Fixed packages 43
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · RHEL 8 enterprise_linux:8::baseos | bpftool | 0:4.18.0-425.3.1.el8 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | bpftool-debuginfo | 0:4.18.0-425.3.1.el8 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | kernel | 0:4.18.0-425.3.1.el8 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | kernel-abi-stablelists | 0:4.18.0-425.3.1.el8 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | kernel-core | 0:4.18.0-425.3.1.el8 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | kernel-debug | 0:4.18.0-425.3.1.el8 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | kernel-debug-core | 0:4.18.0-425.3.1.el8 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | kernel-debug-debuginfo | 0:4.18.0-425.3.1.el8 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | kernel-debug-devel | 0:4.18.0-425.3.1.el8 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | kernel-debug-modules | 0:4.18.0-425.3.1.el8 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | kernel-debug-modules-extra | 0:4.18.0-425.3.1.el8 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | kernel-debuginfo | 0:4.18.0-425.3.1.el8 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | kernel-debuginfo-common-aarch64 | 0:4.18.0-425.3.1.el8 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | kernel-debuginfo-common-ppc64le | 0:4.18.0-425.3.1.el8 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | kernel-debuginfo-common-s390x | 0:4.18.0-425.3.1.el8 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | kernel-debuginfo-common-x86_64 | 0:4.18.0-425.3.1.el8 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | kernel-devel | 0:4.18.0-425.3.1.el8 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | kernel-doc | 0:4.18.0-425.3.1.el8 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | kernel-modules | 0:4.18.0-425.3.1.el8 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | kernel-modules-extra | 0:4.18.0-425.3.1.el8 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | kernel-tools | 0:4.18.0-425.3.1.el8 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | kernel-tools-debuginfo | 0:4.18.0-425.3.1.el8 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | kernel-tools-libs | 0:4.18.0-425.3.1.el8 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | kernel-zfcpdump | 0:4.18.0-425.3.1.el8 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | kernel-zfcpdump-core | 0:4.18.0-425.3.1.el8 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | kernel-zfcpdump-debuginfo | 0:4.18.0-425.3.1.el8 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | kernel-zfcpdump-devel | 0:4.18.0-425.3.1.el8 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | kernel-zfcpdump-modules | 0:4.18.0-425.3.1.el8 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | kernel-zfcpdump-modules-extra | 0:4.18.0-425.3.1.el8 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | perf | 0:4.18.0-425.3.1.el8 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | perf-debuginfo | 0:4.18.0-425.3.1.el8 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | python3-perf | 0:4.18.0-425.3.1.el8 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | python3-perf-debuginfo | 0:4.18.0-425.3.1.el8 |
| Red Hat · RHEL 8 enterprise_linux:8::crb | bpftool-debuginfo | 0:4.18.0-425.3.1.el8 |
| Red Hat · RHEL 8 enterprise_linux:8::crb | kernel-debug-debuginfo | 0:4.18.0-425.3.1.el8 |
| Red Hat · RHEL 8 enterprise_linux:8::crb | kernel-debuginfo | 0:4.18.0-425.3.1.el8 |
| Red Hat · RHEL 8 enterprise_linux:8::crb | kernel-debuginfo-common-aarch64 | 0:4.18.0-425.3.1.el8 |
| Red Hat · RHEL 8 enterprise_linux:8::crb | kernel-debuginfo-common-ppc64le | 0:4.18.0-425.3.1.el8 |
| Red Hat · RHEL 8 enterprise_linux:8::crb | kernel-debuginfo-common-x86_64 | 0:4.18.0-425.3.1.el8 |
| Red Hat · RHEL 8 enterprise_linux:8::crb | kernel-tools-debuginfo | 0:4.18.0-425.3.1.el8 |
| Red Hat · RHEL 8 enterprise_linux:8::crb | kernel-tools-libs-devel | 0:4.18.0-425.3.1.el8 |
| Red Hat · RHEL 8 enterprise_linux:8::crb | perf-debuginfo | 0:4.18.0-425.3.1.el8 |
| Red Hat · RHEL 8 enterprise_linux:8::crb | python3-perf-debuginfo | 0:4.18.0-425.3.1.el8 |
Vulnerabilities 139
-
Medium 5.3
It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-…
KEV Jun 26, 2024 -
Critical 9.8
inet: fully convert sk->sk_rx_dst to RCU rules
In the Linux kernel, the following vulnerability has been resolved: inet: fully convert sk->sk_rx_dst to RCU rules syzbot reported various issues around early demux, one being included in this changelog [1] sk->sk_rx_dst is using RCU protection without clearl…
-
Critical 9.8
NFSD: Fix READDIR buffer overflow
In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix READDIR buffer overflow If a client sends a READDIR count argument that is too small (say, zero), then the buffer size calculation in the new init_dirlist helper functions results i…
-
Critical 9.8
nvme-rdma: destroy cm id before destroy qp to avoid use after free
In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: destroy cm id before destroy qp to avoid use after free We should always destroy cm_id before destroy qp to avoid to get cma event after qp was destroyed, which may lead to use aft…
-
Critical 9.8
NFSv4: Fix free of uninitialized nfs4_label on referral lookup.
