kernel

Vulnerabilities (14,254)

• CVE-2022-48984MedOct 21, 2024
  affected >= 6.0.0, < 6.0.13fixed 6.0.13

  In the Linux kernel, the following vulnerability has been resolved: can: slcan: fix freed work crash The LTP test pty03 is causing a crash in slcan: BUG: kernel NULL pointer dereference, address: 0000000000000008 #PF: supervisor read access in kernel mode #PF: error_code(

• CVE-2022-48983MedOct 21, 2024
  affected >= 5.12.0, < 5.15.83fixed 5.15.83

  In the Linux kernel, the following vulnerability has been resolved: io_uring: Fix a null-ptr-deref in io_tctx_exit_cb() Syzkaller reports a NULL deref bug as follows: BUG: KASAN: null-ptr-deref in io_tctx_exit_cb+0x53/0xd3 Read of size 4 at addr 0000000000000138 by task file

• CVE-2022-48982MedOct 21, 2024
  affected >= 6.0.0, < 6.0.13fixed 6.0.13

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix crash when replugging CSR fake controllers It seems fake CSR 5.0 clones can cause the suspend notifier to be registered twice causing the following kernel panic: [ 71.986122] Call Trace: [ 7

• CVE-2022-48981HigOct 21, 2024
  affected >= 5.2.0, < 5.4.227fixed 5.4.227

  In the Linux kernel, the following vulnerability has been resolved: drm/shmem-helper: Remove errant put in error path drm_gem_shmem_mmap() doesn't own this reference, resulting in the GEM object getting prematurely freed leading to a later use-after-free.

• CVE-2022-48980HigOct 21, 2024
  affected >= 5.14.0, < 5.15.83fixed 5.15.83

  In the Linux kernel, the following vulnerability has been resolved: net: dsa: sja1105: avoid out of bounds access in sja1105_init_l2_policing() The SJA1105 family has 45 L2 policing table entries (SJA1105_MAX_L2_POLICING_COUNT) and SJA1110 has 110 (SJA1110_MAX_L2_POLICING_COUNT

• CVE-2022-48979HigOct 21, 2024
  affected >= 5.14.0, < 6.0.13fixed 6.0.13

  In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix array index out of bound error in DCN32 DML [Why&How] LinkCapacitySupport array is indexed with the number of voltage states and not the number of max DPPs. Fix the error by changing the ar

• CVE-2022-48978MedOct 21, 2024
  affected >= 2.6.20, < 4.9.336fixed 4.9.336

  In the Linux kernel, the following vulnerability has been resolved: HID: core: fix shift-out-of-bounds in hid_report_raw_event Syzbot reported shift-out-of-bounds in hid_report_raw_event. microsoft 0003:045E:07DA.0001: hid_field_extract() called with n (128) > 32! (swapper/0)

• CVE-2022-48977MedOct 21, 2024
  affected < 5.4.227fixed 5.4.227

  In the Linux kernel, the following vulnerability has been resolved: can: af_can: fix NULL pointer dereference in can_rcv_filter Analogue to commit 8aa59e355949 ("can: af_can: fix NULL pointer dereference in can_rx_register()") we need to check for a missing initialization of ml

• CVE-2022-48976MedOct 21, 2024
  affected >= 6.0.0, < 6.0.13fixed 6.0.13

  In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable_offload: fix using __this_cpu_add in preemptible flow_offload_queue_work() can be called in workqueue without bh disabled, like the call trace showed in my act_ct testing, calling NF_FLOW_T

• CVE-2022-48975MedOct 21, 2024
  affected >= 4.6.0, < 5.15.83fixed 5.15.83

  In the Linux kernel, the following vulnerability has been resolved: gpiolib: fix memory leak in gpiochip_setup_dev() Here is a backtrace report about memory leak detected in gpiochip_setup_dev(): unreferenced object 0xffff88810b406400 (size 512): comm "python3", pid 1682, ji

• CVE-2022-48974MedOct 21, 2024
  affected >= 5.19.0, < 6.0.13fixed 6.0.13

  In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: fix using __this_cpu_add in preemptible Currently in nf_conntrack_hash_check_insert(), when it fails in nf_ct_ext_valid_pre/post(), NF_CT_STAT_INC() will be called in the preemptible conte

• CVE-2022-48973MedOct 21, 2024
  affected >= 3.6.0, < 4.9.336fixed 4.9.336

  In the Linux kernel, the following vulnerability has been resolved: gpio: amd8111: Fix PCI device reference count leak for_each_pci_dev() is implemented by pci_get_device(). The comment of pci_get_device() says that it will increase the reference count for the returned pci_dev

• CVE-2022-48972MedOct 21, 2024
  affected >= 3.19.0, < 4.9.336fixed 4.9.336

  In the Linux kernel, the following vulnerability has been resolved: mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add() Kernel fault injection test reports null-ptr-deref as follows: BUG: kernel NULL pointer dereference, address: 0000000000000008 RIP: 0010:cfg802154_n

• CVE-2022-48971MedOct 21, 2024
  affected >= 4.9.0, < 4.19.269fixed 4.19.269

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix not cleanup led when bt_init fails bt_init() calls bt_leds_init() to register led, but if it fails later, bt_leds_cleanup() is not called to unregister it. This can cause panic if the argument "

• CVE-2022-48970MedOct 21, 2024
  affected >= 5.3.0, < 5.4.227fixed 5.4.227

  In the Linux kernel, the following vulnerability has been resolved: af_unix: Get user_ns from in_skb in unix_diag_get_exact(). Wei Chen reported a NULL deref in sk_user_ns() [0][1], and Paolo diagnosed the root cause: in unix_diag_get_exact(), the newly allocated skb does not h

• CVE-2022-48969MedOct 21, 2024
  affected >= 2.6.24, < 4.19.269fixed 4.19.269

  In the Linux kernel, the following vulnerability has been resolved: xen-netfront: Fix NULL sring after live migration A NAPI is setup for each network sring to poll data to kernel The sring with source host is destroyed before live migration and new sring with target host is se

• CVE-2022-48968MedOct 21, 2024
  affected >= 5.15.0, < 5.15.83fixed 5.15.83

  In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: Fix potential memory leak in otx2_init_tc() In otx2_init_tc(), if rhashtable_init() failed, it does not free tc->tc_entries_bitmap which is allocated in otx2_tc_alloc_ent_bitmap().

• CVE-2022-48967HigOct 21, 2024
  affected >= 3.4.0, < 4.9.336fixed 4.9.336

  In the Linux kernel, the following vulnerability has been resolved: NFC: nci: Bounds check struct nfc_target arrays While running under CONFIG_FORTIFY_SOURCE=y, syzkaller reported: memcpy: detected field-spanning write (size 129) of single field "target->sensf_res" at net/nf

• CVE-2022-48966HigOct 21, 2024
  affected >= 4.5.0, < 4.9.336fixed 4.9.336

  In the Linux kernel, the following vulnerability has been resolved: net: mvneta: Prevent out of bounds read in mvneta_config_rss() The pp->indir[0] value comes from the user. It is passed to: if (cpu_online(pp->rxq_def)) inside the mvneta_percpu_elect() function. It needs

• CVE-2022-48965MedOct 21, 2024
  affected >= 5.15.0, < 5.15.83fixed 5.15.83

  In the Linux kernel, the following vulnerability has been resolved: gpio/rockchip: fix refcount leak in rockchip_gpiolib_register() The node returned by of_get_parent() with refcount incremented, of_node_put() needs be called when finish using it. So add it in the end of of_pin