Skip to content
OpenAdvisories
Medium WID-SEC-2024-1898 46 CVEs

Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of Service

Published Aug 21, 2024 · Updated Aug 6, 2025 · Revision 39 · de-DE

Vendor: Dell Vendor: IBM Vendor: Oracle Vendor: Red Hat Vendor: RESF Vendor: SUSE Vendor: Ubuntu Product: Db2 Product: Enterprise Linux Product: Linux Product: Linux Product: Linux Product: PowerProtect Data Domain Product: PowerProtect Data Domain Management Center Product: PowerProtect Data Domain OS Product: QRadar SIEM Product: Rocky Linux Product: Spectrum Protect Plus Platform: Linux

Summary

Ein lokaler Angreifer kann mehrere Schwachstellen im Linux-Kernel ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder einen unspezifischen Angriff durchzuführen.

Product

Der Kernel stellt den Kern des Linux Betriebssystems dar.

Vulnerabilities 46

  • High 8.8
    CVE-2022-48919

    cifs: fix double free race when mount fails in cifs_get_root()

    In the Linux kernel, the following vulnerability has been resolved: cifs: fix double free race when mount fails in cifs_get_root() When cifs_get_root() fails during cifs_smb3_do_mount() we call deactivate_locked_super() which eventually will call delayed_free…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2022-48941

    ice: fix concurrent reset and removal of VFs

    In the Linux kernel, the following vulnerability has been resolved: ice: fix concurrent reset and removal of VFs Commit c503e63200c6 ("ice: Stop processing VF messages during teardown") introduced a driver state flag, ICE_VF_DEINIT_IN_PROGRESS, which is inten…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2022-48911

    netfilter: nf_queue: fix possible use-after-free

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_queue: fix possible use-after-free Eric Dumazet says: The sock_hold() side seems suspect, because there is no guarantee that sk_refcnt is not already 0. On failure, we cannot qu…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2022-48912

    netfilter: fix use-after-free in __nf_register_net_hook()

    In the Linux kernel, the following vulnerability has been resolved: netfilter: fix use-after-free in __nf_register_net_hook() We must not dereference @new_hooks after nf_hook_mutex has been released, because other threads might have freed our allocated hooks …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2022-48913

    blktrace: fix use after free for struct blk_trace

    In the Linux kernel, the following vulnerability has been resolved: blktrace: fix use after free for struct blk_trace When tracing the whole disk, 'dropped' and 'msg' will be created under 'q->debugfs_dir' and 'bt->dir' is NULL, thus blk_trace_free() won't re…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2022-48923

    btrfs: prevent copying too big compressed lzo segment

    In the Linux kernel, the following vulnerability has been resolved: btrfs: prevent copying too big compressed lzo segment Compressed length can be corrupted to be a lot larger than memory we have allocated for buffer. This will cause memcpy in copy_compressed…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2022-48925

    RDMA/cma: Do not change route.addr.src_addr outside state checks

    In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Do not change route.addr.src_addr outside state checks If the state is not idle then resolve_prepare_src() should immediately fail and no change to global state should happen. Howev…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2022-48927

    iio: adc: tsc2046: fix memory corruption by preventing array overflow

    In the Linux kernel, the following vulnerability has been resolved: iio: adc: tsc2046: fix memory corruption by preventing array overflow On one side we have indio_dev->num_channels includes all physical channels + timestamp channel. On other side we have an …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2022-48932

    net/mlx5: DR, Fix slab-out-of-bounds in mlx5_cmd_dr_create_fte

    In the Linux kernel, the following vulnerability has been resolved: net/mlx5: DR, Fix slab-out-of-bounds in mlx5_cmd_dr_create_fte When adding a rule with 32 destinations, we hit the following out-of-band access issue: BUG: KASAN: slab-out-of-bounds in mlx5_c…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2022-48935

    netfilter: nf_tables: unregister flowtable hooks on netns exit

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: unregister flowtable hooks on netns exit Unregister flowtable hooks before they are releases via nf_tables_flowtable_destroy() otherwise hook core reports UAF. BUG: KASA…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2022-48940

    bpf: Fix crash due to incorrect copy_map_value

    In the Linux kernel, the following vulnerability has been resolved: bpf: Fix crash due to incorrect copy_map_value When both bpf_spin_lock and bpf_timer are present in a BPF map value, copy_map_value needs to skirt both objects when copying a value into and o…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.1
    CVE-2022-48943

