{"kind": "product", "path": "vulns/ubuntu-18.04-lts/linux-kvm", "name": "linux-kvm", "product": "linux-kvm", "ecosystem": "Ubuntu:18.04:LTS", "items": [{"id": "CVE-2022-50887", "noindex": false, "published": "2025-12-30T12:37:05.505Z", "modified": "2026-05-11T19:27:03.329Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00237, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2022-50887", "title": "regulator: core: fix unbalanced of node refcount in regulator_dev_lookup()", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nregulator: core: fix unbalanced of node refcount in regulator_dev_lookup()\n\nI got the the following report:\n\n  OF: ERROR: memory leak, expected refcount 1 instead of 2,\n  of_node_get()/of_node_put() unbalanced - destroy cset entry:\n  attach overlay node /i2c/pmic@62/regulators/exten\n\nIn of_get_regulator(), the node is returned from of_parse_phandle()\nwith refcount incremented, after using it, of_node_put() need be called.", "references": ["https://git.kernel.org/stable/c/0e88505ac0a6ae97746bcdbd4b042ee9f20455ae", "https://git.kernel.org/stable/c/4dfcf5087db9a34a300d6b99009232d4537c3e6a", "https://git.kernel.org/stable/c/3ac888db0f67813d91373a9a61c840f815cd4ec9"], "fixes": ["4.15.0-1137.142"], "products": [{"name": "linux-kvm", "path": "vulns/ubuntu-18.04-lts/linux-kvm", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2022-50886", "noindex": false, "published": "2025-12-30T12:34:12.782Z", "modified": "2026-05-11T19:27:02.120Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00232, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2022-50886", "title": "mmc: toshsd: fix return value check of mmc_add_host()", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: toshsd: fix return value check of mmc_add_host()\n\nmmc_add_host() may return error, if we ignore its return value, the memory\nthat allocated in mmc_alloc_host() will be leaked and it will lead a kernel\ncrash because of deleting not added device in the remove path.\n\nSo fix this by checking the return value and goto error path which will call\nmmc_free_host(), besides, free_irq() also needs be called.", "references": ["https://git.kernel.org/stable/c/34ae492f8d172f0bd193c24cad588b35419ea47a", "https://git.kernel.org/stable/c/3329e7b7132ca727263fb0ee214cf52cc6dcaaad", "https://git.kernel.org/stable/c/4f6cb1c685f9e20a4a9fa565e442f5af4dad70ff"], "fixes": ["4.15.0-1137.142"], "products": [{"name": "linux-kvm", "path": "vulns/ubuntu-18.04-lts/linux-kvm", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2022-50885", "noindex": false, "published": "2025-12-30T12:34:12.093Z", "modified": "2026-10-15T21:41:24.572Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.006, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2022-50885", "title": "RDMA/rxe: Fix NULL-ptr-deref in rxe_qp_do_cleanup() when socket create failed", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Fix NULL-ptr-deref in rxe_qp_do_cleanup() when socket create failed\n\nThere is a null-ptr-deref when mount.cifs over rdma:\n\n  BUG: KASAN: null-ptr-deref in rxe_qp_do_cleanup+0x2f3/0x360 [rdma_rxe]\n  Read of size 8 at addr 0000000000000018 by task mount.cifs/3046\n\n  CPU: 2 PID: 3046 Comm: mount.cifs Not tainted 6.1.0-rc5+ #62\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc3\n  Call Trace:\n   <TASK>\n   dump_stack_lvl+0x34/0x44\n   kasan_report+0xad/0x130\n   rxe_qp_do_cleanup+0x2f3/0x360 [rdma_rxe]\n   execute_in_process_context+0x25/0x90\n   __rx", "references": ["https://git.kernel.org/stable/c/ee24de095569935eba600f7735e8e8ddea5b418e", "https://git.kernel.org/stable/c/7340ca9f782be6fbe3f64a134dc112772764f766", "https://git.kernel.org/stable/c/bd7106a6004f1077a365ca7f5a99c7a708e20714"], "fixes": ["4.15.0-1137.142"], "products": [{"name": "linux-kvm", "path": "vulns/ubuntu-18.04-lts/linux-kvm", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2022-50884", "noindex": false, "published": "2025-12-30T12:34:11.390Z", "modified": "2026-05-11T19:26:59.632Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00233, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2022-50884", "title": "drm: Prevent drm_copy_field() to attempt copying a NULL pointer", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm: Prevent drm_copy_field() to attempt copying a NULL pointer\n\nThere are some struct drm_driver fields that are required by drivers since\ndrm_copy_field() attempts to copy them to user-space via DRM_IOCTL_VERSION.