SB20250416110 - SUSE update for the Linux Kernel

Description

This security bulletin contains information about 222 secuirty vulnerabilities.

1) Information disclosure (CVE-ID: CVE-2017-5753)

The vulnerability allows a local attacker to obtain potentially sensitive information.

The vulnerability exists in Intel CPU hardware due to improper implementation of the speculative execution of instructions. A local attacker can perform a bounds check bypass, execute arbitrary code, conduct a side-channel attack and read sensitive memory information.

2) Improper locking (CVE-ID: CVE-2021-46925)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the smc_wr_is_tx_pend(), smc_wr_tx_process_cqe(), smc_wr_reg_send() and smc_wr_free_link() functions in net/smc/smc_wr.c, within the smc_ib_modify_qp_rts() function in net/smc/smc_ib.c, within the smc_conn_free(), smcr_link_clear(), smc_conn_kill(), smc_smcd_terminate_all(), smc_smcr_terminate_all(), smcr_link_down() and init_waitqueue_head() functions in net/smc/smc_core.c, within the smc_cdc_tx_handler(), smc_cdc_msg_send(), smcr_cdc_msg_send_validation() and smc_cdc_get_slot_and_msg_send() functions in net/smc/smc_cdc.c. A local user can perform a denial of service (DoS) attack.

3) Out-of-bounds read (CVE-ID: CVE-2021-47633)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the ath5k_eeprom_convert_pcal_info_5111() function in drivers/net/wireless/ath/ath5k/eeprom.c. A local user can perform a denial of service (DoS) attack.

4) NULL pointer dereference (CVE-ID: CVE-2021-47645)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the zoran_reap_stat_com() function in drivers/staging/media/zoran/zoran_device.c. A local user can perform a denial of service (DoS) attack.

5) Memory leak (CVE-ID: CVE-2021-47648)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the host1x_remove() function in drivers/gpu/host1x/dev.c. A local user can perform a denial of service (DoS) attack.

6) NULL pointer dereference (CVE-ID: CVE-2021-47652)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the ufx_usb_probe() function in drivers/video/fbdev/smscufx.c. A local user can perform a denial of service (DoS) attack.

7) Use-after-free (CVE-ID: CVE-2022-1016)

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to a use-after-free error in net/netfilter/nf_tables_core.c:nft_do_chain in Linux kernel.. A local user can trigger a use-after-free error and gain access to sensitive information.

8) Use-after-free (CVE-ID: CVE-2022-1048)

The vulnerability allows a local user to execute arbitrary code with elevated privileges.

The vulnerability exists due to a use-after-free error in the Linux kernel’s sound subsystem in the way a user triggers concurrent calls of PCM hw_params. A local user can execute arbitrary code with elevated privileges and perform a denial-of-service attack.

9) Use-after-free (CVE-ID: CVE-2022-1184)

The vulnerability allows a local user to perform a denial of service attack.

The vulnerability exists due to a use-after-free error in fs/ext4/namei.c:dx_insert_block() function in the Linux kernel’s filesystem sub-component.. A local user can trigger use-after-free and perform a denial of service attack.

10) Security restrictions bypass (CVE-ID: CVE-2022-26373)

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to non-transparent sharing of return predictor targets between contexts in Intel CPU processors. A local user can bypass the expected architecture isolation between contexts and gain access to sensitive information on the system.

11) Use-after-free (CVE-ID: CVE-2022-2977)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error in the Linux kernel implementation of proxied virtualized TPM devices. A local user can trigger a use-after-free error and execute arbitrary code with elevated privileges.

12) NULL pointer dereference (CVE-ID: CVE-2022-3303)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in the Linux kernel sound subsystem due to improper locking when handling the SNDCTL_DSP_SYNC ioctl. A privileged local user can trigger a NULL pointer dereference error and perform a denial of service (DoS) attack.

13) NULL pointer dereference (CVE-ID: CVE-2022-49046)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the i2cdev_attach_adapter() function in drivers/i2c/i2c-dev.c. A local user can perform a denial of service (DoS) attack.

14) Out-of-bounds read (CVE-ID: CVE-2022-49051)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the aqc111_rx_fixup() function in drivers/net/usb/aqc111.c. A local user can perform a denial of service (DoS) attack.

15) Use-after-free (CVE-ID: CVE-2022-49053)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the tcmu_try_get_data_page() and tcmu_vma_fault() functions in drivers/target/target_core_user.c. A local user can escalate privileges on the system.

16) Buffer overflow (CVE-ID: CVE-2022-49058)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the parse_mf_symlink() function in fs/cifs/link.c. A local user can escalate privileges on the system.

17) Use-after-free (CVE-ID: CVE-2022-49059)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the nci_close_device() function in net/nfc/nci/core.c. A local user can escalate privileges on the system.

18) NULL pointer dereference (CVE-ID: CVE-2022-49065)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the include/trace/events/sunrpc.h. A local user can perform a denial of service (DoS) attack.

19) Improper error handling (CVE-ID: CVE-2022-49066)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the veth_xmit() function in drivers/net/veth.c. A local user can perform a denial of service (DoS) attack.

20) Resource management error (CVE-ID: CVE-2022-49074)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the gic_dist_base() and gic_do_wait_for_rwp() functions in drivers/irqchip/irq-gic-v3.c. A local user can perform a denial of service (DoS) attack.

21) Buffer overflow (CVE-ID: CVE-2022-49075)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the fs/btrfs/extent_io.h. A local user can escalate privileges on the system.

22) Improper error handling (CVE-ID: CVE-2022-49084)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the qede_build_skb() function in drivers/net/ethernet/qlogic/qede/qede_fp.c. A local user can perform a denial of service (DoS) attack.

23) Use-after-free (CVE-ID: CVE-2022-49085)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the drbd_bitmap_io_from_worker(), notify_resource_state_change(), notify_connection_state_change(), notify_device_state_change(), notify_peer_device_state_change() and broadcast_state_change() functions in drivers/block/drbd/drbd_state.c, within the nla_put_notification_header(), notify_resource_state(), notify_device_state(), notify_connection_state(), notify_peer_device_state(), notify_initial_state_done() and get_initial_state() functions in drivers/block/drbd/drbd_nl.c. A local user can escalate privileges on the system.

24) Memory leak (CVE-ID: CVE-2022-49095)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the zorro7xx_remove_one() function in drivers/scsi/zorro7xx.c. A local user can perform a denial of service (DoS) attack.

25) Improper Initialization (CVE-ID: CVE-2022-49098)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper initialization within the vmbus_exit() function in drivers/hv/vmbus_drv.c. A local user can perform a denial of service (DoS) attack.

26) Buffer overflow (CVE-ID: CVE-2022-49100)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the init() and fini() functions in drivers/char/virtio_console.c. A local user can perform a denial of service (DoS) attack.

27) Memory leak (CVE-ID: CVE-2022-49107)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the fs/ceph/dir.c. A local user can perform a denial of service (DoS) attack.

28) Memory leak (CVE-ID: CVE-2022-49109)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the ceph_get_snapdir() function in fs/ceph/inode.c. A local user can perform a denial of service (DoS) attack.

