CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2022-49744 – mm/uffd: fix pte marker when fork() without fork event
https://notcve.org/view.php?id=CVE-2022-49744
27 Mar 2025 — In the Linux kernel, the following vulnerability has been resolved: mm/uffd: fix pte marker when fork() without fork event Patch series "mm: Fixes on pte markers". Patch 1 resolves the syzkiller report from Pengfei. Patch 2 further harden pte markers when used with the recent swapin error markers. The major case is we should persist a swapin error marker after fork(), so child shouldn't read a corrupted page. This patch (of 2): When fork(), dst_vma is not guaranteed to have VM_UFFD_WP even if src may have i... • https://git.kernel.org/stable/c/c56d1b62cce83695823c13e52f73e92eb568c0c1 •
CVSS: -EPSS: 0%CPEs: 3EXPL: 0CVE-2022-49743 – ovl: Use "buf" flexible array for memcpy() destination
https://notcve.org/view.php?id=CVE-2022-49743
27 Mar 2025 — In the Linux kernel, the following vulnerability has been resolved: ovl: Use "buf" flexible array for memcpy() destination The "buf" flexible array needs to be the memcpy() destination to avoid false positive run-time warning from the recent FORTIFY_SOURCE hardening: memcpy: detected field-spanning write (size 93) of single field "&fh->fb" at fs/overlayfs/export.c:799 (size 21) In the Linux kernel, the following vulnerability has been resolved: ovl: Use "buf" flexible array for memcpy() destination The "buf... • https://git.kernel.org/stable/c/a77141a06367825d639ac51b04703d551163e36c •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2022-49742 – f2fs: initialize locks earlier in f2fs_fill_super()
https://notcve.org/view.php?id=CVE-2022-49742
27 Mar 2025 — In the Linux kernel, the following vulnerability has been resolved: f2fs: initialize locks earlier in f2fs_fill_super() syzbot is reporting lockdep warning at f2fs_handle_error() [1], for spin_lock(&sbi->error_lock) is called before spin_lock_init() is called. For safe locking in error handling, move initialization of locks (and obvious structures) in f2fs_fill_super() to immediately after memory allocation. In the Linux kernel, the following vulnerability has been resolved: f2fs: initialize locks earlier i... • https://git.kernel.org/stable/c/ddeff03bb33810fcf2f0c18e03d099cf0aacda62 •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2022-49741 – fbdev: smscufx: fix error handling code in ufx_usb_probe
https://notcve.org/view.php?id=CVE-2022-49741
27 Mar 2025 — In the Linux kernel, the following vulnerability has been resolved: fbdev: smscufx: fix error handling code in ufx_usb_probe The current error handling code in ufx_usb_probe have many unmatching issues, e.g., missing ufx_free_usb_list, destroy_modedb label should only include framebuffer_release, fb_dealloc_cmap only matches fb_alloc_cmap. My local syzkaller reports a memory leak bug: memory leak in ufx_usb_probe BUG: memory leak unreferenced object 0xffff88802f879580 (size 128): comm "kworker/0:7", pid 174... • https://git.kernel.org/stable/c/3b3d3127f5b4291ae4caaf50f7b66089ad600480 •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2022-49740 – wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads
https://notcve.org/view.php?id=CVE-2022-49740
27 Mar 2025 — In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads This patch fixes slab-out-of-bounds reads in brcmfmac that occur in brcmf_construct_chaninfo() and brcmf_enable_bw40_2g() when the count value of channel specifications provided by the device is greater than the length of 'list->element[]', decided by the size of the 'list' allocated with kzalloc(). The patch adds checks that make the functions free the buf... • https://git.kernel.org/stable/c/9cf5e99c1ae1a85286a76c9a970202750538394c •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2022-49739 – gfs2: Always check inode size of inline inodes
