CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2022-50572 – ASoC: audio-graph-card: fix refcount leak of cpu_ep in __graph_for_each_link()
https://notcve.org/view.php?id=CVE-2022-50572
22 Oct 2025 — In the Linux kernel, the following vulnerability has been resolved: ASoC: audio-graph-card: fix refcount leak of cpu_ep in __graph_for_each_link() The of_get_next_child() returns a node with refcount incremented, and decrements the refcount of prev. So in the error path of the while loop, of_node_put() needs be called for cpu_ep. In the Linux kernel, the following vulnerability has been resolved: ASoC: audio-graph-card: fix refcount leak of cpu_ep in __graph_for_each_link() The of_get_next_child() returns a... • https://git.kernel.org/stable/c/fce9b90c1ab7e915553c57353355700c79b39c86 •
CVSS: 7.1EPSS: 0%CPEs: 2EXPL: 0CVE-2022-50571 – btrfs: call __btrfs_remove_free_space_cache_locked on cache load failure
https://notcve.org/view.php?id=CVE-2022-50571
22 Oct 2025 — In the Linux kernel, the following vulnerability has been resolved: btrfs: call __btrfs_remove_free_space_cache_locked on cache load failure Now that lockdep is staying enabled through our entire CI runs I started seeing the following stack in generic/475 ------------[ cut here ]------------ WARNING: CPU: 1 PID: 2171864 at fs/btrfs/discard.c:604 btrfs_discard_update_discardable+0x98/0xb0 CPU: 1 PID: 2171864 Comm: kworker/u4:0 Not tainted 5.19.0-rc8+ #789 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), B... • https://git.kernel.org/stable/c/819a61301275dcc573e3f520be3dc2c8531bee2d •
CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 0CVE-2022-50570 – platform/chrome: fix memory corruption in ioctl
https://notcve.org/view.php?id=CVE-2022-50570
22 Oct 2025 — In the Linux kernel, the following vulnerability has been resolved: platform/chrome: fix memory corruption in ioctl If "s_mem.bytes" is larger than the buffer size it leads to memory corruption. In the Linux kernel, the following vulnerability has been resolved: platform/chrome: fix memory corruption in ioctl If "s_mem.bytes" is larger than the buffer size it leads to memory corruption. • https://git.kernel.org/stable/c/eda2e30c6684d67288edb841c6125d48c608a242 •
CVSS: 5.5EPSS: 0%CPEs: 9EXPL: 0CVE-2022-50569 – xfrm: Update ipcomp_scratches with NULL when freed
https://notcve.org/view.php?id=CVE-2022-50569
22 Oct 2025 — In the Linux kernel, the following vulnerability has been resolved: xfrm: Update ipcomp_scratches with NULL when freed Currently if ipcomp_alloc_scratches() fails to allocate memory ipcomp_scratches holds obsolete address. So when we try to free the percpu scratches using ipcomp_free_scratches() it tries to vfree non existent vm area. Described below: static void * __percpu *ipcomp_alloc_scratches(void) { ... scratches = alloc_percpu(void *); if (!scratches) return NULL; ipcomp_scratches does not know about... • https://git.kernel.org/stable/c/debca61df6bc2f65e020656c9c5b878d6b38d30f •
CVSS: 7.1EPSS: 0%CPEs: 7EXPL: 0CVE-2022-50568 – usb: gadget: f_hid: fix f_hidg lifetime vs cdev
https://notcve.org/view.php?id=CVE-2022-50568
22 Oct 2025 — In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_hid: fix f_hidg lifetime vs cdev The embedded struct cdev does not have its lifetime correctly tied to the enclosing struct f_hidg, so there is a use-after-free if /dev/hidgN is held open while the gadget is deleted. This can readily be replicated with libusbgx's example programs (for conciseness - operating directly via configfs is equivalent): gadget-hid exec 3<> /dev/hidg0 gadget-vid-pid-remove exec 3<&- Pull the existing ... • https://git.kernel.org/stable/c/71adf118946957839a13aa4d1094183e05c6c094 •