In the Linux kernel, the following vulnerability has been resolved: NFSv4: Fix free of uninitialized nfs4_label on referral lookup. Send along the already-allocated fattr along with nfs4_fs_locations, and drop the memcpy of fattr. We end up growing two more a…
-
Critical 9.8
netfilter: conntrack: re-fetch conntrack after insertion
In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: re-fetch conntrack after insertion In case the conntrack is clashing, insertion can free skb->_nfct and set skb->_nfct to the already-confirmed entry. This wasn't found …
-
High 8.8
ath11k: free peer for station when disconnect from AP for QCA6390/WCN6855
In the Linux kernel, the following vulnerability has been resolved: ath11k: free peer for station when disconnect from AP for QCA6390/WCN6855 Commit b4a0f54156ac ("ath11k: move peer delete after vdev stop of station for QCA6390 and WCN6855") is to fix firmwar…
-
High 8.6
Use after Free in tc_new_tfilter allowing for privilege escalation in Linux Kernel
A use-after-free exists in the Linux Kernel in tc_new_tfilter that could allow a local attacker to gain privilege escalation. The exploit requires unprivileged user namespaces. We recommend upgrading past commit 04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5
-
High 8.4
cpufreq: CPPC: Fix potential memleak in cppc_cpufreq_cpu_init
In the Linux kernel, the following vulnerability has been resolved: cpufreq: CPPC: Fix potential memleak in cppc_cpufreq_cpu_init It's a classic example of memleak, we allocate something, we fail and never free the resources. Make sure we free all resources o…
-
High 7.8
veth: ensure skb entering GRO are not cloned.
In the Linux kernel, the following vulnerability has been resolved: veth: ensure skb entering GRO are not cloned. After commit d3256efd8e8b ("veth: allow enabling NAPI even without XDP"), if GRO is enabled on a veth device and TSO is disabled on the peer devi…
-
High 7.8
regmap: Fix possible double-free in regcache_rbtree_exit()
In the Linux kernel, the following vulnerability has been resolved: regmap: Fix possible double-free in regcache_rbtree_exit() In regcache_rbtree_insert_to_block(), when 'present' realloc failed, the 'blk' which is supposed to assign to 'rbnode->block' will b…
-
High 7.8
ethtool: do not perform operations on net devices being unregistered
In the Linux kernel, the following vulnerability has been resolved: ethtool: do not perform operations on net devices being unregistered There is a short period between a net device starts to be unregistered and when it is actually gone. In that time frame et…
-
High 7.8
KVM: x86/mmu: Zap _all_ roots when unmapping gfn range in TDP MMU
In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Zap _all_ roots when unmapping gfn range in TDP MMU Zap both valid and invalid roots when zapping/unmapping a gfn range, as KVM must ensure it holds no references to the freed p…
-
High 7.8CVE-2022-29581 Public exploit
Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to cause privilege …
-
High 7.8
ALSA: hda: Fix UAF of leds class devs at unbinding
In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: Fix UAF of leds class devs at unbinding The LED class devices that are created by HD-audio codec drivers are registered via devm_led_classdev_register() and associated with the HD-…
-
High 7.8
vsock: remove vsock from connected table when connect is interrupted by a signal
In the Linux kernel, the following vulnerability has been resolved: vsock: remove vsock from connected table when connect is interrupted by a signal vsock_connect() expects that the socket could already be in the TCP_ESTABLISHED state when the connecting task…
-
High 7.8
netfilter: fix use-after-free in __nf_register_net_hook()
In the Linux kernel, the following vulnerability has been resolved: netfilter: fix use-after-free in __nf_register_net_hook() We must not dereference @new_hooks after nf_hook_mutex has been released, because other threads might have freed our allocated hooks …
-
High 7.8
ice: arfs: fix use-after-free when freeing @rx_cpu_rmap
In the Linux kernel, the following vulnerability has been resolved: ice: arfs: fix use-after-free when freeing @rx_cpu_rmap The CI testing bots triggered the following splat: [ 718.203054] BUG: KASAN: use-after-free in free_irq_cpu_rmap+0x53/0x80 [ 718.206349…
-
High 7.8
mt76: mt7921: fix crash when startup fails.