    KVM: x86/mmu: make apf token non-zero to fix bug

    In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: make apf token non-zero to fix bug In current async pagefault logic, when a page is ready, KVM relies on kvm_arch_can_dequeue_async_page_present() to determine whether to delive…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Medium 5.5
    CVE-2022-48908

    net: arcnet: com20020: Fix null-ptr-deref in com20020pci_probe()

    In the Linux kernel, the following vulnerability has been resolved: net: arcnet: com20020: Fix null-ptr-deref in com20020pci_probe() During driver initialization, the pointer of card info, i.e. the variable 'ci' is required. However, the definition of 'com200…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2021-4441

    spi: spi-zynq-qspi: Fix a NULL pointer dereference in zynq_qspi_exec_mem_op()

    In the Linux kernel, the following vulnerability has been resolved: spi: spi-zynq-qspi: Fix a NULL pointer dereference in zynq_qspi_exec_mem_op() In zynq_qspi_exec_mem_op(), kzalloc() is directly used in memset(), which could lead to a NULL pointer dereferenc…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2022-48901

    btrfs: do not start relocation until in progress drops are done

    In the Linux kernel, the following vulnerability has been resolved: btrfs: do not start relocation until in progress drops are done We hit a bug with a recovering relocation on mount for one of our file systems in production. I reproduced this locally by inje…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2022-48902

    btrfs: do not WARN_ON() if we have PageError set

    In the Linux kernel, the following vulnerability has been resolved: btrfs: do not WARN_ON() if we have PageError set Whenever we do any extent buffer operations we call assert_eb_page_uptodate() to complain loudly if we're operating on an non-uptodate page. O…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2022-48903

    btrfs: fix relocation crash due to premature return from btrfs_commit_transaction()

    In the Linux kernel, the following vulnerability has been resolved: btrfs: fix relocation crash due to premature return from btrfs_commit_transaction() We are seeing crashes similar to the following trace: [38.969182] WARNING: CPU: 20 PID: 2105 at fs/btrfs/re…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2022-48904

    iommu/amd: Fix I/O page table memory leak

    In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix I/O page table memory leak The current logic updates the I/O page table mode for the domain before calling the logic to free memory used for the page table. This results in IOM…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2022-48905

    ibmvnic: free reset-work-item when flushing

    In the Linux kernel, the following vulnerability has been resolved: ibmvnic: free reset-work-item when flushing Fix a tiny memory leak when flushing the reset work queue.

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2022-48906

    mptcp: Correctly set DATA_FIN timeout when number of retransmits is large

    In the Linux kernel, the following vulnerability has been resolved: mptcp: Correctly set DATA_FIN timeout when number of retransmits is large Syzkaller with UBSAN uncovered a scenario where a large number of DATA_FIN retransmits caused a shift-out-of-bounds i…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2022-48907

    auxdisplay: lcd2s: Fix memory leak in ->remove()

    In the Linux kernel, the following vulnerability has been resolved: auxdisplay: lcd2s: Fix memory leak in ->remove() Once allocated the struct lcd2s_data is never freed. Fix the memory leak by switching to devm_kzalloc().

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2022-48909

    net/smc: fix connection leak

    In the Linux kernel, the following vulnerability has been resolved: net/smc: fix connection leak There's a potential leak issue under following execution sequence : smc_release smc_connect_work if (sk->sk_state == SMC_INIT) send_clc_confirim tcp_abort(); ... …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2022-48910

    net: ipv6: ensure we call ipv6_mc_down() at most once

    In the Linux kernel, the following vulnerability has been resolved: net: ipv6: ensure we call ipv6_mc_down() at most once There are two reasons for addrconf_notify() to be called with NETDEV_DOWN: either the network device is actually going down, or IPv6 was …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2022-48914

    xen/netfront: destroy queues before real_num_tx_queues is zeroed

    In the Linux kernel, the following vulnerability has been resolved: xen/netfront: destroy queues before real_num_tx_queues is zeroed xennet_destroy_queues() relies on info->netdev->real_num_tx_queues to delete queues. Since d7dac083414eb5bb99a6d2ed53dc2c1b405…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2022-48915

    thermal: core: Fix TZ_GET_TRIP NULL pointer dereference

    In the Linux kernel, the following vulnerability has been resolved: thermal: core: Fix TZ_GET_TRIP NULL pointer dereference Do not call get_trip_hyst() from thermal_genl_cmd_tz_get_trip() if the thermal zone does not define one.

