xamxte/cve-to-cwe huggingface dataset:
CVE-2023-54141: In the Linux kernel, the following vulnerability has been resolved:  wifi: ath11k: Add missing hw_ops->get_ring_selector() for IPQ5018  During sending data after clients connected, hw_ops->get_ring_selector() will be called. But for IPQ5018, this member isn't set, and the following NULL pointer exception will be occurred:   [   38.840478] 8<--- cut here ---  [   38.840517] Unable to handle kernel NULL pointer dereference at virtual address 00000000  ...  [   38.923161] PC is at 0x0  [   38.927930] LR is at ath11k_dp_tx+0x70/0x730 [ath11k]  ...  [   39.063264] Process hostapd (pid: 1034, stack limit = 0x801ceb3d)  [   39.068994] Stack: (0x856a9a68 to 0x856aa000)  ...  [   39.438467] [<7f323804>] (ath11k_dp_tx [ath11k]) from [<7f314e6c>] (ath11k_mac_op_tx+0x80/0x190 [ath11k])  [   39.446607] [<7f314e6c>] (ath11k_mac_op_tx [ath11k]) from [<7f17dbe0>] (ieee80211_handle_wake_tx_queue+0x7c/0xc0 [mac80211])  [   39.456162] [<7f17dbe0>] (ieee80211_handle_wake_tx_queue [mac80211]) from [<7f174450>] (ieee80211_probereq_get+0x584/0x704 [mac80211])  [   39.467443] [<7f174450>] (ieee80211_probereq_get [mac80211]) from [<7f178c40>] (ieee80211_tx_prepare_skb+0x1f8/0x248 [mac80211])  [   39.479334] [<7f178c40>] (ieee80211_tx_prepare_skb [mac80211]) from [<7f179e28>] (__ieee80211_subif_start_xmit+0x32c/0x3d4 [mac80211])  [   39.491053] [<7f179e28>] (__ieee80211_subif_start_xmit [mac80211]) from [<7f17af08>] (ieee80211_tx_control_port+0x19c/0x288 [mac80211])  [   39.502946] [<7f17af08>] (ieee80211_tx_control_port [mac80211]) from [<7f0fc704>] (nl80211_tx_control_port+0x174/0x1d4 [cfg80211])  [   39.515017] [<7f0fc704>] (nl80211_tx_control_port [cfg80211]) from [<808ceac4>] (genl_rcv_msg+0x154/0x340)  [   39.526814] [<808ceac4>] (genl_rcv_msg) from [<808cdb74>] (netlink_rcv_skb+0xb8/0x11c)  [   39.536446] [<808cdb74>] (netlink_rcv_skb) from [<808ce1d0>] (genl_rcv+0x28/0x34)  [   39.544344] [<808ce1d0>] (genl_rcv) from [<808cd234>] (netlink_unicast+0x174/0x274)  [   39.551895] [<808cd234>] (netlink_unicast) from [<808cd510>] (netlink_sendmsg+0x1dc/0x440)  [   39.559362] [<808cd510>] (netlink_sendmsg) from [<808596e0>] (____sys_sendmsg+0x1a8/0x1fc)  [   39.567697] [<808596e0>] (____sys_sendmsg) from [<8085b1a8>] (___sys_sendmsg+0xa4/0xdc)  [   39.575941] [<8085b1a8>] (___sys_sendmsg) from [<8085b310>] (sys_sendmsg+0x44/0x74)  [   39.583841] [<8085b310>] (sys_sendmsg) from [<80300060>] (ret_fast_syscall+0x0/0x40)  ...  [   39.620734] Code: bad PC value  [   39.625869] ---[ end trace 8aef983ad3cbc032 ]---
CVE-2023-54143: In the Linux kernel, the following vulnerability has been resolved:  media: mediatek: vcodec: fix resource leaks in vdec_msg_queue_init()  If we encounter any error in the vdec_msg_queue_init() then we need to set "msg_queue->wdma_addr.size = 0;".  Normally, this is done inside the vdec_msg_queue_deinit() function.  However, if the first call to allocate &msg_queue->wdma_addr fails, then the vdec_msg_queue_deinit() function is a no-op.  For that situation, just set the size to zero explicitly and return.  There were two other error paths which did not clean up before returning. Change those error paths to goto mem_alloc_err.