CVSS: 5.5EPSS: 0%CPEs: 9EXPL: 0CVE-2022-50567 – fs: jfs: fix shift-out-of-bounds in dbAllocAG
https://notcve.org/view.php?id=CVE-2022-50567
22 Oct 2025 — In the Linux kernel, the following vulnerability has been resolved: fs: jfs: fix shift-out-of-bounds in dbAllocAG Syzbot found a crash : UBSAN: shift-out-of-bounds in dbAllocAG. The underlying bug is the missing check of bmp->db_agl2size. The field can be greater than 64 and trigger the shift-out-of-bounds. Fix this bug by adding a check of bmp->db_agl2size in dbMount since this field is used in many following functions. The upper bound for this field is L2MAXL2SIZE - L2MAXAG, thanks for the help of Dave Kl... • https://git.kernel.org/stable/c/d3b486946a4e62c7ef6023f7d9c1d049051384ba •
CVSS: 5.5EPSS: 0%CPEs: 9EXPL: 0CVE-2022-50566 – mtd: Fix device name leak when register device failed in add_mtd_device()
https://notcve.org/view.php?id=CVE-2022-50566
22 Oct 2025 — In the Linux kernel, the following vulnerability has been resolved: mtd: Fix device name leak when register device failed in add_mtd_device() There is a kmemleak when register device failed: unreferenced object 0xffff888101aab550 (size 8): comm "insmod", pid 3922, jiffies 4295277753 (age 925.408s) hex dump (first 8 bytes): 6d 74 64 30 00 88 ff ff mtd0.... backtrace: [<00000000bde26724>] __kmalloc_node_track_caller+0x4e/0x150 [<000000003c32b416>] kvasprintf+0xb0/0x130 [<000000001f7a8f15>] kobject_set_name_va... • https://git.kernel.org/stable/c/1f24b5a8ecbb2a3c7080f418974d40e3ffedb221 •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2022-50565 – wifi: plfxlc: fix potential memory leak in __lf_x_usb_enable_rx()
https://notcve.org/view.php?id=CVE-2022-50565
22 Oct 2025 — In the Linux kernel, the following vulnerability has been resolved: wifi: plfxlc: fix potential memory leak in __lf_x_usb_enable_rx() urbs does not be freed in exception paths in __lf_x_usb_enable_rx(). That will trigger memory leak. To fix it, add kfree() for urbs within "error" label. Compile tested only. In the Linux kernel, the following vulnerability has been resolved: wifi: plfxlc: fix potential memory leak in __lf_x_usb_enable_rx() urbs does not be freed in exception paths in __lf_x_usb_enable_rx(). ... • https://git.kernel.org/stable/c/68d57a07bfe5bb29b80cd8b8fa24c9d1ea104124 •
CVSS: 7.1EPSS: 0%CPEs: 9EXPL: 0CVE-2022-50564 – s390/netiucv: Fix return type of netiucv_tx()
https://notcve.org/view.php?id=CVE-2022-50564
22 Oct 2025 — In the Linux kernel, the following vulnerability has been resolved: s390/netiucv: Fix return type of netiucv_tx() With clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG), indirect call targets are validated against the expected function pointer prototype to make sure the call target is valid to help mitigate ROP attacks. If they are not identical, there is a failure at run time, which manifests as either a kernel panic or thread getting killed. A proposed warning in clang aims to catch these at ... • https://git.kernel.org/stable/c/f13d870fce90f01cf930bfaffecc8185ae0be21c •
CVSS: 7.8EPSS: 0%CPEs: 9EXPL: 0CVE-2022-50563 – dm thin: Fix UAF in run_timer_softirq()
https://notcve.org/view.php?id=CVE-2022-50563
22 Oct 2025 — In the Linux kernel, the following vulnerability has been resolved: dm thin: Fix UAF in run_timer_softirq() When dm_resume() and dm_destroy() are concurrent, it will lead to UAF, as follows: BUG: KASAN: use-after-free in __run_timers+0x173/0x710 Write of size 8 at addr ffff88816d9490f0 by task swapper/0/0