Vulnerability-Lookup

CERTFR-2026-AVI-0128

Vulnerability from certfr_avis - Published: 2026-02-06 - Updated: 2026-02-06

De multiples vulnérabilités ont été découvertes dans le noyau Linux de SUSE. Certaines d'entre elles permettent à un attaquant de provoquer une élévation de privilèges, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
SUSE	N/A	SUSE Linux Enterprise Micro for Rancher 5.2
SUSE	N/A	SUSE Linux Enterprise Server High Availability Extension 16.0
SUSE	N/A	SUSE Linux Enterprise Server 11 SP4
SUSE	N/A	SUSE Linux Micro 6.2
SUSE	N/A	SUSE Linux Enterprise Micro 5.2
SUSE	N/A	SUSE Linux Micro Extras 6.2
SUSE	N/A	SUSE Linux Enterprise Server for SAP Applications 16.0
SUSE	N/A	SUSE Linux Enterprise Server 16.0
SUSE	N/A	SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME CORE
SUSE	N/A	openSUSE Leap 15.3

References

Title

Publication Time

Tags

Bulletin de sécurité SUSE SUSE-SU-2026:0350-1	2026-01-30	vendor-advisory
Bulletin de sécurité SUSE SUSE-SU-2026:0385-1	2026-02-04	vendor-advisory
Bulletin de sécurité SUSE SUSE-SU-2026:0369-1	2026-02-03	vendor-advisory
Bulletin de sécurité SUSE SUSE-SU-2026:20220-1	2026-02-02	vendor-advisory
Bulletin de sécurité SUSE SUSE-SU-2026:20171-1	2026-01-28	vendor-advisory
Bulletin de sécurité SUSE SUSE-SU-2026:0352-1	2026-01-30	vendor-advisory
Bulletin de sécurité SUSE SUSE-SU-2026:20228-1	2026-02-02	vendor-advisory
Bulletin de sécurité SUSE SUSE-SU-2026:20207-1	2026-02-02	vendor-advisory
Bulletin de sécurité SUSE SUSE-SU-2026:20202-1	2026-01-28	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "SUSE Linux Enterprise Micro for Rancher 5.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SUSE",
          "scada": false
        }
      }
    },
    {
      "description": "SUSE Linux Enterprise Server High Availability Extension 16.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SUSE",
          "scada": false
        }
      }
    },
    {
      "description": "SUSE Linux Enterprise Server 11 SP4",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SUSE",
          "scada": false
        }
      }
    },
    {
      "description": "SUSE Linux Micro 6.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SUSE",
          "scada": false
        }
      }
    },
    {
      "description": "SUSE Linux Enterprise Micro 5.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SUSE",
          "scada": false
        }
      }
    },
    {
      "description": "SUSE Linux Micro Extras 6.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SUSE",
          "scada": false
        }
      }
    },
    {
      "description": "SUSE Linux Enterprise Server for SAP Applications 16.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SUSE",
          "scada": false
        }
      }
    },
    {
      "description": "SUSE Linux Enterprise Server 16.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SUSE",
          "scada": false
        }
      }
    },
    {
      "description": "SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME CORE",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SUSE",
          "scada": false
        }
      }
    },
    {
      "description": "openSUSE Leap 15.3",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SUSE",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2023-53761",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-53761"
    },
    {
      "name": "CVE-2025-40225",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40225"
    },
    {
      "name": "CVE-2025-40273",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40273"
    },
    {
      "name": "CVE-2025-68230",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68230"
    },
    {
      "name": "CVE-2023-54142",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-54142"
    },
    {
      "name": "CVE-2025-68342",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68342"
    },
    {
      "name": "CVE-2025-68286",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68286"
    },
    {
      "name": "CVE-2025-68749",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68749"
    },
    {
      "name": "CVE-2022-50641",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-50641"
    },
    {
      "name": "CVE-2025-40314",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40314"
    },
    {
      "name": "CVE-2025-68210",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68210"
    },
    {
      "name": "CVE-2025-40239",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40239"
    },
    {
      "name": "CVE-2023-54270",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-54270"
    },
    {
      "name": "CVE-2025-40254",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40254"
    },
    {
      "name": "CVE-2025-40219",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40219"
    },
    {
      "name": "CVE-2025-68736",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68736"
    },
    {
      "name": "CVE-2025-68176",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68176"
    },
    {
      "name": "CVE-2022-50630",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-50630"
    },
    {
      "name": "CVE-2025-68380",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68380"
    },
    {
      "name": "CVE-2025-68283",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68283"
    },
    {
      "name": "CVE-2025-68339",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68339"
    },
    {
      "name": "CVE-2025-40287",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40287"
    },
    {
      "name": "CVE-2025-40019",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40019"
    },
    {
      "name": "CVE-2025-68287",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68287"
    },
    {
      "name": "CVE-2025-40240",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40240"
    },
    {
      "name": "CVE-2025-68746",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68746"
    },
    {
      "name": "CVE-2025-40294",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40294"
    },
    {
      "name": "CVE-2025-40204",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40204"
    },
    {
      "name": "CVE-2025-68302",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68302"
    },
    {
      "name": "CVE-2025-68238",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68238"
    },
    {
      "name": "CVE-2025-40221",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40221"
    },
    {
      "name": "CVE-2022-50646",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-50646"
    },
    {
      "name": "CVE-2022-49291",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-49291"
    },
    {
      "name": "CVE-2025-40350",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40350"
    },
    {
      "name": "CVE-2025-40309",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40309"
    },
    {
      "name": "CVE-2025-40343",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40343"
    },
    {
      "name": "CVE-2025-68307",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68307"
    },
    {
      "name": "CVE-2025-40308",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40308"
    },
    {
      "name": "CVE-2025-40315",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40315"
    },
    {
      "name": "CVE-2025-40251",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40251"
    },
    {
      "name": "CVE-2025-40355",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40355"
    },
    {
      "name": "CVE-2025-68184",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68184"
    },
    {
      "name": "CVE-2025-68813",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68813"
    },
    {
      "name": "CVE-2022-50644",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-50644"
    },
    {
      "name": "CVE-2025-68344",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68344"
    },
    {
      "name": "CVE-2025-40347",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40347"
    },
    {
      "name": "CVE-2022-50668",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-50668"
    },
    {
      "name": "CVE-2025-68257",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68257"
    },
    {
      "name": "CVE-2022-50840",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-50840"
    },
    {
      "name": "CVE-2025-40190",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40190"
    },
    {
      "name": "CVE-2022-50756",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-50756"
    },
    {
      "name": "CVE-2025-68347",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68347"
    },
    {
      "name": "CVE-2025-68235",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68235"
    },
    {
      "name": "CVE-2025-40311",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40311"
    },
    {
      "name": "CVE-2025-40237",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40237"
    },
    {
      "name": "CVE-2022-50700",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-50700"
    },
    {
      "name": "CVE-2022-50821",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-50821"
    },
    {
      "name": "CVE-2022-49288",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-49288"
    },
    {
      "name": "CVE-2025-40167",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40167"
    },
    {
      "name": "CVE-2025-38159",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-38159"
    },
    {
      "name": "CVE-2023-54110",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-54110"
    },
    {
      "name": "CVE-2025-40256",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40256"
    },
    {
      "name": "CVE-2025-40360",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40360"
    },
    {
      "name": "CVE-2025-40332",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40332"
    },
    {
      "name": "CVE-2025-68354",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68354"
    },
    {
      "name": "CVE-2025-38068",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-38068"
    },
    {
      "name": "CVE-2025-21772",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-21772"
    },
    {
      "name": "CVE-2025-68258",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68258"
    },
    {
      "name": "CVE-2022-50726",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-50726"
    },
    {
      "name": "CVE-2025-40322",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40322"
    },
    {
      "name": "CVE-2025-68209",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68209"
    },
    {
      "name": "CVE-2022-50814",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-50814"
    },
    {
      "name": "CVE-2022-49733",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-49733"
    },
    {
      "name": "CVE-2025-40233",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40233"
    },
    {
      "name": "CVE-2025-40271",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40271"
    },
    {
      "name": "CVE-2025-40359",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40359"
    },
    {
      "name": "CVE-2025-68306",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68306"
    },
    {
      "name": "CVE-2025-68308",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68308"
    },
    {
      "name": "CVE-2023-54024",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-54024"
    },
    {
      "name": "CVE-2025-40242",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40242"
    },
    {
      "name": "CVE-2025-68198",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68198"
    },
    {
      "name": "CVE-2025-40212",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40212"
    },
    {
      "name": "CVE-2022-50649",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-50649"
    },
    {
      "name": "CVE-2025-68190",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68190"
    },
    {
      "name": "CVE-2025-68242",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68242"
    },
    {
      "name": "CVE-2024-57996",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-57996"
    },
    {
      "name": "CVE-2025-40252",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40252"
    },
    {
      "name": "CVE-2025-68255",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68255"
    },
    {
      "name": "CVE-2025-40238",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40238"
    },
    {
      "name": "CVE-2025-40277",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40277"
    },
    {
      "name": "CVE-2022-50736",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-50736"
    },
    {
      "name": "CVE-2025-40272",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40272"
    },
    {
      "name": "CVE-2025-68759",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68759"
    },
    {
      "name": "CVE-2025-40344",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40344"
    },
    {
      "name": "CVE-2022-50843",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-50843"
    },
    {
      "name": "CVE-2025-40345",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40345"
    },
    {
      "name": "CVE-2025-40354",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40354"
    },
    {
      "name": "CVE-2023-54170",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-54170"
    },
    {
      "name": "CVE-2023-53781",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-53781"
    },
    {
      "name": "CVE-2025-68215",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68215"
    },
    {
      "name": "CVE-2025-40269",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40269"
    },
    {
      "name": "CVE-2025-68335",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68335"
    },
    {
      "name": "CVE-2025-39977",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-39977"
    },
    {
      "name": "CVE-2025-68330",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68330"
    },
    {
      "name": "CVE-2022-50758",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-50758"
    },
    {
      "name": "CVE-2025-68180",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68180"
    },
    {
      "name": "CVE-2025-68343",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68343"
    },
    {
      "name": "CVE-2023-54243",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-54243"
    },
    {
      "name": "CVE-2025-40362",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40362"
    },
    {
      "name": "CVE-2025-68201",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68201"
    },
    {
      "name": "CVE-2025-40289",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40289"
    },
    {
      "name": "CVE-2025-68748",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68748"
    },
    {
      "name": "CVE-2025-68223",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68223"
    },
    {
      "name": "CVE-2025-40292",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40292"
    },
    {
      "name": "CVE-2025-68181",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68181"
    },
    {
      "name": "CVE-2025-68724",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68724"
    },
    {
      "name": "CVE-2022-0854",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-0854"
    },
    {
      "name": "CVE-2022-50827",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-50827"
    },
    {
      "name": "CVE-2025-68252",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68252"
    },
    {
      "name": "CVE-2025-40274",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40274"
    },
    {
      "name": "CVE-2025-40218",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40218"
    },
    {
      "name": "CVE-2025-40220",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40220"
    },
    {
      "name": "CVE-2025-68237",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68237"
    },
    {
      "name": "CVE-2025-68259",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68259"
    },
    {
      "name": "CVE-2022-1048",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-1048"
    },
    {
      "name": "CVE-2025-68312",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68312"
    },
    {
      "name": "CVE-2025-68284",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68284"
    },
    {
      "name": "CVE-2025-68194",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68194"
    },
    {
      "name": "CVE-2022-50744",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-50744"
    },
    {
      "name": "CVE-2025-68183",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68183"
    },
    {
      "name": "CVE-2025-40263",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40263"
    },
    {
      "name": "CVE-2025-40353",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40353"
    },
    {
      "name": "CVE-2022-50717",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-50717"
    },
    {
      "name": "CVE-2025-68244",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68244"
    },
    {
      "name": "CVE-2025-40231",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40231"
    },
    {
      "name": "CVE-2022-50742",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-50742"
    },
    {
      "name": "CVE-2025-40278",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40278"
    },
    {
      "name": "CVE-2025-40342",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40342"
    },
    {
      "name": "CVE-2022-50709",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-50709"
    },
    {
      "name": "CVE-2025-68222",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68222"
    },
    {
      "name": "CVE-2025-68765",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68765"
    },
    {
