CVE-2022-50472

Root has patched CVE-2022-50472 in the linux package for Root:Debian:11. Multiple fixed versions available.

In the Linux kernel, the following vulnerability has been resolved: IB/mad: Don't call to function that might sleep while in atomic context Tracepoints are not allowed to sleep, as such the following splat is generated due to call to ib_query_pkey() in atomic context. WARNING: CPU: 0 PID: 1888000 at kernel/trace/ring_buffer.c:2492 rb_commit+0xc1/0x220 CPU: 0 PID: 1888000 Comm: kworker/u9:0 Kdump: loaded Tainted: G OE --------- - - 4.18.0-305.3.1.el8.x86_64 #1 Hardware name: Red Hat KVM, BIOS 1.13.0-2.module_el8.3.0+555+a55c8938 04/01/2014 Workqueue: ib-comp-unb-wq ib_cq_poll_work [ib_core] RIP: 0010:rb_commit+0xc1/0x220 RSP: 0000:ffffa8ac80f9bca0 EFLAGS: 00010202 RAX: ffff8951c7c01300 RBX: ffff8951c7c14a00 RCX: 0000000000000246 RDX: ffff8951c707c000 RSI: ffff8951c707c57c RDI: ffff8951c7c14a00 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: ffff8951c7c01300 R11: 0000000000000001 R12: 0000000000000246 R13: 0000000000000000 R14: ffffffff964c70c0 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8951fbc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f20e8f39010 CR3: 000000002ca10005 CR4: 0000000000170ef0 Call Trace: ring_buffer_unlock_commit+0x1d/0xa0 trace_buffer_unlock_commit_regs+0x3b/0x1b0 trace_event_buffer_commit+0x67/0x1d0 trace_event_raw_event_ib_mad_recv_done_handler+0x11c/0x160 [ib_core] ib_mad_recv_done+0x48b/0xc10 [ib_core] ? trace_event_raw_event_cq_poll+0x6f/0xb0 [ib_core] __ib_process_cq+0x91/0x1c0 [ib_core] ib_cq_poll_work+0x26/0x80 [ib_core] process_one_work+0x1a7/0x360 ? create_worker+0x1a0/0x1a0 worker_thread+0x30/0x390 ? create_worker+0x1a0/0x1a0 kthread+0x116/0x130 ? kthread_flush_work_fn+0x10/0x10 ret_from_fork+0x35/0x40 ---[ end trace 78ba8509d3830a16 ]---

• KVM: x86: Fix shadow paging use-after-free due to unexpected role {CVE-2026-46113}
• KVM: x86: Fix shadow paging use-after-free due to unexpected GFN {CVE-2026-46113}
• Bluetooth: bcsp: receive data only if registered {CVE-2025-40308}
• xen/privcmd: unregister xenstore notifier on module exit {CVE-2026-31788}
• xen/privcmd: restrict usage in unprivileged domU {CVE-2026-31788}
• USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts {CVE-2026-43429}
• net: usb: rtl8150: enable basic endpoint checking {CVE-2025-21708}
• net: usb: kaweth: validate USB endpoints {CVE-2026-23312}
• net: usb: kalmia: validate USB endpoints {CVE-2026-23365}
• net: usb: pegasus: validate USB endpoints {CVE-2026-23290}
• net: usb: pegasus: enable basic endpoint checking {CVE-2026-43156}
• USB: usbcore: Introduce usb_bulk_msg_killable() {CVE-2026-43429}
• USB: core: Add routines for endpoint checks in old drivers {CVE-2026-43156}
• nf_tables: nft_dynset: fix possible stateful expression memleak in error path {CVE-2026-23399}
• tpm: Cap the number of PCR banks {CVE-2025-71077}
• clk: imx: clk-imx8mp: improve error handling in imx8mp_clocks_probe() {CVE-2023-53704}
• dm: fix a race condition in retrieve_deps {CVE-2023-54324}
• ice: fix Tx scheduler error handling in XDP callback {CVE-2025-38127}
• mlx5: fix skb leak while fifo resync and push {CVE-2023-54238}
• mmc: vub300: fix return value check of mmc_add_host() {CVE-2022-50251}
• bonding: annotate data-races around slave->last_rx {CVE-2026-23212}
• RDMA/irdma: Fix data race on CQP completion stats {CVE-2023-54302}
• bpf: cpumap: Fix memory leak in cpu_map_update_elem {CVE-2023-53441}
• fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var {CVE-2025-38215}
• trace/fgraph: Fix the warning caused by missing unregister notifier {CVE-2025-39829}
• vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects {CVE-2025-39850}
• team: prevent adding a device which is already a team device lower {CVE-2024-58071}
• net: stmmac: move the EST lock to struct stmmac_priv {CVE-2024-38594}
• drm/amd/display: Disable PSR-SU on Parade 08-01 TCON too {CVE-2024-50108}
• rxrpc: Fix handling of received connection abort {CVE-2024-58053}
• bnxt_en: Fix out-of-bound memcpy() during ethtool -w {CVE-2025-37911}
• scsi: storvsc: Ratelimit warning logs to prevent VM denial of service {CVE-2025-21690}
• net: atlantic: Fix DMA mapping for PTP hwts ring {CVE-2024-26680}
• wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop() {CVE-2024-47713}
• drm/amd/display: Add null check for 'afb' in amdgpu_dm_plane_handle_cursor_update (v2) {CVE-2024-49905}
• dm: fix NULL pointer dereference in __dm_suspend() {CVE-2025-40134}
• smb: client: validate the whole DACL before rewriting it in cifsacl {CVE-2026-31709}
• PM: runtime: Fix a race condition related to device removal {CVE-2026-23452}
• ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces {CVE-2026-43436}
• nvme-pci: Fix race bug in nvme_poll_irqdisable() {CVE-2026-43448}
• sctp: add mutual exclusion in proc_sctp_do_udp_port() {CVE-2025-22062}
• cachefiles: fix dentry leak in cachefiles_open_file() {CVE-2024-49870}
• mm: revert "mm: shmem: fix data-race in shmem_getattr()" {CVE-2024-53136}
• memcg: fix soft lockup in the OOM process {CVE-2024-57977}
• resource: fix region_intersects() vs add_memory_driver_managed() {CVE-2024-49878}
• r8169: add tally counter fields added with RTL8125 {CVE-2024-49973}
• svcrdma: fix miss destroy percpu_counter in svc_rdma_proc_init() {CVE-2024-53215}
• ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths {CVE-2026-43066}
• wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() {CVE-2025-71273}
• net: netlink: af_netlink: Prevent empty skb by adding a check on len. {CVE-2021-47606}
• extcon: Modify extcon device to be created after driver data is set {CVE-2022-49308}
• tick/nohz: unexport __init-annotated tick_nohz_full_setup() {CVE-2022-49675}
• bridge:…