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2022-48916

    iommu/vt-d: Fix double list_add when enabling VMD in scalable mode

    In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix double list_add when enabling VMD in scalable mode When enabling VMD and IOMMU scalable mode, the following kernel panic call trace/kernel log is shown in Eagle Stream platfor…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2022-48917 Rejected

    This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

    linux-raspi2 linux-hwe linux-azure linux-riscv Ubuntu
  • Unscored —
    CVE-2022-48918

    iwlwifi: mvm: check debugfs_dir ptr before use

    In the Linux kernel, the following vulnerability has been resolved: iwlwifi: mvm: check debugfs_dir ptr before use When "debugfs=off" is used on the kernel command line, iwiwifi's mvm module uses an invalid/unchecked debugfs_dir pointer and causes a BUG: BUG:…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2022-48920

    btrfs: get rid of warning on transaction commit when using flushoncommit

    In the Linux kernel, the following vulnerability has been resolved: btrfs: get rid of warning on transaction commit when using flushoncommit When using the flushoncommit mount option, during almost every transaction commit we trigger a warning from __writebac…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2022-48921

    sched/fair: Fix fault in reweight_entity

    In the Linux kernel, the following vulnerability has been resolved: sched/fair: Fix fault in reweight_entity Syzbot found a GPF in reweight_entity. This has been bisected to commit 4ef0c5c6b5ba ("kernel/sched: Fix sched_fork() access an invalid sched_task_gro…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2022-48922

    riscv: fix oops caused by irqsoff latency tracer

    In the Linux kernel, the following vulnerability has been resolved: riscv: fix oops caused by irqsoff latency tracer The trace_hardirqs_{on,off}() require the caller to setup frame pointer properly. This because these two functions use macro 'CALLER_ADDR1' (a…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2022-48924

    thermal: int340x: fix memory leak in int3400_notify()

    In the Linux kernel, the following vulnerability has been resolved: thermal: int340x: fix memory leak in int3400_notify() It is easy to hit the below memory leaks in my TigerLake platform: unreferenced object 0xffff927c8b91dbc0 (size 32): comm "kworker/0:2", …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2022-48926

    usb: gadget: rndis: add spinlock for rndis response list

    In the Linux kernel, the following vulnerability has been resolved: usb: gadget: rndis: add spinlock for rndis response list There's no lock for rndis response list. It could cause list corruption if there're two different list_add at the same time like below…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2022-48928

    iio: adc: men_z188_adc: Fix a resource leak in an error handling path

    In the Linux kernel, the following vulnerability has been resolved: iio: adc: men_z188_adc: Fix a resource leak in an error handling path If iio_device_register() fails, a previous ioremap() is left unbalanced. Update the error handling path and add the missi…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2022-48929

    bpf: Fix crash due to out of bounds access into reg2btf_ids.

    In the Linux kernel, the following vulnerability has been resolved: bpf: Fix crash due to out of bounds access into reg2btf_ids. When commit e6ac2450d6de ("bpf: Support bpf program calling kernel function") added kfunc support, it defined reg2btf_ids as a che…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2022-48930

    RDMA/ib_srp: Fix a deadlock

    In the Linux kernel, the following vulnerability has been resolved: RDMA/ib_srp: Fix a deadlock Remove the flush_workqueue(system_long_wq) call since flushing system_long_wq is deadlock-prone and since that call is redundant with a preceding cancel_work_sync()

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2022-48931

    configfs: fix a race in configfs_{,un}register_subsystem()