      "name": "CVE-2025-40279",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40279"
    },
    {
      "name": "CVE-2025-68328",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68328"
    },
    {
      "name": "CVE-2023-23559",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-23559"
    },
    {
      "name": "CVE-2025-68311",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68311"
    },
    {
      "name": "CVE-2025-68744",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68744"
    },
    {
      "name": "CVE-2025-68353",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68353"
    },
    {
      "name": "CVE-2025-68172",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68172"
    },
    {
      "name": "CVE-2025-40338",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40338"
    },
    {
      "name": "CVE-2022-50767",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-50767"
    },
    {
      "name": "CVE-2022-50880",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-50880"
    },
    {
      "name": "CVE-2025-40302",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40302"
    },
    {
      "name": "CVE-2025-40357",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40357"
    },
    {
      "name": "CVE-2025-40328",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40328"
    },
    {
      "name": "CVE-2025-40340",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40340"
    },
    {
      "name": "CVE-2025-68332",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68332"
    },
    {
      "name": "CVE-2025-40283",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40283"
    },
    {
      "name": "CVE-2025-40324",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40324"
    },
    {
      "name": "CVE-2025-68378",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68378"
    },
    {
      "name": "CVE-2022-50623",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-50623"
    },
    {
      "name": "CVE-2025-40250",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40250"
    },
    {
      "name": "CVE-2025-40264",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40264"
    },
    {
      "name": "CVE-2025-40255",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40255"
    },
    {
      "name": "CVE-2025-21718",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-21718"
    },
    {
      "name": "CVE-2025-40246",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40246"
    },
    {
      "name": "CVE-2025-40226",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40226"
    },
    {
      "name": "CVE-2025-40321",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40321"
    },
    {
      "name": "CVE-2023-53215",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-53215"
    },
    {
      "name": "CVE-2025-68249",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68249"
    },
    {
      "name": "CVE-2025-68740",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68740"
    },
    {
      "name": "CVE-2025-40130",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40130"
    },
    {
      "name": "CVE-2025-40179",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40179"
    },
    {
      "name": "CVE-2025-68742",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68742"
    },
    {
      "name": "CVE-2025-40282",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40282"
    },
    {
      "name": "CVE-2025-68192",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68192"
    },
    {
      "name": "CVE-2025-68256",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68256"
    },
    {
      "name": "CVE-2025-68254",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68254"
    },
    {
      "name": "CVE-2025-40214",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40214"
    },
    {
      "name": "CVE-2025-68171",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68171"
    },
    {
      "name": "CVE-2025-40301",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40301"
    },
    {
      "name": "CVE-2025-68298",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68298"
    },
    {
      "name": "CVE-2025-68207",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68207"
    },
    {
      "name": "CVE-2024-56658",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-56658"
    },
    {
      "name": "CVE-2022-50282",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-50282"
    },
    {
      "name": "CVE-2025-68167",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68167"
    },
    {
      "name": "CVE-2025-68747",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68747"
    },
    {
      "name": "CVE-2023-54168",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-54168"
    },
    {
      "name": "CVE-2025-68327",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68327"
    },
    {
      "name": "CVE-2025-40318",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40318"
    },
    {
      "name": "CVE-2022-50889",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-50889"
    },
    {
      "name": "CVE-2025-40266",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40266"
    },
    {
      "name": "CVE-2022-50870",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-50870"
    },
    {
      "name": "CVE-2025-68345",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68345"
    },
    {
      "name": "CVE-2025-40310",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40310"
    },
    {
      "name": "CVE-2022-50733",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-50733"
    },
    {
      "name": "CVE-2022-3303",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-3303"
    },
    {
      "name": "CVE-2022-50731",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-50731"
    },
    {
      "name": "CVE-2025-68317",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68317"
    },
    {
      "name": "CVE-2025-40331",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40331"
    },
    {
      "name": "CVE-2025-38704",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-38704"
    },
    {
      "name": "CVE-2025-68351",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68351"
    },
    {
      "name": "CVE-2022-50730",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-50730"
    },
    {
      "name": "CVE-2025-40235",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40235"
    },
    {
      "name": "CVE-2025-68208",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68208"
    },
    {
      "name": "CVE-2025-68362",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68362"
    },
    {
      "name": "CVE-2022-50823",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-50823"
    },
    {
      "name": "CVE-2022-50703",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-50703"
    },
    {
      "name": "CVE-2025-68290",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68290"
    },
    {
      "name": "CVE-2025-40280",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40280"
    },
    {
      "name": "CVE-2025-40293",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40293"
    },
    {
      "name": "CVE-2025-40330",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40330"
    },
    {
      "name": "CVE-2025-68750",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68750"
    },
    {
      "name": "CVE-2025-68331",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68331"
    },
    {
      "name": "CVE-2025-68305",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68305"
    },
    {
      "name": "CVE-2025-68352",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68352"
    },
    {
      "name": "CVE-2025-40320",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40320"
    },
    {
      "name": "CVE-2025-39963",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-39963"
    },
    {
      "name": "CVE-2025-40018",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40018"
    },
    {
      "name": "CVE-2025-68753",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68753"
    },
    {
      "name": "CVE-2025-39880",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-39880"
    },
    {
      "name": "CVE-2025-40170",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40170"
    },
    {
      "name": "CVE-2025-40160",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40160"
    },
    {
      "name": "CVE-2025-40284",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40284"
    },
    {
      "name": "CVE-2025-40209",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40209"
    },
    {
      "name": "CVE-2025-40215",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40215"
    },
    {
      "name": "CVE-2025-40307",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40307"
    },
    {
      "name": "CVE-2025-68346",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68346"
    },
    {
      "name": "CVE-2025-40211",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40211"
    },
    {
      "name": "CVE-2025-40042",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40042"
    },
    {
      "name": "CVE-2025-71096",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71096"
    },
    {
      "name": "CVE-2022-50640",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-50640"
    },
    {
      "name": "CVE-2025-68363",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68363"
    },
    {
      "name": "CVE-2025-40248",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40248"
    },
    {
      "name": "CVE-2025-68303",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68303"
    },
    {
      "name": "CVE-2025-68757",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68757"
    },
    {
      "name": "CVE-2025-40329",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40329"
    },
    {
      "name": "CVE-2022-48853",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-48853"
    },
    {
      "name": "CVE-2022-50635",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-50635"
    },
    {
      "name": "CVE-2025-68766",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68766"
    },
    {
      "name": "CVE-2025-68206",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68206"
    },
    {
      "name": "CVE-2022-50678",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-50678"
    },
    {
      "name": "CVE-2025-68170",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68170"
    },
    {
      "name": "CVE-2025-68313",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68313"
    },
    {
      "name": "CVE-2025-68197",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68197"
    },
    {
      "name": "CVE-2025-40123",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40123"
    },
    {
      "name": "CVE-2025-68301",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68301"
    },
    {
      "name": "CVE-2025-40297",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40297"
    },
    {
      "name": "CVE-2025-68217",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68217"
    },
    {
      "name": "CVE-2023-54242",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-54242"
    },
    {
      "name": "CVE-2025-68289",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68289"
    },
    {
      "name": "CVE-2025-40276",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40276"
    },
    {
      "name": "CVE-2025-68213",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68213"
    },
    {
      "name": "CVE-2025-40317",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40317"
    },
    {
      "name": "CVE-2023-53254",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-53254"
    },
    {
      "name": "CVE-2025-68202",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68202"
    },
    {
      "name": "CVE-2023-4132",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-4132"
    },
    {
      "name": "CVE-2025-68233",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68233"
    },
    {
      "name": "CVE-2025-71120",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71120"
    },
    {
      "name": "CVE-2025-40316",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40316"
    },
    {
      "name": "CVE-2025-68758",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68758"
    },
    {
      "name": "CVE-2025-68340",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68340"
    },
    {
      "name": "CVE-2025-40288",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40288"
    },
    {
      "name": "CVE-2025-68239",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68239"
    },
    {
      "name": "CVE-2025-40258",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40258"
    },
    {
      "name": "CVE-2025-68185",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68185"
    },
    {
      "name": "CVE-2025-40304",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40304"
    },
    {
      "name": "CVE-2025-40268",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40268"
    },
    {
      "name": "CVE-2025-40303",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40303"
    },
    {
      "name": "CVE-2025-40337",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40337"
    },
    {
      "name": "CVE-2025-40346",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40346"
    },
    {
      "name": "CVE-2025-40262",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40262"
    },
    {
      "name": "CVE-2022-50828",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-50828"
    },
    {
      "name": "CVE-2021-47633",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-47633"
    },
    {
      "name": "CVE-2022-49272",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-49272"
    },
    {
      "name": "CVE-2025-68732",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68732"
    },
    {
      "name": "CVE-2022-50876",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-50876"
    },
    {
      "name": "CVE-2025-40323",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40323"
    },
    {
      "name": "CVE-2025-68285",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68285"
    },
    {
      "name": "CVE-2022-50671",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-50671"
    },
    {
      "name": "CVE-2025-40275",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40275"
    },
    {
      "name": "CVE-2023-54019",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-54019"
    },
    {
      "name": "CVE-2025-40339",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40339"
    },
    {
      "name": "CVE-2025-40223",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40223"
    },
    {
      "name": "CVE-2022-50884",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-50884"
    },
    {
      "name": "CVE-2022-49545",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-49545"
    },
    {
      "name": "CVE-2025-68293",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68293"
    },
    {
      "name": "CVE-2025-68195",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68195"
    },
    {
      "name": "CVE-2025-40213",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40213"
    },
    {
      "name": "CVE-2022-50850",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-50850"
    },
    {
      "name": "CVE-2025-40319",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40319"
    },
    {
      "name": "CVE-2025-68264",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68264"
    }
  ],
  "initial_release_date": "2026-02-06T00:00:00",
  "last_revision_date": "2026-02-06T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-0128",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-02-06T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "D\u00e9ni de service"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans le noyau Linux de SUSE. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans le noyau Linux de SUSE",
  "vendor_advisories": [
    {
      "published_at": "2026-01-30",
      "title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:0350-1",
      "url": "https://www.suse.com/support/update/announcement/2026/suse-su-20260350-1"
    },
    {
      "published_at": "2026-02-04",
      "title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:0385-1",
      "url": "https://www.suse.com/support/update/announcement/2026/suse-su-20260385-1"
    },
    {
      "published_at": "2026-02-03",
      "title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:0369-1",
      "url": "https://www.suse.com/support/update/announcement/2026/suse-su-20260369-1"
    },
    {
      "published_at": "2026-02-02",
      "title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:20220-1",
      "url": "https://www.suse.com/support/update/announcement/2026/suse-su-202620220-1"
    },
    {
      "published_at": "2026-01-28",
      "title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:20171-1",
      "url": "https://www.suse.com/support/update/announcement/2026/suse-su-202620171-1"
    },
    {
      "published_at": "2026-01-30",
      "title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:0352-1",
      "url": "https://www.suse.com/support/update/announcement/2026/suse-su-20260352-1"
    },
    {
      "published_at": "2026-02-02",
      "title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:20228-1",
      "url": "https://www.suse.com/support/update/announcement/2026/suse-su-202620228-1"
    },
    {
      "published_at": "2026-02-02",
      "title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:20207-1",
      "url": "https://www.suse.com/support/update/announcement/2026/suse-su-202620207-1"
    },
    {
      "published_at": "2026-01-28",
      "title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:20202-1",
      "url": "https://www.suse.com/support/update/announcement/2026/suse-su-202620202-1"
    }
  ]
}