In the Linux kernel, the following vulnerability has been resolved: mt76: mt7921: fix crash when startup fails. If the nic fails to start, it is possible that the reset_work has already been scheduled. Ensure the work item is canceled so we do not have use-af…
-
High 7.8
ALSA: pcm: Fix races among concurrent prealloc proc writes
In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Fix races among concurrent prealloc proc writes We have no protection against concurrent PCM buffer preallocation changes via proc files, and it may potentially lead to UAF or some…
-
High 7.8
mac80211: fix potential double free on mesh join
In the Linux kernel, the following vulnerability has been resolved: mac80211: fix potential double free on mesh join While commit 6a01afcf8468 ("mac80211: mesh: Free ie data when leaving mesh") fixed a memory leak on mesh leave / teardown it introduced a pote…
-
High 7.8
ALSA: oss: Fix PCM OSS buffer allocation overflow
In the Linux kernel, the following vulnerability has been resolved: ALSA: oss: Fix PCM OSS buffer allocation overflow We've got syzbot reports hitting INT_MAX overflow at vmalloc() allocation that is called from snd_pcm_plug_alloc(). Although we apply the res…
-
High 7.8
ext4: avoid cycles in directory h-tree
In the Linux kernel, the following vulnerability has been resolved: ext4: avoid cycles in directory h-tree A maliciously corrupted filesystem can contain cycles in the h-tree stored inside a directory. That can easily lead to the kernel corrupting tree nodes …
-
High 7.8
ext4: fix use-after-free in ext4_rename_dir_prepare
In the Linux kernel, the following vulnerability has been resolved: ext4: fix use-after-free in ext4_rename_dir_prepare We got issue as follows: EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue ext4_get_first_dir_block: bh->b_data=0…
-
High 7.8
iommu/arm-smmu-v3-sva: Fix mm use-after-free
In the Linux kernel, the following vulnerability has been resolved: iommu/arm-smmu-v3-sva: Fix mm use-after-free We currently call arm64_mm_context_put() without holding a reference to the mm, which can result in use-after-free. Call mmgrab()/mmdrop() to ensu…
-
High 7.8
cifs: fix potential double free during failed mount
In the Linux kernel, the following vulnerability has been resolved: cifs: fix potential double free during failed mount RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=2088799
-
High 7.8
sfc: fix use after free when disabling sriov
In the Linux kernel, the following vulnerability has been resolved: sfc: fix use after free when disabling sriov Use after free is detected by kfence when disabling sriov. What was read after being freed was vf->pci_dev: it was freed from pci_disable_sriov an…
-
High 7.8
mptcp: fix race on unaccepted mptcp sockets
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix race on unaccepted mptcp sockets When the listener socket owning the relevant request is closed, it frees the unaccepted subflows and that causes later deletion of the paired MPTCP…
-
High 7.8
igb: fix a use-after-free issue in igb_clean_tx_ring
In the Linux kernel, the following vulnerability has been resolved: igb: fix a use-after-free issue in igb_clean_tx_ring Fix the following use-after-free bug in igb_clean_tx_ring routine when the NIC is running in XDP mode. The issue can be triggered redirect…
-
High 7.8
netfilter: nf_tables: do not allow SET_ID to refer to another table
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: do not allow SET_ID to refer to another table When doing lookups for sets on the same batch by using its ID, a set from a different table can be used. Then, when the tab…
-
High 7.5CVE-2022-36946 Public exploit
nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote attackers to cause a …
-
High 7.5
scsi: qla2xxx: Fix crash during module load unload test
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix crash during module load unload test During purex packet handling the driver was incorrectly freeing a pre-allocated structure. Fix this by skipping that entry. System cras…
-
High 7.5
tipc: move bc link creation back to tipc_node_create
In the Linux kernel, the following vulnerability has been resolved: tipc: move bc link creation back to tipc_node_create Shuang Li reported a NULL pointer dereference crash: [] BUG: kernel NULL pointer dereference, address: 0000000000000068 [] RIP: 0010:tipc_…
-
High 7.1
scsi: scsi_debug: Fix type in min_t to avoid stack OOB
In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_debug: Fix type in min_t to avoid stack OOB Change min_t() to use type "u32" instead of type "int" to avoid stack out of bounds. With min_t() type "int" the values get sign extende…
-
High 7.1
KVM: x86/mmu: make apf token non-zero to fix bug
In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: make apf token non-zero to fix bug In current async pagefault logic, when a page is ready, KVM relies on kvm_arch_can_dequeue_async_page_present() to determine whether to delive…
-
High 7.1
Kernel: vmxnet3: use-after-free in vmxnet3_rq_alloc_rx_buf()