    In the Linux kernel, the following vulnerability has been resolved: configfs: fix a race in configfs_{,un}register_subsystem() When configfs_register_subsystem() or configfs_unregister_subsystem() is executing link_group() or unlink_group(), it is possible th…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2022-48933

    netfilter: nf_tables: fix memory leak during stateful obj update

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix memory leak during stateful obj update stateful objects can be updated from the control plane. The transaction logic allocates a temporary object for this purpose. T…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2022-48934

    nfp: flower: Fix a potential leak in nfp_tunnel_add_shared_mac()

    In the Linux kernel, the following vulnerability has been resolved: nfp: flower: Fix a potential leak in nfp_tunnel_add_shared_mac() ida_simple_get() returns an id between min (0) and max (NFP_MAX_MAC_INDEX) inclusive. So NFP_MAX_MAC_INDEX (0xff) is a valid i…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2022-48936 Rejected

    This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

    linux-raspi2 linux-hwe linux-azure linux-riscv Ubuntu
  • Unscored —
    CVE-2022-48937

    io_uring: add a schedule point in io_add_buffers()

    In the Linux kernel, the following vulnerability has been resolved: io_uring: add a schedule point in io_add_buffers() Looping ~65535 times doing kmalloc() calls can trigger soft lockups, especially with DEBUG features (like KASAN). [ 253.536212] watchdog: BU…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2022-48938

    CDC-NCM: avoid overflow in sanity checking

    In the Linux kernel, the following vulnerability has been resolved: CDC-NCM: avoid overflow in sanity checking A broken device may give an extreme offset like 0xFFF0 and a reasonable length for a fragment. In the sanity check as formulated now, this will crea…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2022-48939

    bpf: Add schedule points in batch ops

    In the Linux kernel, the following vulnerability has been resolved: bpf: Add schedule points in batch ops syzbot reported various soft lockups caused by bpf batch operations. INFO: task kworker/1:1:27 blocked for more than 140 seconds. INFO: task hung in rcu_…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2022-48942

    hwmon: Handle failure to register sensor with thermal zone correctly

    In the Linux kernel, the following vulnerability has been resolved: hwmon: Handle failure to register sensor with thermal zone correctly If an attempt is made to a sensor with a thermal zone and it fails, the call to devm_thermal_zone_of_sensor_register() may…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-37353 Rejected

    This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

    linux-raspi2 linux-hwe linux-azure linux-riscv Ubuntu
  • Unscored —
    CVE-2024-42143 Rejected

    This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

    linux-raspi2 linux-hwe linux-azure linux-riscv Ubuntu

Revision history

  1. #39

    Neue Updates von IBM aufgenommen

  2. #38

    Neue Updates von Dell aufgenommen

  3. #37

    Neue Updates von Oracle Linux und Red Hat aufgenommen

  4. #36

    Neue Updates von Red Hat aufgenommen

  5. #35

    Neue Updates von SUSE aufgenommen

  6. #34

    Neue Updates von SUSE aufgenommen

  7. #33

    Neue Updates von IBM aufgenommen

  8. #32

    Neue Updates von IBM aufgenommen

  9. #31

    Neue Updates von SUSE aufgenommen

  10. #30

    Neue Updates von SUSE aufgenommen

  11. #29

    Neue Updates von SUSE aufgenommen

  12. #28

    Neue Updates von SUSE aufgenommen

  13. #27

    Neue Updates von Ubuntu aufgenommen

  14. #26

    Neue Updates von Ubuntu aufgenommen

  15. #25

    Neue Updates von Ubuntu aufgenommen

  16. #24

    Neue Updates von Ubuntu aufgenommen

  17. #23

    Neue Updates von Ubuntu aufgenommen

  18. #22

    Neue Updates von Ubuntu aufgenommen

  19. #21

    Neue Updates von Ubuntu aufgenommen

  20. #20

    Neue Updates von Red Hat und Ubuntu aufgenommen

  21. #19

    Neue Updates von Ubuntu aufgenommen

  22. #18

    Neue Updates von Ubuntu aufgenommen

  23. #17

    Neue Updates von Red Hat aufgenommen

  24. #16

    Neue Updates von Rocky Enterprise Software Foundation aufgenommen

  25. #15

    Neue Updates von Oracle Linux aufgenommen

References