linux package
kernel
pkg:linux/kernel
Vulnerabilities (14,119)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2022-48863 | Med | 5.5 | >= 2.6.27, < 5.10.106 | 5.10.106 | Jul 16, 2024 | In the Linux kernel, the following vulnerability has been resolved: mISDN: Fix memory leak in dsp_pipeline_build() dsp_pipeline_build() allocates dup pointer by kstrdup(cfg), but then it updates dup variable by strsep(&dup, "|"). As a result when it calls kfree(dup), the dup va | |
| CVE-2022-48862 | Med | 5.5 | >= 5.7.0, < 5.15.29 | 5.15.29 | Jul 16, 2024 | In the Linux kernel, the following vulnerability has been resolved: vhost: fix hung thread due to erroneous iotlb entries In vhost_iotlb_add_range_ctx(), range size can overflow to 0 when start is 0 and last is ULONG_MAX. One instance where it can happen is when userspace sends | |
| CVE-2022-48861 | Med | 5.5 | >= 5.13.0, < 5.15.29 | 5.15.29 | Jul 16, 2024 | In the Linux kernel, the following vulnerability has been resolved: vdpa: fix use-after-free on vp_vdpa_remove When vp_vdpa driver is unbind, vp_vdpa is freed in vdpa_unregister_device and then vp_vdpa->mdev.pci_dev is dereferenced in vp_modern_remove, triggering use-after-free | |
| CVE-2022-48860 | Med | 5.5 | >= 2.6.34, < 4.9.307 | 4.9.307 | Jul 16, 2024 | In the Linux kernel, the following vulnerability has been resolved: ethernet: Fix error handling in xemaclite_of_probe This node pointer is returned by of_parse_phandle() with refcount incremented in this function. Calling of_node_put() to avoid the refcount leak. As the remove | |
| CVE-2022-48859 | Med | 5.5 | >= 5.10.0, < 5.15.29 | 5.15.29 | Jul 16, 2024 | In the Linux kernel, the following vulnerability has been resolved: net: marvell: prestera: Add missing of_node_put() in prestera_switch_set_base_mac_addr This node pointer is returned by of_find_compatible_node() with refcount incremented. Calling of_node_put() to aovid the re | |
| CVE-2022-48858 | Hig | 7.0 | < 5.4.185 | 5.4.185 | Jul 16, 2024 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix a race on command flush flow Fix a refcount use after free warning due to a race on command entry. Such race occurs when one of the commands releases its last refcount and frees its index and entr | |
| CVE-2022-48857 | Med | 5.5 | >= 3.13.0, < 4.9.307 | 4.9.307 | Jul 16, 2024 | In the Linux kernel, the following vulnerability has been resolved: NFC: port100: fix use-after-free in port100_send_complete Syzbot reported UAF in port100_send_complete(). The root case is in missing usb_kill_urb() calls on error handling path of ->probe function. port100_se | |
| CVE-2022-48856 | Med | 5.5 | >= 4.18.0, < 4.19.235 | 4.19.235 | Jul 16, 2024 | In the Linux kernel, the following vulnerability has been resolved: gianfar: ethtool: Fix refcount leak in gfar_get_ts_info The of_find_compatible_node() function returns a node pointer with refcount incremented, We should use of_node_put() on it when done Add the missing of_no | |
| CVE-2022-48855 | Hig | 7.1 | >= 4.7.0, < 4.9.307 | 4.9.307 | Jul 16, 2024 | In the Linux kernel, the following vulnerability has been resolved: sctp: fix kernel-infoleak for SCTP sockets syzbot reported a kernel infoleak [1] of 4 bytes. After analysis, it turned out r->idiag_expires is not initialized if inet_sctp_diag_fill() calls inet_diag_msg_commo | |
| CVE-2022-48854 | Hig | 7.8 | >= 5.16.0, < 5.16.15 | 5.16.15 | Jul 16, 2024 | In the Linux kernel, the following vulnerability has been resolved: net: arc_emac: Fix use after free in arc_mdio_probe() If bus->state is equal to MDIOBUS_ALLOCATED, mdiobus_free(bus) will free the "bus". But bus->name is still used in the next line, which will lead to a use a | |
| CVE-2022-48853 | Med | 5.5 | >= 2.6.12, < 4.9.320 | 4.9.320 | Jul 16, 2024 | In the Linux kernel, the following vulnerability has been resolved: swiotlb: fix info leak with DMA_FROM_DEVICE The problem I'm addressing was discovered by the LTP test covering cve-2018-1000204. A short description of what happens follows: 1) The test case issues a command c | |
| CVE-2022-48852 | Low | 3.3 | >= 5.15.0, < 5.15.29 | 5.15.29 | Jul 16, 2024 | In the Linux kernel, the following vulnerability has been resolved: drm/vc4: hdmi: Unregister codec device on unbind On bind we will register the HDMI codec device but we don't unregister it on unbind, leading to a device leakage. Unregister our device at unbind. | |