\n\nBut it can be possible that a driver has a bug and did not set some of the\nfields, which leads to drm_copy_field() attempting to copy a NULL pointer:\n\n[ +10.395966] Unable to handle kernel access to user memory outside uaccess routines at virtual address 0000000000000000\n[  +0.010955] Mem abort info:\n[  +0.002835]   ESR = 0x0000000096000004\n[  +0.003872]   EC = ", "references": ["https://git.kernel.org/stable/c/d213914386a0ede76a4549b41de30192fb92c595", "https://git.kernel.org/stable/c/ee9885cd936aad88f84d0cf90bf9a70e83e42a97", "https://git.kernel.org/stable/c/8052612b9d08048ebbebcb572894670b4ac07d2f"], "fixes": ["4.15.0-1135.140"], "products": [{"name": "linux-kvm", "path": "vulns/ubuntu-18.04-lts/linux-kvm", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2022-50880", "noindex": false, "published": "2025-12-30T12:23:19.551Z", "modified": "2026-10-15T21:41:24.432Z", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00321, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2022-50880", "title": "wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state()", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state()\n\nWhen peer delete failed in a disconnect operation, use-after-free\ndetected by KFENCE in below log. It is because for each vdev_id and\naddress, it has only one struct ath10k_peer, it is allocated in\nath10k_peer_map_event(). When connected to an AP, it has more than\none HTT_T2H_MSG_TYPE_PEER_MAP reported from firmware, then the\narray peer_map of struct ath10k will be set muti-elements to the\nsame ath10k_peer in ath10k_peer_map_event(). When peer delete failed\nin ath10k_sta_state(), the ath10k_peer will ", "references": ["https://git.kernel.org/stable/c/15604ab67179ae27ea3c7fb24b6df32b143257c4", "https://git.kernel.org/stable/c/2d6259715c9597a6cfa25db8911683eb0073b1c6", "https://git.kernel.org/stable/c/f12fc305c127bd07bb50373e29c6037696f916a8"], "fixes": ["4.15.0-1135.140"], "products": [{"name": "linux-kvm", "path": "vulns/ubuntu-18.04-lts/linux-kvm", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2022-50876", "noindex": false, "published": "2025-12-30T12:23:16.790Z", "modified": "2026-05-11T19:26:50.207Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00233, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2022-50876", "title": "usb: musb: Fix musb_gadget.c rxstate overflow bug", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: musb: Fix musb_gadget.c rxstate overflow bug\n\nThe usb function device call musb_gadget_queue() adds the passed\nrequest to musb_ep::req_list,If the (request->length > musb_ep->packet_sz)\nand (is_buffer_mapped(req) return false),the rxstate() will copy all data\nin fifo to request->buf which may cause request->buf out of bounds.\n\nFix it by add the length check :\nfifocnt = min_t(unsigned, request->length - request->actual, fifocnt);", "references": ["https://git.kernel.org/stable/c/826f84ab04a5cafe484ea9c2c85a3930068e5cb7", "https://git.kernel.org/stable/c/a1008c8b9f357691ce6a8fdb8f157aecb2d79167", "https://git.kernel.org/stable/c/7c80f3a918ba9aa26fb699ee887064ec3af0396a"], "fixes": ["4.15.0-1135.140"], "products": [{"name": "linux-kvm", "path": "vulns/ubuntu-18.04-lts/linux-kvm", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2022-50870", "noindex": false, "published": "2025-12-30T12:15:40.718Z", "modified": "2026-05-11T19:26:43.134Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00211, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2022-50870", "title": "powerpc/rtas: avoid device tree lookups in rtas_os_term()", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/rtas: avoid device tree lookups in rtas_os_term()\n\nrtas_os_term() is called during panic. Its behavior depends on a couple\nof conditions in the /rtas node of the device tree, the traversal of\nwhich entails locking and local IRQ state changes. If the kernel panics\nwhile devtree_lock is held, rtas_os_term() as currently written could\nhang.