CVSS: 7.8EPSS: 0%CPEs: 10EXPL: 0CVE-2022-49505 – NFC: NULL out the dev->rfkill to prevent UAF
https://notcve.org/view.php?id=CVE-2022-49505
26 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: NFC: NULL out the dev->rfkill to prevent UAF Commit 3e3b5dfcd16a ("NFC: reorder the logic in nfc_{un,}register_device") assumes the device_is_registered() in function nfc_dev_up() will help to check when the rfkill is unregistered. However, this check only take effect when device_del(&dev->dev) is done in nfc_unregister_device(). Hence, the rfkill object is still possible be dereferenced. The crash trace in latest kernel (5.18-rc2): [ 68.76... • https://git.kernel.org/stable/c/ff169909eac9e00bf1aa0af739ba6ddfb1b1d135 • CWE-416: Use After Free •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2022-49504 – scsi: lpfc: Inhibit aborts if external loopback plug is inserted
https://notcve.org/view.php?id=CVE-2022-49504
26 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Inhibit aborts if external loopback plug is inserted After running a short external loopback test, when the external loopback is removed and a normal cable inserted that is directly connected to a target device, the system oops in the llpfc_set_rrq_active() routine. When the loopback was inserted an FLOGI was transmit. As we're looped back, we receive the FLOGI request. The FLOGI is ABTS'd as we recognize the same wppn thus unde... • https://git.kernel.org/stable/c/a1516930cb605caee3bc7b4f3b7994b88c0b8505 •
CVSS: 7.1EPSS: 0%CPEs: 9EXPL: 0CVE-2022-49503 – ath9k_htc: fix potential out of bounds access with invalid rxstatus->rs_keyix
https://notcve.org/view.php?id=CVE-2022-49503
26 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: ath9k_htc: fix potential out of bounds access with invalid rxstatus->rs_keyix The "rxstatus->rs_keyix" eventually gets passed to test_bit() so we need to ensure that it is within the bitmap. drivers/net/wireless/ath/ath9k/common.c:46 ath9k_cmn_rx_accept() error: passing untrusted data 'rx_stats->rs_keyix' to 'test_bit()' In the Linux kernel, the following vulnerability has been resolved: ath9k_htc: fix potential out of bounds access with in... • https://git.kernel.org/stable/c/4ed1a8d4a25711f780b96920fff2bb531229e322 •
CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 0CVE-2022-49502 – media: rga: fix possible memory leak in rga_probe
https://notcve.org/view.php?id=CVE-2022-49502
26 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: media: rga: fix possible memory leak in rga_probe rga->m2m_dev needs to be freed when rga_probe fails. • https://git.kernel.org/stable/c/8ddc89437ccefa18279918c19a61fd81527f40b9 •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2022-49501 – usbnet: Run unregister_netdev() before unbind() again
https://notcve.org/view.php?id=CVE-2022-49501
26 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: usbnet: Run unregister_netdev() before unbind() again Commit 2c9d6c2b871d ("usbnet: run unbind() before unregister_netdev()") sought to fix a use-after-free on disconnect of USB Ethernet adapters. It turns out that a different fix is necessary to address the issue: https://lore.kernel.org/netdev/18b3541e5372bc9b9fc733d422f4e698c089077c.1650177997.git.lukas@wunner.de/ So the commit was not necessary. The commit made binding and unbinding of ... • https://git.kernel.org/stable/c/6d5deb242874d924beccf7eb3cef04c1c3b0da79 • CWE-416: Use After Free •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2022-49498 – ALSA: pcm: Check for null pointer of pointer substream before dereferencing it
https://notcve.org/view.php?id=CVE-2022-49498
26 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Check for null pointer of pointer substream before dereferencing it Pointer substream is being dereferenced on the assignment of pointer card before substream is being null checked with the macro PCM_RUNTIME_CHECK. Although PCM_RUNTIME_CHECK calls BUG_ON, it still is useful to perform the the pointer check before card is assigned. In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Check for null pointe... • https://git.kernel.org/stable/c/d4cfb30fce03093ad944e0b44bd8f40bdad5330e •
CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 0CVE-2022-49497 – net: remove two BUG() from skb_checksum_help()
https://notcve.org/view.php?id=CVE-2022-49497
26 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: net: remove two BUG() from skb_checksum_help() I have a syzbot report that managed to get a crash in skb_checksum_help() If syzbot can trigger these BUG(), it makes sense to replace them with more friendly WARN_ON_ONCE() since skb_checksum_help() can instead return an error code. Note that syzbot will still crash there, until real bug is fixed. In the Linux kernel, the following vulnerability has been resolved: net: remove two BUG() from sk... • https://git.kernel.org/stable/c/312c43e98ed190bd8fd7a71a0addf9539d5b8ab1 •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2022-49496 – media: mediatek: vcodec: prevent kernel crash when rmmod mtk-vcodec-dec.ko
https://notcve.org/view.php?id=CVE-2022-49496
26 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: prevent kernel crash when rmmod mtk-vcodec-dec.ko If the driver support subdev mode, the parameter "dev->pm.dev" will be NULL in mtk_vcodec_dec_remove. Kernel will crash when try to rmmod mtk-vcodec-dec.ko. [ 4380.702726] pc : do_raw_spin_trylock+0x4/0x80 [ 4380.707075] lr : _raw_spin_lock_irq+0x90/0x14c [ 4380.711509] sp : ffff80000819bc10 [ 4380.714811] x29: ffff80000819bc10 x28: ffff3600c03e4000 x27: 000000000000... • https://git.kernel.org/stable/c/1fa37b00dc55a061a3eb82e378849862b4aeca9d •
CVSS: 5.5EPSS: 0%CPEs: 9EXPL: 0CVE-2022-49495 – drm/msm/hdmi: check return value after calling platform_get_resource_byname()
https://notcve.org/view.php?id=CVE-2022-49495
26 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: drm/msm/hdmi: check return value after calling platform_get_resource_byname() It will cause null-ptr-deref if platform_get_resource_byname() returns NULL, we need check the return value. Patchwork: https://patchwork.freedesktop.org/patch/482992/ In the Linux kernel, the following vulnerability has been resolved: drm/msm/hdmi: check return value after calling platform_get_resource_byname() It will cause null-ptr-deref if platform_get_resourc... • https://git.kernel.org/stable/c/c6a57a50ad562a2e6fc6ac3218b710caea73a58b •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2022-49494 – mtd: rawnand: cadence: fix possible null-ptr-deref in cadence_nand_dt_probe()
https://notcve.org/view.php?id=CVE-2022-49494
26 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: cadence: fix possible null-ptr-deref in cadence_nand_dt_probe() It will cause null-ptr-deref when using 'res', if platform_get_resource() returns NULL, so move using 'res' after devm_ioremap_resource() that will check it to avoid null-ptr-deref. And use devm_platform_get_and_ioremap_resource() to simplify code. In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: cadence: fix possible null-ptr-dere... • https://git.kernel.org/stable/c/ec4ba01e894d3165e4d1ccbef782ef5593b708b4 •