A use-after-free flaw was found in vmxnet3_rq_alloc_rx_buf in drivers/net/vmxnet3/vmxnet3_drv.c in VMware's vmxnet3 ethernet NIC driver in the Linux Kernel. This issue could allow a local attacker to crash the system due to a double-free while cleaning up vmx…
-
Medium 6.9
Linux Kernel LoadPin bypass via dm-verity table reload
Dm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to restrict module/firmware loads to just the trusted root filesystem. Device-mapper table reloads currently allow users with root privileges to switch out the …
-
Medium 6.7
In verity_target of dm-verity-target.c, there is a possible way to modify read-only files due to a missing permission c…
-
Medium 6.7
KGDB and KDB allow read and write access to kernel memory, and thus should be restricted during lockdown. An attacker w…
-
Medium 5.5
drm/virtio: Ensure that objs is not NULL in virtio_gpu_array_put_free()
In the Linux kernel, the following vulnerability has been resolved: drm/virtio: Ensure that objs is not NULL in virtio_gpu_array_put_free() If virtio_gpu_object_shmem_init() fails (e.g. due to fault injection, as it happened in the bug report by syzbot), virt…
-
Medium 5.5
Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow an authorize…
-
Medium 5.5
An issue was discovered in the Linux kernel through 5.16-rc6. netvsc_get_ethtool_stats in drivers/net/hyperv/netvsc_drv…
-
Medium 5.5
net/smc: Fix NULL pointer dereference in smc_pnet_find_ib()
In the Linux kernel, the following vulnerability has been resolved: net/smc: Fix NULL pointer dereference in smc_pnet_find_ib() dev_name() was called with dev.parent as argument but without to NULL-check it before. Solve this by checking the pointer before th…
-
Medium 5.5
ath11k: Fix frames flush failure caused by deadlock
In the Linux kernel, the following vulnerability has been resolved: ath11k: Fix frames flush failure caused by deadlock We are seeing below warnings: kernel: [25393.301506] ath11k_pci 0000:01:00.0: failed to flush mgmt transmit queue 0 kernel: [25398.421509] …
-
Medium 5.5
ath11k: mhi: use mhi_sync_power_up()
In the Linux kernel, the following vulnerability has been resolved: ath11k: mhi: use mhi_sync_power_up() If amss.bin was missing ath11k would crash during 'rmmod ath11k_pci'. The reason for that was that we were using mhi_async_power_up() which does not check…
-
Medium 5.5
ath9k_htc: fix uninit value bugs
In the Linux kernel, the following vulnerability has been resolved: ath9k_htc: fix uninit value bugs Syzbot reported 2 KMSAN bugs in ath9k. All of them are caused by missing field initialization. In htc_connect_service() svc_meta_len and pad are not initializ…
-
Medium 5.5
tipc: check attribute length for bearer name
In the Linux kernel, the following vulnerability has been resolved: tipc: check attribute length for bearer name syzbot reported uninit-value: ===================================================== BUG: KMSAN: uninit-value in string_nocheck lib/vsprintf.c:644 …
-
Medium 5.5
RDMA/hfi1: Fix potential integer multiplication overflow errors
In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Fix potential integer multiplication overflow errors When multiplying of different types, an overflow is possible even when storing the result in a larger type. This is because the…
-
Medium 5.5
scsi: lpfc: Protect memory leak for NPIV ports sending PLOGI_RJT
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Protect memory leak for NPIV ports sending PLOGI_RJT There is a potential memory leak in lpfc_ignore_els_cmpl() and lpfc_els_rsp_reject() that was allocated from NPIV PLOGI_RJT (l…
-
Medium 5.5
scsi: lpfc: Fix SCSI I/O completion and abort handler deadlock
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix SCSI I/O completion and abort handler deadlock During stress I/O tests with 500+ vports, hard LOCKUP call traces are observed. CPU A: native_queued_spin_lock_slowpath+0x192 _r…
-
Medium 5.5
ALSA: jack: Access input_dev under mutex
In the Linux kernel, the following vulnerability has been resolved: ALSA: jack: Access input_dev under mutex It is possible when using ASoC that input_dev is unregistered while calling snd_jack_report, which causes NULL pointer dereference. In order to preven…
-
Medium 5.5
ASoC: rt711-sdca: fix kernel NULL pointer dereference when IO error
In the Linux kernel, the following vulnerability has been resolved: ASoC: rt711-sdca: fix kernel NULL pointer dereference when IO error The initial settings will be written before the codec probe function. But, the rt711->component doesn't be assigned yet. If…
-
Medium 5.5
RDMA/cm: Fix memory leak in ib_cm_insert_listen
In the Linux kernel, the following vulnerability has been resolved: RDMA/cm: Fix memory leak in ib_cm_insert_listen cm_alloc_id_priv() allocates resource for the cm_id_priv. When cm_init_listen() fails it doesn't free it, leading to memory leak. Add the missi…
-
Medium 5.5
ext4: add reserved GDT blocks check
In the Linux kernel, the following vulnerability has been resolved: ext4: add reserved GDT blocks check We capture a NULL pointer issue when resizing a corrupt ext4 image which is freshly clear resize_inode feature (not run e2fsck). It could be simply reprodu…
-
Unscored —