\n\nInstead of discovering the relevant characteristics at panic time,\ncache them in file-static variables at boot. Note the lookup for\n\"ibm,extended-os-term\" is converted to of_property_read_bool() since it\nis a boolean property, not a", "references": ["https://git.kernel.org/stable/c/e23822c7381c59d9e42e65771b6e17c71ed30ea7", "https://git.kernel.org/stable/c/06a07fbb32b3a23eec20a42b1e64474da0a3b33e", "https://git.kernel.org/stable/c/c2fa91abf22a705cf02f886cd99cff41f4ceda60"], "fixes": ["4.15.0-1137.142"], "products": [{"name": "linux-kvm", "path": "vulns/ubuntu-18.04-lts/linux-kvm", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2022-50868", "noindex": false, "published": "2025-12-30T12:15:39.211Z", "modified": "2026-05-11T19:26:40.801Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00242, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2022-50868", "title": "hwrng: amd - Fix PCI device refcount leak", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwrng: amd - Fix PCI device refcount leak\n\nfor_each_pci_dev() is implemented by pci_get_device(). The comment of\npci_get_device() says that it will increase the reference count for the\nreturned pci_dev and also decrease the reference count for the input\npci_dev @from if it is not NULL.\n\nIf we break for_each_pci_dev() loop with pdev not NULL, we need to call\npci_dev_put() to decrease the reference count. Add the missing\npci_dev_put() for the normal and error path.", "references": ["https://git.kernel.org/stable/c/f1c97f72ffd504f49882774e2ab689d982dc7afc", "https://git.kernel.org/stable/c/526c316948819d3ecd2bb20fe5e2580c51a1b760", "https://git.kernel.org/stable/c/e246f5eff26055bdcb61a2cc99c50af72a19680f"], "fixes": ["4.15.0-1137.142"], "products": [{"name": "linux-kvm", "path": "vulns/ubuntu-18.04-lts/linux-kvm", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2022-50866", "noindex": false, "published": "2025-12-30T12:15:37.827Z", "modified": "2026-05-11T19:26:38.291Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00232, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2022-50866", "title": "ASoC: pxa: fix null-pointer dereference in filter()", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: pxa: fix null-pointer dereference in filter()\n\nkasprintf() would return NULL pointer when kmalloc() fail to allocate.\nNeed to check the return pointer before calling strcmp().", "references": ["https://git.kernel.org/stable/c/3ec75e0ea9550b8f2e531172f2e67ba9d5227ec3", "https://git.kernel.org/stable/c/5b510a82740d2a42a75b5661b402bcaf8ae22cd5", "https://git.kernel.org/stable/c/0abd1d78317a3a2dfe00b203fbf14ee7df537e0a"], "fixes": ["4.15.0-1137.142"], "products": [{"name": "linux-kvm", "path": "vulns/ubuntu-18.04-lts/linux-kvm", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2022-50857", "noindex": false, "published": "2025-12-30T12:15:31.873Z", "modified": "2026-05-11T19:26:27.847Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00242, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2022-50857", "title": "rapidio: rio: fix possible name leak in rio_register_mport()", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrapidio: rio: fix possible name leak in rio_register_mport()\n\nIf device_register() returns error, the name allocated by dev_set_name()\nneed be freed.  It should use put_device() to give up the reference in the\nerror path, so that the name can be freed in kobject_cleanup(), and\nlist_del() is called to delete the port from rio_mports.", "references": ["https://git.kernel.org/stable/c/0a71344f99289250e4d5b8adbac76f444485c840", "https://git.kernel.org/stable/c/117fede82e9d6ea3de30746d500eb5edc2eb8310", "https://git.kernel.org/stable/c/a73a626c0510d203e369aeb26c4d6ec9c75af027"], "fixes": ["4.15.0-1137.142"], "products": [{"name": "linux-kvm", "path": "vulns/ubuntu-18.04-lts/linux-kvm", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2022-50850", "noindex": false, "published": "2025-12-30T12:15:27.089Z", "modified": "2026-05-11T19:26:19.596Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00232, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2022-50850", "title": "scsi: ipr: Fix WARNING in ipr_init()", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ipr: Fix WARNING in ipr_init()\n\nipr_init() will not call unregister_reboot_notifier() when\npci_register_driver() fails, which causes a WARNING. Call\nunregister_reboot_notifier() when pci_register_driver() fails.