CVE-2023-54144: In the Linux kernel, the following vulnerability has been resolved:  drm/amdkfd: Fix kernel warning during topology setup  This patch fixes the following kernel warning seen during driver load by correctly initializing the p2plink attr before creating the sysfs file:  [  +0.002865] ------------[ cut here ]------------ [  +0.002327] kobject: '(null)' (0000000056260cfb): is not initialized, yet kobject_put() is being called. [  +0.004780] WARNING: CPU: 32 PID: 1006 at lib/kobject.c:718 kobject_put+0xaa/0x1c0 [  +0.001361] Call Trace: [  +0.001234]  <TASK> [  +0.001067]  kfd_remove_sysfs_node_entry+0x24a/0x2d0 [amdgpu] [  +0.003147]  kfd_topology_update_sysfs+0x3d/0x750 [amdgpu] [  +0.002890]  kfd_topology_add_device+0xbd7/0xc70 [amdgpu] [  +0.002844]  ? lock_release+0x13c/0x2e0 [  +0.001936]  ? smu_cmn_send_smc_msg_with_param+0x1e8/0x2d0 [amdgpu] [  +0.003313]  ? amdgpu_dpm_get_mclk+0x54/0x60 [amdgpu] [  +0.002703]  kgd2kfd_device_init.cold+0x39f/0x4ed [amdgpu] [  +0.002930]  amdgpu_amdkfd_device_init+0x13d/0x1f0 [amdgpu] [  +0.002944]  amdgpu_device_init.cold+0x1464/0x17b4 [amdgpu] [  +0.002970]  ? pci_bus_read_config_word+0x43/0x80 [  +0.002380]  amdgpu_driver_load_kms+0x15/0x100 [amdgpu] [  +0.002744]  amdgpu_pci_probe+0x147/0x370 [amdgpu] [  +0.002522]  local_pci_probe+0x40/0x80 [  +0.001896]  work_for_cpu_fn+0x10/0x20 [  +0.001892]  process_one_work+0x26e/0x5a0 [  +0.002029]  worker_thread+0x1fd/0x3e0 [  +0.001890]  ? process_one_work+0x5a0/0x5a0 [  +0.002115]  kthread+0xea/0x110 [  +0.001618]  ? kthread_complete_and_exit+0x20/0x20 [  +0.002422]  ret_from_fork+0x1f/0x30 [  +0.001808]  </TASK> [  +0.001103] irq event stamp: 59837 [  +0.001718] hardirqs last  enabled at (59849): [<ffffffffb30fab12>] __up_console_sem+0x52/0x60 [  +0.004414] hardirqs last disabled at (59860): [<ffffffffb30faaf7>] __up_console_sem+0x37/0x60 [  +0.004414] softirqs last  enabled at (59654): [<ffffffffb307d9c7>] irq_exit_rcu+0xd7/0x130 [  +0.004205] softirqs last disabled at (59649): [<ffffffffb307d9c7>] irq_exit_rcu+0xd7/0x130 [  +0.004203] ---[ end trace 0000000000000000 ]---
CVE-2023-54146: In the Linux kernel, the following vulnerability has been resolved:  x86/kexec: Fix double-free of elf header buffer  After    b3e34a47f989 ("x86/kexec: fix memory leak of elf header buffer"),  freeing image->elf_headers in the error path of crash_load_segments() is not needed because kimage_file_post_load_cleanup() will take care of that later. And not clearing it could result in a double-free.  Drop the superfluous vfree() call at the error path of crash_load_segments().
CVE-2023-54147: In the Linux kernel, the following vulnerability has been resolved:  media: platform: mtk-mdp3: Add missing check and free for ida_alloc  Add the check for the return value of the ida_alloc in order to avoid NULL pointer dereference. Moreover, free allocated "ctx->id" if mdp_m2m_open fails later in order to avoid memory leak.
CVE-2023-54150: In the Linux kernel, the following vulnerability has been resolved:  drm/amd: Fix an out of bounds error in BIOS parser  The array is hardcoded to 8 in atomfirmware.h, but firmware provides a bigger one sometimes. Deferencing the larger array causes an out of bounds error.  commit 4fc1ba4aa589 ("drm/amd/display: fix array index out of bound error in bios parser") fixed some of this, but there are two other cases not covered by it.  Fix those as well.
