CVSS: 5.6EPSS: 0%CPEs: 6EXPL: 0CVE-2022-49520 – arm64: compat: Do not treat syscall number as ESR_ELx for a bad syscall
https://notcve.org/view.php?id=CVE-2022-49520
26 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: arm64: compat: Do not treat syscall number as ESR_ELx for a bad syscall If a compat process tries to execute an unknown system call above the __ARM_NR_COMPAT_END number, the kernel sends a SIGILL signal to the offending process. Information about the error is printed to dmesg in compat_arm_syscall() -> arm64_notify_die() -> arm64_force_sig_fault() -> arm64_show_signal(). arm64_show_signal() interprets a non-zero value for current->thread.fa... • https://git.kernel.org/stable/c/efd183d988b416fcdf6f7c298a17ced4859ca77d •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2022-49519 – ath10k: skip ath10k_halt during suspend for driver state RESTARTING
https://notcve.org/view.php?id=CVE-2022-49519
26 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: ath10k: skip ath10k_halt during suspend for driver state RESTARTING Double free crash is observed when FW recovery(caused by wmi timeout/crash) is followed by immediate suspend event. The FW recovery is triggered by ath10k_core_restart() which calls driver clean up via ath10k_halt(). When the suspend event occurs between the FW recovery, the restart worker thread is put into frozen state until suspend completes. The suspend event triggers a... • https://git.kernel.org/stable/c/8aa3750986ffcf73e0692db3b40dd3a8e8c0c575 •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2022-49518 – ASoC: SOF: ipc3-topology: Correct get_control_data for non bytes payload
https://notcve.org/view.php?id=CVE-2022-49518
26 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-topology: Correct get_control_data for non bytes payload It is possible to craft a topology where sof_get_control_data() would do out of bounds access because it expects that it is only called when the payload is bytes type. Confusingly it also handles other types of controls, but the payload parsing implementation is only valid for bytes. Fix the code to count the non bytes controls and instead of storing a pointer to sof_a... • https://git.kernel.org/stable/c/896b03bb7c7010042786cfae2115083d4c241dd3 •
CVSS: 5.5EPSS: 0%CPEs: 8EXPL: 0CVE-2022-49517 – ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe
https://notcve.org/view.php?id=CVE-2022-49517
26 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe This node pointer is returned by of_parse_phandle() with refcount incremented in this function. Calling of_node_put() to avoid the refcount leak. In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe This node pointer is returned by of_parse_phandle() with refcount incremented in this fu... • https://git.kernel.org/stable/c/8625c1dbd87631572f8e2c05bc67736b73d6f02f •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2022-49516 – ice: always check VF VSI pointer values
https://notcve.org/view.php?id=CVE-2022-49516
26 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: ice: always check VF VSI pointer values The ice_get_vf_vsi function can return NULL in some cases, such as if handling messages during a reset where the VSI is being removed and recreated. Several places throughout the driver do not bother to check whether this VSI pointer is valid. Static analysis tools maybe report issues because they detect paths where a potentially NULL pointer could be dereferenced. Fix this by checking the return valu... • https://git.kernel.org/stable/c/e7be3877589d539c52e5d1d23a625f889b541b9d •
CVSS: 5.5EPSS: 0%CPEs: 9EXPL: 0CVE-2022-49514 – ASoC: mediatek: Fix error handling in mt8173_max98090_dev_probe
https://notcve.org/view.php?id=CVE-2022-49514
26 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: Fix error handling in mt8173_max98090_dev_probe Call of_node_put(platform_node) to avoid refcount leak in the error path. In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: Fix error handling in mt8173_max98090_dev_probe Call of_node_put(platform_node) to avoid refcount leak in the error path. • https://git.kernel.org/stable/c/94319ba10ecabc8f28129566d1f5793e3e7a0a79 •
CVSS: 7.1EPSS: 0%CPEs: 3EXPL: 0CVE-2022-49513 – cpufreq: governor: Use kobject release() method to free dbs_data
https://notcve.org/view.php?id=CVE-2022-49513
26 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: cpufreq: governor: Use kobject release() method to free dbs_data The struct dbs_data embeds a struct gov_attr_set and the struct gov_attr_set embeds a kobject. Since every kobject must have a release() method and we can't use kfree() to free it directly, so introduce cpufreq_dbs_data_release() to release the dbs_data via the kobject::release() method. This fixes the calltrace like below: ODEBUG: free active (active state 0) object type: tim... • https://git.kernel.org/stable/c/c4435630361d9bebf7154a0c842dc1fb7ae39c99 •
CVSS: 6.9EPSS: 0%CPEs: 10EXPL: 0CVE-2022-49505 – NFC: NULL out the dev->rfkill to prevent UAF
https://notcve.org/view.php?id=CVE-2022-49505
26 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: NFC: NULL out the dev->rfkill to prevent UAF Commit 3e3b5dfcd16a ("NFC: reorder the logic in nfc_{un,}register_device") assumes the device_is_registered() in function nfc_dev_up() will help to check when the rfkill is unregistered. However, this check only take effect when device_del(&dev->dev) is done in nfc_unregister_device(). Hence, the rfkill object is still possible be dereferenced. The crash trace in latest kernel (5.18-rc2): [ 68.76... • https://git.kernel.org/stable/c/ff169909eac9e00bf1aa0af739ba6ddfb1b1d135 •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2022-49504 – scsi: lpfc: Inhibit aborts if external loopback plug is inserted
https://notcve.org/view.php?id=CVE-2022-49504
26 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Inhibit aborts if external loopback plug is inserted After running a short external loopback test, when the external loopback is removed and a normal cable inserted that is directly connected to a target device, the system oops in the llpfc_set_rrq_active() routine. When the loopback was inserted an FLOGI was transmit. As we're looped back, we receive the FLOGI request. The FLOGI is ABTS'd as we recognize the same wppn thus unde... • https://git.kernel.org/stable/c/a1516930cb605caee3bc7b4f3b7994b88c0b8505 •
CVSS: 7.1EPSS: 0%CPEs: 9EXPL: 0CVE-2022-49503 – ath9k_htc: fix potential out of bounds access with invalid rxstatus->rs_keyix
https://notcve.org/view.php?id=CVE-2022-49503
26 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: ath9k_htc: fix potential out of bounds access with invalid rxstatus->rs_keyix The "rxstatus->rs_keyix" eventually gets passed to test_bit() so we need to ensure that it is within the bitmap. drivers/net/wireless/ath/ath9k/common.c:46 ath9k_cmn_rx_accept() error: passing untrusted data 'rx_stats->rs_keyix' to 'test_bit()' In the Linux kernel, the following vulnerability has been resolved: ath9k_htc: fix potential out of bounds access with in... • https://git.kernel.org/stable/c/4ed1a8d4a25711f780b96920fff2bb531229e322 •