CVE-2021-47633 (GCVE-0-2021-47633)

Vulnerability from cvelistv5 – Published: 2025-02-26 01:54 – Updated: 2026-05-11 13:58

Title

ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111

Summary

In the Linux kernel, the following vulnerability has been resolved: ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111 The bug was found during fuzzing. Stacktrace locates it in ath5k_eeprom_convert_pcal_info_5111. When none of the curve is selected in the loop, idx can go up to AR5K_EEPROM_N_PD_CURVES. The line makes pd out of bound. pd = &chinfo[pier].pd_curves[idx]; There are many OOB writes using pd later in the code. So I added a sanity check for idx. Checks for other loops involving AR5K_EEPROM_N_PD_CURVES are not needed as the loop index is not used outside the loops. The patch is NOT tested with real device. The following is the fuzzing report BUG: KASAN: slab-out-of-bounds in ath5k_eeprom_read_pcal_info_5111+0x126a/0x1390 [ath5k] Write of size 1 at addr ffff8880174a4d60 by task modprobe/214 CPU: 0 PID: 214 Comm: modprobe Not tainted 5.6.0 #1 Call Trace: dump_stack+0x76/0xa0 print_address_description.constprop.0+0x16/0x200 ? ath5k_eeprom_read_pcal_info_5111+0x126a/0x1390 [ath5k] ? ath5k_eeprom_read_pcal_info_5111+0x126a/0x1390 [ath5k] __kasan_report.cold+0x37/0x7c ? ath5k_eeprom_read_pcal_info_5111+0x126a/0x1390 [ath5k] kasan_report+0xe/0x20 ath5k_eeprom_read_pcal_info_5111+0x126a/0x1390 [ath5k] ? apic_timer_interrupt+0xa/0x20 ? ath5k_eeprom_init_11a_pcal_freq+0xbc0/0xbc0 [ath5k] ? ath5k_pci_eeprom_read+0x228/0x3c0 [ath5k] ath5k_eeprom_init+0x2513/0x6290 [ath5k] ? ath5k_eeprom_init_11a_pcal_freq+0xbc0/0xbc0 [ath5k] ? usleep_range+0xb8/0x100 ? apic_timer_interrupt+0xa/0x20 ? ath5k_eeprom_read_pcal_info_2413+0x2f20/0x2f20 [ath5k] ath5k_hw_init+0xb60/0x1970 [ath5k] ath5k_init_ah+0x6fe/0x2530 [ath5k] ? kasprintf+0xa6/0xe0 ? ath5k_stop+0x140/0x140 [ath5k] ? _dev_notice+0xf6/0xf6 ? apic_timer_interrupt+0xa/0x20 ath5k_pci_probe.cold+0x29a/0x3d6 [ath5k] ? ath5k_pci_eeprom_read+0x3c0/0x3c0 [ath5k] ? mutex_lock+0x89/0xd0 ? ath5k_pci_eeprom_read+0x3c0/0x3c0 [ath5k] local_pci_probe+0xd3/0x160 pci_device_probe+0x23f/0x3e0 ? pci_device_remove+0x280/0x280 ? pci_device_remove+0x280/0x280 really_probe+0x209/0x5d0

Severity ?

No CVSS data available.

Assigner

Linux

References

9 references

URL	Tags
https://git.kernel.org/stable/c/f4de974019a0adf34…
https://git.kernel.org/stable/c/ed3dfdaa8b5f0579e…
https://git.kernel.org/stable/c/25efc5d03455c3839…
https://git.kernel.org/stable/c/c4e2f577271e158d8…
https://git.kernel.org/stable/c/9d7d83d0399e23d66…
https://git.kernel.org/stable/c/be2f81024e7981565…
https://git.kernel.org/stable/c/fc8f7752a82f4accb…
https://git.kernel.org/stable/c/cbd96d6cad6625feb…
https://git.kernel.org/stable/c/564d4eceb97eaf381…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 8e218fb24faef0bfe95bc91b3c05261e20439527 , < f4de974019a0adf34d0e7de6b86252f1bd266b06 (git) Affected: 8e218fb24faef0bfe95bc91b3c05261e20439527 , < ed3dfdaa8b5f0579eabfc1c5818eed30cfe1fe84 (git) Affected: 8e218fb24faef0bfe95bc91b3c05261e20439527 , < 25efc5d03455c3839249bc77fce5e29ecb54677e (git) Affected: 8e218fb24faef0bfe95bc91b3c05261e20439527 , < c4e2f577271e158d87a916afb4e87415a88ce856 (git) Affected: 8e218fb24faef0bfe95bc91b3c05261e20439527 , < 9d7d83d0399e23d66fd431b553842a84ac10398f (git) Affected: 8e218fb24faef0bfe95bc91b3c05261e20439527 , < be2f81024e7981565d90a4c9ca3067d11b6bca7f (git) Affected: 8e218fb24faef0bfe95bc91b3c05261e20439527 , < fc8f7752a82f4accb99c0f1a868906ba1eb7b86f (git) Affected: 8e218fb24faef0bfe95bc91b3c05261e20439527 , < cbd96d6cad6625feba9c8d101ed4977d53e82f8e (git) Affected: 8e218fb24faef0bfe95bc91b3c05261e20439527 , < 564d4eceb97eaf381dd6ef6470b06377bb50c95a (git)
Linux	Linux	Affected: 2.6.30 Unaffected: 0 , < 2.6.30 (semver) Unaffected: 4.9.311 , ≤ 4.9.* (semver) Unaffected: 4.14.276 , ≤ 4.14.* (semver) Unaffected: 4.19.238 , ≤ 4.19.* (semver) Unaffected: 5.4.189 , ≤ 5.4.* (semver) Unaffected: 5.10.111 , ≤ 5.10.* (semver) Unaffected: 5.15.34 , ≤ 5.15.* (semver) Unaffected: 5.16.20 , ≤ 5.16.* (semver) Unaffected: 5.17.3 , ≤ 5.17.* (semver) Unaffected: 5.18 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/ath/ath5k/eeprom.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f4de974019a0adf34d0e7de6b86252f1bd266b06",
              "status": "affected",
              "version": "8e218fb24faef0bfe95bc91b3c05261e20439527",
              "versionType": "git"
            },
            {
              "lessThan": "ed3dfdaa8b5f0579eabfc1c5818eed30cfe1fe84",
              "status": "affected",
              "version": "8e218fb24faef0bfe95bc91b3c05261e20439527",
              "versionType": "git"
            },
            {
              "lessThan": "25efc5d03455c3839249bc77fce5e29ecb54677e",
              "status": "affected",
              "version": "8e218fb24faef0bfe95bc91b3c05261e20439527",
              "versionType": "git"
            },
            {
              "lessThan": "c4e2f577271e158d87a916afb4e87415a88ce856",
              "status": "affected",
              "version": "8e218fb24faef0bfe95bc91b3c05261e20439527",
              "versionType": "git"
            },
            {
              "lessThan": "9d7d83d0399e23d66fd431b553842a84ac10398f",
              "status": "affected",
              "version": "8e218fb24faef0bfe95bc91b3c05261e20439527",
              "versionType": "git"
            },
            {
              "lessThan": "be2f81024e7981565d90a4c9ca3067d11b6bca7f",
              "status": "affected",
              "version": "8e218fb24faef0bfe95bc91b3c05261e20439527",
              "versionType": "git"
            },
            {
              "lessThan": "fc8f7752a82f4accb99c0f1a868906ba1eb7b86f",
              "status": "affected",
              "version": "8e218fb24faef0bfe95bc91b3c05261e20439527",
              "versionType": "git"
            },
            {
              "lessThan": "cbd96d6cad6625feba9c8d101ed4977d53e82f8e",
              "status": "affected",
              "version": "8e218fb24faef0bfe95bc91b3c05261e20439527",
              "versionType": "git"
            },
            {
              "lessThan": "564d4eceb97eaf381dd6ef6470b06377bb50c95a",
              "status": "affected",
              "version": "8e218fb24faef0bfe95bc91b3c05261e20439527",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/ath/ath5k/eeprom.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.30"
            },
            {
              "lessThan": "2.6.30",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.311",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.276",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.238",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.16.*",
              "status": "unaffected",
              "version": "5.16.20",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.311",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.276",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.238",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.189",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.111",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.34",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16.20",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.3",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111\n\nThe bug was found during fuzzing. Stacktrace locates it in\nath5k_eeprom_convert_pcal_info_5111.\nWhen none of the curve is selected in the loop, idx can go\nup to AR5K_EEPROM_N_PD_CURVES. The line makes pd out of bound.\npd = \u0026chinfo[pier].pd_curves[idx];\n\nThere are many OOB writes using pd later in the code. So I\nadded a sanity check for idx. Checks for other loops involving\nAR5K_EEPROM_N_PD_CURVES are not needed as the loop index is not\nused outside the loops.\n\nThe patch is NOT tested with real device.\n\nThe following is the fuzzing report\n\nBUG: KASAN: slab-out-of-bounds in ath5k_eeprom_read_pcal_info_5111+0x126a/0x1390 [ath5k]\nWrite of size 1 at addr ffff8880174a4d60 by task modprobe/214\n\nCPU: 0 PID: 214 Comm: modprobe Not tainted 5.6.0 #1\nCall Trace:\n dump_stack+0x76/0xa0\n print_address_description.constprop.0+0x16/0x200\n ? ath5k_eeprom_read_pcal_info_5111+0x126a/0x1390 [ath5k]\n ? ath5k_eeprom_read_pcal_info_5111+0x126a/0x1390 [ath5k]\n __kasan_report.cold+0x37/0x7c\n ? ath5k_eeprom_read_pcal_info_5111+0x126a/0x1390 [ath5k]\n kasan_report+0xe/0x20\n ath5k_eeprom_read_pcal_info_5111+0x126a/0x1390 [ath5k]\n ? apic_timer_interrupt+0xa/0x20\n ? ath5k_eeprom_init_11a_pcal_freq+0xbc0/0xbc0 [ath5k]\n ? ath5k_pci_eeprom_read+0x228/0x3c0 [ath5k]\n ath5k_eeprom_init+0x2513/0x6290 [ath5k]\n ? ath5k_eeprom_init_11a_pcal_freq+0xbc0/0xbc0 [ath5k]\n ? usleep_range+0xb8/0x100\n ? apic_timer_interrupt+0xa/0x20\n ? ath5k_eeprom_read_pcal_info_2413+0x2f20/0x2f20 [ath5k]\n ath5k_hw_init+0xb60/0x1970 [ath5k]\n ath5k_init_ah+0x6fe/0x2530 [ath5k]\n ? kasprintf+0xa6/0xe0\n ? ath5k_stop+0x140/0x140 [ath5k]\n ? _dev_notice+0xf6/0xf6\n ? apic_timer_interrupt+0xa/0x20\n ath5k_pci_probe.cold+0x29a/0x3d6 [ath5k]\n ? ath5k_pci_eeprom_read+0x3c0/0x3c0 [ath5k]\n ? mutex_lock+0x89/0xd0\n ? ath5k_pci_eeprom_read+0x3c0/0x3c0 [ath5k]\n local_pci_probe+0xd3/0x160\n pci_device_probe+0x23f/0x3e0\n ? pci_device_remove+0x280/0x280\n ? pci_device_remove+0x280/0x280\n really_probe+0x209/0x5d0"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T13:58:10.164Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f4de974019a0adf34d0e7de6b86252f1bd266b06"
        },
        {
          "url": "https://git.kernel.org/stable/c/ed3dfdaa8b5f0579eabfc1c5818eed30cfe1fe84"
        },
        {
          "url": "https://git.kernel.org/stable/c/25efc5d03455c3839249bc77fce5e29ecb54677e"
        },
        {
          "url": "https://git.kernel.org/stable/c/c4e2f577271e158d87a916afb4e87415a88ce856"
        },
        {
          "url": "https://git.kernel.org/stable/c/9d7d83d0399e23d66fd431b553842a84ac10398f"
        },
        {
          "url": "https://git.kernel.org/stable/c/be2f81024e7981565d90a4c9ca3067d11b6bca7f"
        },
        {
          "url": "https://git.kernel.org/stable/c/fc8f7752a82f4accb99c0f1a868906ba1eb7b86f"
        },
        {
          "url": "https://git.kernel.org/stable/c/cbd96d6cad6625feba9c8d101ed4977d53e82f8e"
        },
        {
          "url": "https://git.kernel.org/stable/c/564d4eceb97eaf381dd6ef6470b06377bb50c95a"
        }
      ],
      "title": "ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47633",
    "datePublished": "2025-02-26T01:54:08.651Z",
    "dateReserved": "2025-02-26T01:48:21.518Z",
    "dateUpdated": "2026-05-11T13:58:10.164Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-0854 (GCVE-0-2022-0854)