The SUSE Linux Enterprise 15 SP4 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2022-50327: ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value (bsc#1249859).
• CVE-2022-50334: hugetlbfs: fix null-ptr-deref in hugetlbfs_parse_param() (bsc#1249857).
• CVE-2022-50490: bpf: Propagate error from htab_lock_bucket() to userspace (bsc#1251164).
• CVE-2022-50516: fs: dlm: fix invalid derefence of sb_lvbptr (bsc#1251741).
• CVE-2023-53365: ip6mr: Fix skb_under_panic in ip6mr_cache_report() (bsc#1249988).
• CVE-2023-53500: xfrm: fix slab-use-after-free in decode_session6 (bsc#1250816).
• CVE-2023-53559: ip_vti: fix potential slab-use-after-free in decode_session6 (bsc#1251052).
• CVE-2023-53574: wifi: rtw88: delete timer and free skb queue when unloading (bsc#1251222).
• CVE-2023-53619: netfilter: conntrack: Avoid nf_ct_helper_hash uses after free (bsc#1251743).
• CVE-2023-53673: Bluetooth: hci_event: call disconnect callback before deleting conn (bsc#1251763).
• CVE-2023-53705: ipv6: Fix out-of-bounds access in ipv6_find_tlv() (bsc#1252554).
• CVE-2025-39742: RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (bsc#1249479).
• CVE-2025-39945: cnic: Fix use-after-free bugs in cnic_delete_task (bsc#1251230).
• CVE-2025-39967: fbcon: fix integer overflow in fbcon_do_set_font (bsc#1252033).
• CVE-2025-39968: i40e: add max boundary check for VF filters (bsc#1252047).
• CVE-2025-39973: i40e: add validation for ring_len param (bsc#1252035).
• CVE-2025-39978: octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (bsc#1252069).
• CVE-2025-40018: ipvs: Defer ip_vs_ftp unregister during netns cleanup (bsc#1252688).
• CVE-2025-40044: fs: udf: fix OOB read in lengthAllocDescs handling (bsc#1252785).
• CVE-2025-40088: hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (bsc#1252904).
• CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).

The following non security issues were fixed:

• fbcon: Fix OOB access in font allocation (bsc#1252033)
• mm: avoid unnecessary page fault retires on shared memory types (bsc#1251823).
• net: hv_netvsc: fix loss of early receive events from host during channel open (bsc#1252265).