\n\nnotifier callback ipr_halt [ipr] already registered\nWARNING: CPU: 3 PID: 299 at kernel/notifier.c:29\nnotifier_chain_register+0x16d/0x230\nModules linked in: ipr(+) xhci_pci_renesas xhci_hcd ehci_hcd usbcore\nled_class gpu_sched drm_buddy video wmi drm_ttm_helper ttm\ndrm_display_helper drm_kms_helper drm drm_panel_orientation_quirks\nagpgart cfbft\nCPU: 3 PID: 299 ", "references": ["https://git.kernel.org/stable/c/020b66023712b1cc42c6ab8b76e4ec13efe4a092", "https://git.kernel.org/stable/c/e965c4a60c1daa6e24355e35d78ca8e9f195196f", "https://git.kernel.org/stable/c/5debd337f534b122f7c5eac6557a41b5636c9b51"], "fixes": ["4.15.0-1137.142"], "products": [{"name": "linux-kvm", "path": "vulns/ubuntu-18.04-lts/linux-kvm", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2022-50849", "noindex": false, "published": "2025-12-30T12:15:26.431Z", "modified": "2026-05-11T19:26:18.385Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00232, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2022-50849", "title": "pstore: Avoid kcore oops by vmap()ing with VM_IOREMAP", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npstore: Avoid kcore oops by vmap()ing with VM_IOREMAP\n\nAn oops can be induced by running 'cat /proc/kcore > /dev/null' on\ndevices using pstore with the ram backend because kmap_atomic() assumes\nlowmem pages are accessible with __va().\n\n Unable to handle kernel paging request at virtual address ffffff807ff2b000\n Mem abort info:\n ESR = 0x96000006\n EC = 0x25: DABT (current EL), IL = 32 bits\n SET = 0, FnV = 0\n EA = 0, S1PTW = 0\n FSC = 0x06: level 2 translation fault\n Data abort info:\n ISV = 0, ISS = 0x00000006\n CM = 0, WnR = 0\n swapper pgtable: 4k pages, 39-bit VAs, pgdp=0000000", "references": ["https://git.kernel.org/stable/c/1579bed1613802a323a1e14567faa95c149e105e", "https://git.kernel.org/stable/c/fdebcc33b663d2e8da937653ddfbfc1315047eaa", "https://git.kernel.org/stable/c/6d9460214e363e1f3d0756ee5d947e76e3e6f86c"], "fixes": ["4.15.0-1137.142"], "products": [{"name": "linux-kvm", "path": "vulns/ubuntu-18.04-lts/linux-kvm", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2022-50848", "noindex": false, "published": "2025-12-30T12:15:25.776Z", "modified": "2026-05-11T19:26:17.227Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00284, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2022-50848", "title": "drivers: dio: fix possible memory leak in dio_init()", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrivers: dio: fix possible memory leak in dio_init()\n\nIf device_register() returns error, the 'dev' and name needs be\nfreed. Add a release function, and then call put_device() in the\nerror path, so the name is freed in kobject_cleanup() and to the\n'dev' is freed in release function.", "references": ["https://git.kernel.org/stable/c/affe3cea6b3148fa66796a48640664822ceccd48", "https://git.kernel.org/stable/c/4b68caa95064ac464f1b261d08ac677e753d1088", "https://git.kernel.org/stable/c/a524e7fed696a4dfef671e0fda3511bfd2dca0cf"], "fixes": ["4.15.0-1137.142"], "products": [{"name": "linux-kvm", "path": "vulns/ubuntu-18.04-lts/linux-kvm", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2022-50846", "noindex": false, "published": "2025-12-30T12:11:03.286Z", "modified": "2026-05-11T19:26:14.924Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00284, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2022-50846", "title": "mmc: via-sdmmc: fix return value check of mmc_add_host()", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: via-sdmmc: fix return value check of mmc_add_host()\n\nmmc_add_host() may return error, if we ignore its return value,\nit will lead two issues:\n1. The memory that allocated in mmc_alloc_host() is leaked.