| CVE-2022-48851 | Cri | 9.8 | >= 3.12.0, < 4.9.307 | 4.9.307 | Jul 16, 2024 | In the Linux kernel, the following vulnerability has been resolved: staging: gdm724x: fix use after free in gdm_lte_rx() The netif_rx_ni() function frees the skb so we can't dereference it to save the skb->len. | |
| CVE-2022-48850 | Med | 5.5 | >= 2.6.33, < 4.9.307 | 4.9.307 | Jul 16, 2024 | In the Linux kernel, the following vulnerability has been resolved: net-sysfs: add check for netdevice being present to speed_show When bringing down the netdevice or system shutdown, a panic can be triggered while accessing the sysfs path because the device is already removed. | |
| CVE-2022-48849 | Med | 5.5 | >= 5.16.0, < 5.16.15 | 5.16.15 | Jul 16, 2024 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: bypass tiling flag check in virtual display case (v2) vkms leverages common amdgpu framebuffer creation, and also as it does not support FB modifier, there is no need to check tiling flags when init | |
| CVE-2022-48848 | Hig | 7.8 | >= 5.16.0, < 5.16.15 | 5.16.15 | Jul 16, 2024 | In the Linux kernel, the following vulnerability has been resolved: tracing/osnoise: Do not unregister events twice Nicolas reported that using: # trace-cmd record -e all -M 10 -p osnoise --poll Resulted in the following kernel warning: ------------[ cut here ]------------ | |
| CVE-2022-48847 | Hig | 7.8 | >= 5.8.0, < 5.10.106 | 5.10.106 | Jul 16, 2024 | In the Linux kernel, the following vulnerability has been resolved: watch_queue: Fix filter limit check In watch_queue_set_filter(), there are a couple of places where we check that the filter type value does not exceed what the type_filter bitmap can hold. One place calculate | |
| CVE-2022-48846 | Med | 5.5 | >= 5.15.0, < 5.15.31 | 5.15.31 | Jul 16, 2024 | In the Linux kernel, the following vulnerability has been resolved: block: release rq qos structures for queue without disk blkcg_init_queue() may add rq qos structures to request queue, previously blk_cleanup_queue() calls rq_qos_exit() to release them, but commit 8e141f9eb803 | |
| CVE-2022-48845 | Med | 5.5 | >= 2.6.28, < 4.9.308 | 4.9.308 | Jul 16, 2024 | In the Linux kernel, the following vulnerability has been resolved: MIPS: smp: fill in sibling and core maps earlier After enabling CONFIG_SCHED_CORE (landed during 5.14 cycle), 2-core 2-thread-per-core interAptiv (CPS-driven) started emitting the following: [ 0.025698] CPU | |
| CVE-2022-48844 | Med | 5.5 | >= 5.15.0, < 5.15.30 | 5.15.30 | Jul 16, 2024 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Fix leaking sent_cmd skb sent_cmd memory is not freed before freeing hci_dev causing it to leak it contents. |
- affected >= 2.6.27, < 5.10.106fixed 5.10.106
In the Linux kernel, the following vulnerability has been resolved: mISDN: Fix memory leak in dsp_pipeline_build() dsp_pipeline_build() allocates dup pointer by kstrdup(cfg), but then it updates dup variable by strsep(&dup, "|"). As a result when it calls kfree(dup), the dup va
- affected >= 5.7.0, < 5.15.29fixed 5.15.29
In the Linux kernel, the following vulnerability has been resolved: vhost: fix hung thread due to erroneous iotlb entries In vhost_iotlb_add_range_ctx(), range size can overflow to 0 when start is 0 and last is ULONG_MAX. One instance where it can happen is when userspace sends
- affected >= 5.13.0, < 5.15.29fixed 5.15.29
In the Linux kernel, the following vulnerability has been resolved: vdpa: fix use-after-free on vp_vdpa_remove When vp_vdpa driver is unbind, vp_vdpa is freed in vdpa_unregister_device and then vp_vdpa->mdev.pci_dev is dereferenced in vp_modern_remove, triggering use-after-free
- affected >= 2.6.34, < 4.9.307fixed 4.9.307
In the Linux kernel, the following vulnerability has been resolved: ethernet: Fix error handling in xemaclite_of_probe This node pointer is returned by of_parse_phandle() with refcount incremented in this function. Calling of_node_put() to avoid the refcount leak. As the remove
- affected >= 5.10.0, < 5.15.29fixed 5.15.29
In the Linux kernel, the following vulnerability has been resolved: net: marvell: prestera: Add missing of_node_put() in prestera_switch_set_base_mac_addr This node pointer is returned by of_find_compatible_node() with refcount incremented. Calling of_node_put() to aovid the re
- affected < 5.4.185fixed 5.4.185
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix a race on command flush flow Fix a refcount use after free warning due to a race on command entry. Such race occurs when one of the commands releases its last refcount and frees its index and entr