Vulnerability from cvelistv5 – Published: 2022-03-23 19:46 – Updated: 2024-08-02 23:40

Summary

A memory leak flaw was found in the Linux kernel’s DMA subsystem, in the way a user calls DMA_FROM_DEVICE. This flaw allows a local user to read random memory from the kernel space.

Severity ?

No CVSS data available.

CWE

CWE-200

Assigner

redhat

References

4 references

URL	Tags
https://git.kernel.org/pub/scm/linux/kernel/git/t…	x_refsource_MISC
https://www.debian.org/security/2022/dsa-5161	vendor-advisoryx_refsource_DEBIAN
https://lists.debian.org/debian-lts-announce/2022…	mailing-listx_refsource_MLIST
https://www.debian.org/security/2022/dsa-5173	vendor-advisoryx_refsource_DEBIAN

Impacted products

1 product

Vendor	Product	Version
n/a	Kernel	Affected: Linux kernel 5.17-rc8

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:40:04.528Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/kernel/dma/swiotlb.c?h=v5.17-rc8\u0026id=aa6f8dcbab473f3a3c7454b74caa46d36cdc5d13"
          },
          {
            "name": "DSA-5161",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5161"
          },
          {
            "name": "[debian-lts-announce] 20220701 [SECURITY] [DLA 3065-1] linux security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html"
          },
          {
            "name": "DSA-5173",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5173"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Kernel",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Linux kernel 5.17-rc8"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A memory leak flaw was found in the Linux kernel\u2019s DMA subsystem, in the way a user calls DMA_FROM_DEVICE. This flaw allows a local user to read random memory from the kernel space."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-07-04T10:11:26.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/kernel/dma/swiotlb.c?h=v5.17-rc8\u0026id=aa6f8dcbab473f3a3c7454b74caa46d36cdc5d13"
        },
        {
          "name": "DSA-5161",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5161"
        },
        {
          "name": "[debian-lts-announce] 20220701 [SECURITY] [DLA 3065-1] linux security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html"
        },
        {
          "name": "DSA-5173",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5173"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2022-0854",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Kernel",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Linux kernel 5.17-rc8"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A memory leak flaw was found in the Linux kernel\u2019s DMA subsystem, in the way a user calls DMA_FROM_DEVICE. This flaw allows a local user to read random memory from the kernel space."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-200"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/kernel/dma/swiotlb.c?h=v5.17-rc8\u0026id=aa6f8dcbab473f3a3c7454b74caa46d36cdc5d13",
              "refsource": "MISC",
              "url": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/kernel/dma/swiotlb.c?h=v5.17-rc8\u0026id=aa6f8dcbab473f3a3c7454b74caa46d36cdc5d13"
            },
            {
              "name": "DSA-5161",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2022/dsa-5161"
            },
            {
              "name": "[debian-lts-announce] 20220701 [SECURITY] [DLA 3065-1] linux security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html"
            },
            {
              "name": "DSA-5173",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2022/dsa-5173"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2022-0854",
    "datePublished": "2022-03-23T19:46:15.000Z",
    "dateReserved": "2022-03-04T00:00:00.000Z",
    "dateUpdated": "2024-08-02T23:40:04.528Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-1048 (GCVE-0-2022-1048)

Vulnerability from cvelistv5 – Published: 2022-04-29 15:34 – Updated: 2024-08-02 23:47

Summary

A use-after-free flaw was found in the Linux kernel’s sound subsystem in the way a user triggers concurrent calls of PCM hw_params. The hw_free ioctls or similar race condition happens inside ALSA PCM for other ioctls. This flaw allows a local user to crash or potentially escalate their privileges on the system.

Severity ?

No CVSS data available.

CWE

CWE-416

Assigner

redhat

References

5 references

URL	Tags
https://bugzilla.redhat.com/show_bug.cgi?id=2066706	x_refsource_MISC
https://lore.kernel.org/lkml/20220322170720.3529-…	x_refsource_MISC
https://www.debian.org/security/2022/dsa-5127	vendor-advisoryx_refsource_DEBIAN
https://security.netapp.com/advisory/ntap-2022062…	x_refsource_CONFIRM
https://www.debian.org/security/2022/dsa-5173	vendor-advisoryx_refsource_DEBIAN

Impacted products

1 product

Vendor	Product	Version
n/a	kernel	Affected: Linux kernel 5.17-rc9

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:47:43.301Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2066706"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://lore.kernel.org/lkml/20220322170720.3529-5-tiwai%40suse.de/T/#m1d3b791b815556012c6be92f1c4a7086b854f7f3"
          },
          {
            "name": "DSA-5127",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5127"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20220629-0001/"
          },
          {
            "name": "DSA-5173",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5173"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "kernel",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Linux kernel 5.17-rc9"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A use-after-free flaw was found in the Linux kernel\u2019s sound subsystem in the way a user triggers concurrent calls of PCM hw_params. The hw_free ioctls or similar race condition happens inside ALSA PCM for other ioctls. This flaw allows a local user to crash or potentially escalate their privileges on the system."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "CWE-416",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-07-04T10:06:10.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2066706"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://lore.kernel.org/lkml/20220322170720.3529-5-tiwai%40suse.de/T/#m1d3b791b815556012c6be92f1c4a7086b854f7f3"
        },
        {
          "name": "DSA-5127",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5127"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20220629-0001/"
        },
        {
          "name": "DSA-5173",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5173"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2022-1048",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "kernel",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Linux kernel 5.17-rc9"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A use-after-free flaw was found in the Linux kernel\u2019s sound subsystem in the way a user triggers concurrent calls of PCM hw_params. The hw_free ioctls or similar race condition happens inside ALSA PCM for other ioctls. This flaw allows a local user to crash or potentially escalate their privileges on the system."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-416"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=2066706",
              "refsource": "MISC",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2066706"
            },
            {
              "name": "https://lore.kernel.org/lkml/20220322170720.3529-5-tiwai@suse.de/T/#m1d3b791b815556012c6be92f1c4a7086b854f7f3",
              "refsource": "MISC",
              "url": "https://lore.kernel.org/lkml/20220322170720.3529-5-tiwai@suse.de/T/#m1d3b791b815556012c6be92f1c4a7086b854f7f3"
            },
            {
              "name": "DSA-5127",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2022/dsa-5127"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20220629-0001/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20220629-0001/"
            },
            {
              "name": "DSA-5173",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2022/dsa-5173"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2022-1048",
    "datePublished": "2022-04-29T15:34:44.000Z",
    "dateReserved": "2022-03-22T00:00:00.000Z",
    "dateUpdated": "2024-08-02T23:47:43.301Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-3303 (GCVE-0-2022-3303)

Vulnerability from cvelistv5 – Published: 2022-09-27 00:00 – Updated: 2025-05-21 15:31

Summary

A race condition flaw was found in the Linux kernel sound subsystem due to improper locking. It could lead to a NULL pointer dereference while handling the SNDCTL_DSP_SYNC ioctl. A privileged local user (root or member of the audio group) could use this flaw to crash the system, resulting in a denial of service condition

Severity ?