CVE-2023-54152: In the Linux kernel, the following vulnerability has been resolved:  can: j1939: prevent deadlock by moving j1939_sk_errqueue()  This commit addresses a deadlock situation that can occur in certain scenarios, such as when running data TP/ETP transfer and subscribing to the error queue while receiving a net down event. The deadlock involves locks in the following order:  3   j1939_session_list_lock ->  active_session_list_lock   j1939_session_activate   ...   j1939_sk_queue_activate_next -> sk_session_queue_lock   ...   j1939_xtp_rx_eoma_one  2   j1939_sk_queue_drop_all  ->  sk_session_queue_lock   ...   j1939_sk_netdev_event_netdown -> j1939_socks_lock   j1939_netdev_notify  1   j1939_sk_errqueue -> j1939_socks_lock   __j1939_session_cancel -> active_session_list_lock   j1939_tp_rxtimer         CPU0                    CPU1        ----                    ----   lock(&priv->active_session_list_lock);                                lock(&jsk->sk_session_queue_lock);                                lock(&priv->active_session_list_lock);   lock(&priv->j1939_socks_lock);  The solution implemented in this commit is to move the j1939_sk_errqueue() call out of the active_session_list_lock context, thus preventing the deadlock situation.
CVE-2023-54153: In the Linux kernel, the following vulnerability has been resolved:  ext4: turn quotas off if mount failed after enabling quotas  Yi found during a review of the patch "ext4: don't BUG on inconsistent journal feature" that when ext4_mark_recovery_complete() returns an error value, the error handling path does not turn off the enabled quotas, which triggers the following kmemleak:  ================================================================ unreferenced object 0xffff8cf68678e7c0 (size 64): comm "mount", pid 746, jiffies 4294871231 (age 11.540s) hex dump (first 32 bytes): 00 90 ef 82 f6 8c ff ff 00 00 00 00 41 01 00 00  ............A... c7 00 00 00 bd 00 00 00 0a 00 00 00 48 00 00 00  ............H... backtrace: [<00000000c561ef24>] __kmem_cache_alloc_node+0x4d4/0x880 [<00000000d4e621d7>] kmalloc_trace+0x39/0x140 [<00000000837eee74>] v2_read_file_info+0x18a/0x3a0 [<0000000088f6c877>] dquot_load_quota_sb+0x2ed/0x770 [<00000000340a4782>] dquot_load_quota_inode+0xc6/0x1c0 [<0000000089a18bd5>] ext4_enable_quotas+0x17e/0x3a0 [ext4] [<000000003a0268fa>] __ext4_fill_super+0x3448/0x3910 [ext4] [<00000000b0f2a8a8>] ext4_fill_super+0x13d/0x340 [ext4] [<000000004a9489c4>] get_tree_bdev+0x1dc/0x370 [<000000006e723bf1>] ext4_get_tree+0x1d/0x30 [ext4] [<00000000c7cb663d>] vfs_get_tree+0x31/0x160 [<00000000320e1bed>] do_new_mount+0x1d5/0x480 [<00000000c074654c>] path_mount+0x22e/0xbe0 [<0000000003e97a8e>] do_mount+0x95/0xc0 [<000000002f3d3736>] __x64_sys_mount+0xc4/0x160 [<0000000027d2140c>] do_syscall_64+0x3f/0x90 ================================================================  To solve this problem, we add a "failed_mount10" tag, and call ext4_quota_off_umount() in this tag to release the enabled qoutas.
CVE-2023-54154: In the Linux kernel, the following vulnerability has been resolved:  scsi: target: core: Fix target_cmd_counter leak  The target_cmd_counter struct allocated via target_alloc_cmd_counter() is never freed, resulting in leaks across various transport types, e.g.:   unreferenced object 0xffff88801f920120 (size 96):   comm "sh", pid 102, jiffies 4294892535 (age 713.412s)   hex dump (first 32 bytes):     07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................     00 00 00 00 00 00 00 00 38 01 92 1f 80 88 ff ff  ........8.......   backtrace:     [<00000000e58a6252>] kmalloc_trace+0x11/0x20     [<0000000043af4b2f>] target_alloc_cmd_counter+0x17/0x90 [target_core_mod]     [<000000007da2dfa7>] target_setup_session+0x2d/0x140 [target_core_mod]     [<0000000068feef86>] tcm_loop_tpg_nexus_store+0x19b/0x350 [tcm_loop]     [<000000006a80e021>] configfs_write_iter+0xb1/0x120     [<00000000e9f4d860>] vfs_write+0x2e4/0x3c0     [<000000008143433b>] ksys_write+0x80/0xb0     [<00000000a7df29b2>] do_syscall_64+0x42/0x90     [<0000000053f45fb8>] entry_SYSCALL_64_after_hwframe+0x6e/0xd8  Free the structure alongside the corresponding iscsit_conn / se_sess parent.
