linux package
kernel
pkg:linux/kernel
Vulnerabilities (14,255)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2022-49199 | Med | 5.5 | >= 5.16.0, < 5.16.19 | 5.16.19 | Feb 26, 2025 | In the Linux kernel, the following vulnerability has been resolved: RDMA/nldev: Prevent underflow in nldev_stat_set_counter_dynamic_doit() This code checks "index" for an upper bound but it does not check for negatives. Change the type to unsigned to prevent underflows. | |
| CVE-2022-49198 | Med | 5.5 | >= 5.16.0, < 5.16.19 | 5.16.19 | Feb 26, 2025 | In the Linux kernel, the following vulnerability has been resolved: mptcp: Fix crash due to tcp_tsorted_anchor was initialized before release skb Got crash when doing pressure test of mptcp: =========================================================================== dst_releas | |
| CVE-2022-49197 | Med | 5.5 | >= 2.6.14, < 4.9.311 | 4.9.311 | Feb 26, 2025 | In the Linux kernel, the following vulnerability has been resolved: af_netlink: Fix shift out of bounds in group mask calculation When a netlink message is received, netlink_recvmsg() fills in the address of the sender. One of the fields is the 32-bit bitfield nl_groups, which | |
| CVE-2022-49196 | Hig | 7.8 | >= 4.8.0, < 5.15.33 | 5.15.33 | Feb 26, 2025 | In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: Fix use after free in remove_phb_dynamic() In remove_phb_dynamic() we use &phb->io_resource, after we've called device_unregister(&host_bridge->dev). But the unregister may have freed phb, beca | |
| CVE-2022-49195 | Med | 5.5 | >= 5.15.0, < 5.15.33 | 5.15.33 | Feb 26, 2025 | In the Linux kernel, the following vulnerability has been resolved: net: dsa: fix panic on shutdown if multi-chip tree failed to probe DSA probing is atypical because a tree of devices must probe all at once, so out of N switches which call dsa_tree_setup_routing_table() during | |
| CVE-2022-49194 | Cri | 9.8 | >= 4.14.0, < 5.10.110 | 5.10.110 | Feb 26, 2025 | In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: Use stronger register read/writes to assure ordering GCC12 appears to be much smarter about its dependency tracking and is aware that the relaxed variants are just normal loads and stores and thi | |
| CVE-2022-49193 | Med | 5.5 | >= 5.14.0, < 5.15.33 | 5.15.33 | Feb 26, 2025 | In the Linux kernel, the following vulnerability has been resolved: ice: fix 'scheduling while atomic' on aux critical err interrupt There's a kernel BUG splat on processing aux critical error interrupts in ice_misc_intr(): [ 2100.917085] BUG: scheduling while atomic: swapper/ | |
| CVE-2022-49192 | Med | 5.5 | >= 5.15.0, < 5.15.33 | 5.15.33 | Feb 26, 2025 | In the Linux kernel, the following vulnerability has been resolved: drivers: ethernet: cpsw: fix panic when interrupt coaleceing is set via ethtool cpsw_ethtool_begin directly returns the result of pm_runtime_get_sync when successful. pm_runtime_get_sync returns -error code on | |
| CVE-2022-49191 | Med | 5.5 | >= 2.6.33, < 4.9.311 | 4.9.311 | Feb 26, 2025 | In the Linux kernel, the following vulnerability has been resolved: mxser: fix xmit_buf leak in activate when LSR == 0xff When LSR is 0xff in ->activate() (rather unlike), we return an error. Provided ->shutdown() is not called when ->activate() fails, nothing actually frees th | |
| CVE-2022-49190 | Med | 5.5 | >= 3.10.0, < 5.10.237 | 5.10.237 | Feb 26, 2025 | In the Linux kernel, the following vulnerability has been resolved: kernel/resource: fix kfree() of bootmem memory again Since commit ebff7d8f270d ("mem hotunplug: fix kfree() of bootmem memory"), we could get a resource allocated during boot via alloc_resource(). And it's req | |