4.7 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-667 - >CWE-362->CWE-476

Assigner

redhat

References

4 references

URL	Tags
https://git.kernel.org/pub/scm/linux/kernel/git/t…
https://lore.kernel.org/all/CAFcO6XN7JDM4xSXGhtus…
https://www.debian.org/security/2022/dsa-5257	vendor-advisory
https://lists.debian.org/debian-lts-announce/2022…	mailing-list

Impacted products

1 product

Vendor	Product	Version
n/a	Linux kernel	Affected: Fixed in kernel 6.0-rc5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T01:07:06.557Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8423f0b6d513b259fdab9c9bf4aaa6188d054c2d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lore.kernel.org/all/CAFcO6XN7JDM4xSXGhtusQfS2mSBcx50VJKwQpCq=WeLt57aaZA%40mail.gmail.com/"
          },
          {
            "name": "DSA-5257",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5257"
          },
          {
            "name": "[debian-lts-announce] 20221101 [SECURITY] [DLA 3173-1] linux-5.10 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/11/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 4.7,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-3303",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-21T15:31:25.170645Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-21T15:31:49.941Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Linux kernel",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Fixed in kernel 6.0-rc5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A race condition flaw was found in the Linux kernel sound subsystem due to improper locking. It could lead to a NULL pointer dereference while handling the SNDCTL_DSP_SYNC ioctl. A privileged local user (root or member of the audio group) could use this flaw to crash the system, resulting in a denial of service condition"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-667",
              "description": "CWE-667-\u003eCWE-362-\u003eCWE-476",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-11-01T00:00:00.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "url": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8423f0b6d513b259fdab9c9bf4aaa6188d054c2d"
        },
        {
          "url": "https://lore.kernel.org/all/CAFcO6XN7JDM4xSXGhtusQfS2mSBcx50VJKwQpCq=WeLt57aaZA%40mail.gmail.com/"
        },
        {
          "name": "DSA-5257",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5257"
        },
        {
          "name": "[debian-lts-announce] 20221101 [SECURITY] [DLA 3173-1] linux-5.10 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/11/msg00001.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2022-3303",
    "datePublished": "2022-09-27T00:00:00.000Z",
    "dateReserved": "2022-09-26T00:00:00.000Z",
    "dateUpdated": "2025-05-21T15:31:49.941Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-48853 (GCVE-0-2022-48853)

Vulnerability from cvelistv5 – Published: 2024-07-16 12:25 – Updated: 2026-05-11 18:48

Title

Reinstate some of "swiotlb: rework "fix info leak with DMA_FROM_DEVICE""

Summary

In the Linux kernel, the following vulnerability has been resolved: swiotlb: fix info leak with DMA_FROM_DEVICE The problem I'm addressing was discovered by the LTP test covering cve-2018-1000204. A short description of what happens follows: 1) The test case issues a command code 00 (TEST UNIT READY) via the SG_IO interface with: dxfer_len == 524288, dxdfer_dir == SG_DXFER_FROM_DEV and a corresponding dxferp. The peculiar thing about this is that TUR is not reading from the device. 2) In sg_start_req() the invocation of blk_rq_map_user() effectively bounces the user-space buffer. As if the device was to transfer into it. Since commit a45b599ad808 ("scsi: sg: allocate with __GFP_ZERO in sg_build_indirect()") we make sure this first bounce buffer is allocated with GFP_ZERO. 3) For the rest of the story we keep ignoring that we have a TUR, so the device won't touch the buffer we prepare as if the we had a DMA_FROM_DEVICE type of situation. My setup uses a virtio-scsi device and the buffer allocated by SG is mapped by the function virtqueue_add_split() which uses DMA_FROM_DEVICE for the "in" sgs (here scatter-gather and not scsi generics). This mapping involves bouncing via the swiotlb (we need swiotlb to do virtio in protected guest like s390 Secure Execution, or AMD SEV). 4) When the SCSI TUR is done, we first copy back the content of the second (that is swiotlb) bounce buffer (which most likely contains some previous IO data), to the first bounce buffer, which contains all zeros. Then we copy back the content of the first bounce buffer to the user-space buffer. 5) The test case detects that the buffer, which it zero-initialized, ain't all zeros and fails. One can argue that this is an swiotlb problem, because without swiotlb we leak all zeros, and the swiotlb should be transparent in a sense that it does not affect the outcome (if all other participants are well behaved). Copying the content of the original buffer into the swiotlb buffer is the only way I can think of to make swiotlb transparent in such scenarios. So let's do just that if in doubt, but allow the driver to tell us that the whole mapped buffer is going to be overwritten, in which case we can preserve the old behavior and avoid the performance impact of the extra bounce.

Severity ?

No CVSS data available.

Assigner

Linux

References

9 references

URL	Tags
https://git.kernel.org/stable/c/fd97de9c7b973f46a…
https://git.kernel.org/stable/c/aaf166f37eb6bb55d…
https://git.kernel.org/stable/c/06cb238b0f7ac1669…
https://git.kernel.org/stable/c/b2f140a9f980806f5…
https://git.kernel.org/stable/c/f3f2247ac31cb71d1…
https://git.kernel.org/stable/c/7007c894631cf4304…
https://git.kernel.org/stable/c/dcead36b19d999d68…
https://git.kernel.org/stable/c/f2141881b53073877…
https://git.kernel.org/stable/c/901c7280ca0d5e2b4…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < fd97de9c7b973f46a6103f4170c5efc7b8ef8797 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < aaf166f37eb6bb55d81c3e40a2a460c8875c8813 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 06cb238b0f7ac1669cb06390704c61794724c191 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < b2f140a9f980806f572d672e1780acea66b9a25c (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < f3f2247ac31cb71d1f05f56536df5946c6652f4a (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 7007c894631cf43041dcfa0da7142bbaa7eb673c (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < dcead36b19d999d687cd9c99b7f37520d9102b57 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < f2141881b530738777c28bb51c62175895c8178b (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 901c7280ca0d5e2b4a8929fbe0bfb007ac2a6544 (git)
Linux	Linux	Affected: 2.6.12 Unaffected: 0 , < 2.6.12 (semver) Unaffected: 4.9.320 , ≤ 4.9.* (semver) Unaffected: 4.14.281 , ≤ 4.14.* (semver) Unaffected: 4.19.245 , ≤ 4.19.* (semver) Unaffected: 5.4.196 , ≤ 5.4.* (semver) Unaffected: 5.10.118 , ≤ 5.10.* (semver) Unaffected: 5.15.33 , ≤ 5.15.* (semver) Unaffected: 5.16.19 , ≤ 5.16.* (semver) Unaffected: 5.17.2 , ≤ 5.17.* (semver) Unaffected: 5.18 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T15:25:01.804Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c132f2ba716b5ee6b35f82226a6e5417d013d753"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/971e5dadffd02beba1063e7dd9c3a82de17cf534"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8d9ac1b6665c73f23e963775f85d99679fd8e192"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/6bfc5377a210dbda2a237f16d94d1bd4f1335026"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d4d975e7921079f877f828099bb8260af335508f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7403f4118ab94be837ab9d770507537a8057bc63"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/270475d6d2410ec66e971bf181afe1958dad565e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ddbd89deb7d32b1fbb879f48d68fda1a8ac58e8e"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-48853",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:25:58.844703Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:08.301Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "Documentation/core-api/dma-attributes.rst",
            "include/linux/dma-mapping.h",
            "kernel/dma/swiotlb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fd97de9c7b973f46a6103f4170c5efc7b8ef8797",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "aaf166f37eb6bb55d81c3e40a2a460c8875c8813",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "06cb238b0f7ac1669cb06390704c61794724c191",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "b2f140a9f980806f572d672e1780acea66b9a25c",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "f3f2247ac31cb71d1f05f56536df5946c6652f4a",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "7007c894631cf43041dcfa0da7142bbaa7eb673c",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "dcead36b19d999d687cd9c99b7f37520d9102b57",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "f2141881b530738777c28bb51c62175895c8178b",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "901c7280ca0d5e2b4a8929fbe0bfb007ac2a6544",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "Documentation/core-api/dma-attributes.rst",
            "include/linux/dma-mapping.h",
            "kernel/dma/swiotlb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.320",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.281",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.245",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.196",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.118",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.16.*",
              "status": "unaffected",
              "version": "5.16.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.320",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.281",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.245",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.196",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.118",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.33",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16.19",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.2",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nswiotlb: fix info leak with DMA_FROM_DEVICE\n\nThe problem I\u0027m addressing was discovered by the LTP test covering\ncve-2018-1000204.\n\nA short description of what happens follows:\n1) The test case issues a command code 00 (TEST UNIT READY) via the SG_IO\n   interface with: dxfer_len == 524288, dxdfer_dir == SG_DXFER_FROM_DEV\n   and a corresponding dxferp. The peculiar thing about this is that TUR\n   is not reading from the device.\n2) In sg_start_req() the invocation of blk_rq_map_user() effectively\n   bounces the user-space buffer. As if the device was to transfer into\n   it. Since commit a45b599ad808 (\"scsi: sg: allocate with __GFP_ZERO in\n   sg_build_indirect()\") we make sure this first bounce buffer is\n   allocated with GFP_ZERO.\n3) For the rest of the story we keep ignoring that we have a TUR, so the\n   device won\u0027t touch the buffer we prepare as if the we had a\n   DMA_FROM_DEVICE type of situation. My setup uses a virtio-scsi device\n   and the  buffer allocated by SG is mapped by the function\n   virtqueue_add_split() which uses DMA_FROM_DEVICE for the \"in\" sgs (here\n   scatter-gather and not scsi generics). This mapping involves bouncing\n   via the swiotlb (we need swiotlb to do virtio in protected guest like\n   s390 Secure Execution, or AMD SEV).\n4) When the SCSI TUR is done, we first copy back the content of the second\n   (that is swiotlb) bounce buffer (which most likely contains some\n   previous IO data), to the first bounce buffer, which contains all\n   zeros.  Then we copy back the content of the first bounce buffer to\n   the user-space buffer.\n5) The test case detects that the buffer, which it zero-initialized,\n  ain\u0027t all zeros and fails.\n\nOne can argue that this is an swiotlb problem, because without swiotlb\nwe leak all zeros, and the swiotlb should be transparent in a sense that\nit does not affect the outcome (if all other participants are well\nbehaved).\n\nCopying the content of the original buffer into the swiotlb buffer is\nthe only way I can think of to make swiotlb transparent in such\nscenarios. So let\u0027s do just that if in doubt, but allow the driver\nto tell us that the whole mapped buffer is going to be overwritten,\nin which case we can preserve the old behavior and avoid the performance\nimpact of the extra bounce."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T18:48:24.939Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fd97de9c7b973f46a6103f4170c5efc7b8ef8797"
        },
        {
          "url": "https://git.kernel.org/stable/c/aaf166f37eb6bb55d81c3e40a2a460c8875c8813"
        },
        {
          "url": "https://git.kernel.org/stable/c/06cb238b0f7ac1669cb06390704c61794724c191"
        },
        {
          "url": "https://git.kernel.org/stable/c/b2f140a9f980806f572d672e1780acea66b9a25c"
        },
        {
          "url": "https://git.kernel.org/stable/c/f3f2247ac31cb71d1f05f56536df5946c6652f4a"
        },
        {
          "url": "https://git.kernel.org/stable/c/7007c894631cf43041dcfa0da7142bbaa7eb673c"
        },
        {
          "url": "https://git.kernel.org/stable/c/dcead36b19d999d687cd9c99b7f37520d9102b57"
        },
        {
          "url": "https://git.kernel.org/stable/c/f2141881b530738777c28bb51c62175895c8178b"
        },
        {
          "url": "https://git.kernel.org/stable/c/901c7280ca0d5e2b4a8929fbe0bfb007ac2a6544"
        }
      ],
      "title": "Reinstate some of \"swiotlb: rework \"fix info leak with DMA_FROM_DEVICE\"\"",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-48853",
    "datePublished": "2024-07-16T12:25:19.814Z",
    "dateReserved": "2024-07-16T11:38:08.913Z",
    "dateUpdated": "2026-05-11T18:48:24.939Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-49272 (GCVE-0-2022-49272)