- affected >= 3.13.0, < 4.9.307fixed 4.9.307
In the Linux kernel, the following vulnerability has been resolved: NFC: port100: fix use-after-free in port100_send_complete Syzbot reported UAF in port100_send_complete(). The root case is in missing usb_kill_urb() calls on error handling path of ->probe function. port100_se
- affected >= 4.18.0, < 4.19.235fixed 4.19.235
In the Linux kernel, the following vulnerability has been resolved: gianfar: ethtool: Fix refcount leak in gfar_get_ts_info The of_find_compatible_node() function returns a node pointer with refcount incremented, We should use of_node_put() on it when done Add the missing of_no
- affected >= 4.7.0, < 4.9.307fixed 4.9.307
In the Linux kernel, the following vulnerability has been resolved: sctp: fix kernel-infoleak for SCTP sockets syzbot reported a kernel infoleak [1] of 4 bytes. After analysis, it turned out r->idiag_expires is not initialized if inet_sctp_diag_fill() calls inet_diag_msg_commo
- affected >= 5.16.0, < 5.16.15fixed 5.16.15
In the Linux kernel, the following vulnerability has been resolved: net: arc_emac: Fix use after free in arc_mdio_probe() If bus->state is equal to MDIOBUS_ALLOCATED, mdiobus_free(bus) will free the "bus". But bus->name is still used in the next line, which will lead to a use a
- affected >= 2.6.12, < 4.9.320fixed 4.9.320
In the Linux kernel, the following vulnerability has been resolved: swiotlb: fix info leak with DMA_FROM_DEVICE The problem I'm addressing was discovered by the LTP test covering cve-2018-1000204. A short description of what happens follows: 1) The test case issues a command c
- affected >= 5.15.0, < 5.15.29fixed 5.15.29
In the Linux kernel, the following vulnerability has been resolved: drm/vc4: hdmi: Unregister codec device on unbind On bind we will register the HDMI codec device but we don't unregister it on unbind, leading to a device leakage. Unregister our device at unbind.
- affected >= 3.12.0, < 4.9.307fixed 4.9.307
In the Linux kernel, the following vulnerability has been resolved: staging: gdm724x: fix use after free in gdm_lte_rx() The netif_rx_ni() function frees the skb so we can't dereference it to save the skb->len.
- affected >= 2.6.33, < 4.9.307fixed 4.9.307
In the Linux kernel, the following vulnerability has been resolved: net-sysfs: add check for netdevice being present to speed_show When bringing down the netdevice or system shutdown, a panic can be triggered while accessing the sysfs path because the device is already removed.
- affected >= 5.16.0, < 5.16.15fixed 5.16.15
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: bypass tiling flag check in virtual display case (v2) vkms leverages common amdgpu framebuffer creation, and also as it does not support FB modifier, there is no need to check tiling flags when init
- affected >= 5.16.0, < 5.16.15fixed 5.16.15
In the Linux kernel, the following vulnerability has been resolved: tracing/osnoise: Do not unregister events twice Nicolas reported that using: # trace-cmd record -e all -M 10 -p osnoise --poll Resulted in the following kernel warning: ------------[ cut here ]------------
- affected >= 5.8.0, < 5.10.106fixed 5.10.106
In the Linux kernel, the following vulnerability has been resolved: watch_queue: Fix filter limit check In watch_queue_set_filter(), there are a couple of places where we check that the filter type value does not exceed what the type_filter bitmap can hold. One place calculate
- affected >= 5.15.0, < 5.15.31fixed 5.15.31
In the Linux kernel, the following vulnerability has been resolved: block: release rq qos structures for queue without disk blkcg_init_queue() may add rq qos structures to request queue, previously blk_cleanup_queue() calls rq_qos_exit() to release them, but commit 8e141f9eb803
- affected >= 2.6.28, < 4.9.308fixed 4.9.308
In the Linux kernel, the following vulnerability has been resolved: MIPS: smp: fill in sibling and core maps earlier After enabling CONFIG_SCHED_CORE (landed during 5.14 cycle), 2-core 2-thread-per-core interAptiv (CPS-driven) started emitting the following: [ 0.025698] CPU
- affected >= 5.15.0, < 5.15.30fixed 5.15.30
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Fix leaking sent_cmd skb sent_cmd memory is not freed before freeing hci_dev causing it to leak it contents.
Page 619 of 706