CVSS: 7.8EPSS: 0%CPEs: 8EXPL: 0CVE-2022-49834 – nilfs2: fix use-after-free bug of ns_writer on remount
https://notcve.org/view.php?id=CVE-2022-49834
01 May 2025 — In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix use-after-free bug of ns_writer on remount If a nilfs2 filesystem is downgraded to read-only due to metadata corruption on disk and is remounted read/write, or if emergency read-only remount is performed, detaching a log writer and synchronizing the filesystem can be done at the same time. In these cases, use-after-free of the log writer (hereinafter nilfs->ns_writer) can happen as shown in the scenario below: Task1 Task2 ------... • https://git.kernel.org/stable/c/b2fbf10040216ef5ee270773755fc2f5da65b749 •
CVSS: 5.5EPSS: 0%CPEs: 8EXPL: 0CVE-2022-49832 – pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map
https://notcve.org/view.php?id=CVE-2022-49832
01 May 2025 — In the Linux kernel, the following vulnerability has been resolved: pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map Here is the BUG report by KASAN about null pointer dereference: BUG: KASAN: null-ptr-deref in strcmp+0x2e/0x50 Read of size 1 at addr 0000000000000000 by task python3/2640 Call Trace: strcmp __of_find_property of_find_property pinctrl_dt_to_map kasprintf() would return NULL pointer when kmalloc() fail to allocate. So directly return ENOMEM, if kasprintf() return NULL p... • https://git.kernel.org/stable/c/57291ce295c0aca738dd284c4a9c591c09ebee71 •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2022-49831 – btrfs: zoned: initialize device's zone info for seeding
https://notcve.org/view.php?id=CVE-2022-49831
01 May 2025 — In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: initialize device's zone info for seeding When performing seeding on a zoned filesystem it is necessary to initialize each zoned device's btrfs_zoned_device_info structure, otherwise mounting the filesystem will cause a NULL pointer dereference. This was uncovered by fstests' testcase btrfs/163. In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: initialize device's zone info for seeding When perf... • https://git.kernel.org/stable/c/91c38504e589dadbcde47b1cacdfc5b684154d44 •
CVSS: 7.1EPSS: 0%CPEs: 2EXPL: 0CVE-2022-49829 – drm/scheduler: fix fence ref counting
https://notcve.org/view.php?id=CVE-2022-49829
01 May 2025 — In the Linux kernel, the following vulnerability has been resolved: drm/scheduler: fix fence ref counting We leaked dependency fences when processes were beeing killed. Additional to that grab a reference to the last scheduled fence. • https://git.kernel.org/stable/c/e5f4b38362df93594cb426b04979d8834122f159 •
CVSS: 7.1EPSS: 0%CPEs: 3EXPL: 0CVE-2022-49828 – hugetlbfs: don't delete error page from pagecache
https://notcve.org/view.php?id=CVE-2022-49828
01 May 2025 — In the Linux kernel, the following vulnerability has been resolved: hugetlbfs: don't delete error page from pagecache This change is very similar to the change that was made for shmem [1], and it solves the same problem but for HugeTLBFS instead. Currently, when poison is found in a HugeTLB page, the page is removed from the page cache. That means that attempting to map or read that hugepage in the future will result in a new hugepage being allocated instead of notifying the user that the page was poisoned.... • https://git.kernel.org/stable/c/30571f28bb35c826219971c63bcf60d2517112ed •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2022-49826 – ata: libata-transport: fix double ata_host_put() in ata_tport_add()
https://notcve.org/view.php?id=CVE-2022-49826
01 May 2025 — In the Linux kernel, the following vulnerability has been resolved: ata: libata-transport: fix double ata_host_put() in ata_tport_add() In the error path in ata_tport_add(), when calling put_device(), ata_tport_release() is called, it will put the refcount of 'ap->host'. And then ata_host_put() is called again, the refcount is decreased to 0, ata_host_release() is called, all ports are freed and set to null. When unbinding the device after failure, ata_host_stop() is called to release the resources, it lead... • https://git.kernel.org/stable/c/2623c7a5f2799569d8bb05eb211da524a8144cb3 •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2022-49825 – ata: libata-transport: fix error handling in ata_tport_add()
https://notcve.org/view.php?id=CVE-2022-49825
01 May 2025 — In the Linux kernel, the following vulnerability has been resolved: ata: libata-transport: fix error handling in ata_tport_add() In ata_tport_add(), the return value of transport_add_device() is not checked. As a result, it causes null-ptr-deref while removing the module, because transport_remove_device() is called to remove the device that was not added. Unable to handle kernel NULL pointer dereference at virtual address 00000000000000d0 CPU: 12 PID: 13605 Comm: rmmod Kdump: loaded Tainted: G W 6.1.0-rc3+ ... • https://git.kernel.org/stable/c/d9027470b88631d0956ac37cdadfdeb9cdcf2c99 •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2022-49824 – ata: libata-transport: fix error handling in ata_tlink_add()
https://notcve.org/view.php?id=CVE-2022-49824
01 May 2025 — In the Linux kernel, the following vulnerability has been resolved: ata: libata-transport: fix error handling in ata_tlink_add() In ata_tlink_add(), the return value of transport_add_device() is not checked. As a result, it causes null-ptr-deref while removing the module, because transport_remove_device() is called to remove the device that was not added. Unable to handle kernel NULL pointer dereference at virtual address 00000000000000d0 CPU: 33 PID: 13850 Comm: rmmod Kdump: loaded Tainted: G W 6.1.0-rc3+ ... • https://git.kernel.org/stable/c/d9027470b88631d0956ac37cdadfdeb9cdcf2c99 •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2022-49823 – ata: libata-transport: fix error handling in ata_tdev_add()
https://notcve.org/view.php?id=CVE-2022-49823
01 May 2025 — In the Linux kernel, the following vulnerability has been resolved: ata: libata-transport: fix error handling in ata_tdev_add() In ata_tdev_add(), the return value of transport_add_device() is not checked. As a result, it causes null-ptr-deref while removing the module, because transport_remove_device() is called to remove the device that was not added. Unable to handle kernel NULL pointer dereference at virtual address 00000000000000d0 CPU: 13 PID: 13603 Comm: rmmod Kdump: loaded Tainted: G W 6.1.0-rc3+ #3... • https://git.kernel.org/stable/c/d9027470b88631d0956ac37cdadfdeb9cdcf2c99 •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2022-49822 – cifs: Fix connections leak when tlink setup failed
https://notcve.org/view.php?id=CVE-2022-49822
01 May 2025 — In the Linux kernel, the following vulnerability has been resolved: cifs: Fix connections leak when tlink setup failed If the tlink setup failed, lost to put the connections, then the module refcnt leak since the cifsd kthread not exit. Also leak the fscache info, and for next mount with fsc, it will print the follow errors: CIFS: Cache volume key already in use (cifs,127.0.0.1:445,TEST) Let's check the result of tlink setup, and do some cleanup. In the Linux kernel, the following vulnerability has been res... • https://git.kernel.org/stable/c/56c762eb9bee330bb4e6d11c589434f2904d3ab6 •