Vulnerability from cvelistv5 – Published: 2025-02-26 01:56 – Updated: 2026-05-11 18:56

Title

ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock

Summary

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock syzbot caught a potential deadlock between the PCM runtime->buffer_mutex and the mm->mmap_lock. It was brought by the recent fix to cover the racy read/write and other ioctls, and in that commit, I overlooked a (hopefully only) corner case that may take the revert lock, namely, the OSS mmap. The OSS mmap operation exceptionally allows to re-configure the parameters inside the OSS mmap syscall, where mm->mmap_mutex is already held. Meanwhile, the copy_from/to_user calls at read/write operations also take the mm->mmap_lock internally, hence it may lead to a AB/BA deadlock. A similar problem was already seen in the past and we fixed it with a refcount (in commit b248371628aa). The former fix covered only the call paths with OSS read/write and OSS ioctls, while we need to cover the concurrent access via both ALSA and OSS APIs now. This patch addresses the problem above by replacing the buffer_mutex lock in the read/write operations with a refcount similar as we've used for OSS. The new field, runtime->buffer_accessing, keeps the number of concurrent read/write operations. Unlike the former buffer_mutex protection, this protects only around the copy_from/to_user() calls; the other codes are basically protected by the PCM stream lock. The refcount can be a negative, meaning blocked by the ioctls. If a negative value is seen, the read/write aborts with -EBUSY. In the ioctl side, OTOH, they check this refcount, too, and set to a negative value for blocking unless it's already being accessed.

Severity ?

No CVSS data available.

Assigner

Linux

References

8 references

URL	Tags
https://git.kernel.org/stable/c/7e9133607e1501c94…
https://git.kernel.org/stable/c/40f4cffbe13a51faf…
https://git.kernel.org/stable/c/9661bf674d6a82b76…
https://git.kernel.org/stable/c/9017201e8d8c6d147…
https://git.kernel.org/stable/c/7777744e92a0b30e3…
https://git.kernel.org/stable/c/abedf0d08c79d76da…
https://git.kernel.org/stable/c/be9813ad2fc8f0885…
https://git.kernel.org/stable/c/bc55cfd5718c7c23e…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 73867cb2bc7dfa7fbd219e53a0b68d253d8fda09 , < 7e9133607e1501c94881be35e118d8f84d96dcb4 (git) Affected: b3830197aa7413c65767cf5a1aa8775c83f0dbf7 , < 40f4cffbe13a51faf136faf5f9ef6847782cd595 (git) Affected: 08d1807f097a63ea00a7067dad89c1c81cb2115e , < 9661bf674d6a82b76e4ae424438a8ce1e3ed855d (git) Affected: 8527c8f052fb42091c6569cb928e472376a4a889 , < 9017201e8d8c6d1472273361389ed431188584a0 (git) Affected: 47711ff10c7e126702cfa725f6d86ef529d15a5f , < 7777744e92a0b30e3e0cce2758d911837011ebd9 (git) Affected: 4d1b0ace2d56dc27cc4921eda7fae57f77f03eb5 , < abedf0d08c79d76da0d6fa0d5dbbc98871dcbc2e (git) Affected: dd2f8c684da3e226e5ec7a81c89ff5fd4a957a03 , < be9813ad2fc8f0885f5ce6925af0d993ce5da4e5 (git) Affected: dca947d4d26dbf925a64a6cfb2ddbc035e831a3d , < bc55cfd5718c7c23e5524582e9fa70b4d10f2433 (git)
Linux	Linux	Affected: 5.10.109 , < 5.10.110 (semver) Affected: 5.15.32 , < 5.15.33 (semver) Affected: 5.16.18 , < 5.16.19 (semver) Affected: 5.17.1 , < 5.17.2 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/sound/pcm.h",
            "sound/core/pcm.c",
            "sound/core/pcm_lib.c",
            "sound/core/pcm_native.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7e9133607e1501c94881be35e118d8f84d96dcb4",
              "status": "affected",
              "version": "73867cb2bc7dfa7fbd219e53a0b68d253d8fda09",
              "versionType": "git"
            },
            {
              "lessThan": "40f4cffbe13a51faf136faf5f9ef6847782cd595",
              "status": "affected",
              "version": "b3830197aa7413c65767cf5a1aa8775c83f0dbf7",
              "versionType": "git"
            },
            {
              "lessThan": "9661bf674d6a82b76e4ae424438a8ce1e3ed855d",
              "status": "affected",
              "version": "08d1807f097a63ea00a7067dad89c1c81cb2115e",
              "versionType": "git"
            },
            {
              "lessThan": "9017201e8d8c6d1472273361389ed431188584a0",
              "status": "affected",
              "version": "8527c8f052fb42091c6569cb928e472376a4a889",
              "versionType": "git"
            },
            {
              "lessThan": "7777744e92a0b30e3e0cce2758d911837011ebd9",
              "status": "affected",
              "version": "47711ff10c7e126702cfa725f6d86ef529d15a5f",
              "versionType": "git"
            },
            {
              "lessThan": "abedf0d08c79d76da0d6fa0d5dbbc98871dcbc2e",
              "status": "affected",
              "version": "4d1b0ace2d56dc27cc4921eda7fae57f77f03eb5",
              "versionType": "git"
            },
            {
              "lessThan": "be9813ad2fc8f0885f5ce6925af0d993ce5da4e5",
              "status": "affected",
              "version": "dd2f8c684da3e226e5ec7a81c89ff5fd4a957a03",
              "versionType": "git"
            },
            {
              "lessThan": "bc55cfd5718c7c23e5524582e9fa70b4d10f2433",
              "status": "affected",
              "version": "dca947d4d26dbf925a64a6cfb2ddbc035e831a3d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/sound/pcm.h",
            "sound/core/pcm.c",
            "sound/core/pcm_lib.c",
            "sound/core/pcm_native.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5.10.110",
              "status": "affected",
              "version": "5.10.109",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.33",
              "status": "affected",
              "version": "5.15.32",
              "versionType": "semver"
            },
            {
              "lessThan": "5.16.19",
              "status": "affected",
              "version": "5.16.18",
              "versionType": "semver"
            },
            {
              "lessThan": "5.17.2",
              "status": "affected",
              "version": "5.17.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.110",
                  "versionStartIncluding": "5.10.109",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.33",
                  "versionStartIncluding": "5.15.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16.19",
                  "versionStartIncluding": "5.16.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.2",
                  "versionStartIncluding": "5.17.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock\n\nsyzbot caught a potential deadlock between the PCM\nruntime-\u003ebuffer_mutex and the mm-\u003emmap_lock.  It was brought by the\nrecent fix to cover the racy read/write and other ioctls, and in that\ncommit, I overlooked a (hopefully only) corner case that may take the\nrevert lock, namely, the OSS mmap.  The OSS mmap operation\nexceptionally allows to re-configure the parameters inside the OSS\nmmap syscall, where mm-\u003emmap_mutex is already held.  Meanwhile, the\ncopy_from/to_user calls at read/write operations also take the\nmm-\u003emmap_lock internally, hence it may lead to a AB/BA deadlock.\n\nA similar problem was already seen in the past and we fixed it with a\nrefcount (in commit b248371628aa).  The former fix covered only the\ncall paths with OSS read/write and OSS ioctls, while we need to cover\nthe concurrent access via both ALSA and OSS APIs now.\n\nThis patch addresses the problem above by replacing the buffer_mutex\nlock in the read/write operations with a refcount similar as we\u0027ve\nused for OSS.  The new field, runtime-\u003ebuffer_accessing, keeps the\nnumber of concurrent read/write operations.  Unlike the former\nbuffer_mutex protection, this protects only around the\ncopy_from/to_user() calls; the other codes are basically protected by\nthe PCM stream lock.  The refcount can be a negative, meaning blocked\nby the ioctls.  If a negative value is seen, the read/write aborts\nwith -EBUSY.  In the ioctl side, OTOH, they check this refcount, too,\nand set to a negative value for blocking unless it\u0027s already being\naccessed."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T18:56:29.104Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7e9133607e1501c94881be35e118d8f84d96dcb4"
        },
        {
          "url": "https://git.kernel.org/stable/c/40f4cffbe13a51faf136faf5f9ef6847782cd595"
        },
        {
          "url": "https://git.kernel.org/stable/c/9661bf674d6a82b76e4ae424438a8ce1e3ed855d"
        },
        {
          "url": "https://git.kernel.org/stable/c/9017201e8d8c6d1472273361389ed431188584a0"
        },
        {
          "url": "https://git.kernel.org/stable/c/7777744e92a0b30e3e0cce2758d911837011ebd9"
        },
        {
          "url": "https://git.kernel.org/stable/c/abedf0d08c79d76da0d6fa0d5dbbc98871dcbc2e"
        },
        {
          "url": "https://git.kernel.org/stable/c/be9813ad2fc8f0885f5ce6925af0d993ce5da4e5"
        },
        {
          "url": "https://git.kernel.org/stable/c/bc55cfd5718c7c23e5524582e9fa70b4d10f2433"
        }
      ],
      "title": "ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49272",
    "datePublished": "2025-02-26T01:56:18.626Z",
    "dateReserved": "2025-02-26T01:49:39.297Z",
    "dateUpdated": "2026-05-11T18:56:29.104Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-49288 (GCVE-0-2022-49288)

Vulnerability from cvelistv5 – Published: 2025-02-26 01:56 – Updated: 2026-05-11 18:56

Title

ALSA: pcm: Fix races among concurrent prealloc proc writes

Summary

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Fix races among concurrent prealloc proc writes We have no protection against concurrent PCM buffer preallocation changes via proc files, and it may potentially lead to UAF or some weird problem. This patch applies the PCM open_mutex to the proc write operation for avoiding the racy proc writes and the PCM stream open (and further operations).

