linux package
kernel
pkg:linux/kernel
Vulnerabilities (14,255)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2022-49402 | Med | 5.5 | >= 5.5.0, < 5.10.121 | 5.10.121 | Feb 26, 2025 | In the Linux kernel, the following vulnerability has been resolved: ftrace: Clean up hash direct_functions on register failures We see the following GPF when register_ftrace_direct fails: [ ] general protection fault, probably for non-canonical address \ 0x200000000000010: 0 | |
| CVE-2022-49401 | Hig | 7.1 | >= 5.18.0, < 5.18.3 | 5.18.3 | Feb 26, 2025 | In the Linux kernel, the following vulnerability has been resolved: mm/page_owner: use strscpy() instead of strlcpy() current->comm[] is not a string (no guarantee for a zero byte in it). strlcpy(s1, s2, l) is calling strlen(s2), potentially causing out-of-bound access, as rep | |
| CVE-2022-49400 | Med | 5.5 | < 5.15.46 | 5.15.46 | Feb 26, 2025 | In the Linux kernel, the following vulnerability has been resolved: md: Don't set mddev private to NULL in raid0 pers->free In normal stop process, it does like this: do_md_stop | __md_stop (pers->free(); mddev->private=NULL) | md_free (free mddev) __md_sto | |
| CVE-2022-49399 | Med | 5.5 | >= 3.9.0, < 4.14.283 | 4.14.283 | Feb 26, 2025 | In the Linux kernel, the following vulnerability has been resolved: tty: goldfish: Use tty_port_destroy() to destroy port In goldfish_tty_probe(), the port initialized through tty_port_init() should be destroyed in error paths.In goldfish_tty_remove(), qtty->port also should be | |
| CVE-2022-49398 | Med | 5.5 | >= 5.0.0, < 5.15.47 | 5.15.47 | Feb 26, 2025 | In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: Replace list_for_each_entry_safe() if using giveback The list_for_each_entry_safe() macro saves the current item (n) and the item after (n+1), so that n can be safely removed without corrupti | |
| CVE-2022-49397 | Med | 5.5 | >= 4.12.0, < 4.14.283 | 4.14.283 | Feb 26, 2025 | In the Linux kernel, the following vulnerability has been resolved: phy: qcom-qmp: fix struct clk leak on probe errors Make sure to release the pipe clock reference in case of a late probe error (e.g. probe deferral). | |
| CVE-2022-49396 | Med | 5.5 | >= 4.12.0, < 4.14.283 | 4.14.283 | Feb 26, 2025 | In the Linux kernel, the following vulnerability has been resolved: phy: qcom-qmp: fix reset-controller leak on probe errors Make sure to release the lane reset controller in case of a late probe error (e.g. probe deferral). Note that due to the reset controller being defined | |
| CVE-2022-49395 | Hig | 7.1 | >= 2.6.15, < 4.9.318 | 4.9.318 | Feb 26, 2025 | In the Linux kernel, the following vulnerability has been resolved: um: Fix out-of-bounds read in LDT setup syscall_stub_data() expects the data_count parameter to be the number of longs, not bytes. ================================================================== BUG: KASA | |
| CVE-2022-49394 | Med | 5.5 | < 4.19.247 | 4.19.247 | Feb 26, 2025 | In the Linux kernel, the following vulnerability has been resolved: blk-iolatency: Fix inflight count imbalances and IO hangs on offline iolatency needs to track the number of inflight IOs per cgroup. As this tracking can be expensive, it is disabled when no cgroup has iolatenc | |
| CVE-2022-49393 | Hig | 7.8 | >= 5.18.0, < 5.18.3 | 5.18.3 | Feb 26, 2025 | In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: fix list iterator in fastrpc_req_mem_unmap_impl This is another instance of incorrect use of list iterator and checking it for NULL. The list iterator value 'map' will *always* be set and non-NU | |
| CVE-2022-49392 | Med | 5.5 | >= 5.14.0, < 5.15.47 | 5.15.47 | Feb 26, 2025 | In the Linux kernel, the following vulnerability has been resolved: serial: 8250_aspeed_vuart: Fix potential NULL dereference in aspeed_vuart_probe platform_get_resource() may fail and return NULL, so we should better check it's return value to avoid a NULL pointer dereference. | |
| CVE-2022-49391 | Hig | 7.8 | >= 5.18.0, < 5.18.4 | 5.18.4 | Feb 26, 2025 | In the Linux kernel, the following vulnerability has been resolved: remoteproc: mtk_scp: Fix a potential double free 'scp->rproc' is allocated using devm_rproc_alloc(), so there is no need to free it explicitly in the remove function. | |