https://notcve.org/view.php?id=CVE-2022-49739
27 Mar 2025 — In the Linux kernel, the following vulnerability has been resolved: gfs2: Always check inode size of inline inodes Check if the inode size of stuffed (inline) inodes is within the allowed range when reading inodes from disk (gfs2_dinode_in()). This prevents us from on-disk corruption. The two checks in stuffed_readpage() and gfs2_unstuffer_page() that just truncate inline data to the maximum allowed size don't actually make sense, and they can be removed now as well. In the Linux kernel, the following vulne... • https://git.kernel.org/stable/c/45df749f827c286adbc951f2a4865b67f0442ba9 •
CVSS: 7.1EPSS: 0%CPEs: 5EXPL: 0CVE-2022-49738 – f2fs: fix to do sanity check on i_extra_isize in is_alive()
https://notcve.org/view.php?id=CVE-2022-49738
27 Mar 2025 — In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on i_extra_isize in is_alive() syzbot found a f2fs bug: BUG: KASAN: slab-out-of-bounds in data_blkaddr fs/f2fs/f2fs.h:2891 [inline] BUG: KASAN: slab-out-of-bounds in is_alive fs/f2fs/gc.c:1117 [inline] BUG: KASAN: slab-out-of-bounds in gc_data_segment fs/f2fs/gc.c:1520 [inline] BUG: KASAN: slab-out-of-bounds in do_garbage_collect+0x386a/0x3df0 fs/f2fs/gc.c:1734 Read of size 4 at addr ffff888076557568 by task kwo... • https://git.kernel.org/stable/c/e5142a4935c1f15841d06047b8130078fc4d7b8f •
CVSS: 5.6EPSS: 0%CPEs: 2EXPL: 0CVE-2023-52942 – cgroup/cpuset: Fix wrong check in update_parent_subparts_cpumask()
https://notcve.org/view.php?id=CVE-2023-52942
27 Mar 2025 — In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Fix wrong check in update_parent_subparts_cpumask() It was found that the check to see if a partition could use up all the cpus from the parent cpuset in update_parent_subparts_cpumask() was incorrect. As a result, it is possible to leave parent with no effective cpu left even if there are tasks in the parent cpuset. This can lead to system panic as reported in [1]. Fix this probem by updating the check to fail the enabling t... • https://git.kernel.org/stable/c/f0af1bfc27b52a4d42510051154c61bd176a8f06 •
CVSS: -EPSS: 0%CPEs: 3EXPL: 0CVE-2023-52941 – can: isotp: split tx timer into transmission and timeout
https://notcve.org/view.php?id=CVE-2023-52941
27 Mar 2025 — In the Linux kernel, the following vulnerability has been resolved: can: isotp: split tx timer into transmission and timeout The timer for the transmission of isotp PDUs formerly had two functions: 1. send two consecutive frames with a given time gap 2. monitor the timeouts for flow control frames and the echo frames This led to larger txstate checks and potentially to a problem discovered by syzbot which enabled the panic_on_warn feature while testing. The former 'txtimer' function is split into 'txfrtimer... • https://git.kernel.org/stable/c/866337865f3747c68a3e7bb837611e39cec1ecd6 •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2023-52940 – mm: multi-gen LRU: fix crash during cgroup migration
https://notcve.org/view.php?id=CVE-2023-52940
27 Mar 2025 — In the Linux kernel, the following vulnerability has been resolved: mm: multi-gen LRU: fix crash during cgroup migration lru_gen_migrate_mm() assumes lru_gen_add_mm() runs prior to itself. This isn't true for the following scenario: CPU 1 CPU 2 clone() cgroup_can_fork() cgroup_procs_write() cgroup_post_fork() task_lock() lru_gen_migrate_mm() task_unlock() task_lock() lru_gen_add_mm() task_unlock() And when the above happens, kernel crashes because of linked list corruption (mm_struct->lru_gen.list). In the ... • https://git.kernel.org/stable/c/bd74fdaea146029e4fa12c6de89adbe0779348a9 •