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2022-50327: ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value (bsc#1249859).
• CVE-2022-50334: hugetlbfs: fix null-ptr-deref in hugetlbfs_parse_param() (bsc#1249857).
• CVE-2022-50490: bpf: Propagate error from htab_lock_bucket() to userspace (bsc#1251164).
• CVE-2022-50516: fs: dlm: fix invalid derefence of sb_lvbptr (bsc#1251741).
• CVE-2023-53365: ip6mr: Fix skb_under_panic in ip6mr_cache_report() (bsc#1249988).
• CVE-2023-53500: xfrm: fix slab-use-after-free in decode_session6 (bsc#1250816).
• CVE-2023-53559: ip_vti: fix potential slab-use-after-free in decode_session6 (bsc#1251052).
• CVE-2023-53574: wifi: rtw88: delete timer and free skb queue when unloading (bsc#1251222).
• CVE-2023-53619: netfilter: conntrack: Avoid nf_ct_helper_hash uses after free (bsc#1251743).
• CVE-2023-53673: Bluetooth: hci_event: call disconnect callback before deleting conn (bsc#1251763).
• CVE-2023-53705: ipv6: Fix out-of-bounds access in ipv6_find_tlv() (bsc#1252554).
• CVE-2025-39742: RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (bsc#1249479).
• CVE-2025-39945: cnic: Fix use-after-free bugs in cnic_delete_task (bsc#1251230).
• CVE-2025-39967: fbcon: fix integer overflow in fbcon_do_set_font (bsc#1252033).
• CVE-2025-39968: i40e: add max boundary check for VF filters (bsc#1252047).
• CVE-2025-39973: i40e: add validation for ring_len param (bsc#1252035).
• CVE-2025-39978: octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (bsc#1252069).
• CVE-2025-40018: ipvs: Defer ip_vs_ftp unregister during netns cleanup (bsc#1252688).
• CVE-2025-40044: fs: udf: fix OOB read in lengthAllocDescs handling (bsc#1252785).
• CVE-2025-40088: hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (bsc#1252904).
• CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).

The following non security issues were fixed:

• fbcon: Fix OOB access in font allocation (bsc#1252033)
• mm: avoid unnecessary page fault retires on shared memory types (bsc#1251823).
• net: hv_netvsc: fix loss of early receive events from host during channel open (bsc#1252265).

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2022-50327: ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value (bsc#1249859).
• CVE-2022-50334: hugetlbfs: fix null-ptr-deref in hugetlbfs_parse_param() (bsc#1249857).
• CVE-2022-50490: bpf: Propagate error from htab_lock_bucket() to userspace (bsc#1251164).
• CVE-2022-50516: fs: dlm: fix invalid derefence of sb_lvbptr (bsc#1251741).
• CVE-2023-53365: ip6mr: Fix skb_under_panic in ip6mr_cache_report() (bsc#1249988).
• CVE-2023-53500: xfrm: fix slab-use-after-free in decode_session6 (bsc#1250816).
• CVE-2023-53559: ip_vti: fix potential slab-use-after-free in decode_session6 (bsc#1251052).
• CVE-2023-53574: wifi: rtw88: delete timer and free skb queue when unloading (bsc#1251222).
• CVE-2023-53619: netfilter: conntrack: Avoid nf_ct_helper_hash uses after free (bsc#1251743).
• CVE-2023-53673: Bluetooth: hci_event: call disconnect callback before deleting conn (bsc#1251763).
• CVE-2023-53705: ipv6: Fix out-of-bounds access in ipv6_find_tlv() (bsc#1252554).
• CVE-2025-37885: KVM: x86: Reset IRTE to host control if new route isn't postable (bsc#1242960).
• CVE-2025-38084: hugetlb: unshare some PMDs when splitting VMAs (bsc#1245498).
• CVE-2025-38085: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (bsc#1245499).
• CVE-2025-38476: rpl: Fix use-after-free in rpl_do_srh_inline() (bsc#1247317).
• CVE-2025-39742: RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (bsc#1249479).
• CVE-2025-39797: xfrm: Duplicate SPI Handling (bsc#1249608).
• CVE-2025-39945: cnic: Fix use-after-free bugs in cnic_delete_task (bsc#1251230).
• CVE-2025-39967: fbcon: fix integer overflow in fbcon_do_set_font (bsc#1252033).
• CVE-2025-39968: i40e: add max boundary check for VF filters (bsc#1252047).
• CVE-2025-39973: i40e: add validation for ring_len param (bsc#1252035).
• CVE-2025-39978: octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (bsc#1252069).
• CVE-2025-39981: Bluetooth: MGMT: Fix possible UAFs (bsc#1252060).
• CVE-2025-40018: ipvs: Defer ip_vs_ftp unregister during netns cleanup (bsc#1252688).
• CVE-2025-40044: fs: udf: fix OOB read in lengthAllocDescs handling (bsc#1252785).