| CVE-2022-49390 | Hig | 7.8 | >= 5.4.0, < 5.17.15 | 5.17.15 | Feb 26, 2025 | In the Linux kernel, the following vulnerability has been resolved: macsec: fix UAF bug for real_dev Create a new macsec device but not get reference to real_dev. That can not ensure that real_dev is freed after macsec. That will trigger the UAF bug for real_dev as following: | |
| CVE-2022-49389 | Med | 5.5 | >= 3.19.0, < 4.9.318 | 4.9.318 | Feb 26, 2025 | In the Linux kernel, the following vulnerability has been resolved: usb: usbip: fix a refcount leak in stub_probe() usb_get_dev() is called in stub_device_alloc(). When stub_probe() fails after that, usb_put_dev() needs to be called to release the reference. Fix this by moving | |
| CVE-2022-49388 | Hig | 7.8 | >= 4.12.0, < 4.14.283 | 4.14.283 | Feb 26, 2025 | In the Linux kernel, the following vulnerability has been resolved: ubi: ubi_create_volume: Fix use-after-free when volume creation failed There is an use-after-free problem for 'eba_tbl' in ubi_create_volume()'s error handling path: ubi_eba_replace_table(vol, eba_tbl) v | |
| CVE-2022-49387 | Med | 5.5 | >= 5.17.0, < 5.17.15 | 5.17.15 | Feb 26, 2025 | In the Linux kernel, the following vulnerability has been resolved: watchdog: rzg2l_wdt: Fix 32bit overflow issue The value of timer_cycle_us can be 0 due to 32bit overflow. For eg:- If we assign the counter value "0xfff" for computing maxval. This patch fixes this issue by ap | |
| CVE-2022-49386 | Med | 5.5 | >= 5.7.0, < 5.10.122 | 5.10.122 | Feb 26, 2025 | In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: am65-cpsw-nuss: Fix some refcount leaks of_get_child_by_name() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. am65_cpsw_init_cpts() | |
| CVE-2022-49385 | Hig | 7.8 | >= 3.9.0, < 5.4.198 | 5.4.198 | Feb 26, 2025 | In the Linux kernel, the following vulnerability has been resolved: driver: base: fix UAF when driver_attach failed When driver_attach(drv); failed, the driver_private will be freed. But it has been added to the bus, which caused a UAF. To fix it, we need to delete it from the | |
| CVE-2022-49384 | Hig | 7.8 | < 5.15.46 | 5.15.46 | Feb 26, 2025 | In the Linux kernel, the following vulnerability has been resolved: md: fix double free of io_acct_set bioset Now io_acct_set is alloc and free in personality. Remove the codes that free io_acct_set in md_free and md_stop. | |
| CVE-2022-49383 | Med | 5.5 | >= 5.17.0, < 5.17.15 | 5.17.15 | Feb 26, 2025 | In the Linux kernel, the following vulnerability has been resolved: watchdog: rzg2l_wdt: Fix 'BUG: Invalid wait context' This patch fixes the issue 'BUG: Invalid wait context' during restart() callback by using clk_prepare_enable() instead of pm_runtime_get_sync() for turning o |
- affected >= 5.5.0, < 5.10.121fixed 5.10.121
In the Linux kernel, the following vulnerability has been resolved: ftrace: Clean up hash direct_functions on register failures We see the following GPF when register_ftrace_direct fails: [ ] general protection fault, probably for non-canonical address \ 0x200000000000010: 0
- affected >= 5.18.0, < 5.18.3fixed 5.18.3
In the Linux kernel, the following vulnerability has been resolved: mm/page_owner: use strscpy() instead of strlcpy() current->comm[] is not a string (no guarantee for a zero byte in it). strlcpy(s1, s2, l) is calling strlen(s2), potentially causing out-of-bound access, as rep
- affected < 5.15.46fixed 5.15.46
In the Linux kernel, the following vulnerability has been resolved: md: Don't set mddev private to NULL in raid0 pers->free In normal stop process, it does like this: do_md_stop | __md_stop (pers->free(); mddev->private=NULL) | md_free (free mddev) __md_sto
- affected >= 3.9.0, < 4.14.283fixed 4.14.283
In the Linux kernel, the following vulnerability has been resolved: tty: goldfish: Use tty_port_destroy() to destroy port In goldfish_tty_probe(), the port initialized through tty_port_init() should be destroyed in error paths.In goldfish_tty_remove(), qtty->port also should be
- affected >= 5.0.0, < 5.15.47fixed 5.15.47
In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: Replace list_for_each_entry_safe() if using giveback The list_for_each_entry_safe() macro saves the current item (n) and the item after (n+1), so that n can be safely removed without corrupti
- affected >= 4.12.0, < 4.14.283fixed 4.14.283
In the Linux kernel, the following vulnerability has been resolved: phy: qcom-qmp: fix struct clk leak on probe errors Make sure to release the pipe clock reference in case of a late probe error (e.g. probe deferral).