29) Use-after-free (CVE-ID: CVE-2022-49114)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the fc_exch_abts_resp() function in drivers/scsi/libfc/fc_exch.c. A local user can escalate privileges on the system.

30) Memory leak (CVE-ID: CVE-2022-49119)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the pm8001_chip_fw_flash_update_req() function in drivers/scsi/pm8001/pm8001_hwi.c. A local user can perform a denial of service (DoS) attack.

31) Memory leak (CVE-ID: CVE-2022-49120)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the pm8001_send_abort_all() function in drivers/scsi/pm8001/pm8001_hwi.c. A local user can perform a denial of service (DoS) attack.

32) Memory leak (CVE-ID: CVE-2022-49122)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the lookup_ioctl() function in drivers/md/dm-ioctl.c. A local user can perform a denial of service (DoS) attack.

33) Improper locking (CVE-ID: CVE-2022-49155)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the qla2xxx_create_qpair() function in drivers/scsi/qla2xxx/qla_init.c. A local user can perform a denial of service (DoS) attack.

34) Improper locking (CVE-ID: CVE-2022-49156)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the qla24xx_handle_plogi_done_event() function in drivers/scsi/qla2xxx/qla_init.c. A local user can perform a denial of service (DoS) attack.

35) Resource management error (CVE-ID: CVE-2022-49157)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the qla27xx_fwdt_entry_t266() function in drivers/scsi/qla2xxx/qla_tmpl.c, within the qla2xxx_pci_error_detected() and qla2xxx_pci_mmio_enabled() functions in drivers/scsi/qla2xxx/qla_os.c. A local user can perform a denial of service (DoS) attack.

36) Improper error handling (CVE-ID: CVE-2022-49158)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the qla2x00_async_login_sp_done(), qla2x00_async_adisc_sp_done() and qla2x00_async_prli_sp_done() functions in drivers/scsi/qla2xxx/qla_init.c. A local user can perform a denial of service (DoS) attack.

37) NULL pointer dereference (CVE-ID: CVE-2022-49159)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the qla2x00_async_nack_sp_done() and qla24xx_async_notify_ack() functions in drivers/scsi/qla2xxx/qla_target.c, within the qla2x00_sp_compl(), qla2xxx_qpair_sp_compl(), qla2xxx_queuecommand() and qla2xxx_mqueuecommand() functions in drivers/scsi/qla2xxx/qla_os.c, within the qlafx00_fx_disc() and dma_free_coherent() functions in drivers/scsi/qla2xxx/qla_mr.c, within the qla24xx_control_vp() function in drivers/scsi/qla2xxx/qla_mid.c, within the qla24xx_send_mb_cmd() function in drivers/scsi/qla2xxx/qla_mbx.c, within the qla24xx_tm_iocb(), qla24xx_els_dcmd_iocb(), qla2x00_els_dcmd2_sp_done(), qla24xx_els_dcmd2_iocb() and qla2x00_start_sp() functions in drivers/scsi/qla2xxx/qla_iocb.c, within the qla2x00_sp_timeout(), qla24xx_abort_iocb_timeout(), qla24xx_abort_sp_done(), qla24xx_async_abort_cmd(), qla2x00_async_login_sp_done(), qla2x00_async_login(), qla2x00_async_logout_sp_done(), qla2x00_async_logout(), qla2x00_async_prlo_sp_done(), qla2x00_async_prlo(), qla2x00_async_adisc_sp_done(), qla2x00_async_adisc(), qla24xx_async_gnl_sp_done(), qla24xx_async_gnl(), dma_pool_free(), qla2x00_async_prli_sp_done(), qla24xx_async_prli() and qla2x00_async_tm_cmd() functions in drivers/scsi/qla2xxx/qla_init.c, within the qla2x00_async_sns_sp_done(), qla_async_rftid(), qla_async_rffid(), qla_async_rnnid(), qla_async_rsnn_nn(), qla24xx_async_gpsc_sp_done(), qla24xx_async_gpsc(), qla24xx_sp_unmap(), qla2x00_async_gpnid_sp_done(), qla24xx_async_gpnid(), qla24xx_async_gffid_sp_done(), qla24xx_async_gffid(), qla2x00_async_gpnft_gnnft_sp_done(), qla24xx_async_gpnft(), qla2x00_async_gnnid_sp_done(), qla24xx_async_gnnid(), qla2x00_async_gfpnid_sp_done() and qla24xx_async_gfpnid() functions in drivers/scsi/qla2xxx/qla_gs.c, within the edif_doorbell_show() function in drivers/scsi/qla2xxx/qla_edif.c, within the qla2x00_bsg_job_done() and qla24xx_bsg_timeout() functions in drivers/scsi/qla2xxx/qla_bsg.c. A local user can perform a denial of service (DoS) attack.

38) Resource management error (CVE-ID: CVE-2022-49160)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the qla24xx_free_purex_list() function in drivers/scsi/qla2xxx/qla_os.c. A local user can perform a denial of service (DoS) attack.

39) Buffer overflow (CVE-ID: CVE-2022-49164)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the REST_GPR() and GET_PACA() functions in arch/powerpc/kernel/tm.S. A local user can perform a denial of service (DoS) attack.

40) Memory leak (CVE-ID: CVE-2022-49191)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the mxser_activate() function in drivers/tty/mxser.c. A local user can perform a denial of service (DoS) attack.

41) Use-after-free (CVE-ID: CVE-2022-49196)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the remove_phb_dynamic() function in arch/powerpc/platforms/pseries/pci_dlpar.c. A local user can escalate privileges on the system.

42) Resource management error (CVE-ID: CVE-2022-49204)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the net/ipv4/tcp_bpf.c. A local user can perform a denial of service (DoS) attack.

43) Memory leak (CVE-ID: CVE-2022-49209)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the sk_msg_alloc() function in net/core/skmsg.c. A local user can perform a denial of service (DoS) attack.

44) Improper locking (CVE-ID: CVE-2022-49217)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the pm80xx_send_abort_all() function in drivers/scsi/pm8001/pm80xx_hwi.c, within the pm8001_send_abort_all() and pm8001_send_read_log() functions in drivers/scsi/pm8001/pm8001_hwi.c. A local user can perform a denial of service (DoS) attack.

45) Input validation error (CVE-ID: CVE-2022-49220)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the dax_fs_init() function in drivers/dax/super.c. A local user can perform a denial of service (DoS) attack.

46) Input validation error (CVE-ID: CVE-2022-49226)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the ax88772_bind() and ax88178_reset() functions in drivers/net/usb/asix_devices.c, within the asix_read_cmd(), asix_check_host_enable() and asix_mdio_read_nopm() functions in drivers/net/usb/asix_common.c. A local user can perform a denial of service (DoS) attack.

47) Resource management error (CVE-ID: CVE-2022-49259)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the blk_unregister_queue() function in block/blk-sysfs.c. A local user can perform a denial of service (DoS) attack.

48) NULL pointer dereference (CVE-ID: CVE-2022-49264)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the bprm_stack_limits(), do_execveat_common() and kernel_execve() functions in fs/exec.c. A local user can perform a denial of service (DoS) attack.