An issue was discovered in the Linux kernel through 5.16.11. The mixed IPID assignment method with the hash-based IPID …
-
Unscored —
A race condition in the Linux kernel before 5.5.7 involving VT_RESIZEX could lead to a NULL pointer dereference and gen…
-
Unscored —
An issue was discovered in the Linux kernel before 5.11.3 when a webcam device exists. video_usercopy in drivers/media/…
-
Unscored —
A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the way user calls …
-
Unscored —
mm/damon/dbgfs: protect targets destructions with kdamond_lock
In the Linux kernel, the following vulnerability has been resolved: mm/damon/dbgfs: protect targets destructions with kdamond_lock DAMON debugfs interface iterates current monitoring targets in 'dbgfs_target_ids_read()' while holding the corresponding 'kdamon…
-
Unscored —
mm/hwpoison: clear MF_COUNT_INCREASED before retrying get_any_page()
In the Linux kernel, the following vulnerability has been resolved: mm/hwpoison: clear MF_COUNT_INCREASED before retrying get_any_page() Hulk Robot reported a panic in put_page_testzero() when testing madvise() with MADV_SOFT_OFFLINE. The BUG() is triggered w…
-
Unscored —CVE-2021-47213 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
udmabuf: validate ubuf->pagecount
In the Linux kernel, the following vulnerability has been resolved: udmabuf: validate ubuf->pagecount Syzbot has reported GPF in sg_alloc_append_table_from_pages(). The problem was in ubuf->pages == ZERO_PTR. ubuf->pagecount is calculated from arguments passe…
-
Unscored —
A denial of service (DOS) issue was found in the Linux kernel’s smb2_ioctl_query_info function in the fs/cifs/smb2ops.c…
-
Unscored —
A flaw null pointer dereference in the Linux kernel UDF file system functionality was found in the way user triggers ud…
-
Unscored —
A memory leak flaw was found in the Linux kernel’s DMA subsystem, in the way a user calls DMA_FROM_DEVICE. This flaw al…
-
Unscored —
A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c:nft_do_chain, which can cause a use-after-free. …
-
Unscored —
A use-after-free flaw was found in the Linux kernel’s sound subsystem in the way a user triggers concurrent calls of PC…
-
Unscored —
A flaw was found in KVM. When updating a guest's page table entry, vm_pgoff was improperly used as the offset to get th…
-
Unscored —
A use-after-free flaw was found in fs/ext4/namei.c:dx_insert_block() in the Linux kernel’s filesystem sub-component. Th…
-
Unscored —
A NULL pointer dereference issue was found in KVM when releasing a vCPU with dirty ring support enabled. This flaw allo…
-
Unscored —
A use-after-free vulnerability was found in drm_lease_held in drivers/gpu/drm/drm_lease.c in the Linux kernel due to a …
-
Unscored —
A NULL pointer dereference flaw was found in the Linux kernel’s KVM module, which can lead to a denial of service in th…
-
Unscored —
Product: AndroidVersions: Android kernelAndroid ID: A-224546354References: Upstream kernel
-
Unscored —CVE-2022-2078 Public exploit
A vulnerability was found in the Linux kernel's nft_set_desc_concat_parse() function .This flaw allows an attacker to t…
-
Unscored —
A flaw was found in the Linux kernel’s KVM when attempting to set a SynIC IRQ. This issue makes it possible for a misbe…
-
Unscored —
Certain Arm Cortex and Neoverse processors through 2022-03-08 do not properly restrict cache speculation, aka Spectre-B…
-
Unscored —
An issue was discovered in fs/nfs/dir.c in the Linux kernel before 5.16.5. If an application sets the O_DIRECTORY flag,…
-
Unscored —CVE-2022-2639 Public exploit
An integer coercion error was found in the openvswitch kernel module. Given a sufficiently large number of actions, whi…
-
Unscored —
In drivers/hid/hid-elo.c in the Linux kernel before 5.16.11, a memory leak exists for a certain hid_parse error conditi…
-
Unscored —
ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double free.
-
Unscored —
The SUNRPC subsystem in the Linux kernel through 5.17.2 can call xs_xprt_free before ensuring that sockets are in the i…
-
Unscored —
A flaw was found in the Linux kernel's implementation of Pressure Stall Information. While the feature is disabled by d…
-
Unscored —
ASoC: ops: Reject out of bounds values in snd_soc_put_volsw()
In the Linux kernel, the following vulnerability has been resolved: ASoC: ops: Reject out of bounds values in snd_soc_put_volsw() We don't currently validate that the values being set are within the range we advertised to userspace as being valid, do so and r…
-
Unscored —
KVM: LAPIC: Also cancel preemption timer during SET_LAPIC
In the Linux kernel, the following vulnerability has been resolved: KVM: LAPIC: Also cancel preemption timer during SET_LAPIC The below warning is splatting during guest reboot. ------------[ cut here ]------------ WARNING: CPU: 0 PID: 1931 at arch/x86/kvm/x8…
-
Unscored —
thermal: core: Fix TZ_GET_TRIP NULL pointer dereference
In the Linux kernel, the following vulnerability has been resolved: thermal: core: Fix TZ_GET_TRIP NULL pointer dereference Do not call get_trip_hyst() from thermal_genl_cmd_tz_get_trip() if the thermal zone does not define one.