| CVE-2022-49189 | Med | 5.5 | >= 3.16.0, < 5.4.189 | 5.4.189 | Feb 26, 2025 | In the Linux kernel, the following vulnerability has been resolved: clk: qcom: clk-rcg2: Update logic to calculate D value for RCG The display pixel clock has a requirement on certain newer platforms to support M/N as (2/3) and the final D value calculated results in underflow | |
| CVE-2022-49188 | Med | 5.5 | >= 4.8.0, < 5.10.110 | 5.10.110 | Feb 26, 2025 | In the Linux kernel, the following vulnerability has been resolved: remoteproc: qcom_q6v5_mss: Fix some leaks in q6v5_alloc_memory_region The device_node pointer is returned by of_parse_phandle() or of_get_child_by_name() with refcount incremented. We should use of_node_put() o | |
| CVE-2022-49187 | Med | 5.5 | >= 5.11.0, < 5.15.33 | 5.15.33 | Feb 26, 2025 | In the Linux kernel, the following vulnerability has been resolved: clk: Fix clk_hw_get_clk() when dev is NULL Any registered clk_core structure can have a NULL pointer in its dev field. While never actually documented, this is evidenced by the wide usage of clk_register and cl | |
| CVE-2022-49186 | Hig | 7.8 | >= 5.17.0, < 5.17.2 | 5.17.2 | Feb 26, 2025 | In the Linux kernel, the following vulnerability has been resolved: clk: visconti: prevent array overflow in visconti_clk_register_gates() This code was using -1 to represent that there was no reset function. Unfortunately, the -1 was stored in u8 so the if (clks[i].rs_id >= 0) | |
| CVE-2022-49185 | Med | 5.5 | >= 3.9.0, < 4.9.311 | 4.9.311 | Feb 26, 2025 | In the Linux kernel, the following vulnerability has been resolved: pinctrl: nomadik: Add missing of_node_put() in nmk_pinctrl_probe This node pointer is returned by of_parse_phandle() with refcount incremented in this function. Calling of_node_put() to avoid the refcount leak. | |
| CVE-2022-49184 | Med | 5.5 | >= 5.15.0, < 5.15.33 | 5.15.33 | Feb 26, 2025 | In the Linux kernel, the following vulnerability has been resolved: net: sparx5: switchdev: fix possible NULL pointer dereference As the possible failure of the allocation, devm_kzalloc() may return NULL pointer. Therefore, it should be better to check the 'db' in order to prev | |
| CVE-2022-49183 | Med | 5.5 | < 5.10.258 | 5.10.258 | Feb 26, 2025 | In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: fix ref leak when switching zones When switching zones or network namespaces without doing a ct clear in between, it is now leaking a reference to the old ct entry. That's because tcf_ct_skb_ | |
| CVE-2022-49182 | Hig | 7.8 | >= 5.1.0, < 5.15.33 | 5.15.33 | Feb 26, 2025 | In the Linux kernel, the following vulnerability has been resolved: net: hns3: add vlan list lock to protect vlan list When adding port base VLAN, vf VLAN need to remove from HW and modify the vlan state in vf VLAN list as false. If the periodicity task is freeing the same node | |
| CVE-2022-49180 | Med | 5.5 | >= 5.1.0, < 5.4.189 | 5.4.189 | Feb 26, 2025 | In the Linux kernel, the following vulnerability has been resolved: LSM: general protection fault in legacy_parse_param The usual LSM hook "bail on fail" scheme doesn't work for cases where a security module may return an error code indicating that it does not recognize an inpu | |
| CVE-2022-49179 | Hig | 7.8 | >= 4.16.0, < 5.4.189 | 5.4.189 | Feb 26, 2025 | In the Linux kernel, the following vulnerability has been resolved: block, bfq: don't move oom_bfqq Our test report a UAF: [ 2073.019181] ================================================================== [ 2073.019188] BUG: KASAN: use-after-free in __bfq_put_async_bfqq+0xa0/0 |
- affected >= 5.16.0, < 5.16.19fixed 5.16.19
In the Linux kernel, the following vulnerability has been resolved: RDMA/nldev: Prevent underflow in nldev_stat_set_counter_dynamic_doit() This code checks "index" for an upper bound but it does not check for negatives. Change the type to unsigned to prevent underflows.