49) NULL pointer dereference (CVE-ID: CVE-2022-49271)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the smb2_ioctl_query_info() function in fs/cifs/smb2ops.c. A local user can perform a denial of service (DoS) attack.

50) Improper locking (CVE-ID: CVE-2022-49272)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the snd_pcm_hw_params_choose(), snd_pcm_hw_params(), snd_pcm_hw_free() and snd_pcm_action_nonatomic() functions in sound/core/pcm_native.c, within the wait_for_avail() and __snd_pcm_lib_xfer() functions in sound/core/pcm_lib.c, within the snd_pcm_attach_substream() function in sound/core/pcm.c. A local user can perform a denial of service (DoS) attack.

51) Use-after-free (CVE-ID: CVE-2022-49275)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the m_can_tx_handler() function in drivers/net/can/m_can/m_can.c. A local user can escalate privileges on the system.

52) Integer underflow (CVE-ID: CVE-2022-49280)

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer underflow within the nfsd_proc_write() function in fs/nfsd/nfsproc.c. A local user can execute arbitrary code.

53) Resource management error (CVE-ID: CVE-2022-49281)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the cifs_kill_sb() function in fs/cifs/cifsfs.c. A local user can perform a denial of service (DoS) attack.

54) NULL pointer dereference (CVE-ID: CVE-2022-49286)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the tpm2_init_space() function in drivers/char/tpm/tpm2-space.c. A local user can perform a denial of service (DoS) attack.

55) Use-after-free (CVE-ID: CVE-2022-49287)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the dev_err() function in drivers/char/tpm/tpm2-space.c, within the tpm_dev_release(), tpm_chip_alloc(), tpm_add_char_device() and tpm_chip_unregister() functions in drivers/char/tpm/tpm-chip.c. A local user can escalate privileges on the system.

56) Use-after-free (CVE-ID: CVE-2022-49288)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the snd_pcm_lib_preallocate_proc_write() function in sound/core/pcm_memory.c. A local user can escalate privileges on the system.

57) Use-after-free (CVE-ID: CVE-2022-49291)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the snd_pcm_hw_params_choose(), snd_pcm_hw_params() and do_hw_free() functions in sound/core/pcm_native.c, within the snd_pcm_attach_substream() and snd_pcm_detach_substream() functions in sound/core/pcm.c. A local user can escalate privileges on the system.

58) Buffer overflow (CVE-ID: CVE-2022-49292)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the snd_pcm_plugin_alloc() function in sound/core/oss/pcm_plugin.c, within the snd_pcm_oss_period_size() and snd_pcm_oss_change_params_locked() functions in sound/core/oss/pcm_oss.c. A local user can escalate privileges on the system.

59) Memory leak (CVE-ID: CVE-2022-49293)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the nft_do_chain() function in net/netfilter/nf_tables_core.c. A local user can perform a denial of service (DoS) attack.

60) NULL pointer dereference (CVE-ID: CVE-2022-49295)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the nbd_cleanup() function in drivers/block/nbd.c. A local user can perform a denial of service (DoS) attack.

61) Improper locking (CVE-ID: CVE-2022-49297)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the nbd_start_device_ioctl() function in drivers/block/nbd.c. A local user can perform a denial of service (DoS) attack.

62) Memory leak (CVE-ID: CVE-2022-49300)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the nbd_alloc_config(), nbd_open(), nbd_put() and nbd_cleanup() functions in drivers/block/nbd.c. A local user can perform a denial of service (DoS) attack.

63) Improper error handling (CVE-ID: CVE-2022-49308)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the extcon_dev_register() and extcon_dev_unregister() functions in drivers/extcon/extcon.c. A local user can perform a denial of service (DoS) attack.

64) Improper locking (CVE-ID: CVE-2022-49313)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the oxu_bus_suspend() function in drivers/usb/host/oxu210hp-hcd.c. A local user can perform a denial of service (DoS) attack.

65) NULL pointer dereference (CVE-ID: CVE-2022-49321)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the rpcrdma_is_bcall() function in net/sunrpc/xprtrdma/rpc_rdma.c. A local user can perform a denial of service (DoS) attack.

66) Improper locking (CVE-ID: CVE-2022-49322)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the trace_event_buffer_lock_reserve() and output_printk() functions in kernel/trace/trace.c. A local user can perform a denial of service (DoS) attack.

67) Improper locking (CVE-ID: CVE-2022-49330)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the tcp_mtup_probe_success() function in net/ipv4/tcp_input.c. A local user can perform a denial of service (DoS) attack.

68) Memory leak (CVE-ID: CVE-2022-49331)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the st21nfca_connectivity_event_received() function in drivers/nfc/st21nfca/se.c. A local user can perform a denial of service (DoS) attack.

69) NULL pointer dereference (CVE-ID: CVE-2022-49332)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the lpfc_device_reset_handler() and lpfc_target_reset_handler() functions in drivers/scsi/lpfc/lpfc_scsi.c. A local user can perform a denial of service (DoS) attack.

70) Use-after-free (CVE-ID: CVE-2022-49337)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the spin_lock() and user_dlm_destroy_lock() functions in fs/ocfs2/dlmfs/userdlm.c. A local user can escalate privileges on the system.

71) Buffer overflow (CVE-ID: CVE-2022-49343)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the dx_probe() function in fs/ext4/namei.c. A local user can perform a denial of service (DoS) attack.

72) Race condition within a thread (CVE-ID: CVE-2022-49344)

The vulnerability allows a local user to corrupt data.

The vulnerability exists due to a data race within the unix_dgram_peer_wake_me() function in net/unix/af_unix.c. A local user can corrupt data.

73) Improper error handling (CVE-ID: CVE-2022-49347)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the ext4_convert_inline_data() function in fs/ext4/inline.c. A local user can perform a denial of service (DoS) attack.

74) Use-after-free (CVE-ID: CVE-2022-49349)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the ext4_get_first_dir_block() function in fs/ext4/namei.c. A local user can escalate privileges on the system.

75) Memory leak (CVE-ID: CVE-2022-49367)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the mv88e6xxx_mdios_register() function in drivers/net/dsa/mv88e6xxx/chip.c. A local user can perform a denial of service (DoS) attack.

76) Memory leak (CVE-ID: CVE-2022-49370)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the dmi_sysfs_register_handle() function in drivers/firmware/dmi-sysfs.c. A local user can perform a denial of service (DoS) attack.

77) Improper locking (CVE-ID: CVE-2022-49372)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the tcp_rtx_synack() function in net/ipv4/tcp_output.c. A local user can perform a denial of service (DoS) attack.

78) Use-after-free (CVE-ID: CVE-2022-49388)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the spin_unlock() function in drivers/mtd/ubi/vmt.c. A local user can escalate privileges on the system.

79) Memory leak (CVE-ID: CVE-2022-49389)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the stub_probe() and put_busid_priv() functions in drivers/usb/usbip/stub_dev.c. A local user can perform a denial of service (DoS) attack.

80) Out-of-bounds read (CVE-ID: CVE-2022-49395)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the write_ldt_entry() function in arch/x86/um/ldt.c. A local user can perform a denial of service (DoS) attack.

81) Memory leak (CVE-ID: CVE-2022-49397)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the qcom_qmp_phy_create() function in drivers/phy/qualcomm/phy-qcom-qmp.c. A local user can perform a denial of service (DoS) attack.

