CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2022-49995 – writeback: avoid use-after-free after removing device
https://notcve.org/view.php?id=CVE-2022-49995
18 Jun 2025 — In the Linux kernel, the following vulnerability has been resolved: writeback: avoid use-after-free after removing device When a disk is removed, bdi_unregister gets called to stop further writeback and wait for associated delayed work to complete. However, wb_inode_writeback_end() may schedule bandwidth estimation dwork after this has completed, which can result in the timer attempting to access the just freed bdi_writeback. Fix this by checking if the bdi_writeback is alive, similar to when scheduling wri... • https://git.kernel.org/stable/c/45a2966fd64147518dc5bca25f447bd0fb5359ac •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2022-49994 – bootmem: remove the vmemmap pages from kmemleak in put_page_bootmem
https://notcve.org/view.php?id=CVE-2022-49994
18 Jun 2025 — In the Linux kernel, the following vulnerability has been resolved: bootmem: remove the vmemmap pages from kmemleak in put_page_bootmem The vmemmap pages is marked by kmemleak when allocated from memblock. Remove it from kmemleak when freeing the page. Otherwise, when we reuse the page, kmemleak may report such an error and then stop working. kmemleak: Cannot insert 0xffff98fb6eab3d40 into the object search tree (overlaps existing) kmemleak: Kernel memory leak detector disabled kmemleak: Object 0xffff98fb6b... • https://git.kernel.org/stable/c/f41f2ed43ca5258d70d53290d1951a21621f95c8 •
CVSS: 5.5EPSS: 0%CPEs: 8EXPL: 0CVE-2022-49993 – loop: Check for overflow while configuring loop
https://notcve.org/view.php?id=CVE-2022-49993
18 Jun 2025 — In the Linux kernel, the following vulnerability has been resolved: loop: Check for overflow while configuring loop The userspace can configure a loop using an ioctl call, wherein a configuration of type loop_config is passed (see lo_ioctl()'s case on line 1550 of drivers/block/loop.c). This proceeds to call loop_configure() which in turn calls loop_set_status_from_info() (see line 1050 of loop.c), passing &config->info which is of type loop_info64*. This function then sets the appropriate values, like the ... • https://git.kernel.org/stable/c/18e28817cb516b39de6281f6db9b0618b2cc7b42 •
CVSS: 7.1EPSS: 0%CPEs: 3EXPL: 0CVE-2022-49991 – mm/hugetlb: avoid corrupting page->mapping in hugetlb_mcopy_atomic_pte
https://notcve.org/view.php?id=CVE-2022-49991
18 Jun 2025 — In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: avoid corrupting page->mapping in hugetlb_mcopy_atomic_pte In MCOPY_ATOMIC_CONTINUE case with a non-shared VMA, pages in the page cache are installed in the ptes. But hugepage_add_new_anon_rmap is called for them mistakenly because they're not vm_shared. This will corrupt the page->mapping used by page cache code. In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: avoid corrupting page->mapping in hu... • https://git.kernel.org/stable/c/f619147104c8ea71e120e4936d2b68ec11a1e527 •
CVSS: 7.8EPSS: 0%CPEs: 9EXPL: 0CVE-2022-49990 – s390: fix double free of GS and RI CBs on fork() failure
https://notcve.org/view.php?id=CVE-2022-49990
18 Jun 2025 — In the Linux kernel, the following vulnerability has been resolved: s390: fix double free of GS and RI CBs on fork() failure The pointers for guarded storage and runtime instrumentation control blocks are stored in the thread_struct of the associated task. These pointers are initially copied on fork() via arch_dup_task_struct() and then cleared via copy_thread() before fork() returns. If fork() happens to fail after the initial task dup and before copy_thread(), the newly allocated task and associated threa... • https://git.kernel.org/stable/c/8d9047f8b967ce6181fd824ae922978e1b055cc0 •