\n2. In the remove() path, mmc_remove_host() will be called to\n   delete device, but it's not added yet, it will lead a kernel\n   crash because of null-ptr-deref in device_del().\n\nFix this by checking the return value and goto error path which\nwill call mmc_free_host().", "references": ["https://git.kernel.org/stable/c/076bcd2c93e16b05c10564e299d6e5d26a766d00", "https://git.kernel.org/stable/c/12b8e81b77c05c658efd9cde3585bbd65ae39b59", "https://git.kernel.org/stable/c/95025a8dd0ec015872f6c16473fe04d6264e68ca"], "fixes": ["4.15.0-1137.142"], "products": [{"name": "linux-kvm", "path": "vulns/ubuntu-18.04-lts/linux-kvm", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2022-50845", "noindex": false, "published": "2025-12-30T12:11:02.615Z", "modified": "2026-05-11T19:26:13.671Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00251, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2022-50845", "title": "ext4: fix inode leak in ext4_xattr_inode_create() on an error path", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix inode leak in ext4_xattr_inode_create() on an error path\n\nThere is issue as follows when do setxattr with inject fault:\n\n[localhost]# fsck.ext4  -fn  /dev/sda\ne2fsck 1.46.6-rc1 (12-Sep-2022)\nPass 1: Checking inodes, blocks, and sizes\nPass 2: Checking directory structure\nPass 3: Checking directory connectivity\nPass 4: Checking reference counts\nUnattached zero-length inode 15.  Clear? no\n\nUnattached inode 15\nConnect to /lost+found? no\n\nPass 5: Checking group summary information\n\n/dev/sda: ********** WARNING: Filesystem still has errors **********\n\n/dev/sda: 15/655360", "references": ["https://git.kernel.org/stable/c/0f709e08caffb41bbc9b38b9a4c1bd0769794007", "https://git.kernel.org/stable/c/eab94a46560f68d4bcd15222701ced479f84f427", "https://git.kernel.org/stable/c/9ef603086c5b796fde1c7f22a17d0fc826ba54cb"], "fixes": ["4.15.0-1137.142"], "products": [{"name": "linux-kvm", "path": "vulns/ubuntu-18.04-lts/linux-kvm", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2022-50840", "noindex": false, "published": "2025-12-30T12:10:59.066Z", "modified": "2026-05-11T19:26:07.823Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00284, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2022-50840", "title": "scsi: snic: Fix possible UAF in snic_tgt_create()", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: snic: Fix possible UAF in snic_tgt_create()\n\nSmatch reports a warning as follows:\n\ndrivers/scsi/snic/snic_disc.c:307 snic_tgt_create() warn:\n  '&tgt->list' not removed from list\n\nIf device_add() fails in snic_tgt_create(), tgt will be freed, but\ntgt->list will not be removed from snic->disc.tgt_list, then list traversal\nmay cause UAF.\n\nRemove from snic->disc.tgt_list before free().", "references": ["https://git.kernel.org/stable/c/f9d8b8ba0f1a16cde0b1fc9e80466df76b6db8ff", "https://git.kernel.org/stable/c/3772319e40527e6a5f2ec1d729e01f271d818f5c", "https://git.kernel.org/stable/c/3007f96ca20c848d0b1b052df6d2cb5ae5586e78"], "fixes": ["4.15.0-1137.142"], "products": [{"name": "linux-kvm", "path": "vulns/ubuntu-18.04-lts/linux-kvm", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2022-50838", "noindex": false, "published": "2025-12-30T12:10:57.721Z", "modified": "2026-05-23T15:25:19.909Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00284, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2022-50838", "title": "net: stream: purge sk_error_queue in sk_stream_kill_queues()", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stream: purge sk_error_queue in sk_stream_kill_queues()\n\nChangheon Lee reported TCP socket leaks, with a nice repro.\n\nIt seems we leak TCP sockets with the following sequence:\n\n1) SOF_TIMESTAMPING_TX_ACK is enabled on the socket.\n\n   Each ACK will cook an skb put in error queue, from __skb_tstamp_tx().\n   __skb_tstamp_tx() is using skb_clone(), unless\n   SOF_TIMESTAMPING_OPT_TSONLY was also requested.