Severity ?

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416 - Use After Free

Assigner

Linux

References

8 references

URL	Tags
https://git.kernel.org/stable/c/e7786c445bb67a9a6…
https://git.kernel.org/stable/c/e14dca613e0a6ddc2…
https://git.kernel.org/stable/c/37b12c16beb6f6c1c…
https://git.kernel.org/stable/c/b560d670c87d7d40b…
https://git.kernel.org/stable/c/51fce708ab8986a98…
https://git.kernel.org/stable/c/a21d2f323b5a978de…
https://git.kernel.org/stable/c/5ed8f8e3c4e59d039…
https://git.kernel.org/stable/c/69534c48ba8ce552c…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < e7786c445bb67a9a6e64f66ebd6b7215b153ff7d (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < e14dca613e0a6ddc2bf6e360f16936a9f865205b (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 37b12c16beb6f6c1c3c678c1aacbc46525c250f7 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < b560d670c87d7d40b3cf6949246fa4c7aa65a00a (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 51fce708ab8986a9879ee5da946a2cc120f1036d (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < a21d2f323b5a978dedf9ff1d50f101f85e39b3f2 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 5ed8f8e3c4e59d0396b9ccf2e639711e24295bb6 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 69534c48ba8ce552ce383b3dfdb271ffe51820c3 (git)
Linux	Linux	Affected: 2.6.12 Unaffected: 0 , < 2.6.12 (semver) Unaffected: 4.14.279 , ≤ 4.14.* (semver) Unaffected: 4.19.243 , ≤ 4.19.* (semver) Unaffected: 5.4.193 , ≤ 5.4.* (semver) Unaffected: 5.10.109 , ≤ 5.10.* (semver) Unaffected: 5.15.32 , ≤ 5.15.* (semver) Unaffected: 5.16.18 , ≤ 5.16.* (semver) Unaffected: 5.17.1 , ≤ 5.17.* (semver) Unaffected: 5.18 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-49288",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-27T17:58:50.352103Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-27T18:02:29.155Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/core/pcm_memory.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e7786c445bb67a9a6e64f66ebd6b7215b153ff7d",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "e14dca613e0a6ddc2bf6e360f16936a9f865205b",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "37b12c16beb6f6c1c3c678c1aacbc46525c250f7",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "b560d670c87d7d40b3cf6949246fa4c7aa65a00a",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "51fce708ab8986a9879ee5da946a2cc120f1036d",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "a21d2f323b5a978dedf9ff1d50f101f85e39b3f2",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "5ed8f8e3c4e59d0396b9ccf2e639711e24295bb6",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "69534c48ba8ce552ce383b3dfdb271ffe51820c3",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/core/pcm_memory.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.279",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.243",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.193",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.32",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.16.*",
              "status": "unaffected",
              "version": "5.16.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.279",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.243",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.193",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.109",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.32",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16.18",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.1",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: pcm: Fix races among concurrent prealloc proc writes\n\nWe have no protection against concurrent PCM buffer preallocation\nchanges via proc files, and it may potentially lead to UAF or some\nweird problem.  This patch applies the PCM open_mutex to the proc\nwrite operation for avoiding the racy proc writes and the PCM stream\nopen (and further operations)."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T18:56:47.729Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e7786c445bb67a9a6e64f66ebd6b7215b153ff7d"
        },
        {
          "url": "https://git.kernel.org/stable/c/e14dca613e0a6ddc2bf6e360f16936a9f865205b"
        },
        {
          "url": "https://git.kernel.org/stable/c/37b12c16beb6f6c1c3c678c1aacbc46525c250f7"
        },
        {
          "url": "https://git.kernel.org/stable/c/b560d670c87d7d40b3cf6949246fa4c7aa65a00a"
        },
        {
          "url": "https://git.kernel.org/stable/c/51fce708ab8986a9879ee5da946a2cc120f1036d"
        },
        {
          "url": "https://git.kernel.org/stable/c/a21d2f323b5a978dedf9ff1d50f101f85e39b3f2"
        },
        {
          "url": "https://git.kernel.org/stable/c/5ed8f8e3c4e59d0396b9ccf2e639711e24295bb6"
        },
        {
          "url": "https://git.kernel.org/stable/c/69534c48ba8ce552ce383b3dfdb271ffe51820c3"
        }
      ],
      "title": "ALSA: pcm: Fix races among concurrent prealloc proc writes",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49288",
    "datePublished": "2025-02-26T01:56:26.550Z",
    "dateReserved": "2025-02-26T01:49:39.302Z",
    "dateUpdated": "2026-05-11T18:56:47.729Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-49291 (GCVE-0-2022-49291)

Vulnerability from cvelistv5 – Published: 2025-02-26 01:56 – Updated: 2026-05-11 18:56

Title

ALSA: pcm: Fix races among concurrent hw_params and hw_free calls

Summary

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Fix races among concurrent hw_params and hw_free calls Currently we have neither proper check nor protection against the concurrent calls of PCM hw_params and hw_free ioctls, which may result in a UAF. Since the existing PCM stream lock can't be used for protecting the whole ioctl operations, we need a new mutex to protect those racy calls. This patch introduced a new mutex, runtime->buffer_mutex, and applies it to both hw_params and hw_free ioctl code paths. Along with it, the both functions are slightly modified (the mmap_count check is moved into the state-check block) for code simplicity.

Severity ?

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416 - Use After Free

Assigner

Linux

References

8 references

URL	Tags
https://git.kernel.org/stable/c/a42aa926843acca96…
https://git.kernel.org/stable/c/9cb6c40a6ebe4a0cf…
https://git.kernel.org/stable/c/fbeb492694ce04410…
https://git.kernel.org/stable/c/0f6947f5f5208f6eb…
https://git.kernel.org/stable/c/33061d0fba51d2bf7…
https://git.kernel.org/stable/c/0090c13cbbdffd7da…
https://git.kernel.org/stable/c/1bbf82d9f961414d6…
https://git.kernel.org/stable/c/92ee3c60ec9fe6440…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < a42aa926843acca96c0dfbde2e835b8137f2f092 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 9cb6c40a6ebe4a0cfc9d6a181958211682cffea9 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < fbeb492694ce0441053de57699e1e2b7bc148a69 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 0f6947f5f5208f6ebd4d76a82a4757e2839a23f8 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 33061d0fba51d2bf70a2ef9645f703c33fe8e438 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 0090c13cbbdffd7da079ac56f80373a9a1be0bf8 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 1bbf82d9f961414d6c76a08f7f843ea068e0ab7b (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 92ee3c60ec9fe64404dc035e7c41277d74aa26cb (git)
Linux	Linux	Affected: 2.6.12 Unaffected: 0 , < 2.6.12 (semver) Unaffected: 4.14.279 , ≤ 4.14.* (semver) Unaffected: 4.19.243 , ≤ 4.19.* (semver) Unaffected: 5.4.193 , ≤ 5.4.* (semver) Unaffected: 5.10.109 , ≤ 5.10.* (semver) Unaffected: 5.15.32 , ≤ 5.15.* (semver) Unaffected: 5.16.18 , ≤ 5.16.* (semver) Unaffected: 5.17.1 , ≤ 5.17.* (semver) Unaffected: 5.18 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-49291",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-27T17:58:45.856077Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-27T18:02:29.053Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/sound/pcm.h",
            "sound/core/pcm.c",
            "sound/core/pcm_native.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a42aa926843acca96c0dfbde2e835b8137f2f092",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "9cb6c40a6ebe4a0cfc9d6a181958211682cffea9",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "fbeb492694ce0441053de57699e1e2b7bc148a69",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "0f6947f5f5208f6ebd4d76a82a4757e2839a23f8",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "33061d0fba51d2bf70a2ef9645f703c33fe8e438",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "0090c13cbbdffd7da079ac56f80373a9a1be0bf8",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "1bbf82d9f961414d6c76a08f7f843ea068e0ab7b",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "92ee3c60ec9fe64404dc035e7c41277d74aa26cb",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/sound/pcm.h",
            "sound/core/pcm.c",
            "sound/core/pcm_native.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.279",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.243",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.193",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.32",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.16.*",
              "status": "unaffected",
              "version": "5.16.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.279",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.243",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.193",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.109",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.32",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16.18",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.1",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: pcm: Fix races among concurrent hw_params and hw_free calls\n\nCurrently we have neither proper check nor protection against the\nconcurrent calls of PCM hw_params and hw_free ioctls, which may result\nin a UAF.  Since the existing PCM stream lock can\u0027t be used for\nprotecting the whole ioctl operations, we need a new mutex to protect\nthose racy calls.\n\nThis patch introduced a new mutex, runtime-\u003ebuffer_mutex, and applies\nit to both hw_params and hw_free ioctl code paths.  Along with it, the\nboth functions are slightly modified (the mmap_count check is moved\ninto the state-check block) for code simplicity."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T18:56:51.127Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a42aa926843acca96c0dfbde2e835b8137f2f092"
        },
        {
          "url": "https://git.kernel.org/stable/c/9cb6c40a6ebe4a0cfc9d6a181958211682cffea9"
        },
        {
          "url": "https://git.kernel.org/stable/c/fbeb492694ce0441053de57699e1e2b7bc148a69"
        },
        {
          "url": "https://git.kernel.org/stable/c/0f6947f5f5208f6ebd4d76a82a4757e2839a23f8"
        },
        {
          "url": "https://git.kernel.org/stable/c/33061d0fba51d2bf70a2ef9645f703c33fe8e438"
        },
        {
          "url": "https://git.kernel.org/stable/c/0090c13cbbdffd7da079ac56f80373a9a1be0bf8"
        },
        {
          "url": "https://git.kernel.org/stable/c/1bbf82d9f961414d6c76a08f7f843ea068e0ab7b"
        },
        {
          "url": "https://git.kernel.org/stable/c/92ee3c60ec9fe64404dc035e7c41277d74aa26cb"
        }
      ],
      "title": "ALSA: pcm: Fix races among concurrent hw_params and hw_free calls",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49291",
    "datePublished": "2025-02-26T01:56:27.986Z",
    "dateReserved": "2025-02-26T01:49:39.302Z",
    "dateUpdated": "2026-05-11T18:56:51.127Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-49545 (GCVE-0-2022-49545)

Vulnerability from cvelistv5 – Published: 2025-02-26 02:13 – Updated: 2026-05-11 19:02

Title

ALSA: usb-audio: Cancel pending work at closing a MIDI substream

Summary

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Cancel pending work at closing a MIDI substream At closing a USB MIDI output substream, there might be still a pending work, which would eventually access the rawmidi runtime object that is being released. For fixing the race, make sure to cancel the pending work at closing.