CVSS: 5.6EPSS: 0%CPEs: 4EXPL: 0CVE-2022-49989 – xen/privcmd: fix error exit of privcmd_ioctl_dm_op()
https://notcve.org/view.php?id=CVE-2022-49989
18 Jun 2025 — In the Linux kernel, the following vulnerability has been resolved: xen/privcmd: fix error exit of privcmd_ioctl_dm_op() The error exit of privcmd_ioctl_dm_op() is calling unlock_pages() potentially with pages being NULL, leading to a NULL dereference. Additionally lock_pages() doesn't check for pin_user_pages_fast() having been completely successful, resulting in potentially not locking all pages into memory. This could result in sporadic failures when using the related memory in user mode. Fix all of that... • https://git.kernel.org/stable/c/ab520be8cd5d56867fc95cfbc34b90880faf1f9d •
CVSS: 7.1EPSS: 0%CPEs: 7EXPL: 0CVE-2022-49987 – md: call __md_stop_writes in md_stop
https://notcve.org/view.php?id=CVE-2022-49987
18 Jun 2025 — In the Linux kernel, the following vulnerability has been resolved: md: call __md_stop_writes in md_stop From the link [1], we can see raid1d was running even after the path raid_dtr -> md_stop -> __md_stop. Let's stop write first in destructor to align with normal md-raid to fix the KASAN issue. [1]. https://lore.kernel.org/linux-raid/CAPhsuW5gc4AakdGNdF8ubpezAuDLFOYUO_sfMZcec6hQFm8nhg@mail.gmail.com/T/#m7f12bf90481c02c6d2da68c64aeed4779b7df74a In the Linux kernel, the following vulnerability has been reso... • https://git.kernel.org/stable/c/48df498daf62e1292868005675331929305067f0 •
CVSS: 6.3EPSS: 0%CPEs: 6EXPL: 0CVE-2022-49986 – scsi: storvsc: Remove WQ_MEM_RECLAIM from storvsc_error_wq
https://notcve.org/view.php?id=CVE-2022-49986
18 Jun 2025 — In the Linux kernel, the following vulnerability has been resolved: scsi: storvsc: Remove WQ_MEM_RECLAIM from storvsc_error_wq storvsc_error_wq workqueue should not be marked as WQ_MEM_RECLAIM as it doesn't need to make forward progress under memory pressure. Marking this workqueue as WQ_MEM_RECLAIM may cause deadlock while flushing a non-WQ_MEM_RECLAIM workqueue. In the current state it causes the following warning: [ 14.506347] ------------[ cut here ]------------ [ 14.506354] workqueue: WQ_MEM_RECLAIM st... • https://git.kernel.org/stable/c/436ad941335386c5fc7faa915a8fbdfe8c908084 •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2022-49985 – bpf: Don't use tnum_range on array range checking for poke descriptors
https://notcve.org/view.php?id=CVE-2022-49985
18 Jun 2025 — In the Linux kernel, the following vulnerability has been resolved: bpf: Don't use tnum_range on array range checking for poke descriptors Hsin-Wei reported a KASAN splat triggered by their BPF runtime fuzzer which is based on a customized syzkaller: BUG: KASAN: slab-out-of-bounds in bpf_int_jit_compile+0x1257/0x13f0 Read of size 8 at addr ffff888004e90b58 by task syz-executor.0/1489 CPU: 1 PID: 1489 Comm: syz-executor.0 Not tainted 5.19.0 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.... • https://git.kernel.org/stable/c/d2e4c1e6c2947269346054ac8937ccfe9e0bcc6b •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2022-49984 – HID: steam: Prevent NULL pointer dereference in steam_{recv,send}_report
https://notcve.org/view.php?id=CVE-2022-49984
18 Jun 2025 — In the Linux kernel, the following vulnerability has been resolved: HID: steam: Prevent NULL pointer dereference in steam_{recv,send}_report It is possible for a malicious device to forgo submitting a Feature Report. The HID Steam driver presently makes no prevision for this and de-references the 'struct hid_report' pointer obtained from the HID devices without first checking its validity. Let's change that. In the Linux kernel, the following vulnerability has been resolved: HID: steam: Prevent NULL pointer... • https://git.kernel.org/stable/c/c164d6abf3841ffacfdb757c10616f9cb1f67276 •