CVE-2023-54156: In the Linux kernel, the following vulnerability has been resolved:  sfc: fix crash when reading stats while NIC is resetting  efx_net_stats() (.ndo_get_stats64) can be called during an ethtool  selftest, during which time nic_data->mc_stats is NULL as the NIC has  been fini'd.  In this case do not attempt to fetch the latest stats  from the hardware, else we will crash on a NULL dereference:     BUG: kernel NULL pointer dereference, address: 0000000000000038     RIP efx_nic_update_stats     abridged calltrace:     efx_ef10_update_stats_pf     efx_net_stats     dev_get_stats     dev_seq_printf_stats Skipping the read is safe, we will simply give out stale stats. To ensure that the free in efx_ef10_fini_nic() does not race against  efx_ef10_update_stats_pf(), which could cause a TOCTTOU bug, take the  efx->stats_lock in fini_nic (it is already held across update_stats).
CVE-2023-54159: In the Linux kernel, the following vulnerability has been resolved:  usb: mtu3: fix kernel panic at qmu transfer done irq handler  When handle qmu transfer irq, it will unlock @mtu->lock before give back request, if another thread handle disconnect event at the same time, and try to disable ep, it may lock @mtu->lock and free qmu ring, then qmu irq hanlder may get a NULL gpd, avoid the KE by checking gpd's value before handling it.  e.g. qmu done irq on cpu0                 thread running on cpu1  qmu_done_tx()   handle gpd [0]     mtu3_requ_complete()        mtu3_gadget_ep_disable()       unlock @mtu->lock         give back request         lock @mtu->lock                                     mtu3_ep_disable()                                       mtu3_gpd_ring_free()                                    unlock @mtu->lock       lock @mtu->lock     get next gpd [1]  [1]: goto [0] to handle next gpd, and next gpd may be NULL.
CVE-2025-68735: In the Linux kernel, the following vulnerability has been resolved:  drm/panthor: Prevent potential UAF in group creation  This commit prevents the possibility of a use after free issue in the GROUP_CREATE ioctl function, which arose as pointer to the group is accessed in that ioctl function after storing it in the Xarray. A malicious userspace can second guess the handle of a group and try to call GROUP_DESTROY ioctl from another thread around the same time as GROUP_CREATE ioctl.  To prevent the use after free exploit, this commit uses a mark on an entry of group pool Xarray which is added just before returning from the GROUP_CREATE ioctl function. The mark is checked for all ioctls that specify the group handle and so userspace won't be abe to delete a group that isn't marked yet.  v2: Add R-bs and fixes tags
CVE-2025-68738: In the Linux kernel, the following vulnerability has been resolved:  wifi: mt76: mt7996: fix null pointer deref in mt7996_conf_tx()  If a link does not have an assigned channel yet, mt7996_vif_link returns NULL. We still need to store the updated queue settings in that case, and apply them later. Move the location of the queue params to within struct mt7996_vif_link.
CVE-2025-68739: In the Linux kernel, the following vulnerability has been resolved:  PM / devfreq: hisi: Fix potential UAF in OPP handling  Ensure all required data is acquired before calling dev_pm_opp_put(opp) to maintain correct resource acquisition and release order.
