysis pointed at an issue in barrier processing code -- a race among perf open / close replacing active barriers with perf requests on kernel context and concurrent barrier preallocate / acquire operations performed during user context first pin / last unpin.  When adding a request to a composite tracker, we try to reuse an existing fence tracker, already allocated and registered with that composite.  The tracker we obtain may already track another fence, may be an idle barrier, or an active barrier.  If the tracker we get occurs a non-idle barrier then we try to delete that barrier from a list of barrier tasks it belongs to.  However, while doing that we don't respect return value from a function that performs the barrier deletion.  Should the deletion ever fail, we would end up reusing the tracker still registered as a barrier task.  Since the same structure field is reused with both fence callback lists and barrier tasks list, list corruptions would likely occur.  Barriers are now deleted from a barrier tasks list by temporarily removing the list content, traversing that content with skip over the node to be deleted, then populating the list back with the modified content.  Should that intentionally racy concurrent deletion attempts be not serialized, one or more of those may fail because of the list being temporary empty.  Related code that ignores the results of barrier deletion was initially introduced in v5.4 by commit d8af05ff38ae ("drm/i915: Allow sharing the idle-barrier from other kernel requests").  However, all users of the barrier deletion routine were apparently serialized at that time, then the issue didn't exhibit itself.  Results of git bisect with help of a newly developed igt@gem_barrier_race@remote-request IGT test indicate that list corruptions might start to appear after commit 311770173fac ("drm/i915/gt: Schedule request retirement when timeline idles"), introduced in v5.5.  Respect results of barrier deletion attempts -- mark the barrier as idle only if successfully deleted from the list.  Then, before proceeding with setting our fence as the one currently tracked, make sure that the tracker we've got is not a non-idle barrier.  If that check fails then don't use that tracker but go back and try to acquire a new, usable one.  v3: use unlikely() to document what outcome we expect (Andi),   - fix bad grammar in commit description. v2: no code changes,   - blame commit 311770173fac ("drm/i915/gt: Schedule request retirement     when timeline idles"), v5.5, not commit d8af05ff38ae ("drm/i915: Allow     sharing the idle-barrier from other kernel requests"), v5.4,   - reword commit description.  (cherry picked from commit 506006055769b10d1b2b4e22f636f3b45e0e9fc7)
CVE-2024-39442: In sprd ssense service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
CVE-2025-20953: Improper access control in SmartManagerCN prior to SMR May-2025 Release 1 allows local attackers to launch activities within SmartManagerCN.
CVE-2025-20955: Improper Export of Android Application Components in NotificationHistoryImageProvider prior to SMR May-2025 Release 1 allows local attackers to access notification images.
CVE-2025-20956: Improper export of android application components in Settings in Galaxy Watch prior to SMR May-2025 Release 1 allows physical attackers to access developer settings.
CVE-2025-20957: Improper access control in SmartManagerCN prior to SMR May-2025 Release 1 allows local attackers to launch arbitrary activities with SmartManagerCN privilege.
CVE-2025-20960: Improper handling of insufficient permission in CocktailBarService prior to SMR May-2025 Release 1 allows local attackers to use the privileged api.
CVE-2025-20961: Improper handling of insufficient permission or privileges in sepunion service prior to SMR May-2025 Release 1 allows local privileged attackers to access files with system privilege.
CVE-2025-20962: Improper handling of insufficient permission in SpenGesture service prior to SMR May-2025 Release 1 allows local attackers to track the S Pen position.
CVE-2025-20966: Improper access control in Samsung Gallery prior to version 14.5.10.3 in Global Android 13, 14.5.09.3 in China Android 13, and 15.5.04.5 in Android 14 allows physical attackers to access data across multiple user profiles.
CVE-2025-20967: Improper access control in Samsung Gallery prior to version 14.5.10.3 in Global Android 13, 14.5.09.3 in China Android 13, and 15.5.04.5 in Android 14 allows attackers to read and write arbitrary file with the privilege of Samsung Gallery.
CVE-2025-20968: Improper access control in Samsung Gallery prior to version 14.5.10.3 in Global Android 13, 14.5.09.3 in China Android 13, and 15.5.04.5 in Android 14 allows remote attackers to access data and perform internal operations within Samsung Gallery.
CVE-2025-20970: Improper access control in Bixby Vision prior to version 3.8.1 in Android 13, 3.8.3 in Android 14, 3.8.21 in Android 15 allows local attackers to access image files with Bixby Vision privilege.
CVE-2025-20971: Improper input validation in Samsung Flow prior to version 4.9.17.6 allows local attackers to access data within Samsung Flow.
CVE-2025-20973: Improper authentication in Secure Folder prior to version 1.8.12.0 in Android 13, and 1.9.21.00 in Android 14 allows physical attackers to reset the lock type of Secure Folder.
CVE-2025-20974: Improper handling of insufficient permission in PackageInstallerCN prior to version 15.0.11.0 allows local attacker to bypass user interaction for requested installation.
CVE-2025-20975: Improper Export of Android Application Components in AODService prior to version 8.8.28.12 allows local attackers to launch arbitrary activity with systemui privilege.
CVE-2025-20978: Improper access control in PENUP prior to version 3.9.19.32 allows local attackers to access files with PENUP privilege.
CVE-2025-20199: A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker with privilege level 15 to elevate privileges to root on the underlying operating system of an affected device.   This vulnerability is due to insufficient input validation when processing specific configuration commands. An attacker could exploit this vulnerability by including crafted input in specific configuration commands. A successful exploit could allow the attacker to elevate privileges to root on the underlying operating system of an affected device. The security impact rating (SIR) of this advisory has been raised to High because an attacker could gain access to the underlying operating system of the affected device and perform potentially undetected actions.   Note: The attacker must have privileges to enter configuration mode on the affected device. This is usually referred to as privilege level 15.
CVE-2025-37808: In the Linux kernel, the following vulnerability has been resolved:  crypto: null - Use spin lock instead of mutex  As the null algorithm may be freed in softirq context through af_alg, use spin locks instead of mutexes to protect the default null algorithm.