\n\n2) If the application is also using MSG_ZEROCOPY, then we put in the\n   error queue cloned skbs that had a struct ubuf_info attached to them.\n\n   Whenever an struct ubuf_", "references": ["https://git.kernel.org/stable/c/c8c1eec578a9ae2dc8f14a1846942a0b7bf29d1d", "https://git.kernel.org/stable/c/bab542cf56fc174c8447c00b73be99ffd66d2d39", "https://git.kernel.org/stable/c/6f00bd0402a1e3d2d556afba57c045bd7931e4d3"], "fixes": ["4.15.0-1137.142"], "products": [{"name": "linux-kvm", "path": "vulns/ubuntu-18.04-lts/linux-kvm", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2022-50834", "noindex": false, "published": "2025-12-30T12:10:55.025Z", "modified": "2026-05-11T19:26:00.365Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00259, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2022-50834", "title": "nfc: Fix potential resource leaks", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: Fix potential resource leaks\n\nnfc_get_device() take reference for the device, add missing\nnfc_put_device() to release it when not need anymore.\nAlso fix the style warnning by use error EOPNOTSUPP instead of\nENOTSUPP.", "references": ["https://git.kernel.org/stable/c/277f0d0a9084e7454e5532c823a7a876a7b00af7", "https://git.kernel.org/stable/c/d1d912e7f82d7216ba4e266048ec1d1f5ea93839", "https://git.kernel.org/stable/c/d8e410315ad393b23520b5db0706be853589c548"], "fixes": ["4.15.0-1137.142"], "products": [{"name": "linux-kvm", "path": "vulns/ubuntu-18.04-lts/linux-kvm", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2022-50829", "noindex": false, "published": "2025-12-30T12:10:51.434Z", "modified": "2026-05-11T19:25:55.400Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00284, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2022-50829", "title": "wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb()", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb()\n\nIt is possible that skb is freed in ath9k_htc_rx_msg(), then\nusb_submit_urb() fails and we try to free skb again. It causes\nuse-after-free bug. Moreover, if alloc_skb() fails, urb->context becomes\nNULL but rx_buf is not freed and there can be a memory leak.\n\nThe patch removes unnecessary nskb and makes skb processing more clear: it\nis supposed that ath9k_htc_rx_msg() either frees old skb or passes its\nmanaging to another callback function.\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkal", "references": ["https://git.kernel.org/stable/c/5e8751a977a49a6e00cce1a8da5ca16da83f9c8c", "https://git.kernel.org/stable/c/f127c2b4c967025e5c3a4ce7e13b79135d46a33d", "https://git.kernel.org/stable/c/0c8dd2ea4b419da96ab4953e4967e9363e2f8a4f"], "fixes": ["4.15.0-1137.142"], "products": [{"name": "linux-kvm", "path": "vulns/ubuntu-18.04-lts/linux-kvm", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2022-50824", "noindex": false, "published": "2025-12-30T12:08:37.580Z", "modified": "2026-05-11T19:25:49.624Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00257, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2022-50824", "title": "tpm: tpm_tis: Add the missed acpi_put_table() to fix memory leak", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntpm: tpm_tis: Add the missed acpi_put_table() to fix memory leak\n\nIn check_acpi_tpm2(), we get the TPM2 table just to make\nsure the table is there, not used after the init, so the\nacpi_put_table() should be added to release the ACPI memory.", "references": ["https://git.kernel.org/stable/c/8bc6c10d3f389693410adb14b4e9deec01ff6334", "https://git.kernel.org/stable/c/de667a2704ae799f697fd45cf4317623d8c79fb7", "https://git.kernel.org/stable/c/e027f3b9fabd2b410a4e6a7651e7a45b87019f23"], "fixes": ["4.15.0-1137.142"], "products": [{"name": "linux-kvm", "path": "vulns/ubuntu-18.04-lts/linux-kvm", "ecosystem": "Ubuntu:18.04:LTS"}]}], "total": 1604, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 81, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "linux-kvm", "path": "vulns/ubuntu-18.04-lts/linux-kvm", "ecosystem": "Ubuntu:18.04:LTS"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-10-15T21:41:24.572Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}