The following non security issues were fixed:

• NFS: remove revoked delegation from server's delegation list (bsc#1246211).
• NFSv4: Allow FREE_STATEID to clean up delegations (bsc#1246211).
• fbcon: Fix OOB access in font allocation (bsc#1252033)
• kabi fix for NFSv4: Allow FREE_STATEID to clean up delegations (bsc#1246211).
• mm: avoid unnecessary page fault retires on shared memory types (bsc#1251823).
• net: hv_netvsc: fix loss of early receive events from host during channel open (bsc#1252265).
• net: mana: Switch to page pool for jumbo frames (bsc#1248754).
• net: mana: Use page pool fragments for RX buffers instead of full pages to improve memory efficiency (bsc#1248754).
• netfilter: nft_objref: validate objref and objrefmap expressions (bsc#1250237). No CVE available yet, please see the bugzilla ticket referenced.

The SUSE Linux Enterprise 15 SP5 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2022-50327: ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value (bsc#1249859).
• CVE-2022-50334: hugetlbfs: fix null-ptr-deref in hugetlbfs_parse_param() (bsc#1249857).
• CVE-2022-50490: bpf: Propagate error from htab_lock_bucket() to userspace (bsc#1251164).
• CVE-2022-50516: fs: dlm: fix invalid derefence of sb_lvbptr (bsc#1251741).
• CVE-2023-53365: ip6mr: Fix skb_under_panic in ip6mr_cache_report() (bsc#1249988).
• CVE-2023-53500: xfrm: fix slab-use-after-free in decode_session6 (bsc#1250816).
• CVE-2023-53559: ip_vti: fix potential slab-use-after-free in decode_session6 (bsc#1251052).
• CVE-2023-53574: wifi: rtw88: delete timer and free skb queue when unloading (bsc#1251222).
• CVE-2023-53619: netfilter: conntrack: Avoid nf_ct_helper_hash uses after free (bsc#1251743).
• CVE-2023-53673: Bluetooth: hci_event: call disconnect callback before deleting conn (bsc#1251763).
• CVE-2023-53705: ipv6: Fix out-of-bounds access in ipv6_find_tlv() (bsc#1252554).
• CVE-2025-37885: KVM: x86: Reset IRTE to host control if new route isn't postable (bsc#1242960).
• CVE-2025-38084: hugetlb: unshare some PMDs when splitting VMAs (bsc#1245498).
• CVE-2025-38085: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (bsc#1245499).
• CVE-2025-38476: rpl: Fix use-after-free in rpl_do_srh_inline() (bsc#1247317).
• CVE-2025-39742: RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (bsc#1249479).
• CVE-2025-39797: xfrm: Duplicate SPI Handling (bsc#1249608).
• CVE-2025-39945: cnic: Fix use-after-free bugs in cnic_delete_task (bsc#1251230).
• CVE-2025-39967: fbcon: fix integer overflow in fbcon_do_set_font (bsc#1252033).
• CVE-2025-39968: i40e: add max boundary check for VF filters (bsc#1252047).
• CVE-2025-39973: i40e: add validation for ring_len param (bsc#1252035).
• CVE-2025-39978: octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (bsc#1252069).
• CVE-2025-39981: Bluetooth: MGMT: Fix possible UAFs (bsc#1252060).
• CVE-2025-40018: ipvs: Defer ip_vs_ftp unregister during netns cleanup (bsc#1252688).
• CVE-2025-40044: fs: udf: fix OOB read in lengthAllocDescs handling (bsc#1252785).

The following non security issues were fixed:

• NFS: remove revoked delegation from server's delegation list (bsc#1246211).
• NFSv4: Allow FREE_STATEID to clean up delegations (bsc#1246211).
• fbcon: Fix OOB access in font allocation (bsc#1252033)
• kabi fix for NFSv4: Allow FREE_STATEID to clean up delegations (bsc#1246211).
• kernel-subpackage-spec: Do not doubly-sign modules (bsc#1251930).
• mm: avoid unnecessary page fault retires on shared memory types (bsc#1251823).
• net: hv_netvsc: fix loss of early receive events from host during channel open (bsc#1252265).
• net: mana: Switch to page pool for jumbo frames (bsc#1248754).
• net: mana: Use page pool fragments for RX buffers instead of full pages to improve memory efficiency (bsc#1248754).
• netfilter: nft_objref: validate objref and objrefmap expressions (bsc#1250237).
• rpm/check-for-config-changes: ignore CONFIG_SCHED_PROXY_EXEC, too (bsc#1250946)