82) Integer overflow (CVE-ID: CVE-2022-49404)

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer overflow within the set_link_ipg() function in drivers/infiniband/hw/hfi1/init.c. A local user can execute arbitrary code.

83) Out-of-bounds read (CVE-ID: CVE-2022-49407)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the dlm_posix_lock(), dlm_plock_callback() and dev_write() functions in fs/dlm/plock.c. A local user can perform a denial of service (DoS) attack.

84) Improper error handling (CVE-ID: CVE-2022-49409)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the ext4_valid_extent_entries() function in fs/ext4/extents.c. A local user can perform a denial of service (DoS) attack.

85) Use-after-free (CVE-ID: CVE-2022-49413)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the bfq_bio_merge() function in block/bfq-iosched.c. A local user can escalate privileges on the system.

86) Improper locking (CVE-ID: CVE-2022-49414)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the ext4_punch_hole() function in fs/ext4/inode.c, within the ext4_fallocate() function in fs/ext4/extents.c. A local user can perform a denial of service (DoS) attack.

87) Use-after-free (CVE-ID: CVE-2022-49416)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the ieee80211_vif_use_reserved_context() function in net/mac80211/chan.c. A local user can escalate privileges on the system.

88) Memory leak (CVE-ID: CVE-2022-49421)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the clcdfb_of_vram_setup() function in drivers/video/fbdev/amba-clcd.c. A local user can perform a denial of service (DoS) attack.

89) NULL pointer dereference (CVE-ID: CVE-2022-49429)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the hfi1_write_iter() function in drivers/infiniband/hw/hfi1/file_ops.c. A local user can perform a denial of service (DoS) attack.

90) Memory leak (CVE-ID: CVE-2022-49432)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the icp_opal_init() function in arch/powerpc/sysdev/xics/icp-opal.c. A local user can perform a denial of service (DoS) attack.

91) Use-after-free (CVE-ID: CVE-2022-49433)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the sdma_clean() function in drivers/infiniband/hw/hfi1/sdma.c. A local user can escalate privileges on the system.

92) Improper locking (CVE-ID: CVE-2022-49434)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the pci_reset_bus_function() and EXPORT_SYMBOL_GPL() functions in drivers/pci/pci.c. A local user can perform a denial of service (DoS) attack.

93) Memory leak (CVE-ID: CVE-2022-49437)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the xive_spapr_init() and xive_irq_bitmap_remove_all() functions in arch/powerpc/sysdev/xive/spapr.c. A local user can perform a denial of service (DoS) attack.

94) Improper locking (CVE-ID: CVE-2022-49443)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the include/linux/list.h. A local user can perform a denial of service (DoS) attack.

95) Out-of-bounds read (CVE-ID: CVE-2022-49444)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the elf_validity_check() function in kernel/module.c. A local user can perform a denial of service (DoS) attack.

96) NULL pointer dereference (CVE-ID: CVE-2022-49472)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the kszphy_config_reset(), kszphy_config_init() and kszphy_probe() functions in drivers/net/phy/micrel.c. A local user can perform a denial of service (DoS) attack.

97) NULL pointer dereference (CVE-ID: CVE-2022-49488)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the mdp5_mixer_assign() function in drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.c, within the mdp5_crtc_setup_pipeline() function in drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c. A local user can perform a denial of service (DoS) attack.

98) NULL pointer dereference (CVE-ID: CVE-2022-49492)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the nvme_alloc_admin_tags() function in drivers/nvme/host/pci.c. A local user can perform a denial of service (DoS) attack.

99) NULL pointer dereference (CVE-ID: CVE-2022-49495)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the msm_hdmi_init() function in drivers/gpu/drm/msm/hdmi/hdmi.c. A local user can perform a denial of service (DoS) attack.

100) Input validation error (CVE-ID: CVE-2022-49497)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the skb_checksum_help() function in net/core/dev.c. A local user can perform a denial of service (DoS) attack.

101) Use-after-free (CVE-ID: CVE-2022-49505)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the nfc_unregister_device() function in net/nfc/core.c. A local user can escalate privileges on the system.

102) Resource management error (CVE-ID: CVE-2022-49513)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the free_policy_dbs_info(), cpufreq_dbs_governor_init() and cpufreq_dbs_governor_exit() functions in drivers/cpufreq/cpufreq_governor.c. A local user can perform a denial of service (DoS) attack.

103) NULL pointer dereference (CVE-ID: CVE-2022-49516)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the ice_vf_fdir_dump_info() function in drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c, within the ice_vc_ena_vlan_stripping() function in drivers/net/ethernet/intel/ice/ice_virtchnl.c, within the ice_vf_clear_counters(), ice_vf_rebuild_vsi(), ice_reset_vf(), ice_dis_vf_qs(), ice_vf_rebuild_host_mac_cfg(), ice_vf_rebuild_host_tx_rate_cfg() and ice_vf_rebuild_host_cfg() functions in drivers/net/ethernet/intel/ice/ice_vf_lib.c, within the ice_free_vf_entries(), ice_dis_vf_mappings(), ice_ena_vf_q_mappings(), ice_ena_vf_mappings(), ice_get_vf_from_pfq(), ice_calc_all_vfs_min_tx_rate() and ice_set_vf_bw() functions in drivers/net/ethernet/intel/ice/ice_sriov.c, within the ice_repr_add() function in drivers/net/ethernet/intel/ice/ice_repr.c, within the ice_devlink_create_vf_port() function in drivers/net/ethernet/intel/ice/ice_devlink.c. A local user can perform a denial of service (DoS) attack.

104) Improper locking (CVE-ID: CVE-2022-49519)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the ath10k_stop() function in drivers/net/wireless/ath/ath10k/mac.c. A local user can perform a denial of service (DoS) attack.

105) Use-after-free (CVE-ID: CVE-2022-49524)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the cx23885_initdev() function in drivers/media/pci/cx23885/cx23885-core.c. A local user can escalate privileges on the system.

106) Input validation error (CVE-ID: CVE-2022-49526)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the le32_to_cpu() and kunmap_atomic() functions in drivers/md/md-bitmap.c. A local user can perform a denial of service (DoS) attack.

107) Memory leak (CVE-ID: CVE-2022-49530)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the si_parse_power_table() function in drivers/gpu/drm/amd/amdgpu/si_dpm.c. A local user can perform a denial of service (DoS) attack.

108) NULL pointer dereference (CVE-ID: CVE-2022-49532)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the virtio_gpu_conn_get_modes() function in drivers/gpu/drm/virtio/virtgpu_display.c. A local user can perform a denial of service (DoS) attack.

109) NULL pointer dereference (CVE-ID: CVE-2022-49538)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the snd_jack_dev_disconnect(), snd_jack_dev_register(), snd_jack_new(), EXPORT_SYMBOL() and snd_jack_report() functions in sound/core/jack.c. A local user can perform a denial of service (DoS) attack.

110) NULL pointer dereference (CVE-ID: CVE-2022-49544)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the libipw_xmit() function in drivers/net/wireless/intel/ipw2x00/libipw_tx.c. A local user can perform a denial of service (DoS) attack.

