CVSS: -EPSS: 0%CPEs: 5EXPL: 0CVE-2022-49211 – mips: cdmm: Fix refcount leak in mips_cdmm_phys_base
https://notcve.org/view.php?id=CVE-2022-49211
26 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: mips: cdmm: Fix refcount leak in mips_cdmm_phys_base The of_find_compatible_node() function returns a node pointer with refcount incremented, We should use of_node_put() on it when done Add the missing of_node_put() to release the refcount. • https://git.kernel.org/stable/c/2121aa3e2312ccc1d6299154dc4f07a6ab8beee2 •
CVSS: -EPSS: 0%CPEs: 5EXPL: 0CVE-2022-49210 – MIPS: pgalloc: fix memory leak caused by pgd_free()
https://notcve.org/view.php?id=CVE-2022-49210
26 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: MIPS: pgalloc: fix memory leak caused by pgd_free() pgd page is freed by generic implementation pgd_free() since commit f9cb654cb550 ("asm-generic: pgalloc: provide generic pgd_free()"), however, there are scenarios that the system uses more than one page as the pgd table, in such cases the generic implementation pgd_free() won't be applicable anymore. For example, when PAGE_SIZE_4KB is enabled and MIPS_VA_BITS_48 is not enabled in a 64bit ... • https://git.kernel.org/stable/c/f9cb654cb550b7b87e8608b14fc3eca432429ffe •
CVSS: -EPSS: 0%CPEs: 6EXPL: 0CVE-2022-49209 – bpf, sockmap: Fix memleak in tcp_bpf_sendmsg while sk msg is full
https://notcve.org/view.php?id=CVE-2022-49209
26 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix memleak in tcp_bpf_sendmsg while sk msg is full If tcp_bpf_sendmsg() is running while sk msg is full. When sk_msg_alloc() returns -ENOMEM error, tcp_bpf_sendmsg() goes to wait_for_memory. If partial memory has been alloced by sk_msg_alloc(), that is, msg_tx->sg.size is greater than osize after sk_msg_alloc(), memleak occurs. To fix we use sk_msg_trim() to release the allocated memory, then goto wait for memory. Other call ... • https://git.kernel.org/stable/c/604326b41a6fb9b4a78b6179335decee0365cd8c •
CVSS: -EPSS: 0%CPEs: 4EXPL: 0CVE-2022-49208 – RDMA/irdma: Prevent some integer underflows
https://notcve.org/view.php?id=CVE-2022-49208
26 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Prevent some integer underflows My static checker complains that: drivers/infiniband/hw/irdma/ctrl.c:3605 irdma_sc_ceq_init() warn: can subtract underflow 'info->dev->hmc_fpm_misc.max_ceqs'? It appears that "info->dev->hmc_fpm_misc.max_ceqs" comes from the firmware in irdma_sc_parse_fpm_query_buf() so, yes, there is a chance that it could be zero. Even if we trust the firmware, it's easy enough to change the condition just as a ... • https://git.kernel.org/stable/c/3f49d684256963d3f27dfb9d9ff228e2255be78d •
CVSS: -EPSS: 0%CPEs: 4EXPL: 0CVE-2022-49207 – bpf, sockmap: Fix memleak in sk_psock_queue_msg
https://notcve.org/view.php?id=CVE-2022-49207
26 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix memleak in sk_psock_queue_msg If tcp_bpf_sendmsg is running during a tear down operation we may enqueue data on the ingress msg queue while tear down is trying to free it. sk1 (redirect sk2) sk2 ------------------- --------------- tcp_bpf_sendmsg() tcp_bpf_send_verdict() tcp_bpf_sendmsg_redir() bpf_tcp_ingress() sock_map_close() lock_sock() lock_sock() ... blocking sk_psock_stop sk_psock_clear_state(psock, SK_PSOCK_TX_ENAB... • https://git.kernel.org/stable/c/9635720b7c88592214562cb72605bdab6708006c •
CVSS: -EPSS: 0%CPEs: 6EXPL: 0CVE-2022-49206 – RDMA/mlx5: Fix memory leak in error flow for subscribe event routine
https://notcve.org/view.php?id=CVE-2022-49206
26 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix memory leak in error flow for subscribe event routine In case the second xa_insert() fails, the obj_event is not released. Fix the error unwind flow to free that memory to avoid a memory leak. • https://git.kernel.org/stable/c/7597385371425febdaa8c6a1da3625d4ffff16f5 •
CVSS: -EPSS: 0%CPEs: 6EXPL: 0CVE-2022-49205 – bpf, sockmap: Fix double uncharge the mem of sk_msg
https://notcve.org/view.php?id=CVE-2022-49205
26 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix double uncharge the mem of sk_msg If tcp_bpf_sendmsg is running during a tear down operation, psock may be freed. tcp_bpf_sendmsg() tcp_bpf_send_verdict() sk_msg_return() tcp_bpf_sendmsg_redir() unlikely(!psock)) sk_msg_free() The mem of msg has been uncharged in tcp_bpf_send_verdict() by sk_msg_return(), and would be uncharged by sk_msg_free() again. When psock is null, we can simply returning an error code, this would th... • https://git.kernel.org/stable/c/604326b41a6fb9b4a78b6179335decee0365cd8c •
CVSS: -EPSS: 0%CPEs: 6EXPL: 0CVE-2022-49204 – bpf, sockmap: Fix more uncharged while msg has more_data
https://notcve.org/view.php?id=CVE-2022-49204
26 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix more uncharged while msg has more_data In tcp_bpf_send_verdict(), if msg has more data after tcp_bpf_sendmsg_redir(): tcp_bpf_send_verdict() tosend = msg->sg.size //msg->sg.size = 22220 case __SK_REDIRECT: sk_msg_return() //uncharged msg->sg.size(22220) sk->sk_forward_alloc tcp_bpf_sendmsg_redir() //after tcp_bpf_sendmsg_redir, msg->sg.size=11000 goto more_data; tosend = msg->sg.size //msg->sg.size = 11000 case __SK_REDIRE... • https://git.kernel.org/stable/c/604326b41a6fb9b4a78b6179335decee0365cd8c •
CVSS: -EPSS: 0%CPEs: 4EXPL: 0CVE-2022-49202 – Bluetooth: hci_uart: add missing NULL check in h5_enqueue
https://notcve.org/view.php?id=CVE-2022-49202
26 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_uart: add missing NULL check in h5_enqueue Syzbot hit general protection fault in __pm_runtime_resume(). The problem was in missing NULL check. hu->serdev can be NULL and we should not blindly pass &serdev->dev somewhere, since it will cause GPF. • https://git.kernel.org/stable/c/d9dd833cf6d29695682ec7e7924c0d0992b906bc •
CVSS: -EPSS: 0%CPEs: 4EXPL: 0CVE-2022-49201 – ibmvnic: fix race between xmit and reset
https://notcve.org/view.php?id=CVE-2022-49201
26 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: ibmvnic: fix race between xmit and reset There is a race between reset and the transmit paths that can lead to ibmvnic_xmit() accessing an scrq after it has been freed in the reset path. It can result in a crash like: Kernel attempted to read user page (0) - exploit attempt? (uid: 0) BUG: Kernel NULL pointer dereference on read at 0x00000000 Faulting instruction address: 0xc0080000016189f8 Oops: Kernel access of bad area, sig: 11 [#1] ... N... • https://git.kernel.org/stable/c/7ed5b31f4a6695a21f617df07646e9b15c6c1d29 •