CVSS: -EPSS: 0%CPEs: 9EXPL: 0CVE-2022-49280 – NFSD: prevent underflow in nfssvc_decode_writeargs()
https://notcve.org/view.php?id=CVE-2022-49280
26 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: NFSD: prevent underflow in nfssvc_decode_writeargs() Smatch complains: fs/nfsd/nfsxdr.c:341 nfssvc_decode_writeargs() warn: no lower bound on 'args->len' Change the type to unsigned to prevent this issue. • https://git.kernel.org/stable/c/1a33e0de60feda402d05ac8a6cf409c19ea3e0b3 •
CVSS: -EPSS: 0%CPEs: 7EXPL: 0CVE-2022-49279 – NFSD: prevent integer overflow on 32 bit systems
https://notcve.org/view.php?id=CVE-2022-49279
26 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: NFSD: prevent integer overflow on 32 bit systems On a 32 bit system, the "len * sizeof(*p)" operation can have an integer overflow. • https://git.kernel.org/stable/c/3a2789e8ccb4a3e2a631f6817a2d3bb98b8c4fd8 •
CVSS: -EPSS: 0%CPEs: 5EXPL: 0CVE-2022-49278 – remoteproc: Fix count check in rproc_coredump_write()
https://notcve.org/view.php?id=CVE-2022-49278
26 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: remoteproc: Fix count check in rproc_coredump_write() Check count for 0, to avoid a potential underflow. Make the check the same as the one in rproc_recovery_write(). • https://git.kernel.org/stable/c/3afdc59e4390487f04f2435b7e8a6289984e0a1e •
CVSS: -EPSS: 0%CPEs: 9EXPL: 0CVE-2022-49277 – jffs2: fix memory leak in jffs2_do_mount_fs
https://notcve.org/view.php?id=CVE-2022-49277
26 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: jffs2: fix memory leak in jffs2_do_mount_fs If jffs2_build_filesystem() in jffs2_do_mount_fs() returns an error, we can observe the following kmemleak report: -------------------------------------------- unreferenced object 0xffff88811b25a640 (size 64): comm "mount", pid 691, jiffies 4294957728 (age 71.952s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ... • https://git.kernel.org/stable/c/e631ddba588783edd521c5a89f7b2902772fb691 •
CVSS: -EPSS: 0%CPEs: 9EXPL: 0CVE-2022-49276 – jffs2: fix memory leak in jffs2_scan_medium
https://notcve.org/view.php?id=CVE-2022-49276
26 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: jffs2: fix memory leak in jffs2_scan_medium If an error is returned in jffs2_scan_eraseblock() and some memory has been added to the jffs2_summary *s, we can observe the following kmemleak report: -------------------------------------------- unreferenced object 0xffff88812b889c40 (size 64): comm "mount", pid 692, jiffies 4294838325 (age 34.288s) hex dump (first 32 bytes): 40 48 b5 14 81 88 ff ff 01 e0 31 00 00 00 50 00 @H........1...P. 00 0... • https://git.kernel.org/stable/c/e631ddba588783edd521c5a89f7b2902772fb691 •
CVSS: -EPSS: 0%CPEs: 9EXPL: 0CVE-2022-49275 – can: m_can: m_can_tx_handler(): fix use after free of skb
https://notcve.org/view.php?id=CVE-2022-49275
26 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: can: m_can: m_can_tx_handler(): fix use after free of skb can_put_echo_skb() will clone skb then free the skb. Move the can_put_echo_skb() for the m_can version 3.0.x directly before the start of the xmit in hardware, similar to the 3.1.x branch. • https://git.kernel.org/stable/c/80646733f11c2e9de3b6339f7e635047e6087280 •
CVSS: -EPSS: 0%CPEs: 4EXPL: 0CVE-2022-49274 – ocfs2: fix crash when mount with quota enabled
https://notcve.org/view.php?id=CVE-2022-49274
26 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix crash when mount with quota enabled There is a reported crash when mounting ocfs2 with quota enabled. RIP: 0010:ocfs2_qinfo_lock_res_init+0x44/0x50 [ocfs2] Call Trace: ocfs2_local_read_info+0xb9/0x6f0 [ocfs2] dquot_load_quota_sb+0x216/0x470 dquot_load_quota_inode+0x85/0x100 ocfs2_enable_quotas+0xa0/0x1c0 [ocfs2] ocfs2_fill_super.cold+0xc8/0x1bf [ocfs2] mount_bdev+0x185/0x1b0 legacy_get_tree+0x27/0x40 vfs_get_tree+0x25/0xb0 path_m... • https://git.kernel.org/stable/c/6c85c2c728193d19d6a908ae9fb312d0325e65ca •
CVSS: -EPSS: 0%CPEs: 4EXPL: 0CVE-2022-49273 – rtc: pl031: fix rtc features null pointer dereference
https://notcve.org/view.php?id=CVE-2022-49273
26 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: rtc: pl031: fix rtc features null pointer dereference When there is no interrupt line, rtc alarm feature is disabled. The clearing of the alarm feature bit was being done prior to allocations of ldata->rtc device, resulting in a null pointer dereference. Clear RTC_FEATURE_ALARM after the rtc device is allocated. • https://git.kernel.org/stable/c/d9b0dd54a1943f47a381a474f8ea2c94466110c0 •
CVSS: -EPSS: 0%CPEs: 4EXPL: 0CVE-2022-49272 – ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock
https://notcve.org/view.php?id=CVE-2022-49272
26 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock syzbot caught a potential deadlock between the PCM runtime->buffer_mutex and the mm->mmap_lock. It was brought by the recent fix to cover the racy read/write and other ioctls, and in that commit, I overlooked a (hopefully only) corner case that may take the revert lock, namely, the OSS mmap. The OSS mmap operation exceptionally allows to re-configure the parameters inside t... • https://git.kernel.org/stable/c/8527c8f052fb42091c6569cb928e472376a4a889 •
CVSS: -EPSS: 0%CPEs: 5EXPL: 0CVE-2022-49271 – cifs: prevent bad output lengths in smb2_ioctl_query_info()
https://notcve.org/view.php?id=CVE-2022-49271
26 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: cifs: prevent bad output lengths in smb2_ioctl_query_info() When calling smb2_ioctl_query_info() with smb_query_info::flags=PASSTHRU_FSCTL and smb_query_info::output_buffer_length=0, the following would return 0x10 buffer = memdup_user(arg + sizeof(struct smb_query_info), qi.output_buffer_length); if (IS_ERR(buffer)) { kfree(vars); return PTR_ERR(buffer); } rather than a valid pointer thus making IS_ERR() check fail. This would then cause a... • https://git.kernel.org/stable/c/9963ccea6087268e1275b992dca5d0dd4b938765 •