111) Resource management error (CVE-ID: CVE-2022-49545)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the snd_usbmidi_output_open() function in sound/usb/midi.c. A local user can perform a denial of service (DoS) attack.

112) Memory leak (CVE-ID: CVE-2022-49546)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the machine_kexec() function in arch/x86/kernel/machine_kexec_64.c. A local user can perform a denial of service (DoS) attack.

113) Buffer overflow (CVE-ID: CVE-2022-49555)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the qca_close() function in drivers/bluetooth/hci_qca.c. A local user can perform a denial of service (DoS) attack.

114) Integer underflow (CVE-ID: CVE-2022-49563)

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer underflow within the qat_rsa_enc() and qat_rsa_dec() functions in drivers/crypto/qat/qat_common/qat_asym_algs.c. A local user can execute arbitrary code.

115) Integer underflow (CVE-ID: CVE-2022-49564)

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer underflow within the qat_dh_compute_value() function in drivers/crypto/qat/qat_common/qat_asym_algs.c. A local user can execute arbitrary code.

116) Memory leak (CVE-ID: CVE-2022-49566)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the qat_rsa_exit_tfm() function in drivers/crypto/qat/qat_common/qat_asym_algs.c. A local user can perform a denial of service (DoS) attack.

117) Race condition within a thread (CVE-ID: CVE-2022-49578)

The vulnerability allows a local user to corrupt data.

The vulnerability exists due to a data race within the ipv4_local_port_range() and ipv4_privileged_ports() functions in net/ipv4/sysctl_net_ipv4.c. A local user can corrupt data.

118) Buffer overflow (CVE-ID: CVE-2022-49581)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the be_get_module_info() and be_get_module_eeprom() functions in drivers/net/ethernet/emulex/benet/be_ethtool.c, within the be_cmd_read_port_transceiver_data(), be_cmd_query_cable_type() and be_cmd_query_sfp_info() functions in drivers/net/ethernet/emulex/benet/be_cmds.c. A local user can escalate privileges on the system.

119) Improper locking (CVE-ID: CVE-2022-49584)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the ixgbe_enable_sriov(), ixgbe_rcv_ack_from_vf() and ixgbe_msg_task() functions in drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c, within the ixgbe_sw_init() function in drivers/net/ethernet/intel/ixgbe/ixgbe_main.c. A local user can perform a denial of service (DoS) attack.

120) Race condition within a thread (CVE-ID: CVE-2022-49589)

The vulnerability allows a local user to corrupt data.

The vulnerability exists due to a data race within the igmp_ifc_event(), igmp_heard_query(), igmpv3_add_delrec(), igmpv3_del_delrec(), igmp_group_added(), ip_mc_reset(), ip_mc_del1_src(), ip_mc_del_src() and ip_mc_add_src() functions in net/ipv4/igmp.c, within the amt_build_igmp_gq() and amt_newlink() functions in drivers/net/amt.c. A local user can corrupt data.

121) NULL pointer dereference (CVE-ID: CVE-2022-49605)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the drivers/net/ethernet/intel/igc/igc_regs.h. A local user can perform a denial of service (DoS) attack.

122) Infinite loop (CVE-ID: CVE-2022-49607)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop within the mutex_lock_double(), perf_event_set_output(), ring_buffer_get() and mutex_unlock() functions in kernel/events/core.c. A local user can perform a denial of service (DoS) attack.

123) Integer underflow (CVE-ID: CVE-2022-49610)

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer underflow within the vmx_vcpu_run() function in arch/x86/kvm/vmx/vmx.c, within the SYM_FUNC_START() function in arch/x86/kvm/vmx/vmenter.S, within the check_bugs() function in arch/x86/kernel/cpu/bugs.c, within the common() function in arch/x86/kernel/asm-offsets.c. A local user can execute arbitrary code.

124) Integer underflow (CVE-ID: CVE-2022-49611)

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer underflow within the SYM_INNER_LABEL() function in arch/x86/kvm/vmx/vmenter.S, within the spectre_v2_select_mitigation() function in arch/x86/kernel/cpu/bugs.c. A local user can execute arbitrary code.

125) Memory leak (CVE-ID: CVE-2022-49619)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the sfp_probe() function in drivers/net/phy/sfp.c. A local user can perform a denial of service (DoS) attack.

126) Memory leak (CVE-ID: CVE-2022-49620)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the tipc_sk_create() function in net/tipc/socket.c. A local user can perform a denial of service (DoS) attack.

127) Use-after-free (CVE-ID: CVE-2022-49623)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the xive_irq_bitmap_add() and xive_irq_bitmap_remove_all() functions in arch/powerpc/sysdev/xive/spapr.c. A local user can escalate privileges on the system.

128) Race condition within a thread (CVE-ID: CVE-2022-49638)

The vulnerability allows a local user to corrupt data.

The vulnerability exists due to a data race within the icmp_global_allow() function in net/ipv4/icmp.c. A local user can corrupt data.

129) Race condition within a thread (CVE-ID: CVE-2022-49640)

The vulnerability allows a local user to corrupt data.

The vulnerability exists due to a data race within the do_proc_douintvec_minmax_conv() function in kernel/sysctl.c. A local user can corrupt data.

130) Race condition within a thread (CVE-ID: CVE-2022-49641)

The vulnerability allows a local user to corrupt data.

The vulnerability exists due to a data race within the do_proc_douintvec_conv() function in kernel/sysctl.c. A local user can corrupt data.

131) Use-after-free (CVE-ID: CVE-2022-49647)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the LIST_HEAD_INIT(), find_css_set(), cgroup_migrate_vet_dst(), cgroup_migrate_add_src(), cgroup_migrate_prepare_dst() and cgroup_update_dfl_csses() functions in kernel/cgroup/cgroup.c. A local user can escalate privileges on the system.

132) NULL pointer dereference (CVE-ID: CVE-2022-49649)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the xenvif_rx_action() function in drivers/net/xen-netback/rx.c. A local user can perform a denial of service (DoS) attack.

133) Memory leak (CVE-ID: CVE-2022-49657)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the usbnet_async_cmd_cb() and usbnet_write_cmd_async() functions in drivers/net/usb/usbnet.c. A local user can perform a denial of service (DoS) attack.

134) Use-after-free (CVE-ID: CVE-2022-49667)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the bond_3ad_unbind_slave() function in drivers/net/bonding/bond_3ad.c. A local user can escalate privileges on the system.

135) Race condition (CVE-ID: CVE-2022-49672)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition within the tun_detach_all() function in drivers/net/tun.c. A local user can escalate privileges on the system.

136) Resource management error (CVE-ID: CVE-2022-49673)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the raid5_add_disk() function in drivers/md/raid5.c. A local user can perform a denial of service (DoS) attack.

137) Out-of-bounds read (CVE-ID: CVE-2022-49674)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the validate_region_size(), validate_raid_redundancy(), __rdev_sectors() and raid_iterate_devices() functions in drivers/md/dm-raid.c. A local user can perform a denial of service (DoS) attack.

138) Resource management error (CVE-ID: CVE-2022-49687)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the virtnet_freeze_down(), init_vqs() and virtnet_restore_up() functions in drivers/net/virtio_net.c. A local user can perform a denial of service (DoS) attack.