CVE-2025-68740: In the Linux kernel, the following vulnerability has been resolved:  ima: Handle error code returned by ima_filter_rule_match()  In ima_match_rules(), if ima_filter_rule_match() returns -ENOENT due to the rule being NULL, the function incorrectly skips the 'if (!rc)' check and sets 'result = true'. The LSM rule is considered a match, causing extra files to be measured by IMA.  This issue can be reproduced in the following scenario: After unloading the SELinux policy module via 'semodule -d', if an IMA measurement is triggered before ima_lsm_rules is updated, in ima_match_rules(), the first call to ima_filter_rule_match() returns -ESTALE. This causes the code to enter the 'if (rc == -ESTALE && !rule_reinitialized)' block, perform ima_lsm_copy_rule() and retry. In ima_lsm_copy_rule(), since the SELinux module has been removed, the rule becomes NULL, and the second call to ima_filter_rule_match() returns -ENOENT. This bypasses the 'if (!rc)' check and results in a false match.  Call trace:   selinux_audit_rule_match+0x310/0x3b8   security_audit_rule_match+0x60/0xa0   ima_match_rules+0x2e4/0x4a0   ima_match_policy+0x9c/0x1e8   ima_get_action+0x48/0x60   process_measurement+0xf8/0xa98   ima_bprm_check+0x98/0xd8   security_bprm_check+0x5c/0x78   search_binary_handler+0x6c/0x318   exec_binprm+0x58/0x1b8   bprm_execve+0xb8/0x130   do_execveat_common.isra.0+0x1a8/0x258   __arm64_sys_execve+0x48/0x68   invoke_syscall+0x50/0x128   el0_svc_common.constprop.0+0xc8/0xf0   do_el0_svc+0x24/0x38   el0_svc+0x44/0x200   el0t_64_sync_handler+0x100/0x130   el0t_64_sync+0x3c8/0x3d0  Fix this by changing 'if (!rc)' to 'if (rc <= 0)' to ensure that error codes like -ENOENT do not bypass the check and accidentally result in a successful match.
CVE-2025-68742: In the Linux kernel, the following vulnerability has been resolved:  bpf: Fix invalid prog->stats access when update_effective_progs fails  Syzkaller triggers an invalid memory access issue following fault injection in update_effective_progs. The issue can be described as follows:  __cgroup_bpf_detach   update_effective_progs     compute_effective_progs       bpf_prog_array_alloc <-- fault inject   purge_effective_progs     /* change to dummy_bpf_prog */     array->items[index] = &dummy_bpf_prog.prog  ---softirq start--- __do_softirq   ...     __cgroup_bpf_run_filter_skb       __bpf_prog_run_save_cb         bpf_prog_run           stats = this_cpu_ptr(prog->stats)           /* invalid memory access */           flags = u64_stats_update_begin_irqsave(&stats->syncp) ---softirq end---    static_branch_dec(&cgroup_bpf_enabled_key[atype])  The reason is that fault injection caused update_effective_progs to fail and then changed the original prog into dummy_bpf_prog.prog in purge_effective_progs. Then a softirq came, and accessing the members of dummy_bpf_prog.prog in the softirq triggers invalid mem access.  To fix it, skip updating stats when stats is NULL.
CVE-2025-68744: In the Linux kernel, the following vulnerability has been resolved:  bpf: Free special fields when update [lru_,]percpu_hash maps  As [lru_,]percpu_hash maps support BPF_KPTR_{REF,PERCPU}, missing calls to 'bpf_obj_free_fields()' in 'pcpu_copy_value()' could cause the memory referenced by BPF_KPTR_{REF,PERCPU} fields to be held until the map gets freed.  Fix this by calling 'bpf_obj_free_fields()' after 'copy_map_value[,_long]()' in 'pcpu_copy_value()'.
CVE-2025-68746: In the Linux kernel, the following vulnerability has been resolved:  spi: tegra210-quad: Fix timeout handling  When the CPU that the QSPI interrupt handler runs on (typically CPU 0) is excessively busy, it can lead to rare cases of the IRQ thread not running before the transfer timeout is reached.  While handling the timeouts, any pending transfers are cleaned up and the message that they correspond to is marked as failed, which leaves the curr_xfer field pointing at stale memory.  To avoid this, clear curr_xfer to NULL upon timeout and check for this condition when the IRQ thread is finally run.  While at it, also make sure to clear interrupts on failure so that new interrupts can be run.  A better, more involved, fix would move the interrupt clearing into a hard IRQ handler. Ideally we would also want to signal that the IRQ thread no longer needs to be run after the timeout is hit to avoid the extra check for a valid transfer.
CVE-2025-68747: In the Linux kernel, the following vulnerability has been resolved:  drm/panthor: Fix UAF on kernel BO VA nodes  If the MMU is down, panthor_vm_unmap_range() might return an error. We expect the page table to be updated still, and if the MMU is blocked, the rest of the GPU should be blocked too, so no risk of accessing physical memory returned to the system (which the current code doesn't cover for anyway).  Proceed with the rest of the cleanup instead of bailing out and leaving the va_node inserted in the drm_mm, which leads to UAF when other adjacent nodes are removed from the drm_mm tree.