Severity ?

No CVSS data available.

Assigner

Linux

References

5 references

URL	Tags
https://git.kernel.org/stable/c/40bdb5ec957aca5c5…
https://git.kernel.org/stable/c/11868ca2158556165…
https://git.kernel.org/stable/c/5e5fe2b6065541c62…
https://git.kernel.org/stable/c/517dcef4d2dda0132…
https://git.kernel.org/stable/c/0125de38122f0f66b…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 40bdb5ec957aca5c5c1924602bef6b0ab18e22d3 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 11868ca21585561659c2575b0d6508ef8e9c4291 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 5e5fe2b6065541c6216a7a003b0cddf386be0d2d (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 517dcef4d2dda0132648f1e4c079ed17bba4d1a4 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 0125de38122f0f66bf61336158d12a1aabfe6425 (git)
Linux	Linux	Affected: 2.6.12 Unaffected: 0 , < 2.6.12 (semver) Unaffected: 5.10.121 , ≤ 5.10.* (semver) Unaffected: 5.15.46 , ≤ 5.15.* (semver) Unaffected: 5.17.14 , ≤ 5.17.* (semver) Unaffected: 5.18.3 , ≤ 5.18.* (semver) Unaffected: 5.19 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/usb/midi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "40bdb5ec957aca5c5c1924602bef6b0ab18e22d3",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "11868ca21585561659c2575b0d6508ef8e9c4291",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "5e5fe2b6065541c6216a7a003b0cddf386be0d2d",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "517dcef4d2dda0132648f1e4c079ed17bba4d1a4",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "0125de38122f0f66bf61336158d12a1aabfe6425",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/usb/midi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.121",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.18.*",
              "status": "unaffected",
              "version": "5.18.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.121",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.46",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.14",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.3",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Cancel pending work at closing a MIDI substream\n\nAt closing a USB MIDI output substream, there might be still a pending\nwork, which would eventually access the rawmidi runtime object that is\nbeing released.  For fixing the race, make sure to cancel the pending\nwork at closing."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:02:01.004Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/40bdb5ec957aca5c5c1924602bef6b0ab18e22d3"
        },
        {
          "url": "https://git.kernel.org/stable/c/11868ca21585561659c2575b0d6508ef8e9c4291"
        },
        {
          "url": "https://git.kernel.org/stable/c/5e5fe2b6065541c6216a7a003b0cddf386be0d2d"
        },
        {
          "url": "https://git.kernel.org/stable/c/517dcef4d2dda0132648f1e4c079ed17bba4d1a4"
        },
        {
          "url": "https://git.kernel.org/stable/c/0125de38122f0f66bf61336158d12a1aabfe6425"
        }
      ],
      "title": "ALSA: usb-audio: Cancel pending work at closing a MIDI substream",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49545",
    "datePublished": "2025-02-26T02:13:58.363Z",
    "dateReserved": "2025-02-26T02:08:31.590Z",
    "dateUpdated": "2026-05-11T19:02:01.004Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-49733 (GCVE-0-2022-49733)

Vulnerability from cvelistv5 – Published: 2025-03-02 14:30 – Updated: 2026-05-11 19:05

Title

ALSA: pcm: oss: Fix race at SNDCTL_DSP_SYNC

Summary

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: oss: Fix race at SNDCTL_DSP_SYNC There is a small race window at snd_pcm_oss_sync() that is called from OSS PCM SNDCTL_DSP_SYNC ioctl; namely the function calls snd_pcm_oss_make_ready() at first, then takes the params_lock mutex for the rest. When the stream is set up again by another thread between them, it leads to inconsistency, and may result in unexpected results such as NULL dereference of OSS buffer as a fuzzer spotted recently. The fix is simply to cover snd_pcm_oss_make_ready() call into the same params_lock mutex with snd_pcm_oss_make_ready_locked() variant.

Severity ?

4.7 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-476 - NULL Pointer Dereference

Assigner

Linux

References

5 references

URL	Tags
https://git.kernel.org/stable/c/4051324a6dafd7053…
https://git.kernel.org/stable/c/fce793a056c604b41…
https://git.kernel.org/stable/c/8015ef9e8a0ee5cec…
https://git.kernel.org/stable/c/723ac5ab2891b6c10…
https://git.kernel.org/stable/c/8423f0b6d513b259f…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: e3a5d59a17e9a42e3f3e0e37342b2679bab2ff43 , < 4051324a6dafd7053c74c475e80b3ba10ae672b0 (git) Affected: e3a5d59a17e9a42e3f3e0e37342b2679bab2ff43 , < fce793a056c604b41a298317cf704dae255f1b36 (git) Affected: e3a5d59a17e9a42e3f3e0e37342b2679bab2ff43 , < 8015ef9e8a0ee5cecfd0cb6805834d007ab26f86 (git) Affected: e3a5d59a17e9a42e3f3e0e37342b2679bab2ff43 , < 723ac5ab2891b6c10dd6cc78ef5456af593490eb (git) Affected: e3a5d59a17e9a42e3f3e0e37342b2679bab2ff43 , < 8423f0b6d513b259fdab9c9bf4aaa6188d054c2d (git)
Linux	Linux	Affected: 2.6.20 Unaffected: 0 , < 2.6.20 (semver) Unaffected: 5.4.215 , ≤ 5.4.* (semver) Unaffected: 5.10.148 , ≤ 5.10.* (semver) Unaffected: 5.15.68 , ≤ 5.15.* (semver) Unaffected: 5.19.9 , ≤ 5.19.* (semver) Unaffected: 6.0 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 4.7,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-49733",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T19:28:32.574856Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-476",
                "description": "CWE-476 NULL Pointer Dereference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T19:36:38.398Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/core/oss/pcm_oss.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4051324a6dafd7053c74c475e80b3ba10ae672b0",
              "status": "affected",
              "version": "e3a5d59a17e9a42e3f3e0e37342b2679bab2ff43",
              "versionType": "git"
            },
            {
              "lessThan": "fce793a056c604b41a298317cf704dae255f1b36",
              "status": "affected",
              "version": "e3a5d59a17e9a42e3f3e0e37342b2679bab2ff43",
              "versionType": "git"
            },
            {
              "lessThan": "8015ef9e8a0ee5cecfd0cb6805834d007ab26f86",
              "status": "affected",
              "version": "e3a5d59a17e9a42e3f3e0e37342b2679bab2ff43",
              "versionType": "git"
            },
            {
              "lessThan": "723ac5ab2891b6c10dd6cc78ef5456af593490eb",
              "status": "affected",
              "version": "e3a5d59a17e9a42e3f3e0e37342b2679bab2ff43",
              "versionType": "git"
            },
            {
              "lessThan": "8423f0b6d513b259fdab9c9bf4aaa6188d054c2d",
              "status": "affected",
              "version": "e3a5d59a17e9a42e3f3e0e37342b2679bab2ff43",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/core/oss/pcm_oss.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.20"
            },
            {
              "lessThan": "2.6.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.215",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.68",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.19.*",
              "status": "unaffected",
              "version": "5.19.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.215",
                  "versionStartIncluding": "2.6.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.148",
                  "versionStartIncluding": "2.6.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.68",
                  "versionStartIncluding": "2.6.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19.9",
                  "versionStartIncluding": "2.6.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0",
                  "versionStartIncluding": "2.6.20",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: pcm: oss: Fix race at SNDCTL_DSP_SYNC\n\nThere is a small race window at snd_pcm_oss_sync() that is called from\nOSS PCM SNDCTL_DSP_SYNC ioctl; namely the function calls\nsnd_pcm_oss_make_ready() at first, then takes the params_lock mutex\nfor the rest.  When the stream is set up again by another thread\nbetween them, it leads to inconsistency, and may result in unexpected\nresults such as NULL dereference of OSS buffer as a fuzzer spotted\nrecently.\n\nThe fix is simply to cover snd_pcm_oss_make_ready() call into the same\nparams_lock mutex with snd_pcm_oss_make_ready_locked() variant."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:05:46.594Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4051324a6dafd7053c74c475e80b3ba10ae672b0"
        },
        {
          "url": "https://git.kernel.org/stable/c/fce793a056c604b41a298317cf704dae255f1b36"
        },
        {
          "url": "https://git.kernel.org/stable/c/8015ef9e8a0ee5cecfd0cb6805834d007ab26f86"
        },
        {
          "url": "https://git.kernel.org/stable/c/723ac5ab2891b6c10dd6cc78ef5456af593490eb"
        },
        {
          "url": "https://git.kernel.org/stable/c/8423f0b6d513b259fdab9c9bf4aaa6188d054c2d"
        }
      ],
      "title": "ALSA: pcm: oss: Fix race at SNDCTL_DSP_SYNC",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49733",
    "datePublished": "2025-03-02T14:30:02.838Z",
    "dateReserved": "2025-02-26T02:21:30.449Z",
    "dateUpdated": "2026-05-11T19:05:46.594Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CERTFR-2026-AVI-0128

Solutions

CVE-2021-47633 (GCVE-0-2021-47633)

CVE-2022-0854 (GCVE-0-2022-0854)

CVE-2022-1048 (GCVE-0-2022-1048)

CVE-2022-3303 (GCVE-0-2022-3303)

CVE-2022-48853 (GCVE-0-2022-48853)

CVE-2022-49272 (GCVE-0-2022-49272)

CVE-2022-49288 (GCVE-0-2022-49288)

CVE-2022-49291 (GCVE-0-2022-49291)

CVE-2022-49545 (GCVE-0-2022-49545)

CVE-2022-49733 (GCVE-0-2022-49733)

Tags

Sightings

Nomenclature