139) NULL pointer dereference (CVE-ID: CVE-2022-49707)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the ext4_resize_begin() function in fs/ext4/resize.c. A local user can perform a denial of service (DoS) attack.

140) Improper error handling (CVE-ID: CVE-2022-49708)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the ext4_mb_normalize_request() function in fs/ext4/mballoc.c. A local user can perform a denial of service (DoS) attack.

141) Buffer overflow (CVE-ID: CVE-2022-49710)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the create_log_context() function in drivers/md/dm-log.c. A local user can perform a denial of service (DoS) attack.

142) Use-after-free (CVE-ID: CVE-2022-49711)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the fsl_mc_bus_remove() function in drivers/bus/fsl-mc/fsl-mc-bus.c. A local user can escalate privileges on the system.

143) Memory leak (CVE-ID: CVE-2022-49713)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the dwc2_hcd_init() function in drivers/usb/dwc2/hcd.c. A local user can perform a denial of service (DoS) attack.

144) Integer overflow (CVE-ID: CVE-2022-49727)

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer overflow within the l2tp_ip6_sendmsg() function in net/l2tp/l2tp_ip6.c. A local user can execute arbitrary code.

145) NULL pointer dereference (CVE-ID: CVE-2022-49733)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the snd_pcm_oss_sync() function in sound/core/oss/pcm_oss.c. A local user can perform a denial of service (DoS) attack.

146) Use-after-free (CVE-ID: CVE-2022-49740)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the brcmf_construct_chaninfo() and brcmf_enable_bw40_2g() functions in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c. A local user can escalate privileges on the system.

147) Use-after-free (CVE-ID: CVE-2023-2162)

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to a use-after-free error within the scsi_sw_tcp_session_create() function in drivers/scsi/iscsi_tcp.c in SCSI sub-component in the Linux Kernel. A local user can trigger a use-after-free error and gain access to sensitive information.

148) Use-after-free (CVE-ID: CVE-2023-3567)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the vc_screen() function in vcs_read in drivers/tty/vt/vc_screen.c. A local user can trigger a use-after-free error and execute arbitrary code with elevated privileges.

149) Input validation error (CVE-ID: CVE-2023-52933)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the squashfs_xattr_lookup() function in fs/squashfs/xattr_id.c. A local user can perform a denial of service (DoS) attack.

150) Use-after-free (CVE-ID: CVE-2023-52935)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the retract_page_tables() function in mm/khugepaged.c. A local user can escalate privileges on the system.

151) Use-after-free (CVE-ID: CVE-2023-52973)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the vcs_read() function in drivers/tty/vt/vc_screen.c. A local user can escalate privileges on the system.

152) Use-after-free (CVE-ID: CVE-2023-52974)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the iscsi_sw_tcp_host_get_param() and iscsi_sw_tcp_session_create() functions in drivers/scsi/iscsi_tcp.c. A local user can escalate privileges on the system.

153) Out-of-bounds read (CVE-ID: CVE-2023-52979)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the squashfs_read_xattr_id_table() function in fs/squashfs/xattr_id.c. A local user can perform a denial of service (DoS) attack.

154) Memory leak (CVE-ID: CVE-2023-52997)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the ip_metrics_convert() function in net/ipv4/metrics.c. A local user can perform a denial of service (DoS) attack.

155) Memory leak (CVE-ID: CVE-2023-53000)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the validate_nla() and __nla_validate_parse() functions in lib/nlattr.c. A local user can perform a denial of service (DoS) attack.

156) Input validation error (CVE-ID: CVE-2023-53006)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the smbd_destroy() function in fs/cifs/smbdirect.c. A local user can perform a denial of service (DoS) attack.

157) Resource management error (CVE-ID: CVE-2023-53007)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the init_events() function in kernel/trace/trace_output.c, within the early_trace_init() function in kernel/trace/trace.c. A local user can perform a denial of service (DoS) attack.

158) Memory leak (CVE-ID: CVE-2023-53008)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the SMB2_auth_kerberos() function in fs/cifs/smb2pdu.c, within the decode_ntlmssp_challenge() and sess_auth_kerberos() functions in fs/cifs/sess.c, within the build_avpair_blob() function in fs/cifs/cifsencrypt.c. A local user can perform a denial of service (DoS) attack.

159) Buffer overflow (CVE-ID: CVE-2023-53010)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the bnxt_ethtool_init() function in drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c. A local user can escalate privileges on the system.

160) NULL pointer dereference (CVE-ID: CVE-2023-53015)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the betopff_init() function in drivers/hid/hid-betopff.c. A local user can perform a denial of service (DoS) attack.

161) Out-of-bounds read (CVE-ID: CVE-2023-53019)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the EXPORT_SYMBOL() function in drivers/net/phy/mdio_bus.c. A local user can perform a denial of service (DoS) attack.

162) Memory leak (CVE-ID: CVE-2023-53024)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the check_stack_write_fixed_off() function in kernel/bpf/verifier.c. A local user can perform a denial of service (DoS) attack.

163) Improper locking (CVE-ID: CVE-2023-53031)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the DEFINE_MUTEX(), __MUTEX_INITIALIZER(), ppc_nest_imc_cpu_offline(), nest_imc_counters_release(), nest_imc_event_init(), core_imc_mem_init(), ppc_core_imc_cpu_offline(), core_imc_pmu_cpumask_init(), reset_global_refc(), core_imc_counters_release(), core_imc_event_init(), ppc_thread_imc_cpu_offline(), thread_imc_event_init(), thread_imc_event_add(), thread_imc_event_del(), trace_imc_mem_alloc(), ppc_trace_imc_cpu_offline(), trace_imc_event_add(), trace_imc_event_del(), trace_imc_event_init(), init_nest_pmu_ref(), imc_common_mem_free(), imc_common_cpuhp_mem_free() and init_imc_pmu() functions in arch/powerpc/perf/imc-pmu.c. A local user can perform a denial of service (DoS) attack.

164) Improper locking (CVE-ID: CVE-2024-35910)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the tcp_close() function in net/ipv4/tcp.c, within the inet_csk_clear_xmit_timers() function in net/ipv4/inet_connection_sock.c. A local user can perform a denial of service (DoS) attack.

165) Division by zero (CVE-ID: CVE-2024-36968)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a division by zero error within the sco_sock_clear_timer() and sco_conn_add() functions in net/bluetooth/sco.c, within the l2cap_finish_move(), l2cap_rx_state_wait_f() and l2cap_conn_add() functions in net/bluetooth/l2cap_core.c, within the iso_sock_sendmsg() function in net/bluetooth/iso.c, within the hci_cc_read_buffer_size(), hci_cc_le_read_buffer_size(), hci_cs_create_conn(), hci_conn_complete_evt(), hci_conn_request_evt(), hci_cc_le_read_buffer_size_v2(), le_conn_complete_evt(), hci_le_cis_req_evt(), hci_le_big_sync_established_evt() and hci_le_big_info_adv_report_evt() functions in net/bluetooth/hci_event.c, within the hci_conn_add(), hci_conn_add_unset(), hci_connect_le(), hci_add_bis(), hci_connect_le_scan(), hci_connect_acl(), hci_connect_sco(), hci_bind_cis() and hci_iso_qos_setup() functions in net/bluetooth/hci_conn.c. A local user can perform a denial of service (DoS) attack.