- affected >= 5.16.0, < 5.16.19fixed 5.16.19
In the Linux kernel, the following vulnerability has been resolved: mptcp: Fix crash due to tcp_tsorted_anchor was initialized before release skb Got crash when doing pressure test of mptcp: =========================================================================== dst_releas
- affected >= 2.6.14, < 4.9.311fixed 4.9.311
In the Linux kernel, the following vulnerability has been resolved: af_netlink: Fix shift out of bounds in group mask calculation When a netlink message is received, netlink_recvmsg() fills in the address of the sender. One of the fields is the 32-bit bitfield nl_groups, which
- affected >= 4.8.0, < 5.15.33fixed 5.15.33
In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: Fix use after free in remove_phb_dynamic() In remove_phb_dynamic() we use &phb->io_resource, after we've called device_unregister(&host_bridge->dev). But the unregister may have freed phb, beca
- affected >= 5.15.0, < 5.15.33fixed 5.15.33
In the Linux kernel, the following vulnerability has been resolved: net: dsa: fix panic on shutdown if multi-chip tree failed to probe DSA probing is atypical because a tree of devices must probe all at once, so out of N switches which call dsa_tree_setup_routing_table() during
- affected >= 4.14.0, < 5.10.110fixed 5.10.110
In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: Use stronger register read/writes to assure ordering GCC12 appears to be much smarter about its dependency tracking and is aware that the relaxed variants are just normal loads and stores and thi
- affected >= 5.14.0, < 5.15.33fixed 5.15.33
In the Linux kernel, the following vulnerability has been resolved: ice: fix 'scheduling while atomic' on aux critical err interrupt There's a kernel BUG splat on processing aux critical error interrupts in ice_misc_intr(): [ 2100.917085] BUG: scheduling while atomic: swapper/
- affected >= 5.15.0, < 5.15.33fixed 5.15.33
In the Linux kernel, the following vulnerability has been resolved: drivers: ethernet: cpsw: fix panic when interrupt coaleceing is set via ethtool cpsw_ethtool_begin directly returns the result of pm_runtime_get_sync when successful. pm_runtime_get_sync returns -error code on
- affected >= 2.6.33, < 4.9.311fixed 4.9.311
In the Linux kernel, the following vulnerability has been resolved: mxser: fix xmit_buf leak in activate when LSR == 0xff When LSR is 0xff in ->activate() (rather unlike), we return an error. Provided ->shutdown() is not called when ->activate() fails, nothing actually frees th
- affected >= 3.10.0, < 5.10.237fixed 5.10.237
In the Linux kernel, the following vulnerability has been resolved: kernel/resource: fix kfree() of bootmem memory again Since commit ebff7d8f270d ("mem hotunplug: fix kfree() of bootmem memory"), we could get a resource allocated during boot via alloc_resource(). And it's req
- affected >= 3.16.0, < 5.4.189fixed 5.4.189
In the Linux kernel, the following vulnerability has been resolved: clk: qcom: clk-rcg2: Update logic to calculate D value for RCG The display pixel clock has a requirement on certain newer platforms to support M/N as (2/3) and the final D value calculated results in underflow
- affected >= 4.8.0, < 5.10.110fixed 5.10.110
In the Linux kernel, the following vulnerability has been resolved: remoteproc: qcom_q6v5_mss: Fix some leaks in q6v5_alloc_memory_region The device_node pointer is returned by of_parse_phandle() or of_get_child_by_name() with refcount incremented. We should use of_node_put() o
- affected >= 5.11.0, < 5.15.33fixed 5.15.33
In the Linux kernel, the following vulnerability has been resolved: clk: Fix clk_hw_get_clk() when dev is NULL Any registered clk_core structure can have a NULL pointer in its dev field. While never actually documented, this is evidenced by the wide usage of clk_register and cl
- affected >= 5.17.0, < 5.17.2fixed 5.17.2
In the Linux kernel, the following vulnerability has been resolved: clk: visconti: prevent array overflow in visconti_clk_register_gates() This code was using -1 to represent that there was no reset function. Unfortunately, the -1 was stored in u8 so the if (clks[i].rs_id >= 0)
- affected >= 3.9.0, < 4.9.311fixed 4.9.311
In the Linux kernel, the following vulnerability has been resolved: pinctrl: nomadik: Add missing of_node_put() in nmk_pinctrl_probe This node pointer is returned by of_parse_phandle() with refcount incremented in this function. Calling of_node_put() to avoid the refcount leak.
- affected >= 5.15.0, < 5.15.33fixed 5.15.33
In the Linux kernel, the following vulnerability has been resolved: net: sparx5: switchdev: fix possible NULL pointer dereference As the possible failure of the allocation, devm_kzalloc() may return NULL pointer. Therefore, it should be better to check the 'db' in order to prev
- affected < 5.10.258fixed 5.10.258
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: fix ref leak when switching zones When switching zones or network namespaces without doing a ct clear in between, it is now leaking a reference to the old ct entry. That's because tcf_ct_skb_
- affected >= 5.1.0, < 5.15.33fixed 5.15.33
In the Linux kernel, the following vulnerability has been resolved: net: hns3: add vlan list lock to protect vlan list When adding port base VLAN, vf VLAN need to remove from HW and modify the vlan state in vf VLAN list as false. If the periodicity task is freeing the same node
- affected >= 5.1.0, < 5.4.189fixed 5.4.189
In the Linux kernel, the following vulnerability has been resolved: LSM: general protection fault in legacy_parse_param The usual LSM hook "bail on fail" scheme doesn't work for cases where a security module may return an error code indicating that it does not recognize an inpu
- affected >= 4.16.0, < 5.4.189fixed 5.4.189
In the Linux kernel, the following vulnerability has been resolved: block, bfq: don't move oom_bfqq Our test report a UAF: [ 2073.019181] ================================================================== [ 2073.019188] BUG: KASAN: use-after-free in __bfq_put_async_bfqq+0xa0/0
Page 515 of 713