-
Unscored —
iwlwifi: mvm: check debugfs_dir ptr before use
In the Linux kernel, the following vulnerability has been resolved: iwlwifi: mvm: check debugfs_dir ptr before use When "debugfs=off" is used on the kernel command line, iwiwifi's mvm module uses an invalid/unchecked debugfs_dir pointer and causes a BUG: BUG:…
-
Unscored —
dm integrity: fix memory corruption when tag_size is less than digest size
In the Linux kernel, the following vulnerability has been resolved: dm integrity: fix memory corruption when tag_size is less than digest size It is possible to set up dm-integrity in such a way that the "tag_size" parameter is less than the actual digest siz…
-
Unscored —
veth: Ensure eth header is in skb's linear part
In the Linux kernel, the following vulnerability has been resolved: veth: Ensure eth header is in skb's linear part After feeding a decapsulated packet to a veth device with act_mirred, skb_headlen() may be 0. But veth_xmit() calls __dev_forward_skb(), which …
-
Unscored —
net: openvswitch: fix leak of nested actions
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix leak of nested actions While parsing user-provided actions, openvswitch module may dynamically allocate memory and store pointers in the internal copy of the actions. So…
-
Unscored —
Drivers: hv: vmbus: Fix potential crash on module unload
In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Fix potential crash on module unload The vmbus driver relies on the panic notifier infrastructure to perform some operations when a panic event is detected. Since vmbus ca…
-
Unscored —
dm ioctl: prevent potential spectre v1 gadget
In the Linux kernel, the following vulnerability has been resolved: dm ioctl: prevent potential spectre v1 gadget It appears like cmd could be a Spectre v1 gadget as it's supplied by a user and used as an array index. Prevent the contents of kernel memory fro…
-
Unscored —
ACPI: CPPC: Avoid out of bounds access when parsing _CPC data
In the Linux kernel, the following vulnerability has been resolved: ACPI: CPPC: Avoid out of bounds access when parsing _CPC data If the NumEntries field in the _CPC return package is less than 2, do not attempt to access the "Revision" element of that packag…
-
Unscored —
scsi: qla2xxx: Fix scheduling while atomic
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix scheduling while atomic The driver makes a call into midlayer (fc_remote_port_delete) which can put the thread to sleep. The thread that originates the call is in interrupt…
-
Unscored —
scsi: qla2xxx: Fix warning message due to adisc being flushed
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix warning message due to adisc being flushed Fix warning message due to adisc being flushed. Linux kernel triggered a warning message where a different error code type is not…
-
Unscored —
PM: core: keep irq flags in device_pm_check_callbacks()
In the Linux kernel, the following vulnerability has been resolved: PM: core: keep irq flags in device_pm_check_callbacks() The function device_pm_check_callbacks() can be called under the spin lock (in the reported case it happens from genpd_add_device() -> …
-
Unscored —
RDMA/nldev: Prevent underflow in nldev_stat_set_counter_dynamic_doit()
In the Linux kernel, the following vulnerability has been resolved: RDMA/nldev: Prevent underflow in nldev_stat_set_counter_dynamic_doit() This code checks "index" for an upper bound but it does not check for negatives. Change the type to unsigned to prevent …
-
Unscored —
block: don't delete queue kobject before its children
In the Linux kernel, the following vulnerability has been resolved: block: don't delete queue kobject before its children kobjects aren't supposed to be deleted before their child kobjects are deleted. Apparently this is usually benign; however, a WARN will b…
-
Unscored —
brcmfmac: pcie: Release firmwares in the brcmf_pcie_setup error path
In the Linux kernel, the following vulnerability has been resolved: brcmfmac: pcie: Release firmwares in the brcmf_pcie_setup error path This avoids leaking memory if brcmf_chip_get_raminfo fails. Note that the CLM blob is released in the device remove path.
-
Unscored —
PM: domains: Fix sleep-in-atomic bug caused by genpd_debug_remove()
In the Linux kernel, the following vulnerability has been resolved: PM: domains: Fix sleep-in-atomic bug caused by genpd_debug_remove() When a genpd with GENPD_FLAG_IRQ_SAFE gets removed, the following sleep-in-atomic bug will be seen, as genpd_debug_remove()…
-
Unscored —
ASoC: SOF: Intel: Fix NULL ptr dereference when ENOMEM
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: Fix NULL ptr dereference when ENOMEM Do not call snd_dma_free_pages() when snd_dma_alloc_pages() returns -ENOMEM because it leads to a NULL pointer dereference bug. The dmes…
-
Unscored —
ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock
In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock syzbot caught a potential deadlock between the PCM runtime->buffer_mutex and the mm->mmap_lock. It was brought by the recen…
-
Unscored —
ext4: fix bug_on in ext4_writepages
In the Linux kernel, the following vulnerability has been resolved: ext4: fix bug_on in ext4_writepages we got issue as follows: EXT4-fs error (device loop0): ext4_mb_generate_buddy:1141: group 0, block bitmap and bg descriptor inconsistent: 25 vs 31513 free …
-
Unscored —
sfc: fix considering that all channels have TX queues
In the Linux kernel, the following vulnerability has been resolved: sfc: fix considering that all channels have TX queues Normally, all channels have RX and TX queues, but this is not true if modparam efx_separate_tx_channels=1 is used. In that cases, some ch…
-
Unscored —
usb: dwc3: gadget: Replace list_for_each_entry_safe() if using giveback
In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: Replace list_for_each_entry_safe() if using giveback The list_for_each_entry_safe() macro saves the current item (n) and the item after (n+1), so that n can be safely remov…
-
Unscored —
ext4: fix bug_on in __es_tree_search
In the Linux kernel, the following vulnerability has been resolved: ext4: fix bug_on in __es_tree_search Hulk Robot reported a BUG_ON: ================================================================== kernel BUG at fs/ext4/extents_status.c:199! [...] RIP: 00…
-
Unscored —
RDMA/hfi1: Prevent use of lock before it is initialized