166) Out-of-bounds read (CVE-ID: CVE-2024-38559)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the qedf_dbg_debug_cmd_write() function in drivers/scsi/qedf/qedf_debugfs.c. A local user can perform a denial of service (DoS) attack.

167) Improper locking (CVE-ID: CVE-2024-41005)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the netpoll_owner_active() function in net/core/netpoll.c. A local user can perform a denial of service (DoS) attack.

168) Improper locking (CVE-ID: CVE-2024-47678)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the icmpv6_mask_allow(), icmpv6_global_allow(), icmpv6_xrlim_allow(), icmp6_send() and icmpv6_echo_reply() functions in net/ipv6/icmp.c, within the __SPIN_LOCK_UNLOCKED(), icmpv4_mask_allow(), icmpv4_global_allow(), icmpv4_xrlim_allow(), icmp_reply() and __icmp_send() functions in net/ipv4/icmp.c. A local user can perform a denial of service (DoS) attack.

169) Input validation error (CVE-ID: CVE-2024-49571)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the smc_clc_msg_prop_valid() function in net/smc/smc_clc.c, within the smc_listen_prfx_check() and smc_find_ism_v1_device_serv() functions in net/smc/af_smc.c. A local user can perform a denial of service (DoS) attack.

170) Race condition (CVE-ID: CVE-2024-49935)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a race condition within the exit_round_robin() function in drivers/acpi/acpi_pad.c. A local user can perform a denial of service (DoS) attack.

171) NULL pointer dereference (CVE-ID: CVE-2024-49940)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the pppol2tp_session_setsockopt() function in net/l2tp/l2tp_ppp.c, within the l2tp_nl_cmd_session_modify() function in net/l2tp/l2tp_netlink.c, within the l2tp_v3_session_get(), l2tp_session_register(), l2tp_recv_common(), EXPORT_SYMBOL_GPL(), l2tp_session_set_header_len() and l2tp_session_create() functions in net/l2tp/l2tp_core.c. A local user can perform a denial of service (DoS) attack.

172) Improper resource shutdown or release (CVE-ID: CVE-2024-50269)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to failure to properly release resources within the sunxi_musb_exit() function in drivers/usb/musb/sunxi.c. A local user can perform a denial of service (DoS) attack.

173) Integer underflow (CVE-ID: CVE-2024-50290)

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer underflow within the cx24116_read_snr_pct() function in drivers/media/dvb-frontends/cx24116.c. A local user can execute arbitrary code.

174) Resource management error (CVE-ID: CVE-2024-53063)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the DECLARE_RWSEM() and dvb_register_device() functions in drivers/media/dvb-core/dvbdev.c. A local user can perform a denial of service (DoS) attack.

175) Race condition within a thread (CVE-ID: CVE-2024-53124)

The vulnerability allows a local user to corrupt data.

The vulnerability exists due to a data race within the tcp_v6_do_rcv() function in net/ipv6/tcp_ipv6.c, within the dccp_v6_do_rcv() function in net/dccp/ipv6.c. A local user can corrupt data.

176) Double free (CVE-ID: CVE-2024-53140)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a double free error within the netlink_skb_set_owner_r(), netlink_sock_destruct(), deferred_put_nlk_sk() and netlink_release() functions in net/netlink/af_netlink.c. A local user can perform a denial of service (DoS) attack.

177) NULL pointer dereference (CVE-ID: CVE-2024-53680)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the ip_vs_protocol_net_cleanup() and ip_vs_protocol_init() functions in net/netfilter/ipvs/ip_vs_proto.c. A local user can perform a denial of service (DoS) attack.

178) Use-after-free (CVE-ID: CVE-2024-56633)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the sock_put() function in net/ipv4/tcp_bpf.c. A local user can escalate privileges on the system.

179) Use-after-free (CVE-ID: CVE-2024-56640)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the smc_listen_out() and smc_listen_work() functions in net/smc/af_smc.c. A local user can escalate privileges on the system.

180) Resource management error (CVE-ID: CVE-2024-56770)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the tfifo_reset(), tfifo_enqueue(), netem_enqueue() and netem_dequeue() functions in net/sched/sch_netem.c. A local user can perform a denial of service (DoS) attack.

181) Use-after-free (CVE-ID: CVE-2024-57900)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the DEFINE_MUTEX() and ila_add_mapping() functions in net/ipv6/ila/ila_xlat.c. A local user can escalate privileges on the system.

182) Integer overflow (CVE-ID: CVE-2024-57973)

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer overflow within the copy_gl_to_skb_pkt() function in drivers/infiniband/hw/cxgb4/device.c. A local user can execute arbitrary code.

183) Use-after-free (CVE-ID: CVE-2024-57979)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the ptp_ocp_complete() function in drivers/ptp/ptp_ocp.c, within the DEFINE_MUTEX(), pps_cdev_pps_fetch(), pps_cdev_ioctl(), pps_cdev_compat_ioctl(), pps_device_destruct(), pps_register_cdev(), pps_unregister_cdev(), EXPORT_SYMBOL() and pps_init() functions in drivers/pps/pps.c, within the pps_kc_bind() and pps_kc_remove() functions in drivers/pps/kc.c, within the pps_add_offset(), pps_register_source() and pps_event() functions in drivers/pps/kapi.c, within the parport_irq() function in drivers/pps/clients/pps_parport.c, within the pps_tty_dcd_change(), pps_tty_open() and pps_tty_close() functions in drivers/pps/clients/pps-ldisc.c, within the pps_ktimer_exit() and pps_ktimer_init() functions in drivers/pps/clients/pps-ktimer.c, within the pps_gpio_probe() function in drivers/pps/clients/pps-gpio.c. A local user can escalate privileges on the system.

184) Out-of-bounds read (CVE-ID: CVE-2024-57996)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the sfq_change() function in net/sched/sch_sfq.c. A local user can perform a denial of service (DoS) attack.

185) Out-of-bounds read (CVE-ID: CVE-2024-58014)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the wlc_phy_iqcal_gainparams_nphy() function in drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c. A local user can perform a denial of service (DoS) attack.

186) NULL pointer dereference (CVE-ID: CVE-2024-58052)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the atomctrl_get_smc_sclk_range_table() function in drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c. A local user can perform a denial of service (DoS) attack.

187) Improper locking (CVE-ID: CVE-2024-58071)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the team_port_add() function in drivers/net/team/team.c. A local user can perform a denial of service (DoS) attack.

188) Use-after-free (CVE-ID: CVE-2024-58072)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the rtl_pci_get_amd_l1_patch(), _rtl_pci_find_adapter(), rtl_pci_probe(), rtl_pci_disconnect() and EXPORT_SYMBOL() functions in drivers/net/wireless/realtek/rtlwifi/pci.c, within the MODULE_AUTHOR() and rtl_core_module_init() functions in drivers/net/wireless/realtek/rtlwifi/base.c. A local user can escalate privileges on the system.