CVE-2025-68748: In the Linux kernel, the following vulnerability has been resolved:  drm/panthor: Fix UAF race between device unplug and FW event processing  The function panthor_fw_unplug() will free the FW memory sections. The problem is that there could still be pending FW events which are yet not handled at this point. process_fw_events_work() can in this case try to access said freed memory.  Simply call disable_work_sync() to both drain and prevent future invocation of process_fw_events_work().
CVE-2025-68750: In the Linux kernel, the following vulnerability has been resolved:  usb: potential integer overflow in usbg_make_tpg()  The variable tpgt in usbg_make_tpg() is defined as unsigned long and is assigned to tpgt->tport_tpgt, which is defined as u16. This may cause an integer overflow when tpgt is greater than USHRT_MAX (65535). I haven't tried to trigger it myself, but it is possible to trigger it by calling usbg_make_tpg() with a large value for tpgt.  I modified the type of tpgt to match tpgt->tport_tpgt and adjusted the relevant code accordingly.  This patch is similar to commit 59c816c1f24d ("vhost/scsi: potential memory corruption").
CVE-2025-13417: The Plugin Organizer WordPress plugin before 10.2.4 does not sanitize and escape a parameter before using it in a SQL statement, allowing subscribers to perform SQL injection attacks.
CVE-2025-13958: The YaMaps for WordPress Plugin WordPress plugin before 0.6.40 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVE-2025-14312: The Advance WP Query Search Filter WordPress plugin through 1.0.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVE-2025-14313: The Advance WP Query Search Filter WordPress plugin through 1.0.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVE-2022-50784: In the Linux kernel, the following vulnerability has been resolved:  wifi: iwlwifi: mei: fix potential NULL-ptr deref after clone  If cloning the SKB fails, don't try to use it, but rather return as if we should pass it.  Coverity CID: 1503456
CVE-2022-50785: In the Linux kernel, the following vulnerability has been resolved:  fsi: occ: Prevent use after free  Use get_device and put_device in the open and close functions to make sure the device doesn't get freed while a file descriptor is open. Also, lock around the freeing of the device buffer and check the buffer before using it in the submit function.
CVE-2022-50786: In the Linux kernel, the following vulnerability has been resolved:  media: s5p-mfc: Clear workbit to handle error condition  During error on CLOSE_INSTANCE command, ctx_work_bits was not getting cleared. During consequent mfc execution NULL pointer dereferencing of this context led to kernel panic. This patch fixes this issue by making sure to clear ctx_work_bits always.
CVE-2023-54162: In the Linux kernel, the following vulnerability has been resolved:  ksmbd: fix possible memory leak in smb2_lock()  argv needs to be free when setup_async_work fails or when the current process is woken up.
CVE-2022-50809: In the Linux kernel, the following vulnerability has been resolved:  xhci: dbc: Fix memory leak in xhci_alloc_dbc()  If DbC is already in use, then the allocated memory for the xhci_dbc struct doesn't get freed before returning NULL, which leads to a memleak.
CVE-2022-50810: In the Linux kernel, the following vulnerability has been resolved:  rapidio: devices: fix missing put_device in mport_cdev_open  When kfifo_alloc fails, the refcount of chdev->dev is left incremental.  We should use put_device(&chdev->dev) to decrease the ref count of chdev->dev to avoid refcount leak.
CVE-2022-50811: In the Linux kernel, the following vulnerability has been resolved:  erofs: fix missing unmap if z_erofs_get_extent_compressedlen() fails  Otherwise, meta buffers could be leaked.
CVE-2022-50813: In the Linux kernel, the following vulnerability has been resolved:  drivers: mcb: fix resource leak in mcb_probe()  When probe hook function failed in mcb_probe(), it doesn't put the device. Compiled test only.
CVE-2022-50814: In the Linux kernel, the following vulnerability has been resolved:  crypto: hisilicon/zip - fix mismatch in get/set sgl_sge_nr  KASAN reported this Bug:   [17619.659757] BUG: KASAN: global-out-of-bounds in param_get_int+0x34/0x60  [17619.673193] Read of size 4 at addr fffff01332d7ed00 by task read_all/1507958  ...  [17619.698934] The buggy address belongs to the variable:  [17619.708371]  sgl_sge_nr+0x0/0xffffffffffffa300 [hisi_zip]  There is a mismatch in hisi_zip when get/set the variable sgl_sge_nr. The type of sgl_sge_nr is u16, and get/set sgl_sge_nr by param_get/set_int.  Replacing param_get/set_int to param_get/set_ushort can fix this bug.