- affected >= 4.12.0, < 4.14.283fixed 4.14.283
In the Linux kernel, the following vulnerability has been resolved: phy: qcom-qmp: fix reset-controller leak on probe errors Make sure to release the lane reset controller in case of a late probe error (e.g. probe deferral). Note that due to the reset controller being defined
- affected >= 2.6.15, < 4.9.318fixed 4.9.318
In the Linux kernel, the following vulnerability has been resolved: um: Fix out-of-bounds read in LDT setup syscall_stub_data() expects the data_count parameter to be the number of longs, not bytes. ================================================================== BUG: KASA
- affected < 4.19.247fixed 4.19.247
In the Linux kernel, the following vulnerability has been resolved: blk-iolatency: Fix inflight count imbalances and IO hangs on offline iolatency needs to track the number of inflight IOs per cgroup. As this tracking can be expensive, it is disabled when no cgroup has iolatenc
- affected >= 5.18.0, < 5.18.3fixed 5.18.3
In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: fix list iterator in fastrpc_req_mem_unmap_impl This is another instance of incorrect use of list iterator and checking it for NULL. The list iterator value 'map' will *always* be set and non-NU
- affected >= 5.14.0, < 5.15.47fixed 5.15.47
In the Linux kernel, the following vulnerability has been resolved: serial: 8250_aspeed_vuart: Fix potential NULL dereference in aspeed_vuart_probe platform_get_resource() may fail and return NULL, so we should better check it's return value to avoid a NULL pointer dereference.
- affected >= 5.18.0, < 5.18.4fixed 5.18.4
In the Linux kernel, the following vulnerability has been resolved: remoteproc: mtk_scp: Fix a potential double free 'scp->rproc' is allocated using devm_rproc_alloc(), so there is no need to free it explicitly in the remove function.
- affected >= 5.4.0, < 5.17.15fixed 5.17.15
In the Linux kernel, the following vulnerability has been resolved: macsec: fix UAF bug for real_dev Create a new macsec device but not get reference to real_dev. That can not ensure that real_dev is freed after macsec. That will trigger the UAF bug for real_dev as following:
- affected >= 3.19.0, < 4.9.318fixed 4.9.318
In the Linux kernel, the following vulnerability has been resolved: usb: usbip: fix a refcount leak in stub_probe() usb_get_dev() is called in stub_device_alloc(). When stub_probe() fails after that, usb_put_dev() needs to be called to release the reference. Fix this by moving
- affected >= 4.12.0, < 4.14.283fixed 4.14.283
In the Linux kernel, the following vulnerability has been resolved: ubi: ubi_create_volume: Fix use-after-free when volume creation failed There is an use-after-free problem for 'eba_tbl' in ubi_create_volume()'s error handling path: ubi_eba_replace_table(vol, eba_tbl) v
- affected >= 5.17.0, < 5.17.15fixed 5.17.15
In the Linux kernel, the following vulnerability has been resolved: watchdog: rzg2l_wdt: Fix 32bit overflow issue The value of timer_cycle_us can be 0 due to 32bit overflow. For eg:- If we assign the counter value "0xfff" for computing maxval. This patch fixes this issue by ap
- affected >= 5.7.0, < 5.10.122fixed 5.10.122
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: am65-cpsw-nuss: Fix some refcount leaks of_get_child_by_name() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. am65_cpsw_init_cpts()
- affected >= 3.9.0, < 5.4.198fixed 5.4.198
In the Linux kernel, the following vulnerability has been resolved: driver: base: fix UAF when driver_attach failed When driver_attach(drv); failed, the driver_private will be freed. But it has been added to the bus, which caused a UAF. To fix it, we need to delete it from the
- affected < 5.15.46fixed 5.15.46
In the Linux kernel, the following vulnerability has been resolved: md: fix double free of io_acct_set bioset Now io_acct_set is alloc and free in personality. Remove the codes that free io_acct_set in md_free and md_stop.
- affected >= 5.17.0, < 5.17.15fixed 5.17.15
In the Linux kernel, the following vulnerability has been resolved: watchdog: rzg2l_wdt: Fix 'BUG: Invalid wait context' This patch fixes the issue 'BUG: Invalid wait context' during restart() callback by using clk_prepare_enable() instead of pm_runtime_get_sync() for turning o
Page 505 of 713