189) Use-after-free (CVE-ID: CVE-2024-58083)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the include/linux/kvm_host.h. A local user can escalate privileges on the system.

190) Use-after-free (CVE-ID: CVE-2025-21703)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the net/sched/sch_netem.c. A local user can escalate privileges on the system.

191) Resource management error (CVE-ID: CVE-2025-21708)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the MSR_SPEED() and rtl8150_probe() functions in drivers/net/usb/rtl8150.c. A local user can perform a denial of service (DoS) attack.

192) NULL pointer dereference (CVE-ID: CVE-2025-21744)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the brcmf_txfinalize() function in drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c. A local user can perform a denial of service (DoS) attack.

193) Use-after-free (CVE-ID: CVE-2025-21759)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the mld_send_cr() and igmp6_send() functions in net/ipv6/mcast.c. A local user can escalate privileges on the system.

194) Use-after-free (CVE-ID: CVE-2025-21760)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the ip6_nd_hdr() and ndisc_send_skb() functions in net/ipv6/ndisc.c. A local user can escalate privileges on the system.

195) Use-after-free (CVE-ID: CVE-2025-21762)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the arp_xmit_finish() function in net/ipv4/arp.c. A local user can escalate privileges on the system.

196) Use-after-free (CVE-ID: CVE-2025-21763)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the __neigh_notify() function in net/core/neighbour.c. A local user can escalate privileges on the system.

197) Input validation error (CVE-ID: CVE-2025-21765)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the ip6_default_advmss() function in net/ipv6/route.c. A local user can perform a denial of service (DoS) attack.

198) Input validation error (CVE-ID: CVE-2025-21766)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the out: kfree_skb_reason() and __ip_rt_update_pmtu() functions in net/ipv4/route.c. A local user can perform a denial of service (DoS) attack.

199) NULL pointer dereference (CVE-ID: CVE-2025-21776)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the hub_probe() function in drivers/usb/core/hub.c. A local user can perform a denial of service (DoS) attack.

200) Out-of-bounds read (CVE-ID: CVE-2025-21782)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the orangefs_debug_write() function in fs/orangefs/orangefs-debugfs.c. A local user can perform a denial of service (DoS) attack.

201) Out-of-bounds read (CVE-ID: CVE-2025-21785)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the populate_cache_leaves() function in arch/arm64/kernel/cacheinfo.c. A local user can perform a denial of service (DoS) attack.

202) Use-after-free (CVE-ID: CVE-2025-21791)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the include/net/l3mdev.h. A local user can escalate privileges on the system.

203) Use-after-free (CVE-ID: CVE-2025-21796)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the posix_acl_release() function in fs/nfsd/nfs3acl.c, within the posix_acl_release() function in fs/nfsd/nfs2acl.c. A local user can escalate privileges on the system.

204) Input validation error (CVE-ID: CVE-2025-21802)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the hclgevf_init() function in drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c, within the hclge_init() function in drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c, within the module_init() function in drivers/net/ethernet/hisilicon/hns3/hns3_enet.c, within the EXPORT_SYMBOL() function in drivers/net/ethernet/hisilicon/hns3/hnae3.c. A local user can perform a denial of service (DoS) attack.

205) Resource management error (CVE-ID: CVE-2025-21821)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the omap_init_lcd_dma() function in drivers/video/fbdev/omap/lcd_dma.c. A local user can perform a denial of service (DoS) attack.

206) Input validation error (CVE-ID: CVE-2025-21831)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the DECLARE_PCI_FIXUP_SUSPEND() function in arch/x86/pci/fixup.c. A local user can perform a denial of service (DoS) attack.

207) NULL pointer dereference (CVE-ID: CVE-2025-21846)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the do_acct_process(), acct_pin_kill(), close_work(), encode_float() and fill_ac() functions in kernel/acct.c. A local user can perform a denial of service (DoS) attack.

208) NULL pointer dereference (CVE-ID: CVE-2025-21848)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the nfp_bpf_cmsg_alloc() function in drivers/net/ethernet/netronome/nfp/bpf/cmsg.c. A local user can perform a denial of service (DoS) attack.

209) Use-after-free (CVE-ID: CVE-2025-21855)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the ibmvnic_xmit() and netif_stop_subqueue() functions in drivers/net/ethernet/ibm/ibmvnic.c. A local user can escalate privileges on the system.

210) Use-after-free (CVE-ID: CVE-2025-21858)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the geneve_destroy_tunnels() function in drivers/net/geneve.c. A local user can escalate privileges on the system.

211) Improper error handling (CVE-ID: CVE-2025-21865)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the gtp_net_exit_batch_rtnl() function in drivers/net/gtp.c. A local user can perform a denial of service (DoS) attack.

212) Improper locking (CVE-ID: CVE-2025-21871)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the optee_supp_thrd_req() function in drivers/tee/optee/supp.c. A local user can perform a denial of service (DoS) attack.

213) Resource management error (CVE-ID: CVE-2025-21877)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the genelink_bind() function in drivers/net/usb/gl620a.c. A local user can perform a denial of service (DoS) attack.

214) Use of uninitialized resource (CVE-ID: CVE-2025-21891)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the ipvlan_addr_lookup() and ipvlan_process_v6_outbound() functions in drivers/net/ipvlan/ipvlan_core.c. A local user can perform a denial of service (DoS) attack.

215) Resource management error (CVE-ID: CVE-2025-21916)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the cxacru_bind() function in drivers/usb/atm/cxacru.c. A local user can perform a denial of service (DoS) attack.

216) Use of uninitialized resource (CVE-ID: CVE-2025-21922)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the ppp_send_frame() and ppp_receive_nonmp_frame() functions in drivers/net/ppp/ppp_generic.c. A local user can perform a denial of service (DoS) attack.

217) Use-after-free (CVE-ID: CVE-2025-21934)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the rio_mport_add_riodev() function in drivers/rapidio/devices/rio_mport_cdev.c. A local user can escalate privileges on the system.

218) Use-after-free (CVE-ID: CVE-2025-21935)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the rio_scan_alloc_net() function in drivers/rapidio/rio-scan.c. A local user can escalate privileges on the system.

219) Use-after-free (CVE-ID: CVE-2025-21969)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the l2cap_get_ident(), l2cap_send_cmd(), l2cap_conn_del(), l2cap_conn_free(), l2cap_recv_reset() and l2cap_recv_acldata() functions in net/bluetooth/l2cap_core.c. A local user can escalate privileges on the system.

220) Out-of-bounds read (CVE-ID: CVE-2025-21993)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the ibft_attr_show_nic() function in drivers/firmware/iscsi_ibft.c. A local user can perform a denial of service (DoS) attack.

221) Use of uninitialized resource (CVE-ID: CVE-2025-21996)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the radeon_vce_cs_parse() function in drivers/gpu/drm/radeon/radeon_vce.c. A local user can perform a denial of service (DoS) attack.

222) NULL pointer dereference (CVE-ID: CVE-2025-22007)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the chan_alloc_skb_cb() function in net/bluetooth/6lowpan.c. A local user can perform a denial of service (DoS) attack.

Remediation

Install update from vendor's website.

References

• https://www.suse.com/support/update/announcement/2025/suse-su-20251293-1/