In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Prevent use of lock before it is initialized If there is a failure during probe of hfi1 before the sdma_map_lock is initialized, the call to hfi1_free_devdata() will attempt to use…
-
Unscored —
ASoC: cs35l41: Fix an out-of-bounds access in otp_packed_element_t
In the Linux kernel, the following vulnerability has been resolved: ASoC: cs35l41: Fix an out-of-bounds access in otp_packed_element_t The CS35L41_NUM_OTP_ELEM is 100, but only 99 entries are defined in the array otp_map_1/2[CS35L41_NUM_OTP_ELEM], this will t…
-
Unscored —
scsi: lpfc: Fix call trace observed during I/O with CMF enabled
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix call trace observed during I/O with CMF enabled The following was seen with CMF enabled: BUG: using smp_processor_id() in preemptible code: systemd-udevd/31711 kernel: caller …
-
Unscored —
ath11k: fix the warning of dev_wake in mhi_pm_disable_transition()
In the Linux kernel, the following vulnerability has been resolved: ath11k: fix the warning of dev_wake in mhi_pm_disable_transition() When test device recovery with below command, it has warning in message as below. echo assert > /sys/kernel/debug/ath11k/wcn…
-
Unscored —
KVM: x86: Drop WARNs that assert a triple fault never "escapes" from L2
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Drop WARNs that assert a triple fault never "escapes" from L2 Remove WARNs that sanity check that KVM never lets a triple fault for L2 escape and incorrectly end up in L1. In normal…
-
Unscored —
ixgbe: Add locking to prevent panic when setting sriov_numvfs to zero
In the Linux kernel, the following vulnerability has been resolved: ixgbe: Add locking to prevent panic when setting sriov_numvfs to zero It is possible to disable VFs while the PF driver is processing requests from the VF driver. This can result in a panic. …
-
Unscored —
igc: Reinstate IGC_REMOVED logic and implement it properly
In the Linux kernel, the following vulnerability has been resolved: igc: Reinstate IGC_REMOVED logic and implement it properly The initially merged version of the igc driver code (via commit 146740f9abc4, "igc: Add support for PF") contained the following IGC…
-
Unscored —
RDMA/irdma: Fix sleep from invalid context BUG
In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix sleep from invalid context BUG Taking the qos_mutex to process RoCEv2 QP's on netdev events causes a kernel splat. Fix this by removing the handling for RoCEv2 in irdma_cm_tea…
-
Unscored —
KVM: VMX: Prevent RSB underflow before vmenter
In the Linux kernel, the following vulnerability has been resolved: KVM: VMX: Prevent RSB underflow before vmenter On VMX, there are some balanced returns between the time the guest's SPEC_CTRL value is written, and the vmenter. Balanced returns (matched by a…
-
Unscored —
x86/speculation: Fill RSB on vmexit for IBRS
In the Linux kernel, the following vulnerability has been resolved: x86/speculation: Fill RSB on vmexit for IBRS Prevent RSB underflow/poisoning attacks with RSB. While at it, add a bunch of comments to attempt to document the current state of tribal knowledg…
-
Unscored —
ASoC: rt7*-sdw: harden jack_detect_handler
In the Linux kernel, the following vulnerability has been resolved: ASoC: rt7*-sdw: harden jack_detect_handler Realtek headset codec drivers typically check if the card is instantiated before proceeding with the jack detection. The rt700, rt711 and rt711-sdca…
-
Unscored —
sfc: fix kernel panic when creating VF
In the Linux kernel, the following vulnerability has been resolved: sfc: fix kernel panic when creating VF When creating VFs a kernel panic can happen when calling to efx_ef10_try_update_nic_stats_vf. When releasing a DMA coherent buffer, sometimes, I don't k…
-
Unscored —
dm raid: fix KASAN warning in raid5_add_disks
In the Linux kernel, the following vulnerability has been resolved: dm raid: fix KASAN warning in raid5_add_disks There's a KASAN warning in raid5_add_disk when running the LVM testsuite. The warning happens in the test lvconvert-raid-reshape-linear_to_raid6-…
-
Unscored —
dm raid: fix accesses beyond end of raid member array
In the Linux kernel, the following vulnerability has been resolved: dm raid: fix accesses beyond end of raid member array On dm-raid table load (using raid_ctr), dm-raid allocates an array rs->devs[rs->raid_disks] for the raid device members. rs->raid_disks i…
-
Unscored —
bpf: Fix request_sock leak in sk lookup helpers
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix request_sock leak in sk lookup helpers A customer reported a request_socket leak in a Calico cloud environment. We found that a BPF program was doing a socket lookup with takes a ref…
-
Unscored —
netfilter: use get_random_u32 instead of prandom
In the Linux kernel, the following vulnerability has been resolved: netfilter: use get_random_u32 instead of prandom bh might occur while updating per-cpu rnd_state from user context, ie. local_out path. BUG: using smp_processor_id() in preemptible [00000000]…
-
Unscored —
ext4: fix bug_on ext4_mb_use_inode_pa
In the Linux kernel, the following vulnerability has been resolved: ext4: fix bug_on ext4_mb_use_inode_pa Hulk Robot reported a BUG_ON: ================================================================== kernel BUG at fs/ext4/mballoc.c:3211! [...] RIP: 0010:ex…
-
Unscored —
dm mirror log: round up region bitmap size to BITS_PER_LONG
In the Linux kernel, the following vulnerability has been resolved: dm mirror log: round up region bitmap size to BITS_PER_LONG The code in dm-log rounds up bitset_size to 32 bits. It then uses find_next_zero_bit_le on the allocated region. find_next_zero_bit…
-
Unscored —
scsi: lpfc: Fix possible memory leak when failing to issue CMF WQE
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix possible memory leak when failing to issue CMF WQE There is no corresponding free routine if lpfc_sli4_issue_wqe fails to issue the CMF WQE in lpfc_issue_cmf_sync_wqe. If ret_…
-
Unscored —
scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input Malformed user input to debugfs results in buffer overflow crashes. Adapt input string lengths to fit within i…
-
Unscored —
iavf: Fix reset error handling
In the Linux kernel, the following vulnerability has been resolved: iavf: Fix reset error handling Do not call iavf_close in iavf_reset_task error handling. Doing so can lead to double call of napi_disable, which can lead to deadlock there. Removing VF would …
