suse/kernel-source&distro=SUSE Manager Server 4.3

Vulnerabilities (1,907)

• CVE-2022-49029Oct 21, 2024
  affected < 5.14.21-150400.24.141.1fixed 5.14.21-150400.24.141.1

  In the Linux kernel, the following vulnerability has been resolved: hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails Smatch report warning as follows: drivers/hwmon/ibmpex.c:509 ibmpex_register_bmc() warn: '&data->list' not removed from list If ibmpex_find_

• CVE-2022-49028Oct 21, 2024
  affected < 5.14.21-150400.24.141.1fixed 5.14.21-150400.24.141.1

  In the Linux kernel, the following vulnerability has been resolved: ixgbevf: Fix resource leak in ixgbevf_init_module() ixgbevf_init_module() won't destroy the workqueue created by create_singlethread_workqueue() when pci_register_driver() failed. Add destroy_workqueue() in fai

• CVE-2022-49027Oct 21, 2024
  affected < 5.14.21-150400.24.141.1fixed 5.14.21-150400.24.141.1

  In the Linux kernel, the following vulnerability has been resolved: iavf: Fix error handling in iavf_init_module() The iavf_init_module() won't destroy workqueue when pci_register_driver() failed. Call destroy_workqueue() when pci_register_driver() failed to prevent the resourc

• CVE-2022-49026Oct 21, 2024
  affected < 5.14.21-150400.24.141.1fixed 5.14.21-150400.24.141.1

  In the Linux kernel, the following vulnerability has been resolved: e100: Fix possible use after free in e100_xmit_prepare In e100_xmit_prepare(), if we can't map the skb, then return -ENOMEM, so e100_xmit_frame() will return NETDEV_TX_BUSY and the upper layer will resend the s

• CVE-2022-49025Oct 21, 2024
  affected < 5.14.21-150400.24.141.1fixed 5.14.21-150400.24.141.1

  In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix use-after-free when reverting termination table When having multiple dests with termination tables and second one or afterwards fails the driver reverts usage of term tables but doesn't reset the

• CVE-2022-49024Oct 21, 2024
  affected < 5.14.21-150400.24.141.1fixed 5.14.21-150400.24.141.1

  In the Linux kernel, the following vulnerability has been resolved: can: m_can: pci: add missing m_can_class_free_dev() in probe/remove methods In m_can_pci_remove() and error handling path of m_can_pci_probe(), m_can_class_free_dev() should be called to free resource allocated

• CVE-2022-49023Oct 21, 2024
  affected < 5.14.21-150400.24.141.1fixed 5.14.21-150400.24.141.1

  In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: fix buffer overflow in elem comparison For vendor elements, the code here assumes that 5 octets are present without checking. Since the element itself is already checked to fit, we only need to

• CVE-2022-49022Oct 21, 2024
  affected < 5.14.21-150400.24.141.1fixed 5.14.21-150400.24.141.1

  In the Linux kernel, the following vulnerability has been resolved: wifi: mac8021: fix possible oob access in ieee80211_get_rate_duration Fix possible out-of-bound access in ieee80211_get_rate_duration routine as reported by the following UBSAN report: UBSAN: array-index-out-o

• CVE-2022-49021Oct 21, 2024
  affected < 5.14.21-150400.24.141.1fixed 5.14.21-150400.24.141.1

  In the Linux kernel, the following vulnerability has been resolved: net: phy: fix null-ptr-deref while probe() failed I got a null-ptr-deref report as following when doing fault injection test: BUG: kernel NULL pointer dereference, address: 0000000000000058 Oops: 0000 [#1] PRE

• CVE-2022-49019Oct 21, 2024
  affected < 5.14.21-150400.24.141.1fixed 5.14.21-150400.24.141.1

  In the Linux kernel, the following vulnerability has been resolved: net: ethernet: nixge: fix NULL dereference In function nixge_hw_dma_bd_release() dereference of NULL pointer priv->rx_bd_v is possible for the case of its allocation failure in nixge_hw_dma_bd_init(). Move for

• CVE-2022-49016Oct 21, 2024
  affected < 5.14.21-150400.24.141.1fixed 5.14.21-150400.24.141.1

  In the Linux kernel, the following vulnerability has been resolved: net: mdiobus: fix unbalanced node reference count I got the following report while doing device(mscc-miim) load test with CONFIG_OF_UNITTEST and CONFIG_OF_DYNAMIC enabled: OF: ERROR: memory leak, expected re

• CVE-2022-49015Oct 21, 2024
  affected < 5.14.21-150400.24.141.1fixed 5.14.21-150400.24.141.1

  In the Linux kernel, the following vulnerability has been resolved: net: hsr: Fix potential use-after-free The skb is delivered to netif_rx() which may free it, after calling this, dereferencing skb may trigger use-after-free.

• CVE-2022-49014Oct 21, 2024
  affected < 5.14.21-150400.24.141.1fixed 5.14.21-150400.24.141.1

  In the Linux kernel, the following vulnerability has been resolved: net: tun: Fix use-after-free in tun_detach() syzbot reported use-after-free in tun_detach() [1]. This causes call trace like below: ================================================================== BUG: KASA

• CVE-2022-49012Oct 21, 2024
  affected < 5.14.21-150400.24.141.1fixed 5.14.21-150400.24.141.1

  In the Linux kernel, the following vulnerability has been resolved: afs: Fix server->active leak in afs_put_server The atomic_read was accidentally replaced with atomic_inc_return, which prevents the server from getting cleaned up and causes rmmod to hang with a warning: C

• CVE-2022-49011Oct 21, 2024
  affected < 5.14.21-150400.24.141.1fixed 5.14.21-150400.24.141.1

  In the Linux kernel, the following vulnerability has been resolved: hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() As comment of pci_get_domain_bus_and_slot() says, it returns a pci device with refcount increment, when finish using it, the caller must decremen

• CVE-2022-49010Oct 21, 2024
  affected < 5.14.21-150400.24.141.1fixed 5.14.21-150400.24.141.1

  In the Linux kernel, the following vulnerability has been resolved: hwmon: (coretemp) Check for null before removing sysfs attrs If coretemp_add_core() gets an error then pdata->core_data[indx] is already NULL and has been kfreed. Don't pass that to sysfs_remove_group() as that

• CVE-2022-49007Oct 21, 2024
  affected < 5.14.21-150400.24.141.1fixed 5.14.21-150400.24.141.1

  In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry() Syzbot reported a null-ptr-deref bug: NILFS (loop0): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds

• CVE-2022-49006Oct 21, 2024
  affected < 5.14.21-150400.24.141.1fixed 5.14.21-150400.24.141.1

  In the Linux kernel, the following vulnerability has been resolved: tracing: Free buffers when a used dynamic event is removed After 65536 dynamic events have been added and removed, the "type" field of the event then uses the first type number that is available (not currently

• CVE-2022-49005Oct 21, 2024
  affected < 5.14.21-150400.24.141.1fixed 5.14.21-150400.24.141.1

  In the Linux kernel, the following vulnerability has been resolved: ASoC: ops: Fix bounds check for _sx controls For _sx controls the semantics of the max field is not the usual one, max is the number of steps rather than the maximum value. This means that our check in snd_soc_

• CVE-2022-49003Oct 21, 2024
  affected < 5.14.21-150400.24.141.1fixed 5.14.21-150400.24.141.1

  In the Linux kernel, the following vulnerability has been resolved: nvme: fix SRCU protection of nvme_ns_head list Walking the nvme_ns_head siblings list is protected by the head's srcu in nvme_ns_head_submit_bio() but not nvme_mpath_revalidate_paths(). Removing namespaces from