-
Unscored —
iavf: Fix NULL pointer dereference in iavf_get_link_ksettings
In the Linux kernel, the following vulnerability has been resolved: iavf: Fix NULL pointer dereference in iavf_get_link_ksettings Fix possible NULL pointer dereference, due to freeing of adapter->vf_res in iavf_init_get_resources. Previous commit introduced a…
-
Unscored —
iavf: Fix adminq error handling
In the Linux kernel, the following vulnerability has been resolved: iavf: Fix adminq error handling iavf_alloc_asq_bufs/iavf_alloc_arq_bufs allocates with dma_alloc_coherent memory for VF mailbox. Free DMA regions for both ASQ and ARQ in case error happens du…
-
Unscored —
BPF: Fix potential bad pointer dereference in bpf_sys_bpf()
In the Linux kernel, the following vulnerability has been resolved: BPF: Fix potential bad pointer dereference in bpf_sys_bpf() The bpf_sys_bpf() helper function allows an eBPF program to load another eBPF program from within the kernel. In this case the argu…
-
Unscored —CVE-2022-50081 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
dm raid: fix address sanitizer warning in raid_status
In the Linux kernel, the following vulnerability has been resolved: dm raid: fix address sanitizer warning in raid_status There is this warning when using a kernel with the address sanitizer and running this testsuite: https://gitlab.com/cki-project/kernel-te…
-
Unscored —
dm raid: fix address sanitizer warning in raid_resume
In the Linux kernel, the following vulnerability has been resolved: dm raid: fix address sanitizer warning in raid_resume There is a KASAN warning in raid_resume when running the lvm test lvconvert-raid.sh. The reason for the warning is that mddev->raid_disks…
-
Unscored —
dm thin: fix use-after-free crash in dm_sm_register_threshold_callback
In the Linux kernel, the following vulnerability has been resolved: dm thin: fix use-after-free crash in dm_sm_register_threshold_callback Fault inject on pool metadata device reports: BUG: KASAN: use-after-free in dm_pool_register_metadata_threshold+0x40/0x8…
-
Unscored —
watchdog: sp5100_tco: Fix a memory leak of EFCH MMIO resource
In the Linux kernel, the following vulnerability has been resolved: watchdog: sp5100_tco: Fix a memory leak of EFCH MMIO resource Unlike release_mem_region(), a call to release_resource() does not free the resource, so it has to be freed explicitly to avoid a…
-
Unscored —
ASoC: SOF: ipc3-topology: Prevent double freeing of ipc_control_data via load_bytes
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-topology: Prevent double freeing of ipc_control_data via load_bytes We have sanity checks for byte controls and if any of the fail the locally allocated scontrol->ipc_control_…
-
Unscored —
rcutorture: Fix ksoftirqd boosting timing and iteration
In the Linux kernel, the following vulnerability has been resolved: rcutorture: Fix ksoftirqd boosting timing and iteration The RCU priority boosting can fail in two situations: 1) If (nr_cpus= > maxcpus=), which means if the total number of CPUs is higher th…
-
Unscored —
wifi: rtw89: 8852a: rfk: fix div 0 exception
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: 8852a: rfk: fix div 0 exception The DPK is a kind of RF calibration whose algorithm is to fine tune parameters and calibrate, and check the result. If the result isn't good enoug…
-
Unscored —
ath11k: fix netdev open race
In the Linux kernel, the following vulnerability has been resolved: ath11k: fix netdev open race Make sure to allocate resources needed before registering the device. This specifically avoids having a racing open() trigger a BUG_ON() in mod_timer() when ath11…
-
Unscored —
dma-buf/dma-resv: Stop leaking on krealloc() failure
In the Linux kernel, the following vulnerability has been resolved: dma-buf/dma-resv: Stop leaking on krealloc() failure Currently dma_resv_get_fences() will leak the previously allocated array if the fence iteration got restarted and the krealloc_array() fai…
References
-
article
https://access.redhat.com/security/updates/classification/#moderate
-
article
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.7_release_notes/index
-
article
https://access.redhat.com/solutions/6971358
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1946279
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1948442
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1977993
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1978539
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1980646
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2004037
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2019942
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2037386
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2042424
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2044837
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2051444
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2053632
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2056383
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2058369
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2058395
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2059928
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2062284
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2062780
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2066614
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2066706
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2066976
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2069408
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2069472
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2070205
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2070220
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2072552
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2073064
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2074208
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2074317
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2080095
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2084183
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2084479
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